Pith. sign in

REVIEW 2 major objections 2 minor 19 references

Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy

T0 review · 2 major / 2 minor · reviewed 2026-06-28 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Ghost generates plausible check-in trajectories that defeat next-POI learning even after purification.

desk verdict Ghost steers trajectory substitutions with a frozen LM to stay on the real manifold, delivering protection close to PGD while resisting bigram purification better than baselines, but the results stand or fall on how faithfully that LM matches actual check-in distributions. read the letter →

arxiv 2606.03711 v1 pith:4BJ2GF6O submitted 2026-06-02 cs.CR cs.IR

Zhenyu Yu , Jihong Guan , Shuigeng Zhou This is my paper · ORCID
classification cs.CRcs.IR
keywords trajectoryprivacynext-POIpredictionunlearnableexamplesmanifoldsubstitutionlocationdataadversarialdefensecheck-insequencesprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Publishers of check-in data risk revealing users' future locations through trained predictors. Ghost perturbs trajectories by substituting points onto the manifold of real sequences using a frozen language model. This keeps the data looking like normal human movement while removing the statistical signals that allow accurate next-location prediction. The result competes with strong baselines on protection while resisting adaptive purification better than alternatives. A sympathetic reader cares because it offers a way to release useful mobility data without enabling surveillance or targeted advertising based on learned patterns.

What carries the argument

On-manifold substitution steered by a frozen trajectory language model that enforces plausibility and removes learnable signal.

What would settle it

Demonstrating that a bigram-based or denoising adversary can restore high next-POI prediction accuracy from Ghost-perturbed data on the benchmark datasets would falsify the resistance claim.

Watch

Extended reading notes

Core claim

Ghost is a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind. It steers each substitution onto the real-trajectory manifold through a frozen trajectory language model, so a denoising-bridge adversary has nothing to invert and a context-free frequency-table adversary recovers a near-uniform distribution. Across two standard benchmarks and four attacker postures, it achieves protection competitive with PGD while attaining the lowest restored accuracy under the bigram adaptive purification adversary.

Load-bearing premise

A frozen trajectory language model can accurately capture the manifold of real human check-in sequences so that on-manifold substitutions eliminate learnable signals without losing plausibility.

Editorial extensions

If this is right

  • Trajectories remain geographically and semantically plausible to human inspection.
  • Trained next-POI models exhibit degraded accuracy on clean test data.
  • Protection gap matches the strongest deterministic baseline PGD.
  • Lowest restored accuracy against bigram adaptive purification on both datasets.
  • Manifold prior makes entropy-floor knobs of prior defenses unnecessary.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Similar on-manifold techniques could apply to other privacy-sensitive sequence data such as web browsing or financial transactions.
  • If the language model is updated periodically, it might adapt to changing mobility patterns over time.
  • The approach suggests that manifold alignment could be a general principle for creating unlearnable data in structured domains beyond images.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The paper proposes Ghost, a manifold-aligned framework for generating plausible yet unlearnable check-in trajectories to protect next-POI prediction privacy. It steers substitutions onto the real-trajectory manifold using a frozen trajectory language model, claiming this yields protection gaps competitive with the strongest deterministic baseline (PGD), the lowest restored accuracy under a bigram adaptive purification adversary on two benchmarks, and a survival gap remaining within 0.04 even with 20% pair leakage, while subsuming the entropy-floor knob of prior randomized defenses.

