A Correlation-Based Local Differential Privacy Scheme Design for Trajectory Data Collection

With the rapid development of big data technology, the issue of preserving personal privacy has attracted more and more attention. It has been shown that protecting the published graph with the differential privacy can ensure not only the quantitative privacy, but also the data usability. In this paper, we first put forward an optimized randomized response algorithm for generating synthetic graph, which dose not depend on a trusted third party in charge of collecting data. Furthermore, based on multi-party computation clustering, we propose a generated graph model under local differential privacy (LDPGM). The experiment indicates that LDPGM can effectively control the density of the synthetic graph so that significantly reduce the error between the synthetic graph and the original graph. Therefore, it maintains the properties of the original graph well and ensures high usability.

The spatial density distribution collected and aggregated from users’ trajectory data is vital for location-based services like regional popularity analysis and congestion measurement. However, spatial density aggregation poses privacy concerns since trajectory data usually originate from users. Local differential privacy (LDP) addresses these concerns by allowing users to perturb their data before reporting it. Yet, LDP is vulnerable to poisoning attacks where attackers manipulate data from malicious users. Recent studies attempt to defend against such attacks in LDP-enabled frequency estimation but suffer from inaccurate data recovery due to empirical presets of malicious user proportions and inaccurate malicious data estimation. These issues worsen in spatial density aggregation, as high-dimensional trajectory data help conceal malicious information. In this work, we propose GeoRecover, a method to defend against poisoning attacks in LDP-enabled spatial density aggregation by addressing previous limitations. GeoRecover designs an adaptive model to unify these attacks. Under this model, GeoRecover estimates the proportion of malicious users using statistical differences between genuine and malicious data and learns malicious data statistics through LDP properties. This allows GeoRecover to recover accurate spatial density distribution by subtracting malicious users’ contributions. Evaluations on two real-world datasets show GeoRecover outperforms state-of-the-art methods in recovery accuracy, defense capability, and practical performance.

Differential privacy has emerged as a gold standard in privacy-preserving data analysis. A popular variant is local differential privacy, where the data holder is the trusted curator. A major barrier, however, towards a wider adoption of this model is that it offers a poor privacy-utility trade-off. In this work, we address this problem by introducing a new variant of local privacy called profile-based privacy. The central idea is that the problem setting comes with a graph G of data generating distributions, whose edges encode sensitive pairs of distributions that should be made indistinguishable. This provides higher utility because unlike local differential privacy, we no longer need to make every pair of private values in the domain indistinguishable, and instead only protect the identity of the underlying distribution. We establish privacy properties of the profile-based privacy definition, such as post-processing invariance and graceful composition. Finally, we provide mechanisms that are private in this framework, and show via simulations that they achieve higher utility than the corresponding local differential privacy mechanisms.

Trajectory data collection is a common task with many applications in our daily lives. Analyzing trajectory data enables service providers to enhance their services, which ultimately benefits users. However, directly collecting trajectory data may give rise to privacy-related issues that cannot be ignored. Local differential privacy (LDP), as the de facto privacy protection standard in a decentralized setting, enables users to perturb their trajectories locally and provides a provable privacy guarantee. Existing approaches to private trajectory data collection in a local setting typically use relaxed versions of LDP, which cannot provide a strict privacy guarantee, or require some external knowledge that is impractical to obtain and update in a timely manner. To tackle these problems, we propose a novel trajectory perturbation mechanism that relies solely on an underlying location set and satisfies pure ε-LDP to provide a stringent privacy guarantee. In the proposed mechanism, each point's adjacent direction information in the trajectory is used in its perturbation process. Such information serves as an effective clue to connect neighboring points and can be used to restrict the possible region of a perturbed point in order to enhance utility. To the best of our knowledge, our study is the first to use direction information for trajectory perturbation under LDP. Furthermore, based on this mechanism, we present an anchor-based method that adaptively restricts the region of each perturbed trajectory, thereby significantly boosting performance without violating the privacy constraint. Extensive experiments on both real-world and synthetic datasets demonstrate the effectiveness of the proposed mechanisms.

In the rapid development of Internet technology, the application of various new technologies has become more and more extensive. Among them, the development of big data technology and cloud computing technology is very rapid, and these technologies are of great help to improving the efficiency of data storage and management. However, the data system itself has certain data security problems in the big data cloud computing environment. In order to improve people's information security in the process of data processing and integration, we need to study data security protection technology in the big data cloud computing environment. Only in this way can we solve data and information security issues based on specific conditions and improve the reliability and security of data transmission.

