Privacy-Preserving Synthetic Location Data in the Real World

Abstract

Sharing sensitive data is vital in enabling many modern data analysis and machine learning tasks. However, current methods for data release are insufficiently accurate or granular to provide meaningful utility, and they carry a high risk of deanonymization or membership inference attacks. In this paper, we propose a differentially private synthetic data generation solution with a focus on the compelling domain of location data. We present two methods with high practical utility for generating synthetic location data from real locations, both of which protect the existence and true location of each individual in the original dataset. Our first, partitioningbased approach introduces a novel method for privately generating point data using kernel density estimation, in addition to employing private adaptations of classic statistical techniques, such as clustering, for private partitioning. Our second, network-based approach incorporates public geographic information, such as the road network of a city, to constrain the bounds of synthetic data points and hence improve the accuracy of the synthetic data. Both methods satisfy the requirements of differential privacy, while also enabling accurate generation of synthetic data that aims to preserve the distribution of the real locations. We conduct experiments using three large-scale location datasets to show that the proposed solutions generate synthetic location data with high utility and strong similarity to the real datasets. We highlight some practical applications for our work by applying our synthetic data to a range of location analytics queries, and we demonstrate that our synthetic data produces near-identical answers to the same queries compared to when real data is used. Our results show that the proposed approaches are practical solutions for sharing and analyzing sensitive location data privately. CCS CONCEPTS• Information systems → Spatial-temporal systems; Data analytics; • Security and privacy → Privacy protections.

GeoPointGAN: Synthetic Spatial Data with Local Label Differential Privacy

“…They all produce outputs that correspond to arbitrary grid cells or places of interest, whereas we generate coordinate data (i.e., the same form as the input data). While one could extend these solutions to generate individual points (e.g., by using uniform sampling), Cunningham et al [18] show that adapting existing solutions in this way fails to produce high-quality synthetic spatial point data. Their purpose-built solution is designed for the centralized DP setting, which leaves generating high-quality spatial point data in local privacy settings as an important, yet unaddressed, challenge.…”

“…Similarly, although other private methods for synthetic spatial data generation exist, these methods also use different forms of privacy. For example, Chen et al [16] use personalized LDP, and Cunningham et al [18] use centralized DP. As our privacy setting is different from all of these works, any comparison between them is meaningless.…”

“…Generating synthetic datasets of high utility is a fundamental challenge in many data management tasks, such as private data sharing [e.g., 18,19,28,48,74], benchmark generation [e.g., 31,34], and database management system testing [8,9,60].…”

“…Differential privacy (DP) and its local variant, LDP, have become the de facto privacy standards for synthetic data generation owing to their * Both authors contributed equally to this research. mathematically rigorous privacy guarantees, and several studies have tackled the issue of generating private synthetic datasets [e.g., 18,38,76]. Whereas the centralized setting of DP relies on a trusted aggregator, LDP offers a stronger degree of privacy by allowing users to perturb their data before sharing it with the aggregator.…”

Real-world trajectory sharing with local differential privacy

“…There has been DP-related work that considers user-specific context in which user priors are utilized [e.g., 30,33,36], and Desfontaines et al [15] study the notion of DP with 'partial knowledge' for a user. Finally, Cunningham et al [14] use publicly available geographic knowledge to improve the quality of private synthetic location data (in the centralized setting). However, we are the first to explicitly use external domain knowledge (i.e., user-independent prior information that is known to all, such as the locations, business opening hours, etc.)…”