Pith. sign in

REVIEW 4 major objections 6 minor 64 references

Towards Scalable Defenses against Intimate Partner Infiltrations

T0 review · 4 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A phone-resident monitor called AID can detect intimate-partner infiltration by jointly judging who holds the phone and what they do, reaching an F1 of 0.981 with a 1.6% false-positive rate.

desk verdict A genuinely useful IPI taxonomy and a thoughtful system design, but the headline accuracy numbers come from a different decision rule than the main evaluation, and the calibration/test split has an ambiguity that needs fixing before the results can be trusted. read the letter →

arxiv 2502.03682 v2 pith:DIMFAPVK submitted 2025-02-06 cs.CR cs.HC

Weisi Yang , Shinan Liu , Feng Xiao , Nick Feamster , Stephen Xia This is my paper · ORCID
classification cs.CRcs.HC
keywords intimatepartnerviolencesmartphoneintrusiondetectionphysicalaccessattacksbehavioralbiometricscontinuousauthenticationhumanactivityrecognitionprivacy-preservingmonitoringforensicmobiletool
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that intimate-partner infiltration (IPI)—an abuser physically using a victim's smartphone to monitor, impersonate, or sabotage—can be detected automatically on the phone itself, from background-accessible sensor and system signals. The proposed system, AID (Automated IPI Detection), refuses to collapse detection into a single anomaly score; it instead asks two questions at once: who is holding the phone, and what are they doing. An event counts as IPI only when the user is not the owner and the behavior belongs to a taxonomy of abuse intents built from 173 documented cases. In a 27-participant study, AID reports a false-positive rate of 1.6%—about 11 times lower than the best prior approach it compares against—and an end-to-end F1 of 0.981. If the result holds, security clinics could scale their forensic reach by installing a silent monitor that produces interpretable reports for expert review.

What carries the argument

The load-bearing object is the joint decision rule $y = \mathbb{I}(u=1 \wedge b=1)$, which turns IPI detection into two linked subproblems instead of one outlier score. The identity branch encodes each window with a frozen multi-head LSTM autoencoder, computes a difference vector $d = \frac{1}{T}\sum_{t=1}^{T}(x_t - \hat{x}_t)$ between input and reconstruction, and feeds that vector to a one-class SVM that is fine-tuned on the victim's five-minute calibration sample. The intent branch is an LSTM-CNN classifier over the same windows, trained with soft labels over the IPI taxonomy's categories, actions, or subactions. A context-aware risk analyzer fuses the branches with a score that contrasts the predicted NIO (non-IPI-other) probability against the top-$k$ suspicious-class probabilities, and a threshold $T$ found by grid search converts that score into an IPI decision. A temporal consistency module smooths both branches with rolling windows and $k$-means voting so isolated mispredictions do not become alerts.

What would settle it

Re-run the 12-fold evaluation with the victim's five-minute calibration snippet explicitly excluded from every test fold, recompute the end-to-end F1 and false-positive rate, and compare with the reported 0.981 and 1.6%.

Watch

Extended reading notes

Core claim

AID's central claim is that IPI risk is a conjunction, not a score: an event is IPI-positive exactly when the current user is a non-owner ($u=1$) and the behavior is an IPI intent ($b=1$). The authors argue that anomaly detection, continuous authentication, and human activity recognition fail in this setting because each answers only one of those questions, so benign phone sharing produces false alarms. AID therefore runs two branches on the same multimodal windows—a multi-head LSTM autoencoder with an SVM decision module judges owner identity, and an LSTM-CNN classifier labels behavior into a 28-subaction, 9-action, 5-category taxonomy of abuse intents—and fuses the branches through a context-aware risk analyzer with a learned threshold. After a five-minute on-device calibration using roughly 20 windows, the held-out user study reports an end-to-end F1 of 0.981 and a false-positive rate of 1.6% when the top-3 intent predictions are kept; with one best-guess intent, the F1 is 0.928. The authors position AID as a silent forensic logger whose reports are read later by security-clinic experts, not as a real-time alarm.

Load-bearing premise

AID's headline numbers depend on the assumption that the five minutes of the victim's data used to calibrate the identity detector are never also scored as test data; if those calibration windows stay in the test set, the model is partly tested on data it was trained on, which would inflate accuracy and shrink the false-alarm rate.

