Pith. sign in

REVIEW 3 major objections 4 minor 31 references

Differentially Private Aggregated Mobility Data Publication Using Moving Characteristics

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Day-night splitting lets operators publish aggregated mobility counts under differential privacy.

desk verdict The hybrid day/night perturbation idea is new and sensible, but the main DP proof rests on a false sensitivity bound, so the central privacy guarantee collapses as written. read the letter →

arxiv 1908.03715 v1 pith:FU23XXW5 submitted 2019-08-10 cs.CR cs.DB

Zhili Chen , Xiaoli Kan , Shun Zhang , Lin Chen , Yan Xu , Hong Zhong This is my paper · ORCID
classification cs.CRcs.DB
keywords differentialprivacylocationaggregatedmobilitydatatrajectoryrecoveryattackLaplacemechanismexponentialsparsevectortechniquemovingcharacteristics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Mobile operators and location services routinely publish aggregate counts of how many users are in each area at each time, and a known attack can reconstruct individual trajectories from those counts. This paper claims that differential privacy can close that hole while keeping the counts useful, by spending the privacy budget differently in different parts of the day. It proposes two basic mechanisms—direct Laplace perturbation at every time stamp, and threshold perturbation that only re-noises when the data actually change—and then two hybrid mechanisms that split a day into a fast-changing daytime and a slow-moving nighttime. The static hybrid chooses the split with an exponential mechanism and applies direct perturbation by day and threshold perturbation by night; the dynamic hybrid predicts the split for streaming data with linear regression on past days. The authors prove $\epsilon$-differential privacy for all four schemes and report that the hybrids beat the basics in utility while pushing trajectory-recovery accuracy down from about 61% to 10–20% on a synthetic crowd dataset.

What carries the argument

The load-bearing object is the utility function $U(i,j)=\log_\alpha(j-i+1)\,\frac{\text{aveDis}}{\text{simVar}}$ used in the exponential mechanism to choose the two division points $\hat t_1,\hat t_2$ that separate daytime from nighttime. $\text{aveDis}$ is the average $\ell^1$ distance between histograms at adjacent time stamps and $\text{simVar}$ is the average absolute deviation from that mean; large average distance and small variation mark the period where direct perturbation is worth its budget. The same function's claimed global sensitivity, $2\log_\alpha S$, is what converts the division-point choice into an $\epsilon_s$-differentially private step, and the rest of the mechanism then applies Laplace perturbation in the daytime stretch and threshold (sparse-vector) perturbation at night, followed by a consistency post-process that rounds counts to non-negative integers preserving each histogram's total.

What would settle it

Take a neighboring pair of datasets that differ in one user's trajectory and evaluate $\max_{i,j}|U(D,i,j)-U(D',i,j)|$ for small $\text{simVar}$; if any value exceeds $2\log_\alpha S$, the exponential mechanism's selection probabilities can differ by more than $e^{\epsilon_s}$, refuting the sensitivity claim behind Theorem 6.3. A complementary experimental check is to sample the exponential mechanism many times on such a neighboring pair and estimate the log-ratio of selection probabilities for the same division point.

Watch

Extended reading notes

Core claim

The paper's central claim is that the publication of mobility histograms can be made both formally private and practically accurate if the perturbation method is matched to how fast people move. Direct perturbation adds $\text{Lap}(\Delta H/\epsilon)$ noise to every histogram independently; threshold perturbation uses a privately noised comparison of the distance between the previous noisy release and the current data to decide whether to release a fresh noisy histogram or reuse the old one. The improved static hybrid mechanism uses the exponential mechanism with utility $U(i,j)$ to pick two division points, then performs direct perturbation between them and threshold perturbation outside them; the dynamic version learns the division points from historical days using linear regression and applies the same split to data arriving on the fly. The formal results, Theorems 6.3 and 6.4, state that both hybrid mechanisms satisfy $\epsilon$-differential privacy by sequential and parallel composition of the $\epsilon_s$, $\epsilon_d$, and $\epsilon_t$ components, and the experiments claim that the hybrids outperform both basic schemes while resisting the trajectory-recovery attack.

