Privacy by Projection: Federated Population Density Estimation by Projecting on Random Features

Abstract

We consider the problem of population density estimation based on location data crowdsourced from mobile devices, using kernel density estimation (KDE). In a conventional, centralized setting, KDE requires mobile users to upload their location data to a server, thus raising privacy concerns. Here, we propose a Federated KDE framework for estimating the user population density, which not only keeps location data on the devices but also provides probabilistic privacy guarantees against a malicious server that tries to infer users' location. Our approach Federated random Fourier feature (RFF) KDE leverages a random feature representation of the KDE solution, in which each user's information is irreversibly projected onto a small number of spatially delocalized basis functions, making precise localization impossible while still allowing population density estimation. We evaluate our method on both synthetic and real-world datasets, and we show that it achieves a better utility (estimation performance)-vs-privacy (distance between inferred and true locations) tradeoff, compared to state-of-the-art baselines (e.g., GeoInd). We also vary the number of basis functions per user, to further improve the privacy-utility trade-off, and we provide analytical bounds on localization as a function of areal unit size and kernel bandwidth.

Minimizing Noise in Location Privacy Protection Through Equipment Error Consideration

“…Federated learning of location information is also being researched [26][27]. For example, population modeling and population density can be estimated without the user having to send the true original data using the proposed method [27].…”

“…Federated learning of location information is also being researched [26][27]. For example, population modeling and population density can be estimated without the user having to send the true original data using the proposed method [27]. With federated learning, each device uses data to perform calculations and incorporates them into a machine learning model before sending the data to the server.…”

Acceptable Margin of Error: Quantifying Location Privacy in BLE Localization

“…In addition, the use of proximity-based authentication can also leak sensitive information about the users' locations and movements. Some studies have addressed the privacy concerns of BLE indoor positioning systems by proposing different obfuscation techniques or modifying the BLE protocol to enhance privacy [4], [5]. However, there is still a need for more research in this area, especially considering the increasing adoption of BLE indoor positioning systems in various domains, for instance, healthcare, retail, and smart buildings.…”