Building and Evaluating Anonymizations for Human Motions

Human body motion is a rich source of information. Capturing motion data opens up a range of many new applications in mixed reality, robotics, and medicine. With the proliferation of inexpensive motion tracking hardware, such as mixed reality headsets, motion tracking suits, and smartphones, this source of information is becoming increasingly accessible in our everyday lives. Combined, this data can be used to create an accurate motion profile of the person captured, allowing for the creation of digital twins, the motion control of robots, and for more accurate diagnoses in medicine. However, motion data is also an inherently sensitive source of information, as it is behavioral biometric data that allows for many privacy sensitive inferences about the captured individual. An attacker with access to someone's motion data could identify that person by their unique motion patterns, infer the presence of diseases, such as Parkinson's, or infer private attributes such, as sex and weight. In this thesis, we seek to understand the privacy problems of motion data and how we can solve them to enable the privacy preserving usage of motion data. Since privacy for motion data is a new research topic, we began our investigation with an extensive literature review of privacy-preserving techniques for behavioral biometric data. The main findings of the literature review are that there are only preliminary approaches to anonymizing motion data, that the methodology for evaluating biometric data anonymization is limited and needs improvement, and that there are few datasets suitable for evaluating the efficiency of motion data anonymization. Next, we investigated motion anonymization using various simpler techniques and their combinations to better understand which techniques would be effective for anonymizing motion data. Using gait data, we found that identifying individuals is very resilient and difficult to prevent, even when data utility is severely degraded. Due to the high number of correlations in motion data, anonymizing it is a hard problem. We also investigated the privacy issues surrounding motion data by collecting FacialMotionID, the first comprehensive dataset of facial motions. Using this dataset, we demonstrated that facial motion data can also be used to identify individuals. We addressed the lack of a strong evaluation methodology for biometric data anonymization. We developed a stronger attacker model based on stronger assumptions about the attacker's capabilities. This makes our evaluation methodology more rigorous and produces more reliable privacy results. In order to address the lack of motion datasets, we collected the gait sequences of 50 people using an IMU motion capture suit to create CeTI-Locomotion. Lastly, we present Pantomime, the first general anonymization technique for full-body motion data that can maintain high utility while removing most identifiable information. Pantomime demonstrates that meaningful anonymization of motion data is possible, while keeping the utility of the data high.