ChatAnalysis revisited: can ChatGPT undermine privacy in smart homes with data analysis?

2.1 Smart home systems and their data

Smart Home Systems, designed to increase comfort, safety, and efficiency through home automation, enhance modern living. A typical smart home is one that includes consumer smart home devices that enable connectivity and remote control. Examples of these devices include smart thermostats like Nest, ⁸ which optimize heating and cooling based on user preferences, smart lighting systems like Philips Hue, ⁹ which can change the color and tone of light (on schedule), and security devices such as Ring Video Doorbells, ¹⁰ which provide real-time monitoring and alerts. Central control devices like the Amazon Echo ¹¹ integrate voice-activated assistants to manage other devices and provide additional services. With these devices, a typical smart home generates rich data about energy consumption, security monitoring, and personalized automation.

This Smart Home Data can be distinguished into environmental and behavioral data. ¹² Environmental data includes parameters like temperature, humidity, and light levels collected by devices such as thermostats and light meters. This data is used to automate climate control, optimize energy use, and adjust lighting based on occupant preferences. Behavioral data includes monitoring movement patterns with motion sensors and tracking device usage from smart devices. This data enables personalized automation, such as adjusting thermostat settings when no one is home or activating security protocols during unusual activity.

Smart homes continuously collect this multidimensional data, creating a detailed, real-time understanding of the living environment. This comprehensive data collection not only facilitates efficient home management, but also provides insights into occupants’ habits, enhancing the responsiveness and adaptability of smart home systems. ⁷

First LLM-based approaches that utilize this data are user-centric assistants, which highlight their potential to enhance convenience and accessibility in managing daily tasks. The Sascha approach ¹³ demonstrates in a hands-on user study how LLMs can interpret unconstrained, user-generated commands like “make it cozy”, showcasing their ability to adapt to natural language inputs. Similarly, GreenIFTTT, a GPT-4-based conversational agent, empowers users to monitor smart devices and create personalized energy optimization routines. ¹⁴ While these developments illustrate how LLMs’ intuitive interfaces and adaptability make them valuable tools for end users, they highlight the need to take a step back and critically evaluate their capabilities and limitations in terms of smart home data analysis.

Bouchabou et al. provide a comprehensive evaluation of smart home datasets in their survey on HAR in smart homes based on IoT sensor algorithms. From their survey we focus on real-world datasets due to their representativeness in capturing human activities. Cumin et al.’s Orange4Home dataset ¹⁵ includes 236 recorded activities in a single home. Cook et al.’s CASAS dataset ⁷ covers over 30 apartments, each equipped with approximately 50 sensors, while Alemandar et al.’s ARAS dataset ¹⁶ captures multi-resident activity across multiple apartments with 20 sensors per unit. Among these, we selected the CASAS dataset for its balance of scale and detail. It offers a large number of apartments for behavioral comparison, single-resident settings for simplified activity detection, and a representative sensor distribution. These factors make CASAS well-suited for our analysis.

The CASAS architecture, developed by the Center for Advanced Studies in Adaptive Systems, provides smart home capabilities out of the box, with the primary aim of recording datasets of human behavior for research purposes. The CASAS datasets consist of smart home sensor data collected from 30 apartments (HH101–HH130), annotated with activities of the inhabitants. Most apartments have one inhabitant, except for two, which have two inhabitants. Records vary from 10 to 509 days. Most apartments have about 60 days of data. Each apartment dataset was recorded with a different set of sensors, including motion area (MA), light (L), door (D), and temperature (T) sensors (Table 1), providing a comprehensive overview of activities within the apartments. Apartments are equipped with a mean of 46 sensors. Additionally, every apartment dataset includes a layout of the apartment with the positions of the sensors.

