{"id":"888d594d-b327-40bd-8da2-40e6e5efa1a7","arxiv_id":"2505.05155","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A federated framework using LLMs and SLMs with an autoencoder, prompt-based knowledge enhancement, and split learning claims to handle ten trajectory data preparation tasks while protecting privacy.","lead":"The paper combines federated learning with large and small language models to clean and repair trajectory data without sharing raw records. It claims to outperform specialized single-task baselines across ten trajectory preparation tasks while protecting privacy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The server receives TPA embeddings directly, but the secret-sharing defense (Theorem 4.1) only protects parameter aggregation among clients; no argument or experiment shows the server cannot invert those embeddings, so the central privacy claim is unsupported.","rationale":"The reader's weakest assumption correctly identifies the core gap: the paper assumes the server cannot recover raw trajectories from TPA embeddings, without formal analysis or empirical attack evaluation. My reading of the full text confirms this and sharpens it. The secret-sharing protocol in Section 4.1 only masks TPA parameter blocks during client-side aggregation (Theorem 4.1); the embeddings themselves travel in the clear to the server. The paper even cites embedding inversion attacks as the motivation for the protocol, yet the protocol does not restrict the server's view of the embeddings. This is not a disagreement with consensus; it is an internal gap between the claimed privacy guarantee and the mechanism provided. The performance comparisons are also weakened by unspecified DP budgets for baselines and results reported only as figures without error bars, but those are secondary to the privacy claim. If the privacy claim fails, the entire premise of the framework—enabling privacy-preserving F-TDP—collapses, regardless of how well it performs on the 10 tasks. Therefore, the reader's REJECT verdict is appropriate, and no change to the verdict is needed.","tokens_in":23073,"tokens_out":4074,"duration_ms":44961,"concrete_test":"Run a white-box inversion experiment in the honest-but-curious server threat model: after training FedTDP on GeoLife, give the server access to the TPA encoder architecture and the embeddings transmitted by a held-out client, and allow the server to train a small decoder (or use the TPA decoder itself) on public GeoLife trajectories to map embeddings back to GPS coordinates. Measure the median and 95th-percentile geodesic error between reconstructed and true points. If the median error is below a meaningful threshold (e.g., 50 meters, roughly GPS noise), the claimed privacy guarantee fails; if the error is large, report the threshold at which trajectories are considered protected and connect it to a stated threat model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"FedTDP's headline contribution is that it is 'privacy-preserving' because clients transmit TPA embeddings rather than raw trajectories (Section 4.1). However, the server—a central party in the federated architecture—receives and stores these embeddings from all clients. The paper's only concrete privacy mechanism is the decentralized secret-sharing aggregation of TPA parameters (Eq. 2–4, Theorem 4.1). That mechanism protects the parameter aggregation step among clients; it does nothing to prevent the server, or any party with access to the transmitted embeddings, from attempting to invert them. The paper explicitly acknowledges that 'merely using embeddings for transmission cannot safeguard data privacy completely' and cites embedding inversion attacks (Song & Raghunathan 2020; Chen et al. 2024b; Huang et al. 2024) as the motivation for the secret-sharing scheme, but the scheme never addresses the server's access to the embeddings themselves. No threat model is stated, no privacy budget (e.g., differential privacy epsilon) is provided, and no inversion attack evaluation is run. The privacy guarantee therefore reduces to an unstated, untested assumption that a 3-layer MLP with 32-dimensional outputs is not practically invertible. Since the 'privacy-preserving' claim is central to the paper's contribution, this gap is load-bearing: if the server can reconstruct trajectories from the embeddings, the framework provides no meaningful privacy protection.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedTDP, a federated-learning framework for trajectory data preparation (TDP) that aims to be both privacy-preserving and unified across many TDP tasks. The framework consists of three modules: a Trajectory Privacy AutoEncoder (TPA) that encodes raw trajectory points into embeddings before transmission, a Trajectory Knowledge Enhancer (TKE) that adapts a large language model and a small language model to TDP tasks via prompts, offsite-tuning, sparse LoRA tuning, and bidirectional distillation, and a Federated Parallel Optimization (FPO) scheme based on split learning and alternating optimization. The authors report experiments on six datasets and ten TDP tasks, claiming consistent improvements over thirteen baselines, with gains of 4.84% to 45.22%.","tokens_in":23359,"tokens_out":3185,"duration_ms":36148,"significance":"If the performance claims held and the privacy guarantee were real, FedTDP would be a practically useful contribution: it addresses a real gap by applying federated learning to trajectory data preparation and it provides a multi-task, modular design with publicly released code. The efficiency analysis and the use