Pith. sign in

REVIEW 3 major objections 8 minor 57 references

What is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?

T0 review · 3 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding differential privacy to trajectory generators costs utility, but GANs become the best models under DP-SGD.

desk verdict A careful empirical study of DP for trajectory generation with a useful new conditional-embedding mechanism, but the headline GAN result is not a formally private comparison and one noise calibration has an error. read the letter →

arxiv 2506.09312 v1 pith:U7SVSIBE submitted 2025-06-11 cs.CR cs.LG

Erik Buchholz , Natasha Fernandes , David D. Nguyen , Alsharif Abuadbba , Surya Nepal , Salil S. Kanhere This is my paper · ORCID
classification cs.CRcs.LG
keywords differentialprivacytrajectorygenerationDP-SGDconditionalinformationutility-privacytrade-offgenerativemodelssynthetictrajectoriesGANs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper measures the utility cost of formal differential privacy for deep-learning trajectory generation. Across two real GPS datasets and eleven metrics, it finds that DP-SGD with a realistic privacy budget (ε=10) roughly doubles the distributional error of diffusion and VAE generators, and on the smaller dataset most configurations become unusable. The paper also proposes a mechanism that makes conditional generation inputs private by subsampling, compressing, clipping, and adding calibrated noise, and proves its trajectory-level DP guarantee. The model comparison shows a reversal: the conditional diffusion model that performs best without privacy is outperformed by a GAN once DP-SGD is applied. The conclusion is that formal guarantees are currently feasible only for large datasets and coarse-grained use cases.

What carries the argument

The central technical object is the DP conditional-embedding module: it uniformly subsamples m trajectories, compresses them with a fully-connected layer to dimension d_out, clips or scales the per-sample norm to C, adds noise from one of three mechanisms (Laplace, Gaussian, or VMF), and decompresses back to the model's embedding dimension. The privacy analysis treats this as a parallel composition of per-sample compression functions, with uniform-without-replacement subsampling providing amplification, yielding trajectory-level (ε,δ)-DP under replace-one adjacency for the generation-time information. The second load-bearing mechanism is DP-SGD, applied to all parameters of the diffusion and VAE models but only to the generator of the GAN, with the discriminator trained non-privately and kept from release.

What would settle it

Run a shadow-model membership-inference attack (as in the paper's reference [34]) against the released DP-GAN generator; if the attack distinguishes training members from non-members with accuracy exceeding the bound implied by (ε=10, δ=1/$n^{1}$.1), then the assumption that the un-released discriminator cannot compromise the generator is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that the utility cost of formal privacy in trajectory generation is substantial but not uniform across models. It establishes that DP-SGD (ε=10, δ=1/$n^{1}$.1) significantly degrades the generated trajectories' distributional and trajectory-level metrics for diffusion and VAE models, while the GAN's performance is roughly unchanged or slightly improved under DP-SGD. It further claims that its proposed DP conditional-embedding mechanism—a subsample-compress-clip-noise pipeline applied to conditional inputs such as full trajectory samples or eight derived statistics—provides a provable (ε_c,δ_c)-DP guarantee w.r.t. the test set and improves training stability, especially for GANs and small datasets. Finally, it claims that under DP-SGD the GAN outperforms both the diffusion and VAE architectures on most point-level metrics, indicating that model selection for private trajectory generation should be performed under the privacy regime, not before it.

Load-bearing premise

The GAN's claimed privacy guarantee assumes that training the discriminator without DP cannot leak private information into the released generator, because the discriminator itself is not published; if the generator's DP-noised updates still carry information that passed through the non-private discriminator, the trajectory-level guarantee for D_train does not hold.

Editorial extensions

If this is right

  • With formal privacy at ε=10, generated trajectories retain coarse spatial structure but lose fine detail such as road-network fidelity; density- and hotspot-style applications remain viable on large datasets.
  • Model selection for private trajectory generation should be repeated under the intended privacy mechanism, because the best non-private architecture is not the best private one.
  • Conditional inputs can be used with formal guarantees at a modest per-configuration cost, and the main observable benefit is training stability rather than a direct utility boost.
  • Deep-learning DP generators outperform the non-deep-learning baseline PrivTrace on the larger dataset, so deep models are not inherently worse under DP.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the privacy proof for the conditional embedding never uses trajectory-specific structure, the same compress-clip-noise pipeline should apply to conditional information in other data domains, such as tabular or image generation.
  • The GAN result suggests a general recipe for private generative modeling: apply DP-SGD only to the released component (the generator) and leave any internal discriminators or critics non-private, as long as they are never published—though this transfers only if the internal component's information cannot flow into the released parameters.
  • The paper measures trajectory-level privacy, which is weaker than user-level privacy; a user contributing multiple trajectories receives no per-user guarantee, so the reported ε values understate the privacy risk in real multi-trajectory deployments.
  • An explicit comparison with user-level DP accounting would show whether the observed utility collapse is inherent to DP itself or an artifact of per-trajectory accounting.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 8 minor