2.2 Privacy concerns with smart home data

Advances in machine learning and artificial intelligence (AI) are a driving factor for analyzing smart home data. These technologies enable the interpretation of environmental and behavioral data collected from sensors within the home, transforming raw inputs into actionable insights. By combining diverse data streams, systems can identify patterns and anomalies that inform automation decisions. Current state-of-the-art methods include correlation analysis and predictive models to infer meaningful insights from heterogeneous data sources. ^{17 , 18}

AI algorithms can analyze temperature, humidity, and motion data to optimize energy consumption and improve security by detecting anomalies in real-time. ¹⁹ These practices provide insights into daily habits and preferences, enhancing efficiency and responsiveness. This data analysis technology is sufficiently advanced that smart homes are used in human activity recognition. ^{7 , 20}

Significant privacy concerns arise from the collection and analysis of smart home data. Environmental data, such as temperature and light levels, combined with behavioral data like movement patterns, can be used to create detailed profiles of residents’ daily routines. ²¹ While this information is valuable for enabling automation, it poses considerable risks if accessed by unauthorized parties. Privacy attacks have repeatedly demonstrated the vulnerability of such datasets. For instance, deanonymization attacks can infer the identity of individuals within a dataset, as shown in recent research. ²² Similarly, singling-out attacks, which isolate an individual’s data from an aggregated dataset, are another prominent threat, as highlighted by de Montjoye et al. ²³ A comprehensive overview of privacy attacks is provided by Powar et al. ²⁴ detailing various methods that can compromise smart home data. Beyond these known attack vectors, smart home data could also be exploited to track personal habits, predict absences, or infer information about health and lifestyle, raising further privacy issues. Data aggregation in cloud services amplifies these risks, as it becomes a lucrative target for cyberattacks and unauthorized data mining. ¹ Addressing these concerns is crucial to maintaining security in smart home environments.

Mitigating privacy risks in smart homes is a complex task. While several protective measures can be implemented, they often have limitations. Educating users about privacy settings and the importance of securing their smart home network is crucial, yet challenging. First approaches such as ChatIDS ²⁵ aim to address this issue. Encryption of data during transmission and storage is fundamental to protecting smart home data against unauthorized access. However, even encrypted data can be vulnerable to advanced traffic analysis techniques, which allow adversaries to infer activities within the home or interactions with smart home devices. ^{26 , 27} Additionally, smart home system providers may collect this data to analyze it themselves or sell it, posing another privacy risk. While anonymization techniques aim to remove personal identifiers, they also have flaws, as demonstrated by the re-identification of individuals in the Netflix dataset. ²⁸

2.3 LLMs for data analysis and human activity recognition

The application of LLMs to HAR and detecting Activities of Daily Living (ADL) in smart homes is an emerging area of research. Sensor-based HAR has traditionally relied on specialized ML techniques, but is now being reimagined with LLMs. For instance, Hota et al. ²⁹ demonstrate LLMs’ ability to label raw inertial sensor data from wearable devices. They show that GPT-4 provides accurate annotations without requiring computationally expensive fine-tuning. Okita et al. ³⁰ develop an LLM specifically for processing one-dimensional sensor signals, to perform activity recognition and emotion detection. ChatGPT has been used for zero-shot HAR using wearable sensors that record daily object usage. ³¹ Civitarese et al. ³² take a novel approach by converting raw sensor data into textual representations before feeding it to an LLM for zero-shot ADL detection. Meanwhile, Chen et al. ³³ propose LAHAR, a sophisticated LLM-based framework for HAR across multiple users, though its complex prompting system limits accessibility for novices. In contrast, our approach prioritizes simplicity, leveraging structured CO-STAR prompts to enable effective HAR without requiring expertise in machine learning. Finally, Kozama et al. ³⁴ highlight the potential of ChatGPT to empower novices in activity recognition, removing the need for GPU resources and significantly lowering the barrier to entry.

This barrier is further lowered by the LLMs’ shown ability to handle diverse Data Wrangling tasks, such as transforming dates and units into different formats with minimal user input. ³⁵ Systems like InsightPilot leverage LLMs for automated data exploration, enabling users to pose natural language queries and receive actionable insights from datasets. ⁴ Tools such as LangChain streamline data ingestion, transforming text files, CSVs, and PDFs into formats compatible with LLMs. ³⁶ By allowing users to “tell the computer what they want, not how to do it”, ³⁷ LLMs have expanded the realm of data analysis to a broader audience, democratizing access to powerful analytical tools once reserved for experts.

