SENtinel SORt (SENSOR): Scalable Privacy Annotation

• SENSOR is an ML-enhanced annotation tool that automatically extracts and categorizes privacy-related feedback from social-media reviews.
• It employs a dual-mode workflow combining manual review and the GRACE deep neural classifier to achieve high inter-rater reliability with a Cohen’s Kappa of 0.87.
• The system integrates robust review ingestion, real-time progress tracking, and export capabilities, outperforming baseline models with 95.10% accuracy and strong macro metrics.

SENtinel SORt (SENSOR) is an online, machine learning–enhanced annotation tool engineered for extracting and categorizing privacy concerns from large corpora of user reviews on social-media applications. Its primary objective is to enable developers to efficiently identify and triage privacy-related feature requests, privacy-related bug reports, and privacy-irrelevant feedback, leveraging automation to overcome the limitations of manual review at scale. The system operationalizes a structured annotation workflow with the GRACE deep neural classifier and is validated on a large, rigorously annotated dataset with high inter-rater reliability (Farah et al., 14 Jul 2025).

1. Motivation and Scope

Social-media user reviews frequently contain privacy-related feedback, including requests for new privacy controls, complaints regarding data sharing, and reports of privacy-affecting bugs. These reviews are sparse—constituting roughly 0.5% of total reviews—and are often phrased in nuanced, application-specific language. Manual annotation is impeded by volume, inconsistency, and error-proneness, resulting in critical privacy concerns being under-recognized or not addressed by developers.

SENSOR addresses these challenges by combining web-based workflow management, robust review ingestion infrastructure, and a high-precision annotation model. The tool enables seamless switching between manual and automated annotation modes, facilitating both scalability and human oversight in the iterative annotation process.

2. System Architecture and Workflow

SENSOR is implemented as a Flask-based web service providing a RESTful API backend, with a lightweight front end using HTML, CSS, and JavaScript templates. The workflow features two primary user roles: Developer and Annotator.

• Review Acquisition: Reviews are scraped via the google-play-scraper library or uploaded as CSV files. An internal database persists both the raw reviews and associated annotation metadata.
• Assignment and Progress Tracking: The Developer Dashboard allows developers to assign files to two annotators, launch the GRACE-based auto-annotation, monitor review progress, visualize Cohen’s Kappa agreement in real time, and download annotated datasets.
• Annotation Modalities: Annotators operate through the Annotator Dashboard, labeling each review as privacy-related feature request (PFR), privacy-related bug report (PB), or privacy irrelevant (IRR). Dual-mode (manual or automated) annotation ensures both scalability and ongoing quality assurance.
• Export and Integration: Annotated review data—including predicted class and model confidence—can be exported for downstream integration with software maintenance pipelines.

This architecture provides the infrastructure required for periodic review collection, collaborative annotation, and structured feedback export, aligning with developer workflows for privacy-centric app maintenance.

3. Underlying Annotation Model: GRACE

The automated annotation backbone for SENSOR is the GRACE model ("GRU-based Attention with CBOW Embedding"). Its architecture is as follows:

• CBOW Embedding Layer: Each review, tokenized to a sequence of up to 150 tokens, is mapped to 200-dimensional embeddings via a pretrained Continuous Bag-of-Words (CBOW) matrix. The vector for each token is constructed as the average over context word vectors from the corpus.
• GRU Encoder: A single-layer GRU with hidden dimension 896 models sequential dependencies in the token embeddings. At timestep $t$, the GRU cell computes update gate $\mathbf{z}_t$, reset gate $\mathbf{r}_t$, and candidate hidden state $\tilde{\mathbf{h}}_t$, combining these to produce $\mathbf{h}_t$ through weighted summation.
• Attention Mechanism: Alignment scores $a_t$ are computed over the hidden sequence, transformed into attention weights $\alpha_t$ via softmax. A context vector $\mathbf{c}$ is formed as the attention-weighted sum of hidden states, allowing the model to focus on salient segments of the review.
• Classification Layer: The context vector $\mathbf{c}$ is concatenated with a global summary (average hidden state), subject to dropout (50%), passed through a 256-unit dense layer, and outputted via softmax to the three-class probability simplex $\Delta^3$.