Summary. This paper studies the utility cost of enforcing differential privacy in deep-learning-based trajectory generation. It addresses three questions: (1) how DP-SGD affects the utility of a diffusion model, a VAE, and a GAN built from the same UNet backbone; (2) how conditional information can be used under DP, via a proposed mechanism that compresses, clips, and noise-adds trajectory-derived conditioning embeddings (Laplace, Gaussian, and VMF variants) with formal guarantees; and (3) which model type is best under formal privacy guarantees. The evaluation covers two GPS datasets (Porto, ~1.56M trajectories; GeoLife, ~69.5k), eleven utility metrics, six conditional-embedding types, ablations over epsilon_s, epsilon_c, d_out, and the DP mechanism, and a PrivTrace non-DL baseline; 90+ configurations x 5 seeds were run on H100 GPUs and the code and data are released. Reported findings: DP-SGD substantially degrades utility, especially on the smaller dataset; the proposed DP conditional mechanism stabilizes training, particularly for GANs and when combined with DP-SGD; and under DP-SGD the GAN outperforms the diffusion model and the VAE, reversing the non-private ranking.

Significance. Strengths: the empirical evaluation is unusually broad and careful — comparable model architectures, two datasets of very different sizes, eleven metrics, modern PRV accounting via Opacus, a non-DL baseline, and full code/data release. The proposed DP conditional-embedding mechanism is a genuine technical contribution: it cleanly separates the training path (DP-SGD) from the generation path (DP on the conditioning input), and Theorems 1 and 3 follow from the cited results. If the guarantees are valid, the paper's negative result — formal trajectory-level DP is currently practical only for large datasets and coarse use cases — is a useful benchmark for the community. The main weakness is that the GAN, which is the best performer under DP-SGD and drives the headline RQ3 conclusion, does not have a valid formal guarantee as analyzed: only its generator is DP-trained, while the non-private discriminator's state conditions every generator update. The RQ3 finding is therefore not yet a statement about formally private models.

major comments (3)
  1. [§5.1, §6.1, §7.4.3] Corollary 1 (§6.1) claims that 'all models trained with DP-SGD' provide (ε_s, δ_s)-DP w.r.t. D_train, citing Abadi et al. and Gopi et al. For the GAN this is not supported. Section 5.1 states that only the generator is DP-trained while 'the discriminator is trained without it', arguing this 'does not compromise privacy ... as the discriminator is not involved in generation'. The cited DP-SGD proofs do not cover this setup. The generator's per-sample gradients are taken with respect to its input noise z, which is not private data, so per-sample clipping bounds the sensitivity in z, not in D_train; the dependence of the generator update on D_train enters through the discriminator state θ_D^t, which is updated non-privately and has unbounded sensitivity — replacing one trajectory can move θ_D^t arbitrarily, and with it the clipped generator gradient by more than the assumed bound. The per-step mechanisms are therefore not (ε', δ')-DP under the accounting used, composition cannot be invoked, and the released generator is not a post-processing of a DP output, since its entire training trajectory conditions on a hidden non-private state. That the discriminator is not released is immaterial: information that entered through it can be encoded in the released generator weights. Because the GAN is the model that 'performs best' under DP-SGD (§7.4.3), the RQ3 conclusion is not a comparison among formally private models, and the GAN's advantage may reflect the privacy leak rather than utility under DP. The authors should DP-train the discriminator with joint accounting, provide an explicit sensitivity analysis of the joint training map, or drop the formal-DP claim for the GAN configurations and re-frame RQ3.
  2. [§6.2 (Theorem 2)] The calibration in Theorem 2 appears to be a factor of sqrt(2) too small. The theorem claims (log(1 + m/n (e^ε − 1)), m/n · δ)-DP for σ = α·2C/(√2·ε), with α defined 'as per Algorithm 1 in [26]'. In Balle and Wang's analytic Gaussian mechanism the published calibration is σ = α·Δ/ε for sensitivity Δ (their Algorithm 1 and Theorem 8); with Δ = 2C this gives σ = α·2C/ε. As written, the sqrt(2) in the denominator reduces the noise scale by about 29 percent, so the realized mechanism is weaker than the claimed (ε, δ)-DP and the reported ε_c is optimistic. This affects the 'Sample + N' configurations in Table 1 (IDs 15/16) and Ablation Study III (ID 39, d_out = 256). Please correct the formula, or state explicitly the reparameterization of α if one is intended; the Laplace and VMF theorems are not affected, but the Gaussian guarantee as stated does not follow from the cited source.
  3. [§5.3, §7.4.3] The RQ3 comparison under DP-SGD is confounded by a training-protocol difference that is acknowledged in §5.3 but not weighed in the RQ3 conclusion. Under DP-SGD the GAN uses n_critic = 1, so the generator receives 100,000 updates; without DP-SGD it uses n_critic = 5, giving only 20,000 generator updates. The observation in §7.4.1 that the GAN 'performs similar or even better with DP-SGD than without' therefore intertwines the effect of DP-SGD with a 5x increase in generator updates. In addition, the explanation suggested in §7.4.3 — that the GAN benefits from DP-SGD being applied to roughly half the parameters, yielding 'less relative noise per gradient update' — is not correct as stated: DP-SGD's noise multiplier is calibrated relative to the per-sample gradient clip norm, not to the parameter count. Please match generator-update counts across the DP and non-DP GAN conditions and across model types, or temper the RQ3 conclusion so that the GAN's advantage is not attributed solely to the architecture.
minor comments (8)
  1. [Abstract] The abstract contains a grammatical error: 'some utility remains if the datasets is sufficiently large' should read 'if the dataset is sufficiently large'.
  2. [§5.2 (Eq. 5)] In equation (5), d_DP appears on both sides; rename the private embedding and the mixed embedding (for example, d_tilde_DP and d_mix) to avoid the impression that the schedule re-noises an already-noisy vector.
  3. [§6.2] The statement that the add-or-remove adjacency 'is not applicable here, as the output dimensionality of the compression function Fc depends on the number of input samples' is imprecise: when m < n the output dimension is m x d_out regardless of n, and the rationale holds only under the conservative accounting choice m = n made in §7.3.
  4. [§6.3] The claim that 'the replace-one adjacency relation is considered to be approx. twice as strong as the add-or-remove adjacency relation' is a heuristic; the text should state explicitly that the mapping ε_c = 20 versus ε_s = 10 is informal and not a proved equivalence.
  5. [§7.1] Typo: 'notes having two Intel Xeon Platinum 8452Y CPUs' should be 'nodes having...'.
  6. [§7.4.7] The sentence 'the conditional DiffTraj requires ≈54 h (ID 4), VAE ≈29 h, and GAN ≈32 h' is incomplete; add the missing verbs, e.g., '...while the VAE requires ≈29 h and the GAN ≈32 h'.
  7. [§7.3] The statement in §7.3 that 'A full search with formal tuning was not feasible due to resource constraints' should be carried into the RQ3 discussion, since the model-type ranking under DP may reflect a mismatch in hyperparameter tuning across the three architectures.
  8. [§4, §5.1] The related-work section does not position the paper against earlier differentially private GAN training schemes, which typically apply DP noise to both the generator and the discriminator; a brief discussion would clarify why the authors deliberately leave the discriminator non-private and would contextualize the §5.1 claim.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the central results are empirical benchmarks; DP claims cite standard published theorems, and the only self-citations (evaluation framework, GeoLife preprocessing, LSTM-TrajGAN risk) are not load-bearing.

