Protecting adaptive sampling from information leakage on low-power sensors

A battery-powered sensor saves energy by measuring more often when its signal is changing and less often when it is calm, and it sends its measurements in encrypted batches — but the size of each batch reveals how often it sampled, and how often it sampled reveals what was happening, so an eavesdropper who sees only encrypted message lengths can classify the user's activity; Adaptive Group Encoding fixes every batch to one length set by the energy budget and spends the fixed bits wisely, so nothing leaks and the error stays close to unprotected adaptive sampling.

The argument in one glance

Problem

A sensor that samples smartly tells the world what it saw

Low-power sensors cannot afford to measure and transmit at full rate. Adaptive sampling policies watch the signal and sample more when it changes, less when it is steady, achieving near-optimal error for a given energy budget. Measurements are sent to a server in encrypted batches, one per time window, to amortize radio cost. The number of measurements in a batch, and so the length of the encrypted message, follows the sampling rate, and the sampling rate follows the data.
What people did

Encrypt the link, or pad every message to the maximum

Encryption hides the values in a message. Padding every batch to the length of a full-rate batch hides the length as well, which is the standard defence against traffic-analysis side channels.
Why it fell short

Encryption does not hide length, and padding throws away the savings

With standard encryption the message length is visible on the air, and the paper shows that for general adaptive policies it leaks information about the captured measurements, across multiple tasks. Padding to the maximum removes the leak but makes every batch as expensive to transmit as if the sensor had sampled at full rate, cancelling the energy benefit that justified adaptive sampling. The artifact's results show padded policies have much higher error under the same energy budget.
This paper's idea

Fix the message length at the budget, then fit the measurements into it

Adaptive Group Encoding (AGE) wraps any periodic adaptive sampler. It derives a single target message size from the energy budget, so every batch has the same length regardless of how many measurements it holds. When a batch holds more values than fit at full precision, AGE quantizes them to fewer bits rather than dropping them. It reduces the quantization error with a series of transformations: values are split into groups sharing a common exponent shift, consecutive groups with the same shift are merged to limit metadata, and the fixed bit budget is handed out to groups round-robin so no group is starved. The result keeps adaptive sampling's low error, removes the length side channel, and adds negligible energy overhead, demonstrated in simulation on nine datasets and on a TI MSP430 microcontroller with a Bluetooth Low Energy radio.

Why this problem is worth solving

Consider a wearable that records motion to detect epileptic seizures. It runs on a coin cell, so it cannot sample its accelerometer continuously and cannot keep the radio on. A well-designed device uses

adaptive sampling

A sampling strategy that uses recent measurements to decide how soon to take the next one, sampling densely when the signal changes and sparsely when it does not.

: after a quiet stretch it stretches the gap between samples; the moment the signal jumps it samples densely again. It collects a window of samples, encrypts them, and sends the batch over Bluetooth to a phone. This gives almost the accuracy of full-rate sampling at a fraction of the energy.

Now consider someone with a radio receiver nearby. They cannot read the encrypted payload. But they can see that this batch was 40 bytes and the last one was 12. A long batch means many samples, many samples mean the signal was changing, and on this device a changing signal means a seizure. The abstract states the general form of this: the collection rate of an adaptive policy leaks information about the captured measurements, individual policies leak it on multiple tasks, and with batched communication the batch size exposes the rate. The artifact makes it concrete with a

traffic-analysis attacker

An adversary who observes only the sizes and timing of encrypted messages on a link, not their contents.

: an AdaBoost classifier trained on windows of ten consecutive message sizes, evaluated with five-fold cross-validation, that predicts the event label from lengths alone.

What people did before, and where it broke

Adaptive sampling with standard encoding. Policies such as the Linear policy (called the adaptive heuristic in the code), which resets the skip to its minimum when the change between consecutive samples exceeds a threshold and otherwise lengthens it by one, and the Deviation policy, which tracks an exponential moving deviation and halves the skip when it exceeds a threshold. Each batch is encoded at full precision and encrypted with AES or ChaCha20. Where it broke. The encrypted length equals the number of collected samples times their width plus a bitmask of which indices were sampled, so the length is a direct function of the collection rate.
Padding. Pad every batch to the size of a full-rate batch before encryption. Where it broke. Under a fixed energy budget, the padded sensor must sample less to afford the constant large messages, and its error rises sharply; the artifact omits padded policies from its error plots because their error is so high.
Uniform sampling. Sample at a fixed rate chosen to meet the budget. Where it broke. Constant batch size, so no leak, but no adaptivity either: error is higher than adaptive policies at the same budget. The paper uses Uniform to define each energy budget.
The gap. No scheme kept the accuracy of adaptive sampling, the energy of adaptive sampling, and a message length independent of the data, all at once.