of SLM/LLM distillation are also interesting engineering ideas. However, the central claim that the framework is 'privacy-preserving' is not supported by any formal analysis or empirical attack evaluation, and the only concrete cryptographic mechanism protects parameter aggregation rather than the transmitted embeddings. Since privacy is a headline contribution, the significance of the paper as it stands is substantially diminished.","major_comments":[{"comment":"The core privacy claim is unsupported. The paper states that TPA 'encodes trajectory data into spatio-temporal embeddings for transmission, rather than sending the raw data. This ensures data privacy' (Section 4.1), but the server in the federated architecture receives and stores these embeddings from all clients. The only concrete privacy mechanism described is the decentralized secret-sharing aggregation of TPA parameters (Eqs. 2-4, Theorem 4.1), which ensures that masked parameter blocks aggregate correctly; it does not prevent the server, or anyone with access to the transmitted embeddings, from attempting to invert them. The paper itself acknowledges that 'merely using embeddings for transmission cannot safeguard data privacy completely' and cites embedding inversion attacks, yet no threat model, no privacy budget, and no inversion-attack evaluation are provided. The claim that transmitting TPA embeddings 'ensures data privacy' is therefore an untested assumption, and the paper's central privacy contribution is not established.","section":"Section 4.1, Eqs. (2)-(4)"},{"comment":"Theorem 4.2 does not provide a valid or well-specified basis for the LoRA sparse-tuning scheme. The theorem asserts a closed-form expression for the probability that a layer is selected for training, but the expression in Eq. (7) is a sum of terms that do not correspond to a clearly defined sampling procedure. No algorithm for random layer selection is given, no proof of correctness for the probability calculation is supplied beyond an inductive derivation, and no convergence guarantee is established for training with this layer-drop rule. Since the claimed efficiency and generalization of TKE rely on this sparse-tuning mechanism, the theorem as stated is not load-bearing in its current form.","section":"Section 4.2, Theorem 4.2, Eqs. (5)-(7)"},{"comment":"The experimental comparison is under-specified with respect to privacy. The baselines are extended by applying differential privacy to perturb local trajectory data before transmission, but the paper does not report the privacy budget (epsilon, delta) used for these baselines, nor does it report any privacy parameter for FedTDP. Without matching privacy budgets, the comparison between FedTDP and the DP-perturbed baselines is not meaningful. In addition, all main results are reported as point estimates without error bars or significance tests, so the claim that FedTDP 'consistently outperforms' the baselines is not statistically supported. This is particularly important because the privacy mechanism itself may degrade utility, and the paper's own ablation (Section 5.3) notes that using TPA causes a slight performance decline.","section":"Section 5.1 and Figures 5-7"}],"minor_comments":[{"comment":"The ablation study refers to a configuration 'w/o FPT' when it should be 'w/o FPO'.","section":"Section 5.3"},{"comment":"There is a typo: 'TPD decodes results' should be 'TPA decodes results'.","section":"Section 4.1"},{"comment":"The proof of Theorem 4.1 is introduced as 'the complete theoretical proof of Theorem 4.2', which is incorrect and confusing.","section":"Appendix C.1"},{"comment":"The reference for OpenStreetMap is listed as 'Openstreemap' instead of 'OpenStreetMap'.","section":"References"},{"comment":"The dataset name 'Gowall' should be 'Gowalla'.","section":"Table 4"},{"comment":"The figures mix different metric scales on a single axis (e.g., SED values and F1 scores) and are difficult to read; separate panels or clearly labeled secondary axes would improve clarity.","section":"Figures 5-7"}],"recommendation":"reject","confidential_remarks":"The manuscript is a preliminary ICML submission, and the main concern is not stylistic. The privacy claim is the paper's headline contribution, but the proposed mechanism does not protect the embeddings that are sent to the server. This is not a missing experiment that can be patched with a paragraph; it requires either a fundamentally different privacy mechanism (e.g., encrypting or perturbing the embeddings with a formal privacy guarantee) or a repositioning of the paper as a federated utility-preserving compression framework without privacy claims. Given the current framing, I recommend rejection. A resubmission that adds a formal threat model, a privacy analysis, and an attack evaluation would be worth considering."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper builds a plausible federated trajectory preparation system and evaluates it across ten tasks, but its headline \"privacy-preserving\" claim rests on an assertion the server cannot invert TPA embeddings. Nothing in the paper supports that. The secret-sharing scheme (Theorem 4.1) protects the aggregation of model parameters among clients; it does nothing about the embeddings the server receives and stores. The paper even acknowledges that embeddings alone are insufficient, then cites inversion attacks as motivation, but never closes the gap.