full rationale

The paper's claimed derivations are not equivalent to their inputs by construction. RQ1 and RQ3 are empirical comparisons of measured utility across configurations, and RQ2 is a new mechanism whose privacy Theorems 1-3 reduce to standard Laplace/Gaussian/VMF mechanisms plus subsampling amplification (Dwork-Roth, Balle-Wang, Balle-Barthe-Gaboardi, Weggenmann-Kerschbaum) rather than to the paper's own fitted values. The only overlapping-author citations — Buchholz et al. [6] for the evaluation framework and GeoLife preprocessing, and Faustini et al. [42] for the VMF Corollary — are independently published with code/proofs and are not used to define the current paper's predictions. No fitted parameter is renamed as a prediction, and no uniqueness claim is imported from the authors' prior work. I do flag two non-circular correctness concerns in the verdict: (i) Corollary 1 applies standard DP-SGD to the GAN although Section 5.1 trains only the generator with DP while the non-private discriminator shapes every generator update; Abadi et al. and Gopi et al. do not cover a hidden data-dependent state, so the GAN's formal guarantee is an omitted proof rather than a derivation from the cited theorems. (ii) Theorem 2's calibration sigma = alpha*2C/(sqrt(2)*epsilon) is not the Balle-Wang analytical Gaussian calibration as written. Neither concern makes a result identical to its input, so the circularity score remains minimal.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard DP-SGD and amplification theorems, plus one unsupported GAN-specific assumption about the non-private discriminator. The main free parameters are mechanism hyperparameters chosen by hand or by preliminary search rather than fitted to a target result. No new physical or mathematical entities are introduced.

free parameters (4)
  • Conditional embedding norm bound C_cond = 1.0
    Chosen by hand after observing that compression tends to fully use the available norm range; it sets the sensitivity and noise scale for the DP conditional mechanism (Section 5.2, step 4).
  • DP-SGD gradient clipping norm C_dp = 0.1
    Selected in a preliminary hyperparameter search; defines per-sample gradient sensitivity for DP-SGD and affects both noise and utility (Section 7.3).
  • Compressed conditional dimension d_out = 8
    Default dimension for the compressed conditional embedding; ablation tests d_out in {4, 8, 256} (Section 7.4.6).
  • GAN discriminator update ratio n_critic = 5 non-DP, 1 with DP-SGD
    Changed to stabilize training; it alters the number of generator updates and partially confounds the model-type comparison (Section 5.3).
assumptions (5)
  • standard math DP-SGD provides trajectory-level (epsilon_s, delta_s)-DP w.r.t. D_train under add-or-remove adjacency (Abadi et al., Gopi et al.).
    Invoked in Corollary 1 and used for all DP-SGD results; the paper does not re-derive DP-SGD.
  • standard math Uniform subsampling without replacement gives privacy amplification log(1 + (m/n)(e^epsilon - 1)) (Balle et al., Theorem 9).
    Used in Theorems 1-3 for the conditional-information mechanism.
  • domain assumption The compression function f_c has l_p sensitivity bounded by 2C after clipping or scaling, independent of the learned network parameters.
    Used in Definitions 2-4 and Theorems 1-3; true for any f_c because outputs are norm-bounded, but it assumes the network does not otherwise interact with the privacy mechanism.
  • ad hoc to paper A non-privately trained discriminator that is not released does not break the released generator's DP guarantee.
    Stated in Section 5.1 and implicitly used in Corollary 1; no proof is given and the claim is questionable, since the discriminator's parameters influence every generator update.
  • domain assumption Replace-one adjacency is approximately twice as strong as add-or-remove, so epsilon_c = 20 roughly matches epsilon_s = 10.
    Used in Section 6.3 to compare privacy budgets across the two adjacency relations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of What is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?." pith.science (2026). https://pith.science/paper/U7SVSIBE