Editorial extensions

If this is right

  • A clinic could install AID on a victim's phone during a consultation and, at the next visit, read a ranked forensic report of non-owner sessions and suspected intents, extending expert attention across more survivors.
  • At the reported 1.6% false-positive rate, AID would flag far fewer benign interactions than anomaly detection (27.6%), continuous authentication (18.1%), or activity recognition (78.0%), reducing the risk that alerts themselves escalate abuse.
  • The five-minute calibration with about 20 randomly selected windows means each new victim's model adapts on-device and in few-shot fashion, so deployment does not require collecting a large personal dataset.
  • Because true intents appear within top-3 predictions at high rates, the system can support cautious human-in-the-loop review instead of committing to a single behavior label.
  • The identity branch alone, viewed as a continuous authenticator, separates intimate partners from owners at F1 0.998 with a 96KB model, suggesting it could double as a lightweight login-integrity check.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • By extension, the same two-branch decomposition applies to any credentialed-insider setting—insider threat, shared family accounts, delegated device use—where the actor's authority is legitimate but the intent is not; AID's design already names insider-attack and misuse detection as adjacent problems.
  • Top-k reporting is likely a permanent feature rather than a stopgap: the confused 'view account' versus 'alter account settings' cases in the study suggest that OS-level signals cannot always disambiguate intent, so deployments over more apps should keep ranked predictions.
  • The strongest test of the system is a strict audit that removes the victim's calibration snippet from the test set before scoring; this would distinguish genuine generalization from adaptation-set memory and is a natural next step the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper presents AID, an automated system for detecting intimate partner infiltration (IPI) on smartphones. AID uses a dual-branch architecture: one branch identifies whether the current user is the device owner via a multi-head LSTM autoencoder and a one-class SVM fine-tuned with a short calibration session, and the other classifies the user's behavior into a novel 5/9/28-category IPI taxonomy via an LSTM-CNN. The two branches are fused with a context-aware risk analyzer that uses a threshold T. The authors report a 27-participant user study with a leave-two-out protocol, claiming in the abstract an F1 score of 0.981 and a false positive rate of 1.6%, and they compare against anomaly detection, authentication, HAR, and black-box fusion baselines.

Significance. The paper addresses an important and under-studied problem, and the system design is thoughtful: it uses privacy-preserving, background-accessible modalities, local inference, stealth mechanisms, and a safety-oriented deployment model through security clinics. The 27-participant evaluation, with genuine couples/friends and synthetic pairs, is a useful step toward empirical grounding. However, the main empirical claims are not yet supported by the manuscript as written: the evaluation protocol has an ambiguity about whether calibration data appears in the test set, and the headline numbers are drawn from a top-k configuration that is not the primary fusion rule. These issues must be resolved before the results can be relied upon.

major comments (4)
  1. [Section 6.1, data partitioning] The protocol adds the victim's first five minutes to the fine-tuning set but does not state that these windows are excluded from the 'held-out victim-abuser-pair' used for evaluation. As written, the test set could include the exact data on which the identity-branch SVM is adapted, which would inflate the near-perfect partner F1 of 0.998 in Table 8 and, through the conjunction rule in Equation 1, suppress false positives and inflate the end-to-end F1. Please state explicitly whether the calibration segment is removed from the test set; if it is not, re-run the evaluation without it.
  2. [Abstract and Table 7] The abstract's headline 'false positive rate of 1.6%, which is 11x lower than existing methods, and an end-to-end F1 score of 0.981' corresponds to the top-3 intent inclusion row of Table 7, not to the context-aware fusion result in Table 6 (F1=0.928, FPR=0.070). The abstract does not disclose that the reported numbers require a human or downstream system to accept any of the top-3 predicted intents. Since the paper does not define a decision rule for selecting top-k in deployment, reporting the best k as the abstract's claim is post-hoc selection. Please report the unambiguous end-to-end numbers and clearly separate the top-k interpretation scenario.
  3. [Section 4.2 vs Section 6.1] The threshold T in Equation 4 is selected by grid search on a validation set, but the 12-fold protocol in Section 6.1 does not describe where this validation set comes from. If T is selected using the same held-out pair on which performance is reported, the FPR and F1 are optimistically biased. Please specify whether T is chosen per fold from a held-out subset of the pretraining data, and whether the final reported numbers use a fixed T.
  4. [Section 3.2, taxonomy as ground truth] The IPI taxonomy that provides the labels for the intent branch was constructed solely by the authors from prior literature (two authors screened 367 incidents and kept 173), and no inter-annotator agreement or external validation is reported. Because the same taxonomy is used as the target concept and as the evaluation labels, the high top-k classification accuracy in Figure 4 may reflect the authors' coding scheme rather than robust external ground truth. Please report inter-rater reliability or an independent expert review of the taxonomy.
minor comments (6)
  1. [Throughout] The abstract and Table 2 quote performance numbers (0.981/0.016) that conflict with the main result in Table 6 (0.928/0.070); please harmonize these and label the configuration.
  2. [Section 2.2] There is a duplicated phrase: 'yet existing systems Existing systems are primarily designed'; please fix the typo.
  3. [Throughout] Several other typos remain, including 'harrass' in the Introduction, 'slef-destroys' in Section 5.2, and 'resmi ans' in Section 7; a careful proofread is needed.
  4. [Section 4.2, Equation 3] The notation T_k (top-k predicted classes) is used in Equation 3 before it is defined; please define top-k at first use.
  5. [References] Reference [2] is incomplete: it lacks a publication venue and page numbers; please check the full reference list for completeness.
  6. [Table 17] The full action list is useful, but the paper does not specify how task completion was confirmed (e.g., by the experimenter or by self-report); please add a sentence describing this.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: AID's detection rule and training/evaluation pipeline are self-contained, with the reported 0.981/1.6% being a reporting-choice issue rather than a construction-equivalent prediction.

