Smart home security research runs on a scarce ingredient: recordings of how real people use the gadgets in their homes. Getting that data means wiring up someone’s house and watching for months, which is slow, costly, and about as invasive as it sounds. So the datasets stay small and cover a thin slice of how people live.
The smart home testbed used by the researchers
A group from Leipzig University and ipoque, a Rohde & Schwarz company, has a workaround that sounds a little strange at first. Let a language model play the resident. Hand it a persona and a house, let it decide how that person moves through a morning, and have it produce the device commands that follow. Simulate the person, and the lights and locks come along for the ride.
The payoff is a list of timestamped commands a home-automation platform can run on real hardware. That lets researchers record the network traffic and device activity each command produces, which is exactly the raw material people building intrusion detection and traffic-analysis tools are short on. And they get it without parking a camera in anyone’s living room.
The privacy angle is the point. Older work the authors lean on shows how much a smart home gives away even when everything is encrypted. The Peek-a-Boo study pulled household activity straight out of encrypted traffic. Other research showed that individual devices announce themselves through their traffic patterns whether you want them to or not. Studying that leakage has always meant watching real people. A model-generated household lets you make the same test data and leave real homes out of it. The same team has a companion dataset in the works, SPARTAN, aimed at exactly this.
Then comes the catch that hangs over all synthetic data. A detection system learns what “normal” looks like from whatever it trains on, and normal life at home is a mess. People leave lights on for hours, wander off schedule, and do inexplicable things at 3 a.m. The authors name the problem themselves, calling out “irregular, inconsistent, or forgetful” behavior as the quality they cannot yet promise their fake residents capture. Train a detector on suspiciously tidy synthetic mornings and it may choke on the real thing, flagging an ordinary Tuesday as an attack.
There is a quieter worry too. Language models learn a lot of their sense of home life from text about how smart homes are supposed to work, so the residents they invent may skew toward an idealized version of the real deal.
The demonstration behind the paper is tiny on purpose. One run on OpenAI’s GPT-5.4, two residents named Alice and Bob, a German winter morning from 6 to 10, eight devices. It held together. Bob’s activity bunched up before his 8:30 dash out the door, Alice’s spread across the morning, and both leaned on the lights thanks to the late sunrise.
The team is upfront about the gaps. They have run this once, have yet to show the routines resemble real behavior, and have yet to run a single schedule end to end on actual hardware. For a field weighing the cost and privacy load of real data collection, it points at a road worth watching.
Report: How to Implement a Continuous Offensive Security Testing Program