Load-bearing premise

The entire privacy argument for the hybrid schemes assumes that the utility function $U(i,j)$ has global sensitivity at most $2\log_\alpha S$; because $\text{simVar}$ is allowed to be as small as 1, changing one user's trajectory can change the ratio $\text{aveDis}/\text{simVar}$ by more than that bound, and if so the exponential mechanism does not provide the claimed $\epsilon_s$-differential privacy.

Editorial extensions

If this is right

  • A mobile operator can publish daily crowd-count histograms under an explicit $\epsilon$-differential-privacy guarantee instead of stopping publication after a trajectory-recovery attack is demonstrated.
  • The recovered-trajectory accuracy on synthetic data drops from about 61% to 10–20% under the proposed mechanisms, so the published aggregates no longer function as a de facto tracking dataset.
  • Under the same privacy budget, the hybrid schemes report smaller mean absolute and mean relative errors than either basic scheme, which makes the formal guarantee affordable in practice.
  • The dynamic scheme extends the same protection to streaming histograms, as long as enough historical days are available to predict the day/night split.
  • The consistency post-process lowers error without consuming additional privacy budget, because differential privacy is preserved under post-processing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The day/night split is one instance of a general budget-allocation rule for periodic data: release fresh noise only when a change is large enough to matter. The same $U(i,j)$ score could be adapted to weekly or seasonal rhythms, but its sensitivity would need to be re-derived for each new definition, not assumed.
  • Because the paper's privacy proof hinges on the sensitivity bound of $U$, a safer route for the same architecture would be to replace the claimed global sensitivity with a per-dataset bound or to use a report-noisy-max selection that only needs the sensitivity of the average distance.
  • The dynamic scheme trains its linear regression on noisy division points from only $H$ past days; the paper does not quantify how prediction error shrinks as $H$ grows, so comparing predicted splits against oracle splits as $H$ varies is a natural testable extension.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies differentially private publication of aggregated mobility histograms, where each entry counts the number of users at a base station at a time stamp. It proposes two basic mechanisms — direct perturbation, which adds Laplace noise to every histogram, and threshold perturbation, which uses a sparse-vector-style comparison to decide when to release a fresh noisy histogram — and then two improved mechanisms, static and dynamic hybrid perturbation, that split a day into daytime and nighttime periods using an exponential mechanism with a utility function U(i,j) and apply direct or threshold perturbation to each period. The paper claims ε-differential privacy for all four mechanisms (Theorems 6.1–6.4), resistance to the trajectory recovery attack of Xu et al., and improved MAE/MRE utility over the basic schemes on synthetic and taxi datasets.

Significance. The problem is timely and the experimental setup, including an evaluation against an existing trajectory recovery attack on real taxi data, is relevant. The direct and threshold mechanisms are standard constructions and, for a fixed public threshold, the threshold mechanism can plausibly be analyzed with the sparse-vector technique. The central contribution, however, is the pair of hybrid schemes, and their privacy guarantees rest on the sensitivity analysis of the utility function U(i,j). That analysis is incorrect, so the main privacy theorems for the improved schemes are not established. Because the claimed advantage of the paper lies in these improved schemes, the contribution is not currently supported despite the credible basic-mechanism part.