full rationale

AID's detection target y = I(u = 1 AND b = 1) in Equation 1 is a definition of the IPI event, not a derived prediction, so there is no self-definitional reduction. The identity and intent branches are trained on labels grounded in a taxonomy built from prior literature, not from the model's own outputs: the paper states that the authors 'extracted 367 technology-facilitated IPV incidents from 15 top-tier HCI and security papers' and that the taxonomy 'serves as both the first taxonomy for characterizing IPI-related attacks and class labels for detecting IPI behavioral intents.' The decision threshold T is chosen by grid search on a validation set, which is a standard hyperparameter selection and is not later relabeled as a prediction. The top-k variant in Table 7 is a different, transparently reported decision rule; even if the abstract's 0.981/1.6% is a less complete disclosure than Table 6's 0.928/0.070, selecting a stronger reporting configuration is not a circular reduction. The only self-citations appear in related-work motivation ([34], [63]) and are not load-bearing; the LSTM-CNN architecture is empirically compared against LSTM, CNN, and Transformer backbones in Table 9. The ambiguity about whether the victim's first five calibration minutes remain in the test set is a potential data-leakage or verification concern, but the protocol describes the test pair as 'held out' and no equation or fitted parameter makes the reported metrics true by construction. Thus, no specific circular step can be quoted, and the claimed derivation chain is self-contained.

Assumptions & free parameters 5 free parameters · 2 assumptions · 0 invented entities

The central empirical results depend on several free parameters (threshold T, top-k, window size, sampling rate, LSTM heads) that are selected on validation or test performance. The taxonomy is self-authored and used as ground truth. The domain assumption that simulated couples represent real IPI is acknowledged but untested.

free parameters (5)
  • Threshold T for IPI risk decision = Selected via grid search on validation set
    T in Eq. 4 determines the IPI risk boundary; tuned to maximize F1 on a validation set, so reported performance depends on this choice.
  • Top-k intent inclusion = 3 (used for headline 0.981/0.016)
    Table 7 shows top-1 yields 0.928/0.070 while top-3 yields 0.981/0.016; the choice of k is a free parameter that materially changes the reported result.
  • Identity branch window size and sampling rate = 2s window, 20 Hz
    Table 14 shows these were selected as best among combinations; F1 ranges from 0.842 to 0.995 depending on configuration.
  • Number of LSTM heads = 8
    Table 15 shows 8 heads give the best F1 (0.954); 1 head gives 0.733 and 16 heads give 0.924.
  • One-class SVM hyperparameters = Not specified
    The SVM decision module uses an RBF kernel (Appendix F), but C and gamma values are not reported, making exact replication impossible.
assumptions (2)
  • domain assumption Healthy volunteer pairs (couples, friends, roommates) can simulate real IPI abuse dynamics.
    Section 6.1 states real IPV victims were not recruited for ethical and safety reasons; the entire evaluation rests on whether simulated interactions generalize to real abuse dynamics, which is acknowledged but untested.
  • ad hoc to paper The 5/9/28 IPI taxonomy is a complete and accurate representation of IPI behaviors.
    The taxonomy was constructed by two authors screening 367 incidents from 15 papers and retaining 173 cases (§3.2). It serves as both the theoretical framework and the label set, so a flawed taxonomy would directly contaminate all intent classification results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Scalable Defenses against Intimate Partner Infiltrations." pith.science (2026). https://pith.science/paper/DIMFAPVK

@misc{pith2026250203682,
  author       = {Pith},
  title        = {Pith review of: Towards Scalable Defenses against Intimate Partner Infiltrations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DIMFAPVK}},
  note         = {Machine review of arXiv:2502.03682}
}
read the original abstract