@misc{pith2026250609312,
  author       = {Pith},
  title        = {Pith review of: What is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U7SVSIBE}},
  note         = {Machine review of arXiv:2506.09312}
}
read the original abstract

While location trajectories offer valuable insights, they also reveal sensitive personal information. Differential Privacy (DP) offers formal protection, but achieving a favourable utility-privacy trade-off remains challenging. Recent works explore deep learning-based generative models to produce synthetic trajectories. However, current models lack formal privacy guarantees and rely on conditional information derived from real data during generation. This work investigates the utility cost of enforcing DP in such models, addressing three research questions across two datasets and eleven utility metrics. (1) We evaluate how DP-SGD, the standard DP training method for deep learning, affects the utility of state-of-the-art generative models. (2) Since DP-SGD is limited to unconditional models, we propose a novel DP mechanism for conditional generation that provides formal guarantees and assess its impact on utility. (3) We analyse how model types - Diffusion, VAE, and GAN - affect the utility-privacy trade-off. Our results show that DP-SGD significantly impacts performance, although some utility remains if the datasets is sufficiently large. The proposed DP mechanism improves training stability, particularly when combined with DP-SGD, for unstable models such as GANs and on smaller datasets. Diffusion models yield the best utility without guarantees, but with DP-SGD, GANs perform best, indicating that the best non-private model is not necessarily optimal when targeting formal guarantees. In conclusion, DP trajectory generation remains a challenging task, and formal guarantees are currently only feasible with large datasets and in constrained use cases.

Figures

Figures reproduced from arXiv: 2506.09312 by the authors.

Figure 1
Figure 1. Research questions: How do (1) DP-SGD, (2) DP conditional [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. First, m samples from the dataset are selected uniformly at random. A neural network maps these samples to a lower-dimensional space dout. Optionally, the per-sample norm is clipped/scaled, and a DP mechanism is applied. Finally, the resulting encoding is decompressed. this risk, we introduce a novel DP conditional embedding mechanism that ensures privacy w.r.t. the cond. info. used during generation. It is illustra… view at source ↗
Figure 4
Figure 4. Example synthetic trajectories for Porto after [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: The bars depict the SWD for the Porto Taxi dataset. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: The bars depict the JSD for the Porto Taxi dataset. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: The bars depict the SWD ordered by threat model. [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 11
Figure 11. Figure 11: Ablation studies I and II with 95 % conf. Intervals over log-scale. ∞ indicates configurations without DP. We already discussed the different models in the context of DP-SGD in Section 7.4.1. UNetGAN achieves the best performance under DP-SGD on both datasets, followe…
Figure 12
Figure 12. Figure 12: Ablation Study III. Each group represents one of the three DP [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]
Figure 4
Figure 4. Figure 4: Still, the utility for this threat model [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 13
Figure 13. Figure 13: Example synthetic trajectories for GeoLife after [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 26 canonical work pages

  1. [26]

    Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising

    B. Balle and Y .-X. Wang, “Improving the Gaussian Mechanism for Differential Privacy: Analytical Cal- ibration and Optimal Denoising,” inProc. 35th Int. Conf. Mach. Learn., ser. Proceedings of Machine Learning Research, J. Dy and A. Krause, Eds., vol. 80. Stockholm, Sweden: PMLR, Jul. 2018, pp. 394–403. doi:10.48550/arXiv.1805.06530

    work page Pith review arXiv doi:10.48550/arxiv.1805.06530 2018

  2. [1]

    The Long Road to Computational Location Privacy: A Survey,

    V . Primault, A. Boutet, S. B. Mokhtar, and L. Brunie, “The Long Road to Computational Location Privacy: A Survey,”IEEE Commun. Surveys Tuts., vol. 21, no. 3, pp. 2772–2793, 2019. doi:10.1109/COMST.2018.2873950

    arXiv 2019

  3. [2]

    Unique in the Crowd: The Privacy Bounds of Human Mobility,

    Y .-A. de Montjoye, C. A. Hidalgo, M. Verleysen, and V . D. Blondel, “Unique in the Crowd: The Privacy Bounds of Human Mobility,”Sci. Rep., vol. 3, no. 1, pp. 1–5, Dec. 2013. doi:10.1038/srep01376

    doi:10.1038/srep01376 2013

  4. [3]