Yet, Quality Assessment of the LLM’s output in particular without ML knowledge is ongoing research. The seemingly coherent language produced by LLMs can mislead users without background knowledge into thinking that this output is meaningful and unbiased text. ³⁸ In interpreting smart home data, biases in the LLM’s training data can lead to distorted behavioral patterns and incorrect assumptions about occupants’ habits and routines. In particular, the interplay of background knowledge and delivered results from the dataset is underexplored. This paper works towards filling this gap with our assessment of the LLM’s capabilities on smart home data.

2.4 Prompting

An essential technique for optimizing the performance of LLMs in data analysis is Prompting. It involves crafting inputs that guide the model’s reasoning and output generation. While challenging, ³⁹ a wide range of prompt engineering strategies have been developed to enhance the model’s problem-solving capabilities.

Zero-Shot, One-Shot, and Few-Shot Prompting are foundational techniques for guiding LLMs. Zero-Shot prompting is the most basic prompting technique. With this prompting, the model generates an answer based solely on a monolithic task description without any additional examples or external training data. One-Shot prompting goes beyond zero-shopt prompting by providing a single example to offer minimal context, while Few-Shot prompting extends this further by including several examples to improve the model’s understanding and accuracy. ⁴⁰

Chain-of-Thought (CoT) Prompting is a strategy that guides the LLM to break down complex reasoning tasks into intermediate steps. ⁴¹ This approach improves interpretability and enables the model to tackle intricate problems more effectively by encouraging the LLM to employ a sequential reasoning approach.

Decomposition complements CoT by explicitly breaking down complex problems into simpler sub-questions. While CoT often naturally encourages decomposition, explicitly framing sub-tasks within a prompt can further enhance problem-solving capabilities. ⁴²

CO-STAR Prompting is a structured approach to crafting prompts that ensures clarity and precision in AI responses. It includes six elements: Context, to provide background; Objective, to specify the task; Style and Tone, to shape the response’s character; Audience, to tailor content; and Response, to define format and length. This framework reduces ambiguity and aligns outputs with user intent. ⁴³

Verification in this context ensures the LLM understands task instructions by confirming clarity before proceeding. This step involves prompting the model to explicitly acknowledge comprehension, minimizing errors and enhancing alignment with task objectives. ⁴⁴

3.1 Data selection and preparation

For all experiments, we selected the CASAS dataset [available at available at∼\cite {casas-dataset}, 7]. The data are widely used in research, cover different smart home setups, and capture a wide range of daily activities such as sleeping, eating, and relaxing. We selected data from the apartments HH101 and HH102. Specifically, we used data from August 20, 2012, and the week of July 31 to August 6, 2012, from HH101, and from July 8 to July 15, 2012, from HH102. Our selection criteria focused on ensuring a diverse range of activities and sensor types. The time frame and the number and type of sensors used in the recordings of these apartments are shown in Table 2.

We prepared the data by removing sensors that only detect light or motion within 1 m, as they are not representative for smart home devices. We also converted the datasets to a wide format, where each sensor has its own column and a new row is created for each sensor event. We cast all values to either binary or integer.

3.2 LLM

For the experiments Ex1–Ex3 in May 2024, we used OpenAI’s GPT-4 via the chat interface. GPT-4 was chosen because of its widespread recognition and strong performance in various fields. In November 2024, we conducted a second series of experiments Ex4–Ex6 with the updated GPT-4o model. Since we wanted to explore privacy risks posed by users without deep ML knowledge, we did not use any preceding prompts or system prompts in our experiments. The chat interface’s default settings were used, with both Top-P and Temperature set to 1, and Frequency and Presence penalties set to 0. The models employed were gpt-4-0125-preview for GPT-4 and gpt-4o-2024-11-20 for GPT-4o, which were the standard models available in the chat interface at the time of our experiments . ⁴⁵ To isolate the experiments from each other, we started a new chat session for each experiment.

To ensure consistency, we repeated each experiment multiple times until the variance of the results did not increase further, i.e., our termination criterion was the converging result quality. On average, we repeated each experiment 10 times. For all experiments, we provided the prompt, uploaded the dataset with OpenAI’s document loader, ^{46 , 47} and let the LLM execute the data analysis.

3.3 Prompting

Our starting point is an adversary without in-depth ML expertise, who generates LLM prompts to infer daily activities from time-series of sensor data. To devise prompts for our experiments, we determine the capabilities of this adversary.