Training employs categorical cross-entropy loss, the Adam optimizer, early stopping, and checkpointing by validation loss.

4. Data Collection and Labeling Protocol

The SENSOR dataset comprises 16,000 reviews, drawn from an initial pool of ~78,000 reviews across seven prominent social media apps (Instagram, Facebook, WhatsApp, Snapchat, X, Facebook Lite, and Line) from the Google Play store. Selection criteria included length filter ($\mathbf{z}_t$0 words) and keyword-based privacy candidate identification.

• Annotation Process: Two independently trained annotators labeled each review as PFR, PB, or IRR.
• Inter-rater Agreement: Cohen’s Kappa $\mathbf{z}_t$1 was attained, indicating high labeling consensus.
• Resolution: The 13% of cases with disagreement were reconciled through discussion, producing a gold-standard set: 3,627 PFR, 4,221 PB, 8,152 IRR.

This dataset, with its rigorously documented class structure and label provenance, underpins robust model evaluation.

5. Experimental Evaluation and Comparative Performance

The 16,000 labeled reviews were split 80%/10%/10% into train/validation/test sets (12,756/1,594/1,595). The training set was augmented (to $\mathbf{z}_t$2) with synonym substitution, word drop, contextual insert/substitute, and abstraction, designed to foster minority-class pattern diversity without changing the natural class imbalance (PFR ≈ 27%, PB ≈ 27%, IRR ≈ 46%).

A diverse array of baselines (classical models, RNNs, transformer models, hierarchical classifier pipelines) was benchmarked against GRACE. Key comparative metrics on the test set are summarized below:

Model	Accuracy (%)	Macro F1	Macro ROC-AUC
GRACE	95.10	0.9434	0.9934
RoBERTa	88.08	0.8712	0.9671
BiLSTM	88.14	0.8674	0.9654
DistilBERT	87.14	0.8609	0.9673
Hierarchical SGD	87.20	0.8600	0.9416

GRACE substantially outperforms all baselines in accuracy, macro-averaged F1, and macro ROC-AUC, demonstrating both strong overall precision and robustness to class imbalance. Macro-averaged metrics guarantee balanced evaluation across classes, critical in sparse-event detection scenarios such as privacy concern mining.

Handling class imbalance is further aided by data augmentation, macro-averaged metrics, hierarchical classification structures, and GRACE's attention mechanism, which emphasizes rare but informative language cues.

6. Practical Usage, Limitations, and Prospects

Integration into application maintenance pipelines is facilitated by SENSOR’s export capabilities. Developers can retrieve annotated reviews with assigned categories and confidence, sort feature requests by frequency or severity, assign bug reports to engineering, and ignore irrelevant content.

• Continuous Improvement: The human-in-the-loop process supports iterative retraining of GRACE as new data becomes available, refining classifier accuracy over time.
• Examples: SENSOR surfaces detailed privacy-related concerns (e.g., “Please add an option to hide my ‘last seen’ from certain friends.” as PFR; “After the last update, muted chats still send me push notifications, leaking my activity.” as PB).
• Limitations: The reliance on keyword-filtering may omit implicit privacy concerns. The dataset is restricted to English-language reviews from seven social apps on Google Play. The rigid three-class taxonomy might not capture overlapping or nuanced privacy issues.
• Future Directions: Planned enhancements include zero-shot and topic-model filtering, semantic-preserving augmentation, extension to other app categories and languages, hierarchical categories, and integration of unsupervised clustering (e.g., LDA, BERTopic) to identify recurring privacy themes.

A plausible implication is that SENSOR provides a scalable and replicable workflow for actionable privacy mining in app ecosystems characterized by unstructured, high-volume user feedback. Adopting advanced NLP architectures such as GRACE highlights the utility of sophisticated sequence modeling for domain-specific, low-prevalence event detection (Farah et al., 14 Jul 2025).