    Redditor Cracks Anonymous Data Trove to Pinpoint Muslim Cab Drivers,

    L. Franceschi-Bicchierai, “Redditor Cracks Anonymous Data Trove to Pinpoint Muslim Cab Drivers,”

    work page

  5. [4]

    Location Privacy-Preserving Mechanisms in Location- Based Services: A Comprehensive Survey,

    H. Jiang, J. Li, P. Zhao, F. Zeng, Z. Xiao, and A. Iyengar, “Location Privacy-Preserving Mechanisms in Location- Based Services: A Comprehensive Survey,”ACM Com- put. Surv., vol. 54, no. 1, pp. 4:1–4:36, Jan. 2021. doi:10.1145/3423165

    work page doi:10.1145/3423165 2021

  6. [5]

    An Overview of Proposals towards the Privacy-Preserving Publication of Trajec- tory Data,

    `A. Miranda-Pascual, P. Guerra-Balboa, J. Parra-Arnau, J. Forn ´e, and T. Strufe, “An Overview of Proposals towards the Privacy-Preserving Publication of Trajec- tory Data,”Int. J. Inf. Secur., vol. 23, Sep. 2024. doi:10.1007/s10207-024-00894-0

    work page doi:10.1007/s10207-024-00894-0 2024

  7. [6]

    SoK: Can Trajectory Generation Combine Privacy and Utility?

    E. Buchholz, A. Abuadbba, S. Wang, S. Nepal, and S. S. Kanhere, “SoK: Can Trajectory Generation Combine Privacy and Utility?”PoPETS, vol. 2024, no. 3, pp. 75–93, Jul. 2024. doi:10.56553/popets-2024-0068

    doi:10.56553/popets-2024-0068 2024

  8. [7]

    SoK: Differentially Private Publication of Trajectory Data,

    `A. Miranda-Pascual, P. Guerra-Balboa, J. Parra-Arnau, J. Forn ´e, and T. Strufe, “SoK: Differentially Private Publication of Trajectory Data,”Proc. Priv. Enhancing Technol. (PoPETs), vol. 2023, pp. 496–516, 2023. doi:10.56553/popets-2023-0065

    doi:10.56553/popets-2023-0065 2023

Show all 57 references
  1. [8]

    Reconstruction Attack on Differen- tial Private Trajectory Protection Mechanisms,

    E. Buchholz, A. Abuadbba, S. Wang, S. Nepal, and S. S. Kanhere, “Reconstruction Attack on Differen- tial Private Trajectory Protection Mechanisms,” in Proc. 38th Annu. Comput. Secur. Appl. Conf.New York, NY , USA: ACM, Dec. 2022, pp. 279–292. doi:10.1145/3564625.3564628

    2022

  2. [9]

    Structured Sparsity Model Based Trajectory Tracking Using Private Location Data Release,

    M. Shao, J. Li, Q. Yan, F. Chen, H. Huang, and X. Chen, “Structured Sparsity Model Based Trajectory Tracking Using Private Location Data Release,”IEEE Trans. Depend. Sec. Comput., vol. 18, no. 6, pp. 2983–2995,

  3. [10]

    Trajgans: Using Generative Adversarial Networks for Geo-Privacy Protection of Trajectory Data (Vision Paper),

    X. Liu, H. Z. Chen, and C. Andris, “Trajgans: Using Generative Adversarial Networks for Geo-Privacy Protection of Trajectory Data (Vision Paper),” in Workshop LoPaS. Melbourne, Australia: github.io, 2018, pp. 1–7. Available: https://ptal-io.github.io/ lopas2018/papers/LoPaS201...

    2018

  4. [11]

    DiffTraj: Generating GPS Trajectory with Diffusion Probabilistic Model,

    Y . Zhu, Y . Ye, S. Zhang, X. Zhao, and J. J. Q. Yu, “DiffTraj: Generating GPS Trajectory with Diffusion Probabilistic Model,” inAdv. Neural Inf. Process. Syst., ser. 1, vol. 23. New Orleans, USA: Curran Associates, Inc., 2023, p. 21. doi:10.5555/3666122.3668965

    2023

  5. [12]

    LSTM- TrajGAN: A Deep Learning Approach to Trajec- tory Privacy Protection,

    J. Rao, S. Gao, Y . Kang, and Q. Huang, “LSTM- TrajGAN: A Deep Learning Approach to Trajec- tory Privacy Protection,”Leibniz Int. Proc. In- form., vol. 177, no. GIScience, pp. 1–16, 2020. doi:10.4230/LIPIcs.GIScience.2021.I.12

    2020 doi

  6. [13]

    Generative Models for Synthetic Urban Mobility Data: A System- atic Literature Review,

    A. Kapp, J. Hansmeyer, and H. Mihaljevi ´c, “Generative Models for Synthetic Urban Mobility Data: A System- atic Literature Review,”ACM Comput. Surv., vol. 56, no. 4, pp. 1–37, Apr. 2024. doi:10.1145/3610224

    2024 doi

  7. [14]

    A Survey and Experimental Study on Privacy-Preserving Trajectory Data Publishing,

