Towards On-Device Evidence Gathering for Intimate Partner Infiltration: A Feasibility Study for Joint Identity-Action Detection

Intimate Partner Infiltration (IPI) refers to phone-side privacy infiltration in intimate or close relationships, often enabled by physical access to a person's smartphone and discussed in technology-facilitated Intimate Partner Violence (IPV) contexts. Unlike conventional cyberattackers, IPI perpetrators leverage proximity and personal knowledge to circumvent standard protection, underscoring the need for targeted interventions, motivating device-side tools that surface such risk evidence for later review. While prior works have extensively studied IPV, and some have provided tailored and effective solutions such as security clinics, they are necessarily episodic and human-expert-intensive, and offer limited automated visibility into what happens on a smartphone between support sessions. Guided by a formative interview with experts (n=5), we take the first exploration into gathering IPI-risk evidence from a mobile system perspective and present AID, A utomated I PI D etection, a data-driven system that continuously logs unauthorized access and suspicious behaviors on smartphones. In a controlled 27-participant study, AID achieves an end-to-end F1 score of 0.928 with a 7.0% false positive rate for Top-1 phone-side risk flagging; when preserving top-3 candidate action categories as report context, AID achieves an F1 score of 0.981 and a false positive rate of 1.6%. These findings demonstrate AID's potential as an evidence-support tool that complements current clinic-based interpretation and safety-planning.