PaperlayerView exact revision on arXiv

Source-linked AI summary

Trajectory Recovery From Ash: User Privacy Is NOT Preserved in Aggregated Mobility Data

Fengli Xu, Zhen Tu, Yong Li, Pengyu Zhang, Xiaoming Fu, Depeng Jin

arXiv:1702.06270v2cs.CYcs.CR

TL;DR

Aggregated mobility statistics are intended to protect privacy, but regular and user-specific mobility patterns leave trajectories recoverable. The paper develops an unsupervised attack without prior knowledge and evaluates it on two real-world datasets. It recovers 73%∼91% of trajectories and identifies severe privacy leakage in aggregated mobility data.

  • Problem

    Aggregated mobility data is believed to preserve privacy, but whether individual trajectories can be inferred from such statistics remains insufficiently understood.

  • Method

    An unsupervised framework exploits nighttime, daytime, and cross-day mobility characteristics to recover individual trajectories without prior knowledge.

  • Results

    73%∼91% of user trajectories are correctly recovered across two real-world datasets, including a cellular dataset with tens of thousands to hundreds of thousands of users.

  • Takeaways & Limitations

    Aggregating mobility traces does not provide much privacy preservation, and recovered trajectories may be linkable to victims using external information such as frequent locations.

  • Takeaways & Limitations

    The study uses anonymized data stored on a secure local server accessible only to core researchers under nondisclosure agreements.

Abstract

from arXiv · show

Human mobility data has been ubiquitously collected through cellular networks and mobile applications, and publicly released for academic research and commercial purposes for the last decade. Since releasing individual's mobility records usually gives rise to privacy issues, datasets owners tend to only publish aggregated mobility data, such as the number of users covered by a cellular tower at a specific timestamp, which is believed to be sufficient for preserving users' privacy. However, in this paper, we argue and prove that even publishing aggregated mobility data could lead to privacy breach in individuals' trajectories. We develop an attack system that is able to exploit the uniqueness and regularity of human mobility to recover individual's trajectories from the aggregated mobility data without any prior knowledge. By conducting experiments on two real-world datasets collected from both mobile application and cellular network, we reveal that the attack system is able to recover users' trajectories with accuracy about 73%~91% at the scale of tens of thousands to hundreds of thousands users, which indicates severe privacy leakage in such datasets. Through the investigation on aggregated mobility data, our work recognizes a novel privacy problem in publishing statistic data, which appeals for immediate attentions from both academy and industry.

1. INTRODUCTION

Aggregated mobility data is intended to preserve privacy, but human mobility’s regularity and uniqueness enable trajectory recovery. The proposed attack recovers trajectories without prior knowledge and exposes substantial privacy leakage.

  • 1. INTRODUCTION: Aggregated releases conceal individual identities but retain time- and location-based population statistics used in research and commercial applications.Examples include tower-level user counts and regional population density.
  • 1. INTRODUCTION: Human mobility is both coherent over time and significantly different across users, making masked records linkable into individual trajectories.These properties support prediction within a user’s trajectory and distinction between users.
  • 1. INTRODUCTION: The attack estimates next locations and associates records by likelihood, using nighttime regularity and daytime continuity to reconstruct daily trajectories.The framework also exploits cross-day trajectory regularity.
  • 1. INTRODUCTION: 73%∼91% of user trajectories are correctly recovered in a cellular-network dataset spanning tens of thousands to hundreds of thousands of users.The study uses two large-scale datasets collected from mobile applications and cellular networks.
  • 1. INTRODUCTION: Spatial and temporal resolution have little impact on privacy preservation, while the attack remains effective at large scale.The authors characterize the resulting privacy problem as robust, severe, and universal across aggregated mobility datasets.

2. MOTIVATION

Aggregated mobility data replaced anonymized individual records after quasi-identifiers enabled re-identification. The paper formalizes trajectory recovery from published statistics as an unsupervised attack without prior dataset knowledge.