    F. Jin, W. Hua, M. Francia, P. Chao, M. Orlowska, and X. Zhou, “A Survey and Experimental Study on Privacy-Preserving Trajectory Data Publishing,” IEEE Trans. Knowl. Data Eng., vol. 35, no. 6, 2023. doi:10.1109/TKDE.2022.3174204

    2023

  8. [15]

    How to DP-fy ML: A Prac- tical Guide to Machine Learning with Differential Pri- vacy,

    N. Ponomareva, S. Vassilvitskii, Z. Xu, B. McMahan, A. Kurakin, and C. Zhang, “How to DP-fy ML: A Prac- tical Guide to Machine Learning with Differential Pri- vacy,” inProc. 29th ACM SIGKDD Conf. Knowl. Discov. Data Min., ser. Kdd ’23. New York, NY , USA: ACM, 2023, pp. 5823–5...

    2023

  9. [16]

    PrivTrace: Differentially Private Trajectory Synthesis by Adaptive Markov Models,

    H. Wang, Z. Zhang, T. Wang, S. He, M. Backes, J. Chen, and Y . Zhang, “PrivTrace: Differentially Private Trajectory Synthesis by Adaptive Markov Models,” in 32nd USENIX Security Symposium. Anaheim, CA, USA: USENIX Association, 2023, pp. 1649–1666. doi:10.48550/arXiv.2210.00581

    2023 doi arXiv

  10. [17]

    Diff-RNTraj: A Structure-Aware Diffusion Model for Road Network- Constrained Trajectory Generation,

    T. Wei, Y . Lin, S. Guo, Y . Lin, Y . Huang, C. Xiang, Y . Bai, and H. Wan, “Diff-RNTraj: A Structure-Aware Diffusion Model for Road Network- Constrained Trajectory Generation,”IEEE Trans. Knowl. Data Eng., vol. 36, no. 12, pp. 7940–7953, 2024. doi:10.1109/TKDE.2024.3460051

    2024

  11. [18]

    Map2Traj: Street Map Piloted Zero-Shot Trajectory Generation with Diffu- sion Model,

    Z. Tao, W. Xu, and X. You, “Map2Traj: Street Map Piloted Zero-Shot Trajectory Generation with Diffu- sion Model,”arXiv, no. arXiv:2407.19765, Jul. 2024. doi:10.48550/arXiv.2407.19765

    2024 doi arXiv

  12. [19]

    Porto Taxi - Taxi Service Trajectory - Prediction Challenge, ECML PKDD 2015,

    L. Moreira-Matias, M. Ferreira, J. Mendes-Moreira, L. L., and J. J., “Porto Taxi - Taxi Service Trajectory - Prediction Challenge, ECML PKDD 2015,” 2015. doi:10.24432/C55W25

    2015 doi

  13. [20]

    Mining Interesting Locations and Travel Sequences from GPS Trajectories,

    Y . Zheng, L. Zhang, X. Xie, and W.-Y . Ma, “Mining Interesting Locations and Travel Sequences from GPS Trajectories,” inProc. 18th Int. Conf. World Wide Web, ser. WWW ’09. New York, NY , USA: ACM, Apr. 2009, pp. 791–800. doi:10.1145/1526709.1526816

    2009

  14. [21]

    Protecting Trajectory from Semantic Attack Con- sidering K-Anonymity, l-Diversity, and t-Closeness,

    Z. Tu, K. Zhao, F. Xu, Y . Li, L. Su, and D. Jin, “Protecting Trajectory from Semantic Attack Con- sidering K-Anonymity, l-Diversity, and t-Closeness,” IEEE TNSM, vol. 16, no. 1, pp. 264–278, Mar. 2019. doi:10.1109/TNSM.2018.2877790

    2019

  15. [22]

    Rectification of Syn- tactic and Semantic Privacy Mechanisms,

    A. Majeed and S. O. Hwang, “Rectification of Syn- tactic and Semantic Privacy Mechanisms,”IEEE Se- curity Privacy, vol. 21, no. 5, pp. 18–32, Sep. 2023. doi:10.1109/MSEC.2022.3188365

    2023

  16. [23]

    The Algorithmic Founda- tions of Differential Privacy,

    C. Dwork and A. Roth, “The Algorithmic Founda- tions of Differential Privacy,”Found. Trends Theor. Comput. Sci., vol. 9, no. 3-4, pp. 211–407, 2013. doi:10.1561/0400000042

    2013 doi

  17. [24]

    Anonymizing Trajectory Data: Limitations and Opportunities,

    P. Guerra-Balboa, A. M. Pascual, J. Parra-Arnau, J. Forne, and T. Strufe, “Anonymizing Trajectory Data: Limitations and Opportunities,” inThird AAAI Workshop Priv.-Preserv. Artif. Intell. PPAI-22, vol. 28. Virtual: PPAI, 2022, p. 10. doi:10.5445/IR/1000148633

    2022

  18. [25]

    RAPPOR: Randomized Aggregatable Privacy-Preserving Ordi- nal Response,

    ´U. Erlingsson, V . Pihur, and A. Korolova, “RAPPOR: Randomized Aggregatable Privacy-Preserving Ordi- nal Response,” inProc. 2014 ACM SIGSAC CCS. New York, USA: ACM, Nov. 2014, pp. 1054–1067. doi:10.1145/2660267.2660348

