[Paper Review] Prolonging the Hide-and-Seek Game: Optimal Trajectory Privacy for Location-Based Services

George Theodorakopoulos, Reza Shokri+3 more|arXiv (Cornell University)|Sep 5, 2014

Privacy-Preserving Technologies in Data5 citations

TL;DR

This paper proposes a user-centric, optimal trajectory privacy mechanism for location-based services that protects current, past, and future locations by modeling the interaction between the user and a strategic adversary as a Bayesian Stackelberg game. The method precomputes an optimal obfuscation function using linear programming, ensuring maximum privacy against informed adversaries while respecting user quality-of-service constraints.

ABSTRACT

Human mobility is highly predictable. Individuals tend to only visit a few locations with high frequency, and to move among them in a certain sequence reflecting their habits and daily routine. This predictability has to be taken into account in the design of location privacy preserving mechanisms (LPPMs) in order to effectively protect users when they continuously expose their position to location-based services (LBSs). In this paper, we describe a method for creating LPPMs that are customized for a user's mobility profile taking into account privacy and quality of service requirements. By construction, our LPPMs take into account the sequential correlation across the user's exposed locations, providing the maximum possible trajectory privacy, i.e., privacy for the user's present location, as well as past and expected future locations. Moreover, our LPPMs are optimal against a strategic adversary, i.e., an attacker that implements the strongest inference attack knowing both the LPPM operation and the user's mobility profile. The optimality of the LPPMs in the context of trajectory privacy is a novel contribution, and it is achieved by formulating the LPPM design problem as a Bayesian Stackelberg game between the user and the adversary. An additional benefit of our formal approach is that the design parameters of the LPPM are chosen by the optimization algorithm.

Motivation & Objective

• Address the limitations of existing LPPMs that fail to account for sequential location correlation and adaptive adversaries.
• Design a user-centric LPPM that operates independently of third parties or other users.
• Protect not only current locations but also past, future, and transition locations along a user's trajectory.
• Ensure optimal privacy against a strategic adversary who knows both the LPPM and the user’s mobility profile.
• Provide a formal framework that computes the upper bound on achievable privacy for any LPPM under given constraints.

Proposed method

• Formulate the LPPM design as a Bayesian Stackelberg game between the user (leader) and a strategic adversary (follower) with full knowledge of the user’s mobility profile and LPPM algorithm.
• Precompute the optimal obfuscation function $ f(o_{\text{post}}|a_{\text{trg}}, o_{\text{pre}}) $ offline using linear programming, where $ o_{\text{pre}} $ is the history of pseudolocations and $ a_{\text{trg}} $ is the target privacy objective.
• Model privacy and quality-of-service trade-offs via user-defined parameters $ d_p $, $ d_q $, and $ Q_{\text{loss}}^{\max} $, which constrain the optimization.
• Limit computational cost by considering only likely trajectories rather than all theoretically possible location sequences.
• Enable online operation via a simple local look-up on the mobile device, minimizing runtime overhead.
• Ensure optimality by solving for the defense that maximizes privacy under the worst-case inference attack, given the adversary’s knowledge.

Experimental results

Research questions

• RQ1 How can a user-centric LPPM be designed to protect trajectory privacy against a strategic adversary with full knowledge of the user’s mobility profile and the LPPM algorithm?
• RQ2 What is the optimal privacy-utility trade-off when accounting for sequential correlations in user locations, including past, present, and future locations?
• RQ3 Can the framework protect not only current locations but also transitions between locations and locations visited without LBS queries?
• RQ4 How can the LPPM be computed efficiently despite the high-dimensional space of possible location sequences?
• RQ5 What is the theoretical upper bound on trajectory privacy that can be achieved in the presence of a fully informed adversary?

Key findings

• The proposed LPPM achieves optimal trajectory privacy by modeling the defender-adversary interaction as a Bayesian Stackelberg game, ensuring the best possible privacy against a strategic adversary.
• The framework enables protection of past, present, future, and transition locations, which is a novel contribution compared to prior work focusing only on current locations.
• The method is user-centric and requires only a local look-up on the device, making it practical for deployment on resource-constrained mobile devices.
• The offline computation of the obfuscation function $ f $ is efficient in practice due to pruning of implausible trajectories, reducing the number of required linear programs.
• The framework provides a provable upper bound on achievable privacy, serving as a benchmark for evaluating future LPPM designs.
• Using real mobility traces, the study shows that users can trade off quality of service for enhanced privacy, but the maximum achievable privacy is fundamentally limited by mobility predictability.