Intimate Partner Infiltration (IPI)--a type of Intimate Partner Violence (IPV) that typically requires physical access to a victim's device--is a pervasive concern around the world, often manifesting through digital surveillance, control, and monitoring. Unlike conventional cyberattacks, IPI perpetrators leverage close proximity and personal knowledge to circumvent standard protections, underscoring the need for targeted interventions. While security clinics and other human-centered approaches effectively tailor solutions for victims, their scalability remains constrained by resource limitations and the need for specialized counseling. We present AID, an Automated IPI Detection system that continuously monitors for unauthorized access and suspicious behaviors on smartphones. AID employs a unified architecture to process multimodal signals stealthily and preserve user privacy. A brief calibration phase upon installation enables AID to adapt to each user's behavioral patterns, achieving high accuracy with minimal false alarms. Our 27-participant user study demonstrates that AID achieves highly accurate detection of non-owner access and fine-grained IPI-related activities, attaining a false positive rate of 1.6%, which is 11x lower than existing methods, and an end-to-end F1 score of 0.981. These findings suggest that AID can serve as a forensic tool that security clinics can deploy to scale their ability to identify IPI tactics and deliver personalized, far-reaching support to survivors.

Figures

Figures reproduced from arXiv: 2502.03682 by the authors.

Figure 1
Figure 1. AID workflow and system architecture. The output report remains invisible to the victim until their next visit to security clinics. The generated report only becomes visible and shared with the Security Clinic experts for further analysis, much like a forensic tool. For privacy protection, when the user identity-branch recognizes the owner, no information about the application name or detected intents/behaviors will… view at source ↗
Figure 2
Figure 2. AID’s model architectures for a) identifying the phone’s owner and b) detecting IPI behavioral intents. browsing private information). As such, the modalities and techniques used need to be adjusted. Given the challenges of obtaining labeled data post￾installation, we implement a server-side training architec￾ture while deploying only the detection components on￾device. Recent advances in HAR have explored various a… view at source ↗
Figure 3
Figure 3. IPI detection outputs for a sample pair. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Top-k accuracy across granularity levels for IPI [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Impact of pretraining and fine-tuning scheme. [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: Exploring different choices of user identity clas [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

64 extracted references · 62 canonical work pages

  1. [1]

    Multilock: Mobile active authenti- cation based on multiple biometric and behavioral patterns

    Alejandro Acien, Aythami Morales, Ruben Vera-Rodriguez, Julian Fierrez, and Ruben Tolosana. Multilock: Mobile active authenti- cation based on multiple biometric and behavioral patterns. In 1st International Workshop on Multimodal Understanding and Learning for Embodied Applications , pages 53–59, 2019

    work page 2019

  2. [2]

    Protecting internet traffic: Security challenges and solutions

    Mohammed Aledhari, Sukanya Mandal, Nagender Aneja, Mikael Dautrey, Rajesh Nighot, Prasad Mantri, and Jared Bielby. Protecting internet traffic: Security challenges and solutions. 2017

    work page 2017

  3. [3]

    Sensible privacy: how we can protect domestic violence survivors without facilitating misuse

    Budi Arief, Kovila PL Coopamootoo, Martin Emms, and Aad van Moorsel. Sensible privacy: how we can protect domestic violence survivors without facilitating misuse. In Proceedings of the 13th Workshop on Privacy in the Electronic Society, pages 201–204, 2014

    work page 2014

  4. [4]

    Paying the price: When intimate partners use technology for financial harm

    Rosanna Bellini. Paying the price: When intimate partners use technology for financial harm. In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems , pages 1–17, 2023

    work page 2023

  5. [5]

    The {Digital-Safety} risks of financial technologies for survivors of intimate partner violence

    Rosanna Bellini, Kevin Lee, Megan A Brown, Jeremy Shaffer, Rasika Bhalerao, and Thomas Ristenpart. The {Digital-Safety} risks of financial technologies for survivors of intimate partner violence. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 87– 104, 2023

    work page 2023

  6. [6]

    Abusive partner perspectives on technology abuse: Implications for community-based violence prevention

    Rosanna Frances Bellini. Abusive partner perspectives on technology abuse: Implications for community-based violence prevention. Pro- ceedings of the ACM on Human-Computer Interaction, 8(CSCW1):1– 25, 2024

    work page 2024

  7. [7]

    Borky and Thomas H

    John M. Borky and Thomas H. Bradley. Protecting information with cybersecurity. In Effective Model-Based Systems Engineering , pages 345–404. Springer International Publishing, 2018

    work page 2018

  8. [8]

    {FAMOS}: Robust {Privacy- Preserving} authentication on payment apps via federated {Multi- Modal} contrastive learning