  • 2. MOTIVATION: Operators shifted from anonymized individual mobility records to aggregated statistics after mobility patterns were shown to form quasi-identifiers.Earlier attacks could combine mobility records with small amounts of external information.
  • 2. MOTIVATION: Aggregated mobility data groups records by time slot and publishes statistics such as the number of users covered by each base station.This model directly releases population-level information rather than individual trajectories.
  • 2. MOTIVATION: Because aggregated data contains no directly distinguishable individual information, providers believe it satisfies k-anonymity while retaining accurate statistics.The stated model prevents direct extraction of personal information and preserves record-level truthfulness.
  • 2. MOTIVATION: The attack model assumes no prior information about the target dataset and uses an unsupervised method to recover individual trajectories from aggregated data.Recovered trajectories can then threaten privacy through established re-identification and probability attacks.

3. DATASET AND FESIBILITY

The study evaluates aggregated-mobility privacy using two Chinese-city datasets and ground-truth trajectories. Their records reveal regular movement concentrated in a few towers and strong cross-user uniqueness.

  • 3. DATASET AND FESIBILITY: The application dataset traces over 15,000 users for November 1–14, 2015, recording anonymized identities, base stations, and timestamps.It contains fine-grained spatiotemporal points collected when the application was activated.
  • 3. DATASET AND FESIBILITY: The cellular-operator dataset contains 100,000 users over April 1–7, 2016, with access records from calls, texts, or data use.Each record includes anonymous identification, accessed base station, and timestamp.
  • 3. DATASET AND FESIBILITY: Both datasets come from a major Chinese city with over 8,000 base stations, whose locations provide ground-truth user trajectories.The datasets differ in user counts and average records per user, covering varied release scenarios.
  • 3. DATASET AND FESIBILITY: 36% of operator-dataset records occur in users’ top tower, while the top five towers cover 83% of records on average.In the application dataset, the top one tower covers 76% of records and users almost always remain within their top five towers.
  • 3. DATASET AND FESIBILITY: Above 95% of operator-dataset users are unique when identified by their Top-5 towers.Top-K, random-K, and consecutive-K spatiotemporal selections quantify how few records can distinguish users.

4. MOBILITY TRAJECTORY RECOVERY

The framework recovers individual trajectories from aggregated mobility data by iteratively estimating likely next locations and optimally associating records across nighttime, daytime, and different days. It uses mobility regularity, nighttime location stability, daytime continuity, and cross-day similarity to build these associations.

  • Framework overview: The attack framework recovers trajectories by associating ID-removed mobility records across neighboring time slots using estimated likelihoods and optimal matching.Each step estimates whether a next record belongs to a trajectory, then links records to maximize overall likelihood.
  • Nighttime trajectory recovery: 62% of operator-dataset users and 88% of application-dataset users visit only one base station during nighttime.Nighttime stability supplies the basis for initiating trajectory recovery.
  • Nighttime trajectory recovery: The nighttime cost matrix uses each recovered trajectory’s last visited location as its estimated next location and minimizes distance to the actual next location.The Hungarian algorithm then finds the optimal association between recovered trajectories and next location points.
  • Daytime trajectory recovery: Daytime recovery estimates the next location from the current location and velocity, then associates unassigned points by minimizing estimation error.This exploits the continuity of human mobility during daytime.
  • Daytime trajectory recovery: 74% of operator-dataset predictions have errors below 1,000 meters, while 93% of application-dataset predictions have errors below 500 meters.These prediction errors support using distance to formulate the daytime association cost matrix.
  • Cross-day trajectory recovery: Across days, the framework matches sub-trajectories with the highest similarity to recover each mobile user’s whole trajectory.The matching uses information gain from combining sub-trajectories; same-user pairs have close-to-zero values, unlike different-user pairs.