Adversary model: We assume an LLM user with access to smart home sensor data. The user has the expertise to write prompts in a trial-and-error style, according to beginner’s prompting tutorials. The user has an intuition of daily patterns, activities and data structures. They do not use LLM APIs or scripting languages, nor fine-tune models. Sophisticated prompting techniques, e.g., Chain-of-Thought or Decomposition, are beyond their abilities. Thus, the user cannot write prompts that specify how the LLM should clean, transform, and analyze time-series data for a defined ML analysis, but relies on the ML knowledge contained in the LLM.

Based on this adversary, we decided to use zero-shot prompts for Ex1–Ex4. Experiment Ex5 tests a slightly more sophisticated CO-STAR prompt, and Ex6 uses both a zero-shot prompt and the CO-STAR prompt.

3.3.1 Zero-shot prompts

We created straightforward zero-shot prompts first. The prompts contain the structure of the sensor data and the expected output format. Figure 1 shows the zero-shot prompt used for Ex1, Ex4, and Ex6. The similar zero-shot prompts for Ex2 and Ex3 can be found in Ref. 6].

Figure 1:

Zero-shot prompt for inferring daily activities (Ex1, Ex4).

3.4 Ground truth

To evaluate how well the LLM can infer activities, we compare its output with an annotated ground truth adapted from the CASAS data set. For example, Figure 2 shows activity (transparent: activity, blue: no activity) in Apt. HH101 on August 20, 2012. The first five rows visualize sensor activities, and the last row shows the activity labels from the CASAS data. As the figure shows, the original labels are inconsistent, non-specific, and oversegmented on the time axis.

Figure 2:

Activity in apartment HH101 on August, 20 2012. The first five rows visualize sensor activity (transparent: activity, blue: no activity), and the last row shows the activity labels from the CASAS data. The labels sometimes lack specificity and display high fragmentation on the time axis.

Thus, we adapted the CASAS labels to the human activities the experiments are supposed to recognize. In particular, we inferred activities that were labeled with “Other”, e.g., we labelled periods without movement and door activity at the beginning and the end as “Away from Home”. We unified the labels of activities that were named differently but represented the same behavior, such as “Various Activities” and “Work/Leisure”. Finally, we filtered out any activity shorter than 5 min, to avoid oversegmentation. The left column in Figure 4 shows our annotation for Figure 2.

4.1 Daily activities (Ex1)

The goal of Ex1 is to assess how accurately GPT-4 maps sensor readings to daily activities. The experiment mimics the adversary with access to the smart home sensor data of their target apartment, acquired, e.g., by data leaks. The adversary then relies on the LLM to learn about daily activities, e.g., to prepare a burglary or stalking. We use the data of apartment HH101 from August 20, 2012 and the zero-shot prompt from Figure 1, and we repeated this experiment multiple times to ensure consistency. All runs produced similar results, as exemplarily shown in Figure 3.

Figure 3:

Inferred daily activity from HH101 for August, 20 2012.

Figure 4 compares our ground truth with the LLM’s inference. Until 11:00, the LLM performs well, with only minor differences. From 12:00 to 20:00, it appears to hallucinate. There’s no evidence for “Lunch” or “Dinner” due to no sensor activity in the kitchen at these times. The “Away from Home” period with no activity was also missed. The LLM appears to correctly infer activities for a total of 14 h, as shown in Table 3. Various days were tested when developing the prompt, sometimes yielding similar or worse results. These inconsistencies highlight the challenges in ensuring reliable performance across different datasets and scenarios.

Figure 4:

Ground truth versus GPT-4 inferred daily activity in apartment HH101 on August 20, 2012.

4.2 Daily routine (Ex2)

Next, we explore GPT-4’s capability to identify the daily routine, aiming to evaluate whether it can provide a coherent summary of typical daily activities over a week. Our concern is a privacy concern similar to Ex1, but the adversaries’ objective is to identify recurring behavioral patterns. Ex2 uses data from apartment HH101 from July 31 to August 6, 2012, and a zero-shot prompt similar to the one of Ex1.

