Privacy-Preserving Release of Spatio-Temporal Density

Abstract

In today's digital society, increasing amounts of contextually rich spatiotemporal information are collected and used, e.g., for knowledge-based decision making, research purposes, optimizing operational phases of city management, planning infrastructure networks, or developing timetables for public transportation with an increasingly autonomous vehicle fleet. At the same time, however, publishing or sharing spatio-temporal data, even in aggregated form, is not always viable owing to the danger of violating individuals' privacy, along with the related legal and ethical repercussions. In this chapter, we review some fundamental approaches for anonymizing and releasing spatio-temporal density, i.e., the number of individuals visiting a given set of locations as a function of time. These approaches follow different privacy models providing different privacy guarantees as well as accuracy of the released anonymized data. We demonstrate some sanitization (anonymization) techniques with provable privacy guarantees by releasing the spatio-temporal density of Paris, in France. We conclude that, in order to achieve meaningful accuracy, the sanitization process has to be carefully customized to the application and public characteristics of the spatio-temporal data.

Knock Knock, Who's There? Membership Inference on Aggregate Location Data

“…Then, rather than DFT, it uses the Discrete Cosine Transform (DCT) and employs Gaussian noise instead of Laplacian to achieve better accuracy. As a result, EFPAG guarantees ( , δ)-DP [1].…”

“…Enhanced Fourier Perturbation Algorithm with Gaussian Noise (EFPAG): EFPAG [1] improves FPA by choosing the number of coefficients (κ) to be perturbed probabilistically, and using the exponential mechanism to assign larger probability to values that minimize the root-sum-squared error between the input time-series and its noisy version. Then, rather than DFT, it uses the Discrete Cosine Transform (DCT) and employs Gaussian noise instead of Laplacian to achieve better accuracy.…”

“…where γ is a sanity bound mitigating the effect of very small counts. Following previous work [1], we set γ to 0.1% of n i=1 Y i . We compute the MRE over the aggregate time-series for all ROIs (s ∈ S) in our datasets and report the mean value.…”

What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy

“…where β is a sanity bound mitigating the effects of very small counts. As done in previous work [2], we use MRE to measure the utility loss when a privacy mechanism is applied to an aggregate time-series, and we adjust β to 0.1% of n i=0 Y i .…”

“…Therefore, a common approach is to consider aggregation as a privacy defense, and, by using appropriate cryptographic protocols, the aggregation can take place in a privacy-preserving way, i.e., removing the need for a trusted aggregator [24,36,37]. Moreover, Differential Privacy (DP) [13] can be used to bound the privacy leakage from releasing aggregate statistics [2,21], using output [8,14,39] or input [17,38] perturbation. However, there is no sound method to reason about the privacy lost by single individuals from the release of raw aggregate time-series.…”