Local Differential Privacy (LDP) has been widely recognized as a powerful tool for providing a strong theoretical guarantee of data privacy to data contributors against an untrusted data collector. Under a typical LDP scheme, each data contributor independently randomly perturbs their data before submitting them to the data collector, which in turn infers valuable statistics about the original data from received perturbed data. Common to existing LDP mechanisms is an inherent trade-off between the level of privacy protection and data utility in the sense that strong data privacy often comes at the cost of reduced data utility. Frequency estimation based on Randomized Response (RR) is a fundamental building block of many LDP mechanisms. In this paper, we propose a novel Joint Randomized Response (JRR) mechanism based on correlated data perturbations to achieve locally differentially private frequency estimation. JRR divides data contributors into disjoint groups of two members and lets those in the same group jointly perturb their binary data to improve frequency-estimation accuracy and achieve the same level of data privacy by hiding the group membership information in contrast to the classical RR mechanism. Theoretical analysis and detailed simulation studies using both real and synthetic datasets show that JRR achieves the same level of data privacy as the classical RR mechanism while improving the frequency-estimation accuracy in the overwhelming majority of the cases by up to two orders of magnitude.

In this paper, we propose a new class of local differential privacy (LDP) schemes based on combinatorial block designs for a discrete distribution estimation. This class not only recovers many known LDP schemes in a unified framework of combinatorial block design, but also suggests a novel way of finding new schemes achieving the optimal (or near-optimal) privacy-utility trade-off with lower communication costs. Indeed, we find many new LDP schemes that achieve both the optimal privacy-utility trade-off and the minimum communication cost among all the unbiased schemes for a certain set of input data size and LDP constraint. Furthermore, to partially solve the sparse existence issue of block design schemes, we consider a broader class of LDP schemes based on regular and pairwise-balanced designs, called RPBD schemes, which relax one of the symmetry requirements on block designs. By considering this broader class of RPBD schemes, we can find LDP schemes achieving near-optimal privacy-utility trade-off with reasonably low communication costs for a much larger set of input data size and LDP constraint.

Federated analytics (FA) over spatial data with local differential privacy (LDP) has attracted considerable research attention recently. Existing solutions for this problem mostly employ a uniform grid (UG) structure, which recursively decomposes the whole spatial domain into fine‐grained regions in the distributed setting. In each round, the sampled clients perturb their locations using a random response mechanism with a fixed probability. This approach, however, cannot encode the client’s location effectively and will lead to ill‐suited query results. To address the deficiency of existing solutions, we propose LDP‐FSRQ, a spatial range query algorithm that relies on a hybrid spatial structure composed of the UG and quad‐tree with nonuniform perturbation (NUP) probability to encode and perturb clients’ locations. In each iteration of LDP‐FSRQ, each client adopts the quad‐tree to encode his/her location into a binary string and uses four local perturbation mechanisms to protect the encoded string. Then, the collector prunes the quad‐tree of the current round according to the clients’ reports and shares the pruned tree with the clients of the next round. We demonstrate the application of LDP‐FSRQ on Beijing, Landmark, Check‐in, and NYC datasets, and the experimental results show that our approach outperforms its competitors in terms of queries’ utility.

Set-valued data is extremely important and widely used in sensor technology and application. Recently, privacy protection for set-valued data under differential privacy (DP) has become a research hotspot. However, the DP model assumes that the data center is trustworthy, consequently, increasingly attention has been paid to the application of the local differential privacy model (LDP) for set-valued data. Constrained by the local differential privacy model, most methods randomly respond to the subset of set-valued data, and the data collector conducts statistics on the received data. There are two main problems with this kind of method: one is that the utility function used in the random response loses too much information; the other is that the privacy protection of the set-valued data category is usually ignored. To solve these problems, this paper proposes a set-valued data collection method (SetLDP) based on the category hierarchy under the local differential privacy model. The core idea is to first make a random response to the existence of the category, continue to disturb the item count if the category exists, and finally randomly respond to a candidate itemset based on the new utility function. Theory analysis and experimental results show that the SetLDP can not only preserve more information, but also protect the category private information in set-valued data.

In this paper, we study Local Information Privacy (LIP). As a context-aware privacy notion, LIP relaxes the de facto standard privacy notion of local differential privacy (LDP) by incorporating prior knowledge and therefore achieving better utility. We study the relationships between LIP and some of the representative privacy notions including LDP, mutual information and maximal leakage. We show that LIP provides strong instance-wise privacy protection compared to other context-aware privacy notions. Moreover, we present some useful properties of LIP, including post-processing, linkage, composability, transferability and robustness to imperfect prior knowledge. Then we study a general utility-privacy tradeoff framework, under which we derive LIP based privacy-preserving mechanisms for both discrete and continuous-valued data. Three types of perturbation mechanisms are studied in this paper: 1) randomized response (RR), 2) random sampling (RS) and 3) additive noise (AN) (e.g., Gaussian mechanism). Our privacy mechanisms incorporate the prior knowledge into the perturbation parameters so as to enhance utility. Finally, we present a comprehensive set of experiments on real datasets to illustrate the advantage of context-awareness and compare the utility-privacy tradeoffs provided by different mechanisms.