major comments (3)
  1. [§6.2, Eq. (7), 'Sensitivity' paragraph] The asserted global sensitivity of U(i,j) is 2 log_α S is false. The denominator simVar is data-dependent, is not bounded below by 1 (it is 0 when all adjacent L1 distances in the interval are equal, and the text only replaces it by 1 when i=j or simVar<0), and the quotient aveDis/simVar is not Lipschitz in the data. For a fixed interval of length 3, take histograms (50,150), (0,200), (51,149) at t1, t2, t3 and the neighboring dataset obtained by removing one user who is in cell 1 at t1 and cell 2 at t2 and t3. The adjacent L1 distances change from (100,102) to (98,102), so (aveDis, simVar) changes from (101,1) to (100,2); hence |U−U′| = 51 log_α 3. With the default α=12 and S=19, this is about 22.6, while the claimed bound is 2 log_12 19 ≈ 2.37. The same construction with larger counts (e.g., t1=(500,500), t2=(0,1000), t3=(501,499)) gives a difference of about 501 log_α 3, showing that the mismatch grows with the histogram scale. Thus no finite sensitivity of the claimed form exists, the exponential mechanism in Algorithm 4 is not proved to satisfy ε_s-DP, and Theorem 6.3, together with the corresponding historical-data step in Algorithm 5, collapses.
  2. [§7.3 and Algorithm 2] The threshold T is treated as a public, fixed input in Algorithm 2, but the experiments set T from the current day's raw data: §7.3 defines T̄ as the average L1 distance of adjacent time stamps of the current day and then varies T over T̄/5, T̄/4, T̄/3, T̄/2, T̄. If T is chosen from the data without additional privacy protection, the sparse-vector analysis in Theorem 6.2 and hence the privacy of every scheme that uses threshold perturbation no longer follows. The authors need to specify how T is selected independently of the data or allocate part of the privacy budget to a private selection of T; as written, the experimental utility comparisons in Figs. 7 and 8 use a data-dependent secret input.
  3. [§6.4, Theorem 6.4] The proof of Theorem 6.4 applies parallel composition between the H historical time divisions and the current-day perturbation. This is not justified under the paper's own neighboring relation, defined in §5.1 as differing in one user's trajectory: the same users appear across days, so removing one user changes both the historical data and the current data simultaneously. The historical divisions and the current release are therefore not computed on disjoint privacy units, and parallel composition does not apply. The statement that 'historical data of each past day are independent of one another' concerns statistical dependence of the data values, not the DP neighboring relation, and does not repair the composition argument. In addition, Algorithm 5 line 3 says each historical day's division is performed 'with budget ϵ', which would consume Hε if composed, conflicting with the later split into ϵd, ϵt1, and ϵt2; the budget accounting needs to be stated precisely.
minor comments (4)
  1. [Algorithm 1, Line 2] The loop header says 'for i = 0 to S', but the data are indexed from 1 to S; this off-by-one error should be corrected.
  2. [§5.3, Consistency Post-processing] The utility argument for the non-negative post-processing step is heuristic: the claim that decrementing a random positive entry has probability 1/2 of reducing the L1 distance is not derived and is not generally true without distributional assumptions on the noise. The authors should either prove the claim under the Laplace noise distribution or soften the claim to an empirical observation.
  3. [Throughout] There are several typos and wording errors: 'Seqential Composition' in Theorem 3.4, 'cdots' in the same theorem, 'direction perturbation' in the proof of Theorem 6.3, and 'texi dataset' in §7.3 should be 'taxi dataset'.
  4. [Algorithm 5, Line 3] The phrase 'with budget ϵ' for each historical day is ambiguous; it should be clarified whether the historical divisions consume the same global budget or a separate one, and how this is reflected in the final privacy guarantee.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the DP proofs use standard composition and the hybrid split is selected via an exponential mechanism, so the central claims do not reduce to their own inputs by construction.