Where AGE sits

One collection window on a protected sensor

Adaptive policy

Decides which of the window's time steps to measure. Unchanged: AGE wraps any periodic adaptive sampler.
↓ →
Target size new

A fixed message length derived once from the energy budget, the same for every batch.
↓ →
Prune and group new

If too many samples were collected, drop some to fit; split values into exponent-shift groups; merge neighbouring groups with equal shift.
↓ →
Assign widths and pack new

Hand out bits to groups round-robin until the target is full; pack values, shifts, group sizes and the index mask; pad to the exact target.
↓ →
Encrypt and send

AES or ChaCha20 over Bluetooth Low Energy. Every message on the air is the same length.
↓ →
Server decodes

Recovers the values and their time indices from the fixed-length message.

The three new boxes are AGE. Sampling and encryption are untouched, which is why AGE composes with any periodic adaptive policy.

The idea

The abstract states the strategy; the open-source artifact shows how it is carried out. The description below follows the code’s group encoder, which the README identifies as the full AGE system.

One message length for the whole budget. Every sampling policy in the framework is given an energy budget equal to what Uniform sampling would spend at a target collection rate. AGE converts that budget into a single

target byte count

The fixed number of bytes every AGE message occupies, computed once from the energy budget and never from the data.

. Because the target depends only on the budget, the width, the sequence length and the cipher, an observer learns nothing new from any message: they are all the same size. The message must nevertheless carry a bitmask saying which time steps were sampled, a length field, and the cipher’s nonce or block overhead, so those bytes are subtracted first to give the data budget.

Prune only when you must. If the policy collected so many samples that even at the minimum bit width they would not fit, AGE removes measurements until they do. This is the last resort, not the first move; with a sensible budget most batches fit without pruning. An ablation variant that relies on pruning alone, called Pruned in the artifact, has markedly higher error on every dataset in the README’s tables.

Quantize with shared exponent shifts. Values are stored in

fixed point

A number representation with a fixed number of fractional bits, so a value is an integer scaled by a constant.

. When the batch must shrink to fewer bits per value, simply truncating loses the small values entirely. AGE instead computes a range shift for each value, an exponent that scales it into the representable range at the reduced width, and then groups consecutive values that share the same shift. The shifts are chosen to create long runs, because each group costs metadata: one shift byte and a size field. A union-find structure merges neighbouring groups until the count is at or below a maximum, choosing merges that cost the least precision. The code caps the number of groups and estimates their metadata conservatively before deciding how many values fit.

Spend the remaining bits round-robin. With groups fixed, AGE starts every group at the minimum width and then adds one bit at a time to each group in turn until the data budget is saturated, skipping groups that are entirely zero. This is the transformation the abstract describes as reducing quantization error: rather than giving every value the same reduced width, the budget is used to the last bit, spread across groups so none is starved. Finally the message is padded to exactly the target and encrypted.

Why the variants matter. The artifact ships three ablations. Single group uses one shift for the whole batch. Unshifted uses evenly sized groups with zero shift. Pruned drops samples instead of quantizing. In the README’s tables, full AGE has the lowest error on every dataset for both adaptive policies, and on the hardest dataset, Tiselac, it cuts error by more than half relative to Single and Unshifted.

Tracing one window through AGE

A 20-step window, an active signal, and a fixed 24-byte message

Illustrative numbers. One feature per sample, 8-bit width at full precision, target message of 24 bytes derived from the budget. The mechanism follows the artifact's group encoder; the paper's own worked examples were not available.

Step 1 of 6

The policy samples densely

The signal is changing, so the Linear policy keeps the skip at its minimum and collects 16 of the 20 time steps. A quiet window would have collected perhaps 6. Under standard encoding the two messages would differ by 10 bytes on the air.

collected: 16 of 20 | standard message: 16 bytes of data + 3-byte mask + overhead | quiet window: 6 bytes of data

Why it works

A length that depends only on the budget cannot leak the data. The target is computed before any sample is taken, from constants. Because every message is padded to that target, the mutual information between message size and event label is zero by construction.
Quantizing beats dropping. When more values are collected than fit at full width, keeping all of them at slightly fewer bits preserves the timing of the signal, which matters most for reconstruction; dropping samples loses timing entirely. The artifact’s Pruned variant confirms this with consistently higher error.
Shared shifts keep small values alive. A single reduced width for a batch containing both tiny and large values wastes bits on the large ones and zeroes the small ones. Per-group exponent shifts let each run use its bits where they carry information.
Merging bounds the metadata. Every group costs a shift and a size field. Union-find merging of neighbouring groups caps the number of groups, so metadata cannot eat the data budget on a noisy batch.
Round-robin uses every bit. After metadata is known exactly, leftover bits are distributed one at a time across groups, so the fixed message is never partly wasted the way naive padding is.
The encoder is cheap. The transformations are integer arithmetic, a linear pass for shifts, and a small union-find; they run on an MSP430 microcontroller, which is why the abstract can claim negligible energy overhead.