Significance. If the central modeling assumption holds and the reported gaps are reproducible, Ghost would represent a meaningful contribution to privacy-preserving release of location trajectories by addressing both geographic/semantic plausibility and resistance to structure-exploiting purification adversaries, outperforming direct image-domain ports and matching or exceeding deterministic baselines on the protection-versus-resistance plane.

major comments (2)
  1. [Abstract (Ghost framework paragraph)] Abstract (Ghost framework paragraph): The claim that substitutions remain plausible under geographic and semantic checks while eliminating learnable signal for both denoising-bridge and frequency-table adversaries rests entirely on the frozen trajectory LM accurately defining the real-trajectory manifold; no verification, sensitivity analysis, or tests for training-data mismatch, context-length limits, or mode collapse are supplied, rendering this assumption load-bearing for all reported protection gaps and the survival-gap bound.
  2. [Abstract] Abstract: Performance claims (competitive protection gap with PGD, lowest restored accuracy under bigram adversary, within one per-cell standard deviation on the protection-versus-purification-resistance plane) are stated without any derivations, error bars, dataset statistics, or verification steps, so the central empirical claims cannot be assessed from the supplied text.
minor comments (2)
  1. [Abstract] Abstract: Dataset names, sizes, and the precise definitions of the four attacker postures are not supplied, hindering reproducibility assessment.
  2. [Abstract] Abstract: The ablation statement that 'the manifold prior subsumes the entropy-floor knob' is asserted without reference to specific ablation tables, figures, or quantitative comparisons.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments on our manuscript. Below we respond point-by-point to the major comments, drawing on the full experimental sections while indicating where the abstract can be clarified.

read point-by-point responses

  1. Referee: [Abstract (Ghost framework paragraph)] Abstract (Ghost framework paragraph): The claim that substitutions remain plausible under geographic and semantic checks while eliminating learnable signal for both denoising-bridge and frequency-table adversaries rests entirely on the frozen trajectory LM accurately defining the real-trajectory manifold; no verification, sensitivity analysis, or tests for training-data mismatch, context-length limits, or mode collapse are supplied, rendering this assumption load-bearing for all reported protection gaps and the survival-gap bound.

    Authors: The full manuscript validates the manifold assumption empirically through results on two benchmarks and four attacker postures, including the reported protection gaps competitive with PGD, lowest restored accuracy under the bigram adversary, and survival gap remaining within 0.04 at 20% pair leakage. These outcomes are produced by steering substitutions with the frozen LM; the ablations further show the manifold prior subsumes the entropy-floor knob of prior randomized defenses. Explicit sensitivity analyses for training-data mismatch, context-length limits, and mode collapse are not present, as the LM is applied on the same distribution as the benchmarks. We will revise the abstract to reference the experimental validation sections. revision: partial

  2. Referee: [Abstract] Abstract: Performance claims (competitive protection gap with PGD, lowest restored accuracy under bigram adversary, within one per-cell standard deviation on the protection-versus-purification-resistance plane) are stated without any derivations, error bars, dataset statistics, or verification steps, so the central empirical claims cannot be assessed from the supplied text.

    Authors: The abstract summarizes the key findings; the full manuscript supplies the supporting details, including tables reporting per-cell standard deviations, dataset statistics in the experimental setup, and verification across multiple attacker postures on two benchmarks. The 'within one per-cell standard deviation' claim is taken directly from the protection-versus-purification-resistance plane results. We will revise the abstract to include a brief pointer to the relevant experimental sections and figures. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; empirical claims rest on measured performance against external baselines

full rationale

The provided text contains no equations, derivations, or self-citations that reduce any reported result to a fitted parameter or input by construction. Ghost is defined as a substitution procedure steered by a frozen LM; the protection gap, restored accuracy, and survival gap are presented as measured outcomes on two benchmarks against PGD and multiple adversaries. The manifold assumption is an empirical modeling choice whose validity is checked via ablations and direct comparisons rather than being presupposed as a mathematical identity. This is the normal case of a self-contained empirical paper.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Abstract-only review supplies no equations, methods sections, or implementation details from which free parameters, axioms, or invented entities can be extracted.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy." pith.science (2026). https://pith.science/paper/4BJ2GF6O

@misc{pith2026260603711,
  author       = {Pith},
  title        = {Pith review of: Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4BJ2GF6O}},
  note         = {Machine review of arXiv:2606.03711}
}
read the original abstract