In the context of the Internet of Things (IoT), the large-scale generation and collection of data can greatly improve the quality of service provided, but they also raise significant concerns about privacy breaches. However, existing privacy-preserving data collection solutions based on local differential privacy (LDP) often struggle to balance security and accuracy when handling composite data types. To address this challenge, in this paper, we propose CSKV, a high-precision and privacy-preserving key-value data collection scheme. Specifically, we first design a padding and sampling protocol to improve data utility. Then, we propose two randomized response mechanisms to safely perturb keys and values in a cohesive and segmented manner. After that, by leveraging the sampling protocol and key-value correlation perturbation, we demonstrate that CSKV can provide secondary privacy amplification. Detailed theoretical analysis verifies the security and effectiveness of CSKV. In addition, extensive performance evaluations are conducted on synthetic and real-world datasets, and the results indicate that our proposed scheme outperforms existing schemes in terms of hit rate and estimation variance.

Privacy concerns hinder the sharing and utilization of trajectory data collected from Internet of Things (IoT) devices. While local differential privacy mitigates leakage risks by perturbing data on mobile devices, existing methods primarily focus on enhancing global-level statistical usability of perturbed trajectories (such as spatial distributions and mobility transition patterns), neglecting individual-level semantic usability (such as road network consistency and traffic rule compliance). The resulting trajectories frequently contain unrealistic behaviors that violate traffic rules, severely limiting their applicability. To overcome this challenge, we propose TPIS, a trajectory protection approach with individual semantic utility under local differential privacy. First, we design a semantic-enhanced hierarchical modeling method (SEHM) that leverages traffic rule semantic information and geospatial information to model the road network as a weighted graph, supported by an R-tree index for efficient coarse-grained and fine-grained trajectory matching. Second, we propose a cascaded perturbation method combining stochastic sampling guided by the hierarchical graph model (SHG) and multi-feature fusion perturbation mechanism based on δ-location set (MFPD). SHG strategically constrains the perturbation space to preserve global-level statistical usability while ensuring rigorous privacy, and MFPD incorporates a comprehensive trajectory difference metric and δ -location set definition to generate perturbed trajectories that maintain individual-level structural integrity of real-world movement patterns. TPIS efficiently balances privacy and utility and ensures high computational efficiency. Theoretical analysis confirms its differential privacy guarantee and upper bound on perturbation error. Experiments conducted on four real-world datasets demonstrate significant improvements over existing methods, with up to 8× higher utility and 14× greater computational efficiency.

Sequential change detection is a fundamental problem in statistics and signal processing, with the CUSUM procedure widely used to achieve minimax detection delay under a prescribed false alarm rate when pre- and post-change distributions are fully known. However, in many practical settings, raw observations cannot be shared with a trusted central curator, and privacy must be enforced at the data source, which prevents the computation of exact CUSUM statistics. We therefore introduce a local differentially private (DP) variant called LDP-CUSUM, which first applies a local DP mechanism to transform the raw data into privatized observations and then applies a CUSUM procedure to detect the change. We derive closed-form bounds on the average run length to false alarm and on the worst-case average detection delay, explicitly characterizing the tradeoff among privacy level, false alarm rate, and detection efficiency. Numerical simulations and a real-data case study were conducted to demonstrate the detection efficiency of our proposed LDP-CUSUM across various scenarios.

The software-based implementation of differential privacy mechanisms has been shown to be neither friendly for lightweight devices nor secure against side-channel attacks. In this work, we aim to develop a hardware-based technique to achieve differential privacy by design. In contrary to the conventional software-based noise generation and injection process, our design realizes local differential privacy (LDP) by harnessing the inherent hardware noise into controlled LDP noise when data is stored in the memory. Specifically, the noise is tamed through a novel memory design and power downscaling technique, which leads to double-faceted gains in privacy and power efficiency. A well-round study that consists of theoretical design and analysis and chip implementation and experiments is presented. The results confirm that the developed technique is differentially private, saves 88.58% system power, speeds up software-based DP mechanisms by more than <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$10^{6}$</tex-math></inline-formula> times, while only incurring 2.46% chip overhead and 7.81% estimation errors in data recovery.

As an important task in spatial data mining, trajectory transportation mode recognition can reflect various individual behaviors and traveling patterns in urban space. As trajectory is essentially a sequence, many scholars use the sequence inference models to mine the information in trajectory data. However, such methods often ignored the spatial correlation between trajectory points and implemented the evaluation based only on representative feature statistics selected in the trajectory data preprocessing stage, thus have difficulties in acquiring high-order traveling pattern features. In this study, we propose a novel ensemble recognition method for representing trajectory data with the graph structure based on sequence and dependency relations. This method integrates the sequence of trajectory points and the correlation between characteristic points of a travel path into a fused graph convolutional network to obtain semantic feature information at multiple levels. We validate our proposed method with experiments on the trajectory benchmark dataset from the Microsoft GeoLife project. The results demonstrated that our proposed graph network outperforms other baseline methods in the transportation mode recognition task of trajectories. This method can help to discover the movement patterns of urban residents, and further provide effective assistance for the management of cities.