What it costs

Some precision when the policy is busy. In active windows, values are stored at fewer bits than the standard encoder would use. The abstract says the low error of adaptive sampling is preserved; the exact gap is in the paper’s Table 3, which was not available.
Metadata in every message. Shifts, group sizes and the index mask occupy bytes that standard encoding does not need, and the budget must be estimated conservatively before the groups are known.
A hard ceiling on samples. If a policy collects more than the budget can hold even at minimum width, samples are pruned. Budgets set very low will force pruning and its higher error.
Only length is protected. AGE fixes message size; message timing is periodic by assumption, and the framework protects only periodic samplers. A policy that also varies when it transmits would need a further defence.
Full-rate messages still cost full-rate energy. The message length is set by the budget, so if the budget is generous, every message is large; AGE does not reduce radio energy below the padded case at the same target, it recovers accuracy within that target.

The evaluation

Encoding strategies for a periodic adaptive sampler under one energy budget

Property	Standard encoding	Padded
Message length on the air
Information leaked through length		None
Reconstruction error at equal energy
Energy overhead	—	Large
Applies to	Any policy	Any policy

Qualitative rows reflect the abstract and the artifact's design; the datasets, hardware, attacker and variants are documented in the artifact README. The paper's numerical tables (error, mutual information, attack accuracy, energy) were not available and are not reproduced here.Underlined values explain themselves when clicked.

Where this stops working

Where this stops working, and what this page does not know

AGE removes the length side channel for periodic samplers; it does not address timing, and a policy that transmits irregularly would leak through timing instead. It cannot escape the budget: a very small target forces pruning and higher error, and a very large target means every message is expensive even when the sensor is idle. The precision cost in active windows is real, if small. This page was written from the abstract and from the open-source artifact’s README and code, which document the policies, the attacker, the encoder’s transformations, the datasets and the hardware setup. The full text is behind the ACM paywall and an OpenReview access challenge, and there is no preprint. The paper’s measured error gaps, mutual information values, attack accuracies and energy figures are in its Tables 3 to 6 and Figures 6 and 7 and are not reproduced or invented here.

If you remember only three things

1. Adaptive sampling saves energy on low-power sensors by tying the measurement rate to the signal, but batched, encrypted transmission then exposes the rate through message length, and the rate reveals the event. The paper shows this leakage is general across adaptive policies and tasks, and the artifact demonstrates a practical attacker that classifies events from windows of message sizes alone.
2. Adaptive Group Encoding fixes every message to a target length computed from the energy budget, and fits whatever was collected into it: prune only as a last resort, quantize values to fixed point with per-group exponent shifts, merge neighbouring groups by union-find to bound metadata, and assign the remaining bits round-robin across groups until the budget is saturated, then pad and encrypt. It wraps any periodic adaptive sampler without changing it.
3. The abstract reports that AGE preserves the low error of adaptive sampling, prevents the leak, and adds negligible energy overhead, evaluated in simulation on nine datasets and on a TI MSP430 with Bluetooth Low Energy. Padding to the maximum also stops the leak but destroys the accuracy advantage under the same budget. This page is a draft written from the abstract and the artifact; the paper's measured tables are not reproduced here.

Check yourself

Check your understanding

1. Why does encrypting the sensor's messages not stop the attack described in the paper?
2. What determines the length of an AGE message?
3. Predict what happens if AGE assigned the same reduced bit width to every value in a busy batch instead of using exponent-shift groups.
4. Why is padding every message to the full-rate size a poor defence, even though it also removes the leak?
5. When does AGE drop measurements rather than quantize them?

Sources

The paper is “Protecting Adaptive Sampling from Information Leakage on Low-Power Sensors” by Tejas Kannan and Henry Hoffmann, University of Chicago, published at ASPLOS 2022, DOI 10.1145/3503222.3507775. The artifact is open source at github.com/tejaskannan/adaptive-group-encoding and archived on Zenodo (record 5747666); it includes the Python simulator, the attack classifier, the AGE encoder, and the TI MSP430 FR5994 implementation.

This explainer is marked as a draft because the full text was not accessible: the ACM Digital Library returned an anti-bot page, the OpenReview copy requires a browser challenge, Semantic Scholar lists the paper as closed access, and no arXiv preprint exists. The claims attributed to the paper come from its abstract. The description of the sampling policies, the attacker model, the encoder’s pruning, shift grouping, union-find merging and round-robin width assignment, the ablation variants, the nine datasets and the hardware setup comes from the artifact’s README and source code, and the ablation error tables quoted qualitatively are those published in the README. The worked example is illustrative.