{"id":"dd2148ea-5fa6-48ba-9bb7-64b4848e99e8","arxiv_id":"2606.03711","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Ghost steers trajectory perturbations onto the real-data manifold via a frozen language model to produce plausible yet unlearnable sequences that resist purification adversaries in next-POI privacy protection.","lead":"Ghost generates perturbed check-in trajectories that remain geographically plausible but cause next-POI prediction models to degrade on clean test data. A smart generalist might read it to see a privacy technique that avoids obvious fakes while resisting attempts to clean the data for learning.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Central claim depends on frozen trajectory LM defining a manifold that both preserves human/geographic plausibility and erases all learnable signal for the listed adversaries.","rationale":"Reader correctly flagged the frozen-LM manifold assumption as weakest. Full-text access does not add independent verification (no human plausibility study, no ablation on LM training data, no stronger adversary beyond bigram). The empirical numbers therefore remain conditional on that modeling premise being accurate.","tokens_in":1771,"tokens_out":351,"duration_ms":19117,"concrete_test":"Hold out 20 % of each dataset, retrain the trajectory LM on the remaining 80 %, regenerate Ghost trajectories with the new LM, and re-run the bigram adaptive purification adversary; if restored next-POI accuracy rises by more than one standard deviation relative to the original Ghost numbers, the manifold assumption does not hold.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The Ghost construction steers substitutions via a frozen LM so that the resulting sequences lie on the 'real-trajectory manifold.' This single modeling choice is required to (a) keep perturbations plausible under geographic and semantic checks and (b) ensure that neither the denoising-bridge nor the bigram adaptive purification adversary can recover useful signal. If the LM's learned distribution deviates from the true data-generating process (e.g., because of training-data mismatch, limited context length, or mode collapse), the substitutions can simultaneously become either implausible or still contain recoverable bigram statistics. The reported results—protection gap competitive with PGD, lowest restored accuracy under the bigram adversary, and survival gap ≤0.04 even with 20 % pair leakage—rest directly on this untested modeling assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes Ghost, a manifold-aligned framework for generating plausible yet unlearnable check-in trajectories to protect next-POI prediction privacy. It steers substitutions onto the real-trajectory manifold using a frozen trajectory language model, claiming this yields protection gaps competitive with the strongest deterministic baseline (PGD), the lowest restored accuracy under a bigram adaptive purification adversary on two benchmarks, and a survival gap remaining within 0.04 even with 20% pair leakage, while subsuming the entropy-floor knob of prior randomized defenses.","tokens_in":1912,"tokens_out":486,"duration_ms":19846,"significance":"If the central modeling assumption holds and the reported gaps are reproducible, Ghost would represent a meaningful contribution to privacy-preserving release of location trajectories by addressing both geographic/semantic plausibility and resistance to structure-exploiting purification adversaries, outperforming direct image-domain ports and matching or exceeding deterministic baselines on the protection-versus-resistance plane.","major_comments":[{"comment":"Abstract (Ghost framework paragraph): The claim that substitutions remain plausible under geographic and semantic checks while eliminating learnable signal for both denoising-bridge and frequency-table adversaries rests entirely on the frozen trajectory LM accurately defining the real-trajectory manifold; no verification, sensitivity analysis, or tests for training-data mismatch, context-length limits, or mode collapse are supplied, rendering this assumption load-bearing for all reported protection gaps and the survival-gap bound.","section":"Abstract (Ghost framework paragraph)"},{"comment":"Abstract: Performance claims (competitive protection gap with PGD, lowest restored accuracy under bigram adversary, within one per-cell standard deviation on the protection-versus-purification-resistance plane) are stated without any derivations, error bars, dataset statistics, or verification steps, so the central empirical claims cannot be assessed from the supplied text.","section":"Abstract"}],"minor_comments":[{"comment":"Abstract: Dataset names, sizes, and the precise definitions of the four attacker postures are not supplied, hindering reproducibility assessment.","section":"Abstract"},{"comment":"Abstract: The ablation statement that 'the manifold prior subsumes the entropy-floor knob' is asserted without reference to specific ablation tables, figures, or quantitative comparisons.