full rationale

The paper's derivation chain is not circular. The basic schemes (Algorithms 1 and 2) instantiate standard Laplace and sparse-vector mechanisms, and Theorems 6.1 and 6.2 apply textbook composition and post-processing arguments. The improved static scheme (Algorithm 4) selects its day/night division via an exponential mechanism over a utility function U(i,j), and the privacy proof then composes this with the two basic mechanisms; this is a legitimate use of the exponential mechanism, not a fitted parameter renamed as a prediction. The dynamic scheme (Algorithm 5) trains a linear-regression model on historical division points and uses it to predict the current day's division; the current data are not used to fit the predictor, so the prediction is genuinely out-of-sample and not circular. The only parameters that are empirically tuned, alpha = 12 and the threshold T (chosen as a fraction of the current day's average L1 distance), affect experimental utility but are not presented as predictions derived from fits, and they are not embedded in the privacy theorems in a way that makes those theorems definitional. The severe flaw in the paper is a correctness gap, not circularity: the asserted sensitivity bound '2 log_alpha S' for U(i,j) in Eq. (7) is not valid because the quotient aveDis/simVar is not Lipschitz in the data, and the experimental use of a data-dependent threshold T is outside the sparse-vector assumption that T is fixed. These issues undermine the claimed DP guarantee, but they do not make the derivation equivalent to its inputs by construction. Since no load-bearing step reduces to a self-citation, a definitional tautology, or a fitted value masquerading as a prediction, the circularity score is 0.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central privacy claims rest on standard DP machinery plus two data-dependent choices: the day/night split via a utility function whose sensitivity is miscomputed, and a threshold T taken from the data in experiments. No new physical or conceptual entities are introduced.

free parameters (6)
  • alpha (utility function log base) = 12
    Set 'empirically' in Section 6.2 and used as default in experiments; it controls the interval-length term in U(i,j) and thus affects which split points are selected.
  • Threshold T = Tbar/4 in utility-vs-privacy experiments, varied from Tbar/5 to Tbar
    Input to threshold and hybrid perturbation; in experiments T is derived from the current day's average L1 distance (Tbar), making it data-dependent and not protected by DP.
  • Privacy budget split ratios = Not specified
    Algorithms 2, 4, and 5 divide the privacy budget into parts (epsilon_1/epsilon_2, epsilon_s/epsilon_d/epsilon_t, epsilon_d/epsilon_t1/epsilon_t2) but no method or values are given for choosing these splits.
  • Cutoff point c = Not specified
    Threshold perturbation and hybrid schemes take cutoff c as input limiting the number of perturbations; no value or selection method is stated.
  • Learning rate beta (gradient descent) = Not specified
    Dynamic hybrid perturbation uses gradient descent for linear regression; the learning rate is not stated.
  • gamma in MRE = 0.001
    Set to avoid division by zero in the MRE metric; arbitrary and minor, but part of the evaluation.
assumptions (4)
  • domain assumption The moving characteristics of human mobility (frequent daytime movement, static nighttime stays) hold for the target datasets.
    Section 6.1 motivates the hybrid split using literature [2,3] and Fig. 2 on the two evaluation datasets; the utility advantage of hybrid schemes depends on this pattern holding.
  • domain assumption Historical data for each past day are independent of each other and of the current day's data.
    Theorem 6.4 proof uses parallel composition across H historical days and assumes independence; Section 6.4 states this and calls it reasonable.
  • ad hoc to paper The sensitivity of the utility function U(i,j) is 2 log_alpha S.
    Section 6.2 'Sensitivity' paragraph asserts this bound, but dividing by simVar (which can be close to 1) means the true sensitivity can be much larger; this is an unproved premise in the exponential mechanism.
  • standard math Standard differential privacy composition and Laplace/exponential mechanism guarantees.
    Used throughout Sections 5-6; accepted background from Dwork et al. and Dwork-Roth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Differentially Private Aggregated Mobility Data Publication Using Moving Characteristics." pith.science (2026). https://pith.science/paper/FU23XXW5

@misc{pith2026190803715,
  author       = {Pith},
  title        = {Pith review of: Differentially Private Aggregated Mobility Data Publication Using Moving Characteristics},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FU23XXW5}},
  note         = {Machine review of arXiv:1908.03715}
}
read the original abstract