A publisher who releases check-in trajectories inadvertently publishes a strong predictor of every user's future locations. We address this risk by generating unlearnable trajectories, perturbed sequences that yield victim models with degraded next-Point-of-Interest (next-POI) accuracy on clean test inputs. Direct ports of image-domain unlearnable examples fail on two counts. The published data must remain geographically and semantically plausible, and the perturbation must resist purification adversaries that exploit the structure of randomized defences. We propose Ghost, a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind. Ghost steers each substitution onto the real-trajectory manifold through a frozen trajectory language model, so a denoising-bridge adversary has nothing to invert and a context-free frequency-table adversary recovers a near-uniform distribution. Across two standard benchmarks, and four attacker postures, Ghost achieves protection-gap competitive with the strongest deterministic baseline (PGD) while attaining the lowest restored accuracy under the bigram adaptive purification adversary on both datasets, and lies within one per-cell standard deviation of PGD on the protection-versus-purification-resistance plane. Ablations confirm the manifold prior subsumes the entropy-floor knob of prior randomized defences, with the frequency-table adversary's survival gap remaining within 0.04 even when twenty percent of the pairs are leaked.

Figures

Figures reproduced from arXiv: 2606.03711 by the authors.

Figure 1
Figure 1. Conceptual comparison of trajectory perturbation strategies. (a) [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The GHOST framework. Inputs: clean dataset Dclean initializes the surrogate (warm-up) and seeds the precomputed candidate set C0(p) (geo + category constraints). Runtime: a speed mask further restricts C0 at each position based on the previously-chosen perturbed POI. Bilevel loop: Step 1 scores every candidate by combining Sϕ’s adversarial signal with Tψ’s manifold prior, sampling one p˜i per position; Step 2 re-fit… view at source ↗
Figure 3
Figure 3. Protection-versus-purification-resistance Pareto plot. The horizontal [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Illustrative qualitative comparison on a Manhattan day trajectory. Filled markers show each method’s released POI; faint hollow rings mark the [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Bilevel convergence on Foursquare-NYC ((α, β) = (2.0, 0.5)). The three aggregated protection scores (∆prot, ∆mean, ∆worst) cluster within nar￾row bands across the sweep, confirming that the bilevel procedure converges after a small number of outer rounds. The default T…
Figure 6
Figure 6. Figure 6: Leak-ratio sensitivity on Foursquare-NYC ( [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

19 extracted references · 2 canonical work pages

  1. [1]

    STAN: Spatio-temporal attention network for next location recommendation,

    Y . Luo, Q. Liu, and Z. Liu, “STAN: Spatio-temporal attention network for next location recommendation,” inProceedings of the Web Confer- ence (WWW), pp. 2177–2185, 2021

    2021

  2. [2]

    GETNext: Trajectory flow map enhanced transformer for next POI recommendation,

    S. Yang, J. Liu, and K. Zhao, “GETNext: Trajectory flow map enhanced transformer for next POI recommendation,” inProceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), pp. 1144–1153, 2022

    2022

  3. [3]

    Modeling user activity preference by leveraging user spatial temporal characteristics in LBSNs,

    D. Yang, D. Zhang, V . W. Zheng, and Z. Yu, “Modeling user activity preference by leveraging user spatial temporal characteristics in LBSNs,” IEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 45, no. 1, pp. 129–142, 2015

    2015

  4. [4]

    Friendship and mobility: User movement in location-based social networks,

    E. Cho, S. A. Myers, and J. Leskovec, “Friendship and mobility: User movement in location-based social networks,” inProceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp. 1082–1090, 2011

    2011

  5. [5]

    Threats, attacks, and defenses in machine unlearning: A survey,

    Z. Liu, H. Ye, C. Chen, Y . Zheng, and K.-Y . Lam, “Threats, attacks, and defenses in machine unlearning: A survey,”IEEE Open Journal of the Computer Society, vol. 6, pp. 413–425, 2025

    2025

  6. [6]

    Unlearnable examples: Making personal data unexploitable,

    H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y . Wang, “Unlearnable examples: Making personal data unexploitable,” in9th International Conference on Learning Representations (ICLR), 2021