\n\nWhat's genuinely new is the integration. TPA, prompt engineering, offsite-tuning, LoRA sparsity, bidirectional KL distillation, split learning—each piece is known, but the combination for federated TDP across ten tasks is not in the literature I'm aware of. The evaluation is broad (6 datasets, 13 baselines) and the code is released, which is more than many papers in this space provide. The ablations and the model-generalization study are reasonable, and the paper is honest about the privacy limitation in its own text.\n\nThe soft spots are real. Most important: the privacy gap is load-bearing. No threat model, no privacy budget, no inversion-attack evaluation. A 3-layer MLP with 32-d outputs may or may not be invertible; the paper doesn't show it. Theorem 4.2 is not a privacy result—it's the inclusion probability of the layer-selection scheme, essentially a restatement of the procedure. On experiments: all numbers appear in figures without error bars or significance tests, and the DP-perturbed baselines don't state their privacy budgets, so the fairness comparison is under-specified. Minor issue: the efficiency section acknowledges FedTDP has the largest training communication size, which is fine, but the framing as \"efficient\" needs care.\n\nWho is this for? Someone building federated trajectory systems might get useful architecture ideas, but they'd need to treat privacy as an open problem. The paper deserves serious peer review—the assembly is substantial and the benchmark is useful—but the current version overclaims the privacy guarantee. I'd send it to reviewers and expect heavy revision: either a formal privacy analysis or a concrete attack evaluation, plus a fully specified baseline setup.","headline":"The framework is real and broad, but the privacy claim is unsupported—the server sees embeddings directly and the secret-sharing step doesn't cover them.","tokens_in":23865,"tokens_out":2689,"would_cite":false,"duration_ms":26241,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that one federated learning framework, FedTDP, can prepare trajectory data—imputation, denoising, map matching, mode identification, and more—without raw trajectories leaving client regions, and that on six real datasets…","keywords":["trajectory data preparation","federated learning","privacy-preserving machine learning","large language models","spatio-temporal data","trajectory autoencoder","LoRA fine-tuning","secret sharing"],"falsifier":"Take the TPA encoder trained on GeoLife and run embedding-inversion attacks of the kind cited in the paper, for example training a mapping from the 32-dimensional point embeddings back to GPS coordinates; if the reconstructed points land near the true locations on a held-out test set, the privacy claim fails because the server could recover trajectories from what it receives.","tokens_in":22855,"feed_emoji":"🛰️","tokens_out":6889,"duration_ms":62476,"temperature":0.7,"pith_summary":"FedTDP is proposed as a single, privacy-preserving answer to a whole family of quality-repair jobs on movement data. The paper claims that ten trajectory data preparation tasks—anomaly detection, trajectory imputation, noise filtering, stay point detection, map matching, trajectory-user linking, travel mode identification, simplification, segmentation, and recovery—can be handled by one federated training scheme instead of a separate model per task. To keep location data from leaving regional data silos, clients transmit compact encodings of their spatio-temporal points through a trajectory privacy autoencoder, and the server's large language model plus each client's small language model are trained jointly to perform whichever cleanup or labeling task is needed. Experiments across six real datasets report consistent improvements over 13 baselines, between 4.84% and 45.22%, including on tasks never seen during training. The practical interest is that data-quality pipelines for trajectory analytics could become both multi-task and privacy-preserving in one deployment.","feed_headline":"One federated model handles ten trajectory-cleaning tasks privately","feed_subtitle":"By transmitting encoded locations instead of raw coordinates, it claims gains of 4.84–45.22% over 13 baselines.","key_machinery":"The load-bearing object is the Trajectory Privacy AutoEncoder (TPA), a three-layer MLP that maps each spatio-temporal point to a 32-dimensional embedding so raw coordinates never travel, paired with Shamir secret sharing so masked TPA parameter blocks aggregate exactly (Theorem 4.1). The other two modules do the accuracy and efficiency work: TKE converts tasks to prompts, moves LLM adapter layers into the client SLM through offsite-tuning, prunes LoRA layers by change rate, and aligns the two models' output distributions; FPO splits learning between client and server and alternates freezing so communication shrinks. Together they make the claimed result—a single privacy-preserving model for many TDP tasks—mechanically possible.","core_discovery":"The paper's central claim is that trajectory data preparation in a federated setting—where regional data silos legally cannot share raw movement data—can be solved uniformly by FedTDP, a framework that couples a server-side large language model with client-side small language models. The Trajectory Privacy AutoEncoder (TPA) encodes each spatio-temporal point into a 32-dimensional embedding before transmission, so the server sees compact vectors rather than GPS coordinates; a decentralized secret-sharing scheme masks TPA parameters during aggregation so that gradient and parameter inversion attacks are blocked. A Trajectory Knowledge Enhancer (TKE) supplies task prompts, transfers the LLM's adapter layers to the SLM via offsite-tuning, applies LoRA sparse-tuning