    Yifeng Cai, Ziqi Zhang, Jiaping Gui, Bingyan Liu, Xiaoke Zhao, Ruoyu Li, Zhe Li, and Ding Li. {FAMOS}: Robust {Privacy- Preserving} authentication on payment apps via federated {Multi- Modal} contrastive learning. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 289–306, 2024

    work page 2024

Show all 64 references
  1. [9]

    Sneaky spy devices and defective detectors: the ecosystem of intimate partner surveillance with covert devices

    Rose Ceccio, Sophie Stephenson, Varun Chadha, Danny Yuxing Huang, and Rahul Chatterjee. Sneaky spy devices and defective detectors: the ecosystem of intimate partner surveillance with covert devices. In 32nd USENIX Security Symposium (USENIX Security 23), pages 123–140, 2023

    2023

  2. [10]

    Mobile based continuous authentication using deep features

    Mario Parre ˜no Centeno, Yu Guan, and Aad van Moorsel. Mobile based continuous authentication using deep features. In Proceedings of the 2nd international workshop on embedded and mobile deep learning, pages 19–24, 2018

    2018

  3. [11]

    Anomaly detection: A survey

    Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM Comput. Surv., 41(3), July 2009

    2009

  4. [12]

    The spyware used in intimate partner violence

    Rahul Chatterjee, Periwinkle Doerfler, Hadas Orgad, Sam Havron, Jackeline Palmer, Diana Freed, Karen Levy, Nicola Dell, Damon McCoy, and Thomas Ristenpart. The spyware used in intimate partner violence. In 2018 IEEE Symposium on Security and Privacy (SP) , pages 441–458. IEEE, 2018

    2018

  5. [13]

    Clinic to end tech abuse (ceta)

    Clinic to End Tech Abuse. Clinic to end tech abuse (ceta). https: //ceta.tech.cornell.edu/. Accessed: 2025-01-23

    2025

  6. [14]

    Account security interfaces: important, unin- tuitive, and untrustworthy

    Alaa Daffalla, Marina Bohuk, Nicola Dell, Rosanna Bellini, and Thomas Ristenpart. Account security interfaces: important, unin- tuitive, and untrustworthy. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 3601–3618, 2023

    2023

  7. [15]

    Activpass: Your daily activity is your password

    Sourav Kumar Dandapat, Swadhin Pradhan, Bivas Mitra, Romit Roy Choudhury, and Niloy Ganguly. Activpass: Your daily activity is your password. In Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems, CHI ’15, page 2325–2334, New York, NY , USA, 20...

    2015

  8. [16]

    Actions speak louder than (pass) words: Passive authentication of smartphone users via deep temporal features

    Debayan Deb, Arun Ross, Anil K Jain, Kwaku Prakah-Asante, and K Venkatesh Prasad. Actions speak louder than (pass) words: Passive authentication of smartphone users via deep temporal features. In 2019 international conference on biometrics (ICB) , pages 1–8. IEEE, 2019

    2019

  9. [17]

    Privacy or transparency? negotiated smartphone access as a signifier of trust in romantic relationships

    Periwinkle Doerfler, Kieron Ivy Turk, Chris Geeng, Damon McCoy, Jeffrey Ackerman, and Molly Dragiewicz. Privacy or transparency? negotiated smartphone access as a signifier of trust in romantic relationships. arXiv preprint arXiv:2407.04906 , 2024

    2024 arXiv

  10. [18]

    Lightweight transformers for human activity recognition on mobile devices

    Sannara Ek, Franc ¸ois Portet, and Philippe Lalanda. Lightweight transformers for human activity recognition on mobile devices. arXiv preprint arXiv:2209.11750, 2022

    2022 arXiv

  11. [19]

    Authentisense: A scalable behavioral biometrics authenti- cation scheme using few-shot learning for mobile platforms

    Hossein Fereidooni, Jan K ¨onig, Phillip Rieger, Marco Chilese, Bora G¨okbakan, Moritz Finke, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Authentisense: A scalable behavioral biometrics authenti- cation scheme using few-shot learning for mobile platforms. In 30th Annual Netw...

    2023

  12. [20]

    Evading network anomaly detection systems: formal reasoning and practical techniques

    Prahlad Fogla and Wenke Lee. Evading network anomaly detection systems: formal reasoning and practical techniques. In Proceedings of the 13th ACM conference on Computer and communications security, pages 59–68, 2006

    2006

  13. [21]

    Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication

    Mario Frank, Ralf Biedert, Eugene Ma, Ivan Martinovic, and Dawn Song. Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE transactions on information forensics and security , 8(1):136–148, 2012

    2012

  14. [22]

    ” is my phone hacked?” analyzing clinical computer security interventions with survivors of intimate partner violence

    Diana Freed, Sam Havron, Emily Tseng, Andrea Gallardo, Rahul Chatterjee, Thomas Ristenpart, and Nicola Dell. ” is my phone hacked?” analyzing clinical computer security interventions with survivors of intimate partner violence. Proceedings of the ACM on Human-Computer Interact...