    2014

  19. [27]

    Differential Pri- vacy for Directional Data,

    B. Weggenmann and F. Kerschbaum, “Differential Pri- vacy for Directional Data,” inProc. 2021 ACM SIGSAC CCS. Virtual Event Republic of Korea: ACM, Nov. 2021, pp. 1205–1222. doi:10.1145/3460120.3484734

    2021

  20. [28]

    Deep Generative Models for Synthetic Sequential Data: A Survey,

    P. Eigenschink, T. Reutterer, S. Vamosi, R. Va- mosi, C. Sun, and K. Kalcher, “Deep Generative Models for Synthetic Sequential Data: A Survey,” IEEE Access, vol. 11, pp. 47 304–47 320, 2023. doi:10.1109/ACCESS.2023.3275134

    2023

  21. [29]

    Autoen- coders,

    D. Bank, N. Koenigstein, and R. Giryes, “Autoen- coders,”arXiv, no. arXiv:2003.05991, Apr. 2021. doi:10.48550/arXiv.2003.05991

    2003 doi arXiv

  22. [30]

    Auto-Encoding Vari- ational Bayes,

    D. P. Kingma and M. Welling, “Auto-Encoding Vari- ational Bayes,”arXiv, no. arXiv:1312.6114, 2013. doi:10.48550/arXiv.1312.6114

    2013 doi arXiv

  23. [31]

    Generative Adversarial Networks,

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative Adversarial Networks,” Commun. ACM, vol. 63, no. 11, pp. 139–144, 2014. doi:10.1145/3422622

    2014 doi

  24. [32]

    Denoising Diffusion Probabilistic Models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising Diffusion Probabilistic Models,”arXiv, no. arXiv:2006.11239, Dec. 2020. doi:10.48550/arXiv.2006.11239

    2006 doi arXiv

  25. [33]

    U-Net: Convolutional Networks for Biomedical Image Seg- mentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-Net: Convolutional Networks for Biomedical Image Seg- mentation,”arXiv, no. arXiv:1505.04597, May 2015. doi:10.48550/arXiv.1505.04597

    2015 doi arXiv

  26. [34]

    Membership Inference Attacks against Machine Learn- ing Models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership Inference Attacks against Machine Learn- ing Models,” in2017 IEEE Symp. Secur. Priv. SP. San Jose, CA, USA: IEEE, May 2017, pp. 3–18. doi:10.1109/SP.2017.41

    2017 doi

  27. [35]

    Deep Learning with Differential Privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep Learning with Differential Privacy,” inProc. 2016 ACM SIGSAC CCS. New York, NY , USA: ACM, 2016, pp. 308–318. doi:10.1145/2976749.2978318

    2016

  28. [36]

    Attention Is All You Need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention Is All You Need,” arXiv, no. arXiv:1706.03762, Aug. 2023. doi:10.48550/arXiv.1706.03762

    2023 doi arXiv

  29. [37]

    Member- ship Inference Attacks against Diffusion Models,

    T. Matsumoto, T. Miura, and N. Yanai, “Member- ship Inference Attacks against Diffusion Models,” in2023 IEEE Secur. Priv. Workshop SPW. San Francisco, CA, USA: IEEE, May 2023, pp. 77–83. doi:10.1109/SPW59333.2023.00013

    2023

  30. [38]

    Syn- thetic Trajectory Generation through Convolutional Neural Networks,

    J. Merhi, E. Buchholz, and S. S. Kanhere, “Syn- thetic Trajectory Generation through Convolutional Neural Networks,” in2024 21st Annu. Int. Conf. Priv. Secur. Trust PST, ser. PST’24, vol. 21. Syd- ney, NSW, Australia: IEEE, Aug. 2024, pp. 1–12. doi:10.1109/PST62714.2024.10788061

    2024

  31. [39]

    Quantifying Location Privacy: The Case of Sporadic Location Exposure,

    R. Shokri, G. Theodorakopoulos, G. Danezis, J.-P. Hubaux, and J.-Y . Le Boudec, “Quantifying Location Privacy: The Case of Sporadic Location Exposure,” inLecture Notes in Computer Science. Berlin, Hei- delberg: Springer, 2011, vol. 6794 LNCS, pp. 57–76. doi:10.1007/978-3-642-22263-4 4

    2011 doi

  32. [40]

    Opacus: User-Friendly Differential Privacy Library in PyTorch,

    A. Yousefpouret al., “Opacus: User-Friendly Differential Privacy Library in PyTorch,” arXiv, no. arXiv:2109.12298, Sep. 2021. doi:10.48550/arXiv.2109.12298

    2021 doi arXiv

  33. [41]

    Numerical Composition of Differential Privacy,

    S. Gopi, Y . T. Lee, and L. Wutschitz, “Numerical Composition of Differential Privacy,” inAdv. Neural Inf. Process. Syst., M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. On- line: Curran Associates, Inc., 2021, pp. 11 631–11 642. doi:10.55...