to train only the most-changing layers, and aligns SLM and LLM outputs with bidirectional KL divergence. Federated Parallel Optimization (FPO) splits training between client and server, freezes the other side's data during alternating updates, and runs objectives in parallel. On this architecture, the paper claims, FedTDP outperforms 13 state-of-the-art baselines across 10 tasks, with gains from 4.84% to 45.22% and improvement over non-LLM TDP methods of at least 18.38%.","pith_inferences":["Inference beyond the paper: TPA's per-point independent encoding may discard higher-order motion features such as speed, turning angle, and road-network alignment; a natural extension is a recurrent or graph encoder compared head-to-head on map matching and trajectory recovery.","Inference beyond the paper: the privacy claim could be sharpened into a benchmark by measuring reconstructability of TPA embeddings, for example training an inversion model on GeoLife encodings and reporting GPS reconstruction error; the paper currently asserts privacy rather than measuring it.","Inference beyond the paper: the architecture is not trajectory-specific in principle, so the same encode-prompt-decode pipeline could be tested on other federated sequence-preparation problems such as sensor streams or financial transaction cleaning.","Inference beyond the paper: since FPO freezes data alternately, an efficiency extension would be asynchronous client updates or compressed embedding transmission, both likely to reduce communication size further without changing the training objective."],"forward_implications":["If FedTDP's reported gains hold, a single trained deployment can replace seven or more single-task TDP models, cutting training time and memory for organizations that maintain trajectory analytics.","Because the framework reports strong performance on tasks unseen in training (noise filtering, stay point detection, trajectory segmentation), one federated training round on one dataset could transfer to new cleaning jobs without retraining from scratch.","Clients with limited hardware can participate: the client-side SLM is small (60M–125M parameter bases are tested), while the heavy LLM stays on the server, so the framework is usable by regional data silos with modest compute.","Training communication is claimed to drop by roughly 4x via FPO relative to the same framework without it, making multi-round federated training over 100 MB/s links more practical.","The modular architecture is claimed to extend to additional trajectory analysis tasks beyond the ten evaluated, because the pipeline decouples encoding, prompting, and task decoding."],"supporting_citations":[{"why":"Supplies GeoLife, the dataset used for all seven seen training tasks.","marker":"Zheng et al., 2010"},{"why":"LightTR is the federated trajectory recovery baseline FedTDP must beat and motivates the F-TDP problem.","marker":"Liu et al., 2024c"},{"why":"Kamel is the trajectory imputation baseline and an example of the single-task methods FedTDP is designed to outperform.","marker":"Musleh & Mokbel, 2023"},{"why":"Provides the secret-sharing scheme that makes Theorem 4.1's exact aggregation of masked TPA parameters possible.","marker":"Shamir, 1979"},{"why":"Documents embedding information leakage, the attack that the TPA encoding is meant to resist.","marker":"Song & Raghunathan, 2020"},{"why":"Differential privacy is applied to baseline clients to make the privacy comparison fair, and the paper contrasts TPA with its overhead.","marker":"Dwork et al., 2006"},{"why":"LoRA is the parameter-efficient tuning method that TKE's sparse-tuning extends.","marker":"Hu et al., 2022"},{"why":"Offsite-tuning is the technique by which the server's LLM adapter is transferred to the client SLM.","marker":"Xiao et al., 2023"},{"why":"Split learning is the mechanism FPO uses to decompose client/server training.","marker":"Fu et al., 2024"}],"fun_headline_variants":["FedTDP: Federated LLM unifies trajectory data prep privately","One federated model, all trajectory cleanup tasks, private","Privacy-preserving FL framework for all trajectory tasks","FedTDP: one federated model, private trajectory prep"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework's privacy guarantee rests on the assumption that the server cannot recover raw trajectories from the 32-dimensional embeddings it receives, a claim the paper states but does not prove.","fun_headline_variants_meta":{"raw":{"variants":["FedTDP: Federated LLM unifies trajectory data prep privately","One federated model, all trajectory cleanup tasks, private","Privacy-preserving FL framework for all trajectory tasks","FedTDP: one federated model, private trajectory prep"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000801,"raw_usage":{"total_tokens":3573,"prompt_tokens":1049,"completion_tokens":2524,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":665,"completion_tokens_details":{"reasoning_tokens":2455}},"tokens_in":665,"tokens_out":2524,"duration_ms":18283,"temperature":1.0,"reasoning_tokens":2455,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:11:52.020167+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the TPA encoder trained on GeoLife and run embedding-inversion attacks of the kind cited in the paper, for example training a mapping from the 32-dimensional point embeddings back to GPS coordinates; if the reconstructed points land near the true locations on a held-out test set, the privacy claim fails because the server could recover trajectories from what it receives.","supporting_citations":[],"review_version":1}