    2019

  15. [23]

    a stalker’s paradise

    Diana Freed, Jackeline Palmer, Diana Minchala, Karen Levy, Thomas Ristenpart, and Nicola Dell. “a stalker’s paradise” how intimate partner abusers exploit technology. In Proceedings of the 2018 CHI conference on human factors in computing systems, pages 1–13, 2018

    2018

  16. [24]

    Digital technologies and intimate partner violence: A qualitative analysis with multiple stake- holders

    Diana Freed, Jackeline Palmer, Diana Elizabeth Minchala, Karen Levy, Thomas Ristenpart, and Nicola Dell. Digital technologies and intimate partner violence: A qualitative analysis with multiple stake- holders. Proceedings of the ACM on human-computer interaction , 1(CSCW):1–22, 2017

    2017

  17. [25]

    Access app-specific files

    Google. Access app-specific files. https://developer.android.com/ training/data-storage/app-specific, 2019. Accessed: 2025-04-13

    2019

  18. [26]

    Accessibilityservice, 2024

    Google. Accessibilityservice, 2024. Available: https: //developer.android.com/reference/android/accessibilityservice/ AccessibilityService, accessed Aug. 13, 2024

    2024

  19. [27]

    Clinical computer security for victims of intimate partner violence

    Sam Havron, Diana Freed, Rahul Chatterjee, Damon McCoy, Nicola Dell, and Thomas Ristenpart. Clinical computer security for victims of intimate partner violence. In 28th USENIX security symposium (USENIX Security 19) , pages 105–122, 2019

    2019

  20. [28]

    On the long-term effects of continuous keystroke authen- tication: Keeping user frustration low through behavior adaptation

    Jun Ho Huh, Sungsu Kwag, Iljoo Kim, Alexandr Popov, Younghan Park, Geumhwan Cho, Juwon Lee, Hyoungshick Kim, and Choong- Hoon Lee. On the long-term effects of continuous keystroke authen- tication: Keeping user frustration low through behavior adaptation. Proceedings of the AC...

    2023

  21. [29]

    Automated spa- tiotemporal classification based on smartphone app logs

    Shinjin Kang, Youngbin Kim, and Sookyun Kim. Automated spa- tiotemporal classification based on smartphone app logs. Electronics, 9(5):755, 2020

    2020

  22. [30]

    Can i borrow your phone? understanding concerns when sharing mobile phones

    Amy K Karlson, AJ Bernheim Brush, and Stuart Schechter. Can i borrow your phone? understanding concerns when sharing mobile phones. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems , pages 1647–1650, 2009

    2009

  23. [31]

    Mimicry attacks on smartphone keystroke authentication

    Hassan Khan, Urs Hengartner, and Daniel V ogel. Mimicry attacks on smartphone keystroke authentication. ACM Trans. Priv. Secur., 23(1), February 2020

    2020

  24. [32]

    Leemis, Norah Friar, Srijana Khatiwada, May S

    Ruth W. Leemis, Norah Friar, Srijana Khatiwada, May S. Chen, Marcie-jo Kresnow, Sharon G. Smith, Sharon Caslin, and Kathleen C. Basile. The national intimate partner and sexual violence survey: 2016/2017 report on intimate partner violence. National Center for Injury Preventio...

    2016

  25. [33]

    Anomaly detection for time series us- ing vae-lstm hybrid model

    Shuyu Lin, Ronald Clark, Robert Birke, Sandro Sch ¨onborn, Niki Trigoni, and Stephen Roberts. Anomaly detection for time series us- ing vae-lstm hybrid model. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 4322–432...

    2020

  26. [34]

    Amir: Active multimodal interaction recognition from video and network traffic in connected environments

    Shinan Liu, Tarun Mangla, Ted Shaowang, Jinjin Zhao, John Paparri- zos, Sanjay Krishnan, and Nick Feamster. Amir: Active multimodal interaction recognition from video and network traffic in connected environments. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubi...

    2023

  27. [35]

    Madison tech clinic

    Madison Tech Clinic. Madison tech clinic. https://techclinic.cs.wisc. edu/. Accessed: 2025-01-23

    2025

  28. [36]

    An empirical evaluation of deep learning for network anomaly detection

    Ritesh K Malaiya, Donghwoon Kwon, Sang C Suh, Hyunjoo Kim, Ikkyun Kim, and Jinoh Kim. An empirical evaluation of deep learning for network anomaly detection. IEEE Access , 7:140806–140817, 2019

    2019

  29. [37]

    Stories from survivors: Privacy & security practices when coping with intimate partner abuse

    Tara Matthews, Kathleen O’Leary, Anna Turner, Manya Sleeper, Jill Palzkill Woelfer, Martin Shelton, Cori Manthorne, Elizabeth F Churchill, and Sunny Consolvo. Stories from survivors: Privacy & security practices when coping with intimate partner abuse. In Pro- ceedings of the ...