5. PERFORMANCE EVALUATION

The evaluation measures privacy leakage through trajectory recovery accuracy, recovery error, and uniqueness. Across two datasets, the attack recovers trajectories accurately, with small deviations and high re-identification potential; coarser spatial resolution reduces linkage potential, while larger datasets still permit substantial recovery.

  • Metrics: The evaluation measures attack performance using accuracy, recovery error, and uniqueness after pairing recovered trajectories with similar ground-truth trajectories.Uniqueness captures the percentage of recovered trajectories distinguishable by their most frequent k locations, especially home and work locations.
  • Attack Performance: 21% of operator-dataset points and 8% of application-dataset points have recovery error above 1,000 meters, while over 95% of recovered trajectories are uniquely distinguished using their Top-2 locations.The reported error distributions indicate small deviations overall, and Top-2 locations provide strong distinction across recovered trajectories.
  • Impact of Factors: Linking mobile users to recovered trajectories decreases as spatial resolution becomes coarser, likely because coarse-grained mobility is more predictable but less unique.The experiment aggregates points from base-station sectors to administration districts before evaluating the attack.
  • Impact of Factors: The study varies temporal resolution across 30, 90, and 180 minutes to evaluate its effect on attack performance.Figure 10 reports results for the three successive recovery steps at each temporal resolution.
  • Impact of Factors: Recovery accuracy remains substantial as dataset scale increases: it is around 0.99 for 1,000 users and around 50% for 100,000 users.Uniqueness decreases with scale using Top-1 locations but remains above 85% across scales when Top-2 or Top-3 locations are available.

6. DISCUSSION

The discussion considers generalization and perturbation as ways to mitigate privacy risks in aggregated mobility data. It also argues that regularity within individuals’ records and uniqueness across individuals may make similar privacy breaches possible in other statistical data.

  • 6.1 Potential Mitigation Solutions: Generalization reduces spatiotemporal resolution and can lower recovered-trajectory uniqueness, making victim linkage harder while also reducing location sensitivity.The paper identifies generalization as a valid privacy-preserving scheme for releasing aggregated mobility data.
  • 6.1 Potential Mitigation Solutions: Perturbation adds noise to mobility data, with the proposed design goal of disrupting the regular mobility behaviors exploited by the attack.One example adds noise at users’ most frequent locations to make trajectories less regular.
  • 6.2 Privacy Problem in General Statistic Data: The paper identifies regularity within an individual’s records and uniqueness across individuals as features that facilitate inference from statistical data.It notes that these features also occur in credit-card records, mobile-application usage, and web-browsing traces.
  • 6.2 Privacy Problem in General Statistic Data: The authors characterize privacy leakage in statistical data as potentially severe and universal, while calling for evaluation across scenarios and development of a generic privacy model.This conclusion extends the paper’s mobility-data finding to statistical data with similar regularity and uniqueness features.

7. RELATED WORK

Prior work documented the regularity and uniqueness of human mobility and addressed privacy risks in anonymized and aggregated datasets. This paper applies those mobility properties to recover trajectories from aggregated mobility data, extending privacy analysis beyond membership protection.

  • Human mobility exhibits high temporal and spatial regularity, making individual movement patterns potentially predictable.
  • This paper uses human mobility laws to investigate trajectory recovery from aggregated mobility datasets.
  • Prior studies showed that anonymized mobility records can enable re-identification from spatial or spatiotemporal information.
  • Earlier aggregated-statistics research primarily protected whether an individual mobility record belonged to a dataset, rather than whether trajectories could be inferred.

8. CONCLUSION

The paper identifies and evaluates trajectory-recovery risks in aggregated mobility data. Experiments show serious privacy leakage and indicate that dataset resolution and scale affect the extent of privacy breach.

  • The study identifies trajectory recovery from aggregated mobility data as a privacy problem distinct from previously considered risks.
  • Spatiotemporal resolution and dataset scale have notable effects on privacy breach.
Loading 1702.06270v2…