    2021

  34. [42]

    Directional Privacy for Deep Learning,

    P. Faustini, N. Fernandes, S. Tonni, A. McIver, and M. Dras, “Directional Privacy for Deep Learning,”arXiv, no. arXiv:2211.04686, 2022. doi:10.48550/arXiv.2211.04686

    2022 doi arXiv

  35. [43]

    Diffusion Models Beat GANs on Image Synthesis,

    P. Dhariwal and A. Nichol, “Diffusion Models Beat GANs on Image Synthesis,” inAdv. Neural Inf. Pro- cess. Syst., M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. On- line: Curran Associates, Inc., 2021, pp. 8780–8794. doi:10.5555/3540261.3540933

    2021

  36. [44]

    High-Resolution Image Synthesis with Latent Diffusion Models,

    Robin Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-Resolution Image Synthesis with Latent Diffusion Models,” in2022 IEEECVF Conf. Comput. Vis. Pattern Recognit. CVPR. New Orleans, LA, USA: IEEE, Jun. 2022, pp. 10 674–10 685. doi:10.1109/CVPR52688.2022.01042

    2022

  37. [45]

    CompVis/Latent-Diffusion,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “CompVis/Latent-Diffusion,” CompVis LMU Munich, Sep. 2024. Available: https://github. com/CompVis/latent-diffusion (Accessed 2024-09-26)

    2024

  38. [46]

    On the Regularization of Wasserstein GANs,

    H. Petzka, A. Fischer, and D. Lukovnicov, “On the Regularization of Wasserstein GANs,” inInt. Conf. Learn. Represent., vol. 6. Vancouver, BC, Canada: ICLR, Mar. 2018, p. 24. doi:10.48550/arXiv.1709.08894

    2018 doi arXiv

  39. [47]

    Privacy Ampli- fication by Subsampling: Tight Analyses via Couplings and Divergences,

    B. Balle, G. Barthe, and M. Gaboardi, “Privacy Ampli- fication by Subsampling: Tight Analyses via Couplings and Divergences,” inAdv. Neural Inf. Process. Syst., S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, Eds., vol. 31. Mon- treal, QC, Ca...

    2018

  40. [48]

    The Hungarian Method for the Assign- ment Problem,

    H. W. Kuhn, “The Hungarian Method for the Assign- ment Problem,”Nav. Res. Logist. (NRL), vol. 52, no. 1, pp. 7–21, Feb. 2005. doi:10.1002/nav.20053

    2005 doi

  41. [49]

    The Cosine-Haversine Formula,

    C. C. Robusto, “The Cosine-Haversine Formula,” Am. Math. Mon., vol. 64, no. 1, pp. 38–40, 1957. doi:10.2307/2309088

    1957 doi

  42. [50]

    Differentially Private Trajectory Data Publi- cation,

    R. Chen, B. C. M. Fung, and B. C. De- sai, “Differentially Private Trajectory Data Publi- cation,”arXiv, no. arXiv:1112.2020, Dec. 2011. doi:10.48550/arXiv.1112.2020

    2020 doi arXiv

  43. [51]

    GeoPointGAN: Synthetic Spatial Data with Local Label Differential Privacy,

    T. Cunningham, K. Klemmer, H. Wen, and H. Fer- hatosmanoglu, “GeoPointGAN: Synthetic Spatial Data with Local Label Differential Privacy,” May 2022. doi:10.48550/arXiv.2205.08886

    2022 doi arXiv

  44. [52]

    Dynamic Time Warping,

    M. M ¨uller, “Dynamic Time Warping,” inInformation Retrieval for Music and Motion. Berlin, Heidelberg: Springer, 2007, pp. 69–84. doi:10.1007/978-3-540- 74048-3 4

    2007 doi

  45. [53]

    Synthesizing Realistic Trajectory Data with Differential Privacy,

    X. Sun, Q. Ye, H. Hu, Y . Wang, K. Huang, T. Wo, and J. Xu, “Synthesizing Realistic Trajectory Data with Differential Privacy,”IEEE Trans. Intell. Transp. Syst., vol. 24, no. 5, pp. 5502–5515, May 2023. doi:10.1109/TITS.2023.3241290

    2023

  46. [54]

    Wasser- stein Generative Adversarial Networks,

    M. Arjovsky, S. Chintala, and L. Bottou, “Wasser- stein Generative Adversarial Networks,” inProc. 34th Int. Conf. Mach. Learn., ser. Proceedings of Ma- chine Learning Research, D. Precup and Y . W. Teh, Eds., vol. 70. PMLR, Aug. 2017, pp. 214–223. doi:10.48550/arXiv.1701.07875

    2017 doi arXiv

  47. [55]

    The Privacy Loss Random Variable,

    Damien Desfontaines, “The Privacy Loss Random Variable,” Mar. 2020. Available: https://desfontain. es/blog/privacy-loss-random-variable.html (Accessed 2024-06-17). Appendix A. All Results In the following we provide detailed information on the used configurations (Table 1), th...

    2020

  48. [2015]

    Available: https://mashable.com/archive/redditor- muslim-cab-drivers (Accessed 2021-09-28)

    2021

  49. [2020]

    doi:10.1109/TDSC.2020.2972334

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.