    2017

  30. [38]

    Deep learning approaches for continuous authentication based on activity patterns using mobile sensing

    Sakorn Mekruksavanich and Anuchit Jitpattanakul. Deep learning approaches for continuous authentication based on activity patterns using mobile sensing. Sensors, 21(22):7519, 2021

    2021

  31. [39]

    Kitsune: An ensemble of autoencoders for online network intrusion detection

    Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18- 21, 2018. The In...

    2018

  32. [40]

    User con- text recognition using smartphone sensors and classification models

    Abayomi Moradeyo Otebolaku and Maria Teresa Andrade. User con- text recognition using smartphone sensors and classification models. Journal of Network and Computer Applications , 66:33–51, 2016

    2016

  33. [41]

    {HideMyApp}: Hiding the pres- ence of sensitive apps on android

    Anh Pham, Italo Dacosta, Eleonora Losiouk, John Stephan, K ´evin Huguenin, and Jean-Pierre Hubaux. {HideMyApp}: Hiding the pres- ence of sensitive apps on android. In 28th usenix security symposium (usenix security 19) , pages 711–728, 2019

    2019

  34. [42]

    Navigating traumatic stress reactions during computer security interventions

    Lana Ramjit, Natalie Dolci, Francesca Rossi, Ryan Garcia, Thomas Ristenpart, and Dana Cuomo. Navigating traumatic stress reactions during computer security interventions. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 2011–2028, 2024

    2011

  35. [43]

    ARGUS: Context- Based detection of stealthy IoT infiltration attacks

    Phillip Rieger, Marco Chilese, Reham Mohamed, Markus Miettinen, Hossein Fereidooni, and Ahmad-Reza Sadeghi. ARGUS: Context- Based detection of stealthy IoT infiltration attacks. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 4301–4318, Ana- heim, CA, August 202...

    2023

  36. [44]

    Effective anomaly detection with scarce training data

    William K Robertson, Federico Maggi, Christopher Kruegel, Gio- vanni Vigna, et al. Effective anomaly detection with scarce training data. In NDSS, 2010

    2010

  37. [45]

    Rogers, Catherine Fisher, Parveen Ali, Peter Allmark, and Lisa Fontes

    Megan M. Rogers, Catherine Fisher, Parveen Ali, Peter Allmark, and Lisa Fontes. Technology-facilitated abuse in intimate relationships: A scoping review. Trauma, Violence, & Abuse , 24(4):2210–2226, Oct

  38. [46]

    The many kinds of creepware used for interpersonal attacks

    Kevin A Roundy, Paula Barmaimon Mendelberg, Nicola Dell, Damon McCoy, Daniel Nissani, Thomas Ristenpart, and Acar Tamersoy. The many kinds of creepware used for interpersonal attacks. In 2020 IEEE Symposium on Security and Privacy (SP) , pages 626–643. IEEE, 2020

    2020

  39. [47]

    {6thSense}: A context-aware sensor-based attack detector for smart devices

    Amit Kumar Sikder, Hidayet Aksu, and A Selcuk Uluagac. {6thSense}: A context-aware sensor-based attack detector for smart devices. In 26th USENIX Security Symposium (USENIX Security 17) , pages 397–414, 2017

    2017

  40. [48]

    Outside the closed world: On using machine learning for network intrusion detection

    Robin Sommer and Vern Paxson. Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy , pages 305–316, 2010

    2010

  41. [49]

    A high-tech twist on abuse: Technology, intimate partner stalking, and advocacy

    Cindy Southworth, Shawndell Dawson, Cynthia Fraser, and Sarah Tucker. A high-tech twist on abuse: Technology, intimate partner stalking, and advocacy. Violence Against Women Online Resources , pages 1–16, 2005

    2005

  42. [50]

    ” it’s the equivalent of feeling like you’re in {Jail”}: Lessons from firsthand and secondhand accounts of {IoT- Enabled} intimate partner abuse

    Sophie Stephenson, Majed Almansoori, Pardis Emami-Naeini, and Rahul Chatterjee. ” it’s the equivalent of feeling like you’re in {Jail”}: Lessons from firsthand and secondhand accounts of {IoT- Enabled} intimate partner abuse. In 32nd USENIX Security Sympo- sium (USENIX Securit...

