Differential Privacy in Aggregated Mobility Networks: Balancing Privacy and Utility

TL;DR

The paper tackles protecting individual privacy in aggregated mobility data by introducing DP-ANI, a differential privacy framework that perturbs origins and destinations with planar Laplace noise and privately selects perturbation ranges using the Sparse Vector Technique, followed by link matching to form a privatized mobility network. It combines network-aware noise with adaptive range selection to preserve key aggregate statistics at both the network and trajectory levels, achieving close-to-raw utility (up to about 9% deviation in network length) while providing formal DP guarantees. The approach is evaluated on real SF Bay Area data, showing robust performance across temporal windows and comparing favorably against k-anonymity baselines and simpler DP variants. This work advances practical privacy-preserving mobility data publishing, enabling safer sharing for planners and researchers without severely compromising actionable insights for congestion analysis and route identification.

Abstract

Location data is collected from users continuously to understand their mobility patterns. Releasing the user trajectories may compromise user privacy. Therefore, the general practice is to release aggregated location datasets. However, private information may still be inferred from an aggregated version of location trajectories. Differential privacy (DP) protects the query output against inference attacks regardless of background knowledge. This paper presents a differential privacy-based privacy model that protects the user's origins and destinations from being inferred from aggregated mobility datasets. This is achieved by injecting Planar Laplace noise to the user origin and destination GPS points. The noisy GPS points are then transformed into a link representation using a link-matching algorithm. Finally, the link trajectories form an aggregated mobility network. The injected noise level is selected using the Sparse Vector Mechanism. This DP selection mechanism considers the link density of the location and the functional category of the localized links. Compared to the different baseline models, including a k-anonymity method, our differential privacy-based aggregation model offers query responses that are close to the raw data in terms of aggregate statistics at both the network and trajectory-levels with maximum 9% deviation from the baseline in terms of network length.

Figures (8)

• Figure 1: Differentially private aggregated mobility network is released using our noise injection model and link matching algorithm.
• Figure 2: Buffer range for determining link density
• Figure 3: OD pair count for a typical week-day
• Figure 4: Network length for all trajectories with baseline comparisons.
• Figure 5: Aggregated trajectory networks for a 1 hour period are represented together on the map. The red link network represents the DP-ANI-AT model for $\epsilon=1$, the yellow represents the OD successive link removing model, and the light blue represents the original model. Fig.-(a) shows the original network only without any overlap. In Fig.-(b) and Fig.-(c), when the DP and OD-successive links overlap with the original network, the links appear as red and yellow, respectively. The network lengths are 195.2, 138.2, and 194.6 miles for networks with the DP-ANI-AT model, OD successive link removal model, original network respectively.

Theorems & Definitions (12)

• Definition 1
• Definition 2
• Definition 3
• Definition 4
• Definition 5
• Definition 6
• Definition 7
• Definition 8
• Lemma 5.1
• proof