PRISMA: Differentially Private Synthetic In-Car Telemetry via Differentiable Simulation

1 Introduction

• Directly synthesizing high-resolution telemetry under DP is a poor fit because the privacy–utility trade-off degrades with the square root of released dimensions.Fine-grained speed, location, and auxiliary sensor data can reveal routines, home addresses, and behavioral patterns.Source: §1 · p. 1
• AIM synthesizes the descriptor table, and the same simulation decodes sampled synthetic descriptors into full traces as public post-processing without additional privacy budget.The decoding stage uses public inputs and the already private descriptor.Source: §1 · pp. 1–2
• PRISMA combines simulation-based dimensionality reduction with DP tabular synthesis, an approach not previously explored to the authors’ knowledge.Prior DP synthesis methods target tabular data [27] [34] [46] or time series [14] directly.Source: §1 · p. 2
• PRISMA fits each real trace to a compact descriptor using gradient-based optimization through a differentiable physics simulation.Descriptors contain trip endpoints, aggressiveness, detour factor, and a discrete vehicle choice.Source: §1 · pp. 1–2

2.1 Differential Privacy

• Differential privacy bounds the privacy loss of releasing statistics from sensitive data, with ε controlling privacy loss and δ denoting a failure probability.The work sets δ to 10−5 throughout; computation on a DP output without further access to sensitive data preserves the same privacy guarantee.Source: §2.1 · p. 2

2.2 Differentiable Programming

• Differentiable programming supports gradient-based fitting through simulations by replacing non-differentiable operations with smooth approximations.A differentiable simulation is a state-space model whose state-transition and output mappings are differentiable with respect to inputs and parameters.Source: §2.2 · pp. 2–3

3.1 Synthetic Time Series Generation

• Time-series synthesis includes recurrent and adversarial models, autoencoder-based TimeGAN and TimeVAE, and more recent diffusion and flow-matching approaches.DoppelGANger models static attributes alongside time-varying signals.Source: §3.1 · p. 3
• DP synthesis includes query-based methods such as AIM [27] and model-based methods including DP-SGD and PATE approaches; DP time-series models apply DP-SGD to recurrent and GAN generators [14].Query-based methods commonly use marginal queries to represent attribute distributions.Source: §3.1 · p. 3

3.2 Simulation-Based Approaches for Driver and Vehicle Modeling

• PRISMA uses differentiable simulation to fit compact trip descriptors and reconstruct traces, combining physics-based dimensionality reduction with DP tabular synthesis.The authors state that this combination had not previously been explored to their knowledge; prior vehicular privacy work focused largely on location privacy and GPS trajectory anonymization.Source: §3.2 · p. 3

4 PRISMA

• PRISMA encodes real traces into low-dimensional descriptors, synthesizes them with AIM under differential privacy, then decodes full trajectories without additional privacy budget.The decoder uses the post-processing property of differential privacy.Source: §4 · p. 3, Figure 2 · p. 4

4.1 Public Parameters

• Public parameters include road-network routes, elevation-derived slopes, and a discrete pool of candidate vehicles, which constrain the simulation to realistic values and are not protected because they contain no sensitive trip information.The road network supplies road segments, lengths, and speed limits; the vehicle pool is derived from EPA’s fuel economy database [35].Source: §4.1 · p. 4

4.2 Latent Representation

• Each trip’s seven-field latent descriptor combines start and end coordinates with aggressiveness, detour factor, and a vehicle selected from a public candidate pool.The descriptor table uses fixed public discretization grids chosen before the data are read.Source: §4.2 · p. 4

4.3 Forward Simulation Model

• The forward simulation routes trips over public roads and uses a differentiable driver model and vehicle physics to produce power trajectories from trip descriptors and public parameters.The driver controller follows speed limits within acceleration and deceleration limits; aggressiveness and detour factor affect its behavior, and the model is differentiable in both.Source: §4.3 · pp. 5–6

4.4 Encoding

• Encoding fixes trip endpoints and optimizes aggressiveness, detour factor, and vehicle choice to fit each observed trace, minimizing a loss over energy, duration, and power-shape residuals.The shape residual uses the power trace’s cumulative distribution function, and the simulator’s differentiability enables gradient-based fitting.Source: §4.4 · pp. 6–7

4.5 Data Synthesis in the Representation Space (AIM)

• AIM synthesizes the representation-space data through private query selection, measurement, and generation, with initialization from private one-way marginals and workload-aware candidate scoring.Its quality score balances expected L1 error improvement and workload relevance while penalizing high-dimensional marginals with low signal-to-noise ratios.Source: §4.5 · pp. 7–8
• AIM is hyperparameter-free: it checks information gain and adjusts the next round’s privacy budget and noise when the gain is small.This allows more rounds under larger privacy budgets and fewer under tight budgets.Source: §4.5 · p. 8
• AIM satisfies ρ-zCDP, accounts for one exponential-mechanism selection and one Gaussian measurement per round, and stops when its cumulative privacy budget is exhausted.A zCDP privacy filter monitors cumulative privacy loss.Source: §4.5 · p. 8

4.6 Decoding

• Decoding reruns the forward model using each representation’s endpoints and aggressiveness, with vehicle choice resolved by hard lookup.It reads no real telemetry; its inputs are the descriptor and public road, vehicle-catalogue, and terrain/elevation data, so the decoded trace inherits the descriptor’s DP guarantee unchanged.Source: §4.6 · p. 8