    2023

  43. [51]

    Abuse vectors: A framework for conceptualizing {IoT-Enabled} interpersonal abuse

    Sophie Stephenson, Majed Almansoori, Pardis Emami-Naeini, Danny Yuxing Huang, and Rahul Chatterjee. Abuse vectors: A framework for conceptualizing {IoT-Enabled} interpersonal abuse. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 69–86, 2023

    2023

  44. [52]

    A tool for capturing smartphone screen text

    Songyan Teng, Simon D’Alfonso, and Vassilis Kostakos. A tool for capturing smartphone screen text. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems , CHI ’24, New York, NY , USA, 2024. Association for Computing Machinery

    2024

  45. [53]

    Sok: Hate, harassment, and the changing landscape of online abuse

    Kurt Thomas, Devdatta Akhawe, Michael Bailey, Dan Boneh, Elie Bursztein, Sunny Consolvo, Nicola Dell, Zakir Durumeric, Patrick Gage Kelley, Deepak Kumar, et al. Sok: Hate, harassment, and the changing landscape of online abuse. In 2021 IEEE Symposium on Security and Privacy (S...

    2021

  46. [54]

    Data stewardship in clinical computer security: Balancing benefit and burden in participatory systems

    Emily Tseng, Rosanna Bellini, Yeuk-Yu Lee, Alana Ramjit, Thomas Ristenpart, and Nicola Dell. Data stewardship in clinical computer security: Balancing benefit and burden in participatory systems. Proc. ACM Hum.-Comput. Interact. , 8(CSCW1), April 2024

    2024

  47. [55]

    The tools and tactics used in intimate partner surveillance: An analysis of online infidelity forums

    Emily Tseng, Rosanna Bellini, Nora McDonald, Matan Danos, Rachel Greenstadt, Damon McCoy, Nicola Dell, and Thomas Ristenpart. The tools and tactics used in intimate partner surveillance: An analysis of online infidelity forums. In 29th USENIX security symposium (USENIX Securit...

    1909

  48. [56]

    Care infrastructures for digital security in intimate partner violence

    Emily Tseng, Mehrnaz Sabet, Rosanna Bellini, Harkiran Kaur Sodhi, Thomas Ristenpart, and Nicola Dell. Care infrastructures for digital security in intimate partner violence. In Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems , pages 1–20, 2022

    2022

  49. [57]

    Uc berke- ley cybersecurity clinic - cltc

    UC Berkeley Center for Long-Term Cybersecurity. Uc berke- ley cybersecurity clinic - cltc. https://cltc.berkeley.edu/program/ cybersecurity-clinic/. Accessed: 2025-04-13

    2025

  50. [58]

    Deep learning models for real-time human activity recognition with smartphones

    Shaohua Wan, Lianyong Qi, Xiaolong Xu, Chao Tong, and Zonghua Gu. Deep learning models for real-time human activity recognition with smartphones. mobile networks and applications, 25(2):743–755, 2020

    2020

  51. [59]

    The abuse of technology in domestic violence and stalking

    Delanie Woodlock. The abuse of technology in domestic violence and stalking. Violence against women, 23(5):584–602, 2017

    2017

  52. [60]

    Fingerslid: Towards finger-sliding continuous authentication on smart devices via vibration

    Yadong Xie, Fan Li, and Yu Wang. Fingerslid: Towards finger-sliding continuous authentication on smart devices via vibration. IEEE Transactions on Mobile Computing , 23(5):6045–6059, 2023

    2023

  53. [61]

    Autolife: Automatic life journaling with smartphones and llms

    Huatao Xu, Panrong Tong, Mo Li, and Mani Srivastava. Autolife: Automatic life journaling with smartphones and llms. arXiv preprint arXiv:2412.15714, 2024

    2024 arXiv

  54. [62]

    Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones

    Hui Xu, Yangfan Zhou, and Michael R Lyu. Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones. In 10th Symposium On Usable Privacy and Security (SOUPS 2014), pages 187–198, 2014

    2014

  55. [63]

    Deep learning in human activity recognition with wearable sensors: A review on advances

    Shibo Zhang, Yaxuan Li, Shen Zhang, Farzad Shahabi, Stephen Xia, Yu Deng, and Nabil Alshurafa. Deep learning in human activity recognition with wearable sensors: A review on advances. Sensors, 22(4):1476, 2022. Appendix A. Evaluation Settings We train and evaluate the models o...

    2022

  56. [64]

    Appendix H

    The small degradation suggests that AID generalizes well to apps it never observed, supporting its further use on larger, more diverse app populations. Appendix H. Uncovering Complementary Modalities in Uni- fied IPI Detection Modality ablations. Tables 11 and 12 show the perf...

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.