Road-network trajectory synthesis improves privacy and data utility
Risk-aware Road-network Trajectory Synthesis under Local Differential Privacy
Cryptography and SecurityDatabases
Summary
Sharing travel routes can help improve services but also risks revealing private details, especially about sensitive locations or choices. The authors created TrajRACE, a method that masks parts of people's travel paths depending on how risky those parts are, keeping more secretive steps safer. This way, organizations can get useful patterns about how people move without seeing exact routes or risky local choices. Their tests show TrajRACE makes synthetic routes that better protect privacy while still being useful for analysis.
What this means in practice
- •For urban planners: Generate synthetic road-network travel data that protects sensitive movement decisions while supporting large-scale traffic and mobility analysis.
- •For location-based service developers: Create privacy-preserving synthetic user trajectory data to test and improve navigation or route recommendation features without exposing real user paths.
Authors
Hongzhen Xiang, Chenxu Wang, Yumeng Song, Tao Qin, Yushuai Li, Pinghui Wang, Wei Wang
Abstract
Road-network trajectory synthesis under local differential privacy (LDP) enables mobility data analysis without uploading raw trajectories to an untrusted server. Existing locally private trajectory synthesis methods mainly model whole trajectories, point sequences, or grid-level mobility patterns. However, they cannot handle non-uniform privacy risks caused by local road-network and trajectory contexts, such as endpoints, long-stay-associated regions, and low-out-degree branches. They also do not directly protect conditional next-hop choices on road networks, where a user's selected successor may reveal sensitive local movement intentions. To address these challenges, we propose TrajRACE, a locally private synthesis framework for road-network trajectories. TrajRACE uses start, segment-count, and transition reports to represent trajectories. For each transition, it keeps the current road segment as a public aggregation context and perturbs the true successor among legal successors on the client side. It then assigns risk-aware protection strengths to transitions according to local road-network and trajectory contexts. Finally, the server recovers population-level start, segment-count, and conditional transition statistics from heterogeneous privatized reports, and generates synthetic trajectories that follow the public road-network topology. Experiments on three road-network trajectory datasets demonstrate the effectiveness of TrajRACE in improving synthetic-data utility across distributional, query-based, and pattern-level metrics, while providing stronger protection for high-risk local transitions.