• eVED is a public, real-world collection of vehicle energy-consumption traces gathered from a variety of vehicles.Source: §5 · p. 8
• Each trip’s ground-truth data uses its power-consumption time series and GPS coordinates for the trip’s start and end points.Source: §5 · p. 8
• The time series comprises regularly spaced measurements of energy consumed during a trip.Source: §5 · p. 8

6 Experimental Setup

• The encoder is fit on 10,000 traces, with 2,000 trips held out for testing; PRISMA’s AIM synthesis uses ε = 0.5.Source: §6 · p. 8

6.1 Metrics

• Evaluation compares 2,000 held-out traces with 2,000 synthetic samples per model, using Fréchet distance, autocorrelation distance, precision, and recall.Source: §6.1 · pp. 8–9
• Fréchet distance compares Gaussian fits to real and synthetic traces in raw trace space, normalized by the real population’s squared robust amplitude scale.Source: §6.1 · p. 8
• Autocorrelation distance is the mean absolute deviation between population-average ACF curves, isolating temporal dependence from amplitude differences.Source: §6.1 · pp. 8–9
• Precision measures the share of synthetic traces inside real-data nearest-neighbor balls, while recall measures the share of real traces inside synthetic-data balls.Both use k = 3; recall measures whether generated samples reach the real distribution’s modes.Source: §6.1 · p. 9
• FID and ACF distance are also reported relative to a real-versus-real null floor averaged over 15 random half-splits.Source: §6.1 · p. 9

6.2 Baseline Models

• The comparison includes eight baseline models, with DP variants retaining their corresponding non-private architectures and generation procedures but changing the training procedure.Source: §6.2 · p. 9
• B0 releases the mean power-consumption curve without noise and applies DP to a per-ride energy-scaling factor; four diffusion- or flow-based models generate power trajectories.B0 is a deliberately simple utility floor; the evaluated diffusion- or flow-based models use iterative denoising or numerical integration.Source: §6.2 · p. 9

7.1 Fidelity under Privacy

• At ε = 0.5, PRISMA’s FID is unchanged within noise (0.96×), while FLOW MATCHING degrades 3.1× and DDPM 638×, making PRISMA the most faithful model.Table 2 compares each model’s non-DP and ε = 0.5 conditions.Source: §7.1 · p. 10, Table 2 · p. 11
• PRISMA achieves the highest recall in both conditions and remains unchanged under privacy (0.999), while FLOW MATCHING, CSDI, and DIFFWAVE lose coverage.DDPM is an exception: recall rises to 0.996 as its FID worsens by 638×.Source: §7.1 · p. 10

7.2 Ablation Studies

• Without AIM, PRISMA’s ACF distance is 12.72× the real-vs-real floor versus 15.88× for the full pipeline; its FID is 1.99× versus 1.92×.The ablation attributes most FID loss to the encoder and decoder, with little measurable impact from AIM.Source: §7.2 · p. 10
• Without fitting, PRISMA’s ACF distance rises to 25.27× the floor and FID to 2.27×, compared with 15.88× and 1.92× for the full pipeline.The authors conclude that fitting the representation is essential for preserving fidelity.Source: §7.2 · p. 10

7.3 Distributional Structure

• At ε = 0.5, t-SNE contours show PRISMA preserves real-data structure better than most models, while endpoint heatmaps indicate preserved spatial distribution.The authors say these visual patterns are consistent with Table 2’s finding that PRISMA achieves better fidelity under privacy.Source: §7.3 · p. 11

7.4 Limitations

• PRISMA’s three fitted quantities—aggressiveness, detour, and vehicle—reduce the representation’s dimensionality but leave weather, auxiliary loads, and fine-grained driving behavior unrecoverable.The decoder cannot recover these omitted variations regardless of the privacy budget.Source: §7.4 · p. 11
• Reconstruction fidelity depends on public road-network, elevation, and EPA vehicle-catalog coverage; poorly represented vehicles or routes unlike the public router’s may be difficult to reconstruct faithfully.This can hold even when the underlying descriptor is accurately estimated.Source: §7.4 · pp. 11–12
• Evaluation on a dataset with specific geographic and temporal scope may limit generality where road topology, vehicle composition, driving behavior, or environmental conditions differ from eVED.Source: §7.4 · p. 12

8 Conclusion

• PRISMA fits compact, physically interpretable trip descriptors, applies AIM to that low-dimensional representation, and reconstructs telemetry through privacy-free post-processing.The design avoids applying differential privacy directly to high-dimensional time series, mitigating the associated dimensionality penalty.Source: §8 · p. 12
• At ε = 0.5, PRISMA retains the best fidelity of any evaluated model, essentially unchanged from the non-private setting.All other models degrade substantially under privacy; DDPM loses more than 600× in Fréchet distance.Source: §8 · pp. 12–13, Figure 5 · p. 13

Ethical Considerations

• The framework provides formal (ε,δ)-differential privacy guarantees bounding privacy loss for any individual driver contributing to released statistics.Source: Ethical Considerations · p. 13
• The evaluation uses the public, anonymized eVED dataset, which has no direct personal identifiers; the authors state this secondary analysis does not require IRB approval.Source: Ethical Considerations · p. 13

Open Science

• PRISMA’s source code, including its differentiable simulations, privacy mechanism, and optimization loop, will be made publicly available upon acceptance.Source: Open Science · p. 13