ADS Guard: A Generalizable Defense Framework for Adversarially Robust Occupancy Detection in Smart Buildings

Abstract

Occupancy detection is fundamental to the operational intelligence of smart buildings, driving critical functions in energy management, HVAC automation, and physical security. While modern Deep Learning (DL) models have achieved high accuracy in parsing complex environmental sensor data, they remain highly vulnerable to adversarial examples, imperceptibly perturbed inputs designed to deceive neural networks. These vulnerabilities pose severe real-world risks, ranging from energy sabotage, in which systems heat empty rooms, to critical security breaches in which intruders go undetected. To address this security gap, we propose ADS-Guard, a novel Adversarial Detection and Sanitization (ADS) framework rooted in sequence-to-sequence autoencoder purification. Unlike standard denoising techniques, ADS-Guard incorporates a latent consistency regularization mechanism that encourages alignment between clean and adversarial representations in the latent feature space. We evaluated ADS-Guard using a comprehensive experimental pipeline comprising five distinct DL architectures (LSTM, GRU, 1D-CNN, MLP, and Transformer) across three diverse datasets: (1) The UCI Occupancy dataset (20,699 samples) for standard binary detection; (2) Building59 dataset (7200 samples) for three-class occupancy-level classification (Low, Medium, High); and (3) Room Occupancy dataset (10,129 samples), representing a highly imbalanced binary occupancy-detection task. We evaluate ADS-Guard against both Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks across diverse occupancy datasets and model architectures. We further assess the framework under adaptive white-box attacks and compare its performance with FGSM-based and PGD-based adversarial training baselines. Our results demonstrate that adversarial attacks can substantially degrade occupancy-detection performance across datasets and model architectures. ADS-Guard consistently improves robustness relative to undefended models against both FGSM and PGD attacks, recovering a substantial portion of the lost performance in binary occupancy tasks and providing meaningful gains in the more challenging multi-class setting. Furthermore, ADS-Guard remains effective under stronger adaptive threat models while providing a practical retraining-free defense that can be integrated with existing occupancy-detection systems without modifying downstream classifiers.