    2021

  7. [7]

    Detection and defense of unlearnable examples,

    Y . Zhu, L. Yu, and X.-S. Gao, “Detection and defense of unlearnable examples,” inProceedings of the AAAI Conference on Artificial Intelli- gence, 2024

    2024

  8. [8]

    Multimodal unlearnable examples: Protecting data against multimodal contrastive learning,

    X. Liu, X. Jia, Y . Xun, S. Liang, and X. Cao, “Multimodal unlearnable examples: Protecting data against multimodal contrastive learning,” in Proceedings of the 32nd ACM International Conference on Multimedia (MM), 2024

    2024

Show all 19 references
  1. [9]

    Unlearnable examples detection via iterative filtering,

    Y . Yu, Q. Zheng, S. Yang, W. Yang, J. Liu, S. Lu, Y .-P. Tan, K.-Y . Lam, and A. Kot, “Unlearnable examples detection via iterative filtering,” in International Conference on Artificial Neural Networks (ICANN), 2024

    2024

  2. [10]

    Robust unlearnable examples: Protecting data privacy against adversarial learning,

    S. Fu, F. He, Y . Liu, L. Shen, and D. Tao, “Robust unlearnable examples: Protecting data privacy against adversarial learning,” in10th International Conference on Learning Representations (ICLR), 2022

    2022

  3. [11]

    Transferable unlearnable examples,

    J. Ren, H. Xu, Y . Wan, X. Ma, L. Sun, and J. Tang, “Transferable unlearnable examples,” in11th International Conference on Learning Representations (ICLR), 2023

    2023

  4. [12]

    Unlearnable examples for time series

    Y . Jiang, X. Ma, S. M. Erfani, and J. Bailey, “Unlearnable examples for time series.” arXiv preprint arXiv:2402.02028, 2024

    2024

  5. [13]

    BridgePure: Limited protection leakage can break black-box data protection

    Y . Wang, Y . Lu, X.-S. Gao, G. Kamath, and Y . Yu, “BridgePure: Limited protection leakage can break black-box data protection.” arXiv preprint arXiv:2412.21061, 2024

    2024

  6. [14]

    Better safe than sorry: Preventing delusive adversaries with adversarial training,

    L. Tao, L. Feng, J. Yi, S.-J. Huang, and S. Chen, “Better safe than sorry: Preventing delusive adversaries with adversarial training,” inAdvances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  7. [15]

    Never walk alone: Uncertainty for anonymity in moving objects databases,

    O. Abul, F. Bonchi, and M. Nanni, “Never walk alone: Uncertainty for anonymity in moving objects databases,” inProceedings of the 24th IEEE International Conference on Data Engineering (ICDE), pp. 376– 385, 2008

    2008

  8. [16]

    DPT: Differentially private trajectory synthesis using hierarchi- cal reference systems,

    X. He, G. Cormode, A. Machanavajjhala, C. M. Procopiuc, and D. Sri- vastava, “DPT: Differentially private trajectory synthesis using hierarchi- cal reference systems,” inProceedings of the VLDB Endowment, vol. 8, pp. 1154–1165, 2015

    2015

  9. [17]

    Machine unlearning fails to remove data poisoning attacks,

    M. Pawelczyk, J. Z. Di, Y . Lu, G. Kamath, A. Sekhari, and S. Neel, “Machine unlearning fails to remove data poisoning attacks,” inInter- national Conference on Learning Representations (ICLR), 2025

    2025

  10. [18]

    Poisoning at- tacks and defenses to federated unlearning,

    W. Wang, Q. Ma, Z. Zhang, Y . Liu, Z. Liu, and M. Fang, “Poisoning at- tacks and defenses to federated unlearning,” inCompanion Proceedings of the ACM Web Conference 2025, 2025

    2025

  11. [19]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in6th Interna- tional Conference on Learning Representations (ICLR), 2018

    2018

Pith tools

Reviewed June 28, 2026 · model on record in the stance chip above.