With the rapid development of GPS enabled devices (smartphones) and location-based applications, location privacy is increasingly concerned. Intuitively, it is widely believed that location privacy can be preserved by publishing aggregated mobility data, such as the number of users in an area at some time. However, a recent attack shows that these aggregated mobility data can be exploited to recover individual trajectories. In this paper, we first propose two differentially private basic schemes for aggregated mobility data publication, namely direct perturbation and threshold perturbation, which preserve location privacy of users and especially resist the trajectory recovery attack. Then, we explore the moving characteristics of mobile users, and design an improved scheme named static hybrid perturbation by combining the two basic schemes according to the moving characteristics. Since static hybrid perturbation works only for static data, which are entirely available before publishing, we further adapt the static hybrid perturbation by combining it with linear regression, and yield another improved scheme named dynamic hybrid perturbation. The dynamic hybrid perturbation works also for dynamic data, which are generated on the fly during publication. Privacy analysis shows that the proposed schemes achieve differential privacy. Extensive experiments on both simulated and real datasets demonstrate that all proposed schemes resist the trajectory recovery attack well, and the improved schemes significantly outperform the basic schemes.

Figures

Figures reproduced from arXiv: 1908.03715 by the authors.

Figure 1
Figure 1. System Model Gradient Decent. In order to find the optimal hypothesis func￾tion parameters, the goal is to make the cost function take the smallest value. Gradient descent can help us find the local mini￾mum point of a function. It can be used not only in linear regression model, but also in many other machine learning models. The idea is as follows: (1) initialization parameters θ0 and θ1; (2) continuously update t… view at source ↗
Figure 2
Figure 2. The Distances at Adjacent Time stamps on Two [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The Framework of the Improved Schemes 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 0 5000 10000 15000 20000 25000 30000 Time Distance 'D\WLPH3DUW Ö 1LJKWWLPH3DUW 1LJKWWLPH3DUW WÖ1 W [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: A Time Division for Synthetic Dataset differentially private way, and then perturb each division of data according to their moving characteristics. Specifically, the static hybrid perturbation selects two time division points tˆ1 and tˆ2 through the exponential mechani…
Figure 5
Figure 5. Figure 5: Trajectory recovery on two dataset (maybe home and workplace). At different time periods, there is a difference in the time durations users stays, and the stay time durations during the night time are significantly longer than those during the day. And the rule of crow…
Figure 7
Figure 7. Figure 7: Utility vs T on synthetic dataset T/5 T/4 T/3 T/2 T 0.063 0.071 0.079 0.087 0.095 0.103 0.111 0.119 Threshold MAE Sta−HP Dy−HP Th−P Dir−P - - - - - (a) MAE T/5 T/4 T/3 T/2 T 30 34 39 43 48 52 57 Threshold MRE Sta−HP Dy−HP Th−P Dir−P - - - - - (b) MRE [PITH_FULL_IMAGE:…
Figure 8
Figure 8. Figure 8: Utility vs T on taxi dataset affected, since it uses threshold perturbation. While the nighttime part is suitable for threshold perturbation, and thus the impact on data utility is limited. Utility vs Privacy. As shown in [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Utility vs ϵ on synthetic dataset 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 0.06 0.07 0.08 0.09 0.10 0.11 0.12 0.13 0.14 0.15 Privacy Budget Setting(ε) MAE Sta−HP Dy−HP Dir−P Th−P (a) MAE 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 29 34 39 44 49 54 59 64 69 74 Priva…
Figure 10
Figure 10. Figure 10: Utility vs ϵ on taxi dataset 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 0.30 0.71 1.12 1.53 1.94 2.35 2.76 3.17 3.58 3.99 4.40 Privacy Budget Setting(ε) MAE Sta−HP Dy−HP Sta−HP without PP Dy−HP without PP (a) MAE 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 0.10 0.41 …
Figure 11
Figure 11. Figure 11: Utility vs ϵ on synthetic dataset 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 0.05 0.56 1.07 1.58 2