Surprisingly, GPT-4 mostly ignored our various prompt attempts to deliver coherent weekly reports without gaps. Instead, GPT-4 yielded nonsensical time frames, such as “12:00–12:00”, excessively fine-grained time frames (e.g., 15-min intervals) that covered only part of the day, and vague descriptions such as “no significant activity”.

We were able to extract and reproduce only one usable weekly behavioral report, and compare it to our ground truth. Table 4 shows each day we evaluated and whether recurring activities were identified correctly. However, most activities inferred by the LLM deviated from our ground truth. This highlights GPT-4’s limitations to infer the daily routine from the data provided, and leaves much room for further improvements.

4.3 Unusual activities (Ex3)

The goal of Ex3 is to produce evidence for GPT-4’s ability to identify events that deviate from habitual behavior. This might allow an adversary to exfiltrate private details that are not part of an everyday activity, e.g., going on vacation, having become ill, or giving a party.

In a first experiment, Ex3 uses data from apartment HH102 for the week of August 8 to August 15, 2011. This time period has two anomalies: A door left open for more than an hour and an office light left on for more than 10 h. GPT-4 successfully detected both anomalies, and demonstrated its potential to identify significant deviations in smart home environments. However, when repeating this experiment with data from apartment HH101 and the week from July 31 to August 6, 2012, GPT-4 detected nothing but hallucinations. This suggests that GPT-4’s performance varies, depending on characteristics of the data sets and the unusual activities.

4.4 New model (Ex4)

To examine the impact of LLM model advances on our privacy attacks, we compare the capabilities of GPT-4 (Version: gpt-4-0125-preview) and GPT-4o (Version: gpt-4o-2024-11-20). Therefore, we repeat Ex1 with GPT-4o, i.e., we let the LLM infer daily activities with our zero-shot prompt for apartment HH101 on August 20, 2012.

To our surprise, the new GPT-4o model performed much worse than GPT-4 for our daily activity experiment. We repeated our experiment multiple times. Figure 5 shows one of the best daily activity reports we obtained.

Figure 5:

GPT-4o inferred daily activity from sensor data.

Frequently, GPT-4o delivered reports with more than 15 activities, as requested by the prompt. Some activities were identified with durations as brief as 1 min, or had identical start and end times. The inferred activities did not cover the whole day, and empty time slots between inferred activities disrupted the continuity of daily timelines. Finally, many labels were ambiguous, such as “Unknown” or “Various.”

4.5 CO-STAR prompting (Ex5)

Ex1–Ex4 used straightforward zero-shot prompts that any adversary could devise without in-depth knowledge about privacy attacks, machine learning or LLMs. With this experiment, we want to learn if a sophisticated CO-STAR prompt and relating training data can increase the accuracy of the inferred daily activities. Our CO-STAR prompt is much longer and more complex than the zero-shot prompt (cf. Appendix A). It instructs the LLM to use a labeled dataset to infer labels for an unlabeled dataset. After receiving this prompt, the LLM asks to upload both data sets and starts processing.

Figure 6 provides a typical result from GPT-4. While literature proposes CO-STAR as a promising prompt design for complex data analysis tasks, ⁴³ we found that in almost all experiment runs, the daily activities were inferred with less accuracy than in the zero-shot prompt in Ex1. Similar to Ex4, GPT-4o performed much worse than GPT-4. Almost all inferred timelines were unrelated to the input data, contained activities that were unlikely at the assigned time, and the activities exceeded our limit of 15 activities we requested in the prompt. We conclude that a sophisticated prompt might actually distract GPT-4 from its analysis tasks, and the GPT-4o model seems to have issues with our prompt design or with understanding the data.

Figure 6:

Inferred daily activities for Apt. HH101, Aug 20, 2012 with GPT-4.

4.6 Background knowledge (Ex6)

To assess background knowledge of the LLMs, in Ex6 we did not upload the data set, but told the LLM to execute the prompt without input data. Background knowledge on typical human activities is an enabler for many privacy attacks. It allows the imputation of missing data, and is needed to interpret the results of an analysis of personal data. In order to assess the amount of background knowledge in GPT-4 and GPT-4o, we take the best-working case (GPT-4 with a zero-shot prompt, i.e., Ex1) and the worst-working case (GPT-4o with CO-STAR prompting as part of Ex5), each without providing data. To this end, when the respective LLM asked for the familiarization dataset or the test data set, we instructed it with “Please continue without any dataset” to proceed. We expect that the LLMs generate a typical daily routine from their knowledge on human activities.