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive comments on our manuscript. Below we respond point-by-point to the major comments, drawing on the full experimental sections while indicating where the abstract can be clarified.","responses":[{"response":"The full manuscript validates the manifold assumption empirically through results on two benchmarks and four attacker postures, including the reported protection gaps competitive with PGD, lowest restored accuracy under the bigram adversary, and survival gap remaining within 0.04 at 20% pair leakage. These outcomes are produced by steering substitutions with the frozen LM; the ablations further show the manifold prior subsumes the entropy-floor knob of prior randomized defenses. Explicit sensitivity analyses for training-data mismatch, context-length limits, and mode collapse are not present, as the LM is applied on the same distribution as the benchmarks. We will revise the abstract to reference the experimental validation sections.","revision_made":"partial","referee_comment":"[Abstract (Ghost framework paragraph)] Abstract (Ghost framework paragraph): The claim that substitutions remain plausible under geographic and semantic checks while eliminating learnable signal for both denoising-bridge and frequency-table adversaries rests entirely on the frozen trajectory LM accurately defining the real-trajectory manifold; no verification, sensitivity analysis, or tests for training-data mismatch, context-length limits, or mode collapse are supplied, rendering this assumption load-bearing for all reported protection gaps and the survival-gap bound."},{"response":"The abstract summarizes the key findings; the full manuscript supplies the supporting details, including tables reporting per-cell standard deviations, dataset statistics in the experimental setup, and verification across multiple attacker postures on two benchmarks. The 'within one per-cell standard deviation' claim is taken directly from the protection-versus-purification-resistance plane results. We will revise the abstract to include a brief pointer to the relevant experimental sections and figures.","revision_made":"partial","referee_comment":"[Abstract] Abstract: Performance claims (competitive protection gap with PGD, lowest restored accuracy under bigram adversary, within one per-cell standard deviation on the protection-versus-purification-resistance plane) are stated without any derivations, error bars, dataset statistics, or verification steps, so the central empirical claims cannot be assessed from the supplied text."}],"tokens_in":1409,"tokens_out":474,"duration_ms":19517,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"Ghost takes the unlearnable-examples idea and moves it to check-in trajectories by using a frozen trajectory language model to pick substitutions that stay on the manifold of real sequences. The goal is sequences that pass geographic and semantic checks yet leave next-POI models with degraded accuracy on clean test data.\n\nThe paper shows two concrete advances. First, it directly tackles the two failure modes of image-domain methods on trajectories: the need for plausible output and resistance to purification attacks that exploit randomized defenses. Second, the experiments compare against PGD and other baselines across two benchmarks and four attacker settings, reporting that Ghost matches PGD on protection gap while posting the lowest restored accuracy under the bigram adaptive adversary. The survival gap stays inside 0.04 even with 20 percent pair leakage, and ablations indicate the manifold prior replaces the entropy-floor tuning used in earlier randomized defenses.\n\nThe central modeling choice is the frozen LM. The construction assumes this model defines a manifold that keeps substitutions both human-plausible and free of recoverable signal for denoising-bridge and frequency-table adversaries. If the LM deviates from the true data-generating process, the substitutions could lose either plausibility or protection. The abstract presents the ablations as confirmation, but the strength of that confirmation depends on how the LM was trained and validated against the actual datasets.\n\nThis work is for people who release or analyze mobility traces and need a practical way to limit what downstream models can learn. A reader focused on location privacy or trajectory data publishing will find the multi-adversary setup and the direct comparison to PGD useful.