On-device data and privacy boundaries

List the raw sensor input, temporary buffers, extracted features, recurrent state, predictions, diagnostic logs, and network messages. For each item, record who can access it, how long it persists, and what deletes it. Data held only in application RAM has a different exposure from a persistent file, but either can matter under a compromised device or diagnostic tooling. A diagram that stops at the inference call misses copies created by preprocessing, profiling, crash collection, and downstream application code.

An operating system can also transfer data outside the inference process. Android’s Auto Backup documentation is a concrete example: inclusion and exclusion rules depend on platform and target version, and cloud backup and device-to-device transfer have distinct controls. For apps targeting API 31 and above, one manifest flag does not uniformly disable every transfer on every manufacturer’s device. Verify the deployed backup rules and restore behavior rather than assuming that private application storage means data never leaves the device.

A feature vector can preserve identity, activity, location, or reconstructable input details even when it is shorter than the raw signal. Original representation-inversion experiments demonstrate that some deep features retain substantial image information under their tested settings. That finding does not say every embedding is invertible, but it defeats an automatic inference from transformed to anonymous. Evaluate the representation, available auxiliary information, attacker access, and the specific information the product intends to protect.

Reducing telemetry sampling lowers expected record count, not necessarily identification risk for the retained records. Persistent identifiers, precise timestamps and rare events can make a few records highly informative. Ordinary random subsampling by itself is not a differential-privacy guarantee; any such claim needs the full mechanism, adjacency relation and privacy accounting. Separate operational need from convenient debugging: collecting less sensitive aggregate information with short retention can reduce exposure, but its adequacy still depends on the stated threat model and actual implementation.

Inspect storage, network traces, backup and restore paths, and crash artifacts under normal and failure conditions. Define access control, key handling where encryption is used, retention and deletion, and support procedures for diagnostics. Encryption does not remove authorized endpoint access or prevent the application from intentionally logging plaintext. Include model-state resets and user/session boundaries in the tests, because locally retained history can cross those boundaries even when the device never contacts a model server.

The probability lab illustrates telemetry selection only. Reset, set p to 0.1 and n to 10, predict expected selected count one and probability of no selected record approximately 0.3487, then Step. Compare a fresh Reset with both p at 0.1 and n at 30 before Step: mean three and no-selection probability approximately 0.0424. These exact independent-binomial masses contain no personal information, adversary, backup system, or privacy analysis.