We repeated this experiment several times. In most test runs, we obtained results like the one visualized in Figure 7. For comparison, the left column of the figure displays our ground truth, i.e., apartment HH101 on August 20, 2012.

Figure 7:

Ground truth versus background knowledge of GPT-4 and GPT-4o.

In addition, we extended the prompts with specific impersonations. For example, we told the LLMs to generate the sequence of daily activities for a baker, a student, a shift worker or an unemployed person. In each case, we obtained daily routines that we deem realistic for both models. For example, Appendix B, Figure 9 contains the routine of a baker, obtained with GPT-4 and our zero-shot prompt. As expected, both GPT-4 and GPT-4o demonstrated very detailed background knowledge about daily routines, regardless of the prompt used. This indicates a robust grasp of human activity patterns, which can help to automatically extrapolate missing data and provide interpretations of the analyzed data. This automation potential highlights potential privacy risks in smart-home contexts.

5.1 Summary of findings

A core concern of this study was whether LLM accessibility would introduce new privacy risks by enabling non-experts to infer behaviors from sensor data. Contrary to expectations that arose from literature (Section 2.3), e.g., Xia et al.’s use of ChatGPT for HAR on data from wearable sensors, ³¹ our findings suggest that both GPT-4 and GPT-4o, when used with basic prompting techniques, struggle to reliably infer human activities from smart home sensor data.

Across all tasks, our findings yielded mixed results with GPT-4. For example, it could accurately infer certain daily activities, such as morning routines, but struggled with hallucinations and incorrect formatting, especially when identifying the daily routine over a week. Even in the best-performing experiment (Ex1), GPT-4 was underwhelming, only inferring correct activities for the first half of the day.

The introduction of GPT-4o did not yield the expected improvements. It performed worse than GPT-4 in inference of Daily Activities with zero-shot prompts (Ex4), producing fragmented timelines and ambiguous labels. More sophisticated prompting using CO-STAR (Ex5) deteriorated results for both GPT-4 and GPT-4o, and again, the older GPT-4 outperformed GPT-4o. While this might suggest that newer model iterations may not always enhance the result, especially when applied to complex real-world data, the large input size (prompt and document) might have been truncated in the background without notification, leading to ignored instructions. Since we did not explicitly control for the input length of smart home sensor data, the impact of shorter/longer sequences on model output remains an open question that requires further investigation. Future benchmarks, e.g., using RULER, ⁴⁸ could shed more light on the real context length and to what extent prompt designs have to balance complexity with clarity.

In general, the experiments were difficult to conduct, and the responses by the LLM were often verbose, even though our prompts required a list response. Even with examples as templates, responses sometimes had formatting errors, such as missing or duplicate time periods. In addition, responses were often grouped incorrectly and the same unusual activity was reported multiple times. In some cases, the same model provided different answers for identical data inputs. Without instructions on how to analyze the data, the LLM could not consistently infer accurate information. The LLM frequently encountered errors such as “It appears there was an error in the process” and had to be restarted. Overall, unlike traditional ML approaches that optimize for accuracy using labeled data and statistical modeling, LLMs produced outputs that sounded plausible but lacked reliability. This underscores their limitations in structured data analysis, if used on their own.

LLMs are known to incorporate vast background knowledge, and our experiment Ex6 validated that both models exhibited exceptional background knowledge about daily routines, regardless of the prompt used. This highlights potential privacy risks involved in smart-home contexts, as it could be used to deliver easy-to-understand interpretations to non-experts and automatically compensate for data gaps. However, rather than compensating for missing information, the models seemed to ignore the sensor data and over-rely on their background knowledge. Both GPT-4 and GPT-4o often generated confident but incorrect inferences, demonstrating a susceptibility to hallucination rather than genuine pattern recognition.

5.2 What does this imply?

Given the rather poor LLM performance in our experiments, our findings emphasize the limitations of general-purpose AI tools for structured data analysis rather than their immediate privacy risks. However, this outcome provides important insights into design and practical implications for development and deployment of user-centric LLM-based assistants in smart home contexts (Section 2.1). Similar to enhancing comfort, ¹⁴ when empowered to perform data analysis on smart home data, these conversational agents could help educating users about potential privacy risks. For example, implemented in a smart home system, they could demonstrate to the user how much personal information can be inferred from their current smart home data. This enables the user to make a more informed decision about their smart home system (in terms of data collection and sharing data with vendors) and network security.

In this context, on a technical level, we find that designers and programmers should avoid over-reliance on LLMs for structured data analysis (I1). Both GPT-4 and GPT-4o struggled with structured sensor data. We learn that designers and developers should not assume that LLMs can reliably extract insights from structured datasets like time-series sensor data. Instead, our findings reinforce the need for hybrid AI approaches that combine language models with specialized ML techniques (I2). In particular, integrating structured learning models that track long-term patterns and contextualize behaviors over time could improve reliability in behavior inference applications. To this end, one could first develop a working ML pipeline for analyzing the data, then gradually replace parts of this pipeline with complex prompts to evaluate if LLMs can viably replace traditional ML methods. These prompts could then be simplified progressively to assess whether attackers with minimal expertise could still extract meaningful insights, thereby evaluating the real-world privacy risks associated with these models.

Designing interfaces that clearly communicate LLM limitations in data-driven contexts (I3) could prevent users from misinterpreting AI-generated insights. Non-experts using LLMs for structured data analysis in particular may otherwise misinterpret outputs due to the models’ tendency to generate confident but unreliable answers. If coupled with ML techniques, depending on how explainable it is (e.g., decision tree vs. specialized neural networks), explanation and uncertainty indicators or confidence scores could be added, but further research is needed regarding information overload in smart home contexts.

On a policy level beyond LLM-based assistants in smart homes, our findings suggest that AI accessibility does not automatically lead to privacy risks (I4). While AI accessibility raises concerns about misuse, our findings suggest that making LLMs available does not inherently increase privacy risks in structured data analysis. Future discussions on AI governance should differentiate between model accessibility and actual capability when assessing potential threats.

Finally, our results underscore the importance of systematically evaluating LLMs in non-language domains (I5). Future research should establish benchmarking standards for AI output quality in structured data contexts to prevent overestimations of LLM capabilities.

5.3 Further limitations and future work

The dataset used in our study was focused primarily on a single household with a limited range of sensors (motion, door, temperature, and light), and it included a wide array of 35 distinct activities. This setup does not capture the full complexity of modern smart homes and made it difficult for the model to accurately recognize such a high number of activities. To address this limitation, future work should expand datasets to include multiple households, a variety of device types, and more diverse user behaviors. Another promising avenue is to further reduce the number of distinct activities to reduce fragmentation.

While using the chat-based interface resonates well with our assumed adversary model (Section 3.3), API-based prompting provides more control over model behavior, enabling structured and reproducible interactions that might yield different or more reliable inferences. Future work could examine whether API-based adversarial strategies such as iterative refinement or retrieval-augmented techniques enhance inference accuracy.

Our evaluation was constrained to two prompting strategies: zero-shot and CO-STAR prompting. We chose these techniques to capture a reasonable range of prompting styles that align with our adversary model. It remains open to what extent alternative prompting paradigms, such as few-shot learning, chain-of-thought reasoning, and combinations with iterative feedback loops improve results.

Automated testing across multiple models is necessary to better understand how different LLMs perform on sensor data. Our study focused only on GPT-4 and GPT-4o, leaving open questions about output variations across other models. Developing automated testing frameworks to evaluate different LLMs on identical datasets and prompts is a promising research avenue. Additionally, comparisons with AI models designed specifically for sensor-based HAR should be made to determine whether LLMs offer any advantages over traditional methods.

Our findings are framed within an adversarial context, assuming an entity attempting to infer user activities without specialized ML expertise. Shifting the perspective to user-centric LLM-based assistants, i.e., a smart home user with full data access, presents an alternative scenario in which different prompting strategies and LLM interaction models may be more viable. While our results highlight the inherent weaknesses of naive, zero-shot prompting for behavior inference, future work should explore whether more structured, user-driven interactions yield stronger results in practical smart home applications.