\n\nThe paper deserves a serious referee. The claims are scoped, the baselines are strong, and the experiments can be checked once the code and exact dataset splits are available.","headline":"Ghost steers trajectory substitutions with a frozen LM to stay on the real manifold, delivering protection close to PGD while resisting bigram purification better than baselines, but the results stand or fall on how faithfully that LM matches actual check-in distributions.","tokens_in":2393,"tokens_out":445,"would_cite":false,"duration_ms":20746,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Ghost generates plausible check-in trajectories that defeat next-POI learning even after purification.","keywords":["trajectory privacy","next-POI prediction","unlearnable examples","manifold substitution","location data","adversarial defense","check-in sequences","privacy protection"],"falsifier":"Demonstrating that a bigram-based or denoising adversary can restore high next-POI prediction accuracy from Ghost-perturbed data on the benchmark datasets would falsify the resistance claim.","tokens_in":2659,"feed_emoji":"🛡️","tokens_out":616,"duration_ms":30222,"temperature":0.7,"pith_summary":"Publishers of check-in data risk revealing users' future locations through trained predictors. Ghost perturbs trajectories by substituting points onto the manifold of real sequences using a frozen language model. This keeps the data looking like normal human movement while removing the statistical signals that allow accurate next-location prediction. The result competes with strong baselines on protection while resisting adaptive purification better than alternatives. A sympathetic reader cares because it offers a way to release useful mobility data without enabling surveillance or targeted advertising based on learned patterns.","feed_headline":"Ghost perturbations block next-POI learning in plausible trajectories","feed_subtitle":"Substitutions follow real mobility patterns so data stays usable yet yields poor predictors even after attacks.","key_machinery":"On-manifold substitution steered by a frozen trajectory language model that enforces plausibility and removes learnable signal.","core_discovery":"Ghost is a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind. It steers each substitution onto the real-trajectory manifold through a frozen trajectory language model, so a denoising-bridge adversary has nothing to invert and a context-free frequency-table adversary recovers a near-uniform distribution. Across two standard benchmarks and four attacker postures, it achieves protection competitive with PGD while attaining the lowest restored accuracy under the bigram adaptive purification adversary.","pith_inferences":["Similar on-manifold techniques could apply to other privacy-sensitive sequence data such as web browsing or financial transactions.","If the language model is updated periodically, it might adapt to changing mobility patterns over time.","The approach suggests that manifold alignment could be a general principle for creating unlearnable data in structured domains beyond images."],"forward_implications":["Trajectories remain geographically and semantically plausible to human inspection.","Trained next-POI models exhibit degraded accuracy on clean test data.","Protection gap matches the strongest deterministic baseline PGD.","Lowest restored accuracy against bigram adaptive purification on both datasets.","Manifold prior makes entropy-floor knobs of prior defenses unnecessary."],"fun_headline_variants":["Ghost steers check-ins to plausibility minus next-POI learnability","Manifold Ghost hides POI signals in realistic human trajectories","Ghost makes plausible sequences unlearnable by next-POI models","Realistic check-ins via Ghost resist next-POI learning"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"A frozen trajectory language model can accurately capture the manifold of real human check-in sequences so that on-manifold substitutions eliminate learnable signals without losing plausibility.","fun_headline_variants_meta":{"raw":{"variants":["Ghost steers check-ins to plausibility minus next-POI learnability","Manifold Ghost hides POI signals in realistic human trajectories","Ghost makes plausible sequences unlearnable by next-POI models","Realistic check-ins via Ghost resist next-POI learning"]},"model":"grok-4.3","cost_usd":0.006787,"raw_usage":{"total_tokens":3174,"prompt_tokens":703,"num_sources_used":0,"completion_tokens":70,"cost_in_usd_ticks":67874500,"prompt_tokens_details":{"text_tokens":703,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2401,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":703,"tokens_out":70,"duration_ms":17509,"temperature":1.0,"reasoning_tokens":2401,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T09:36:12.653765+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Demonstrating that a bigram-based or denoising adversary can restore high next-POI prediction accuracy from Ghost-perturbed data on the benchmark datasets would falsify the resistance claim.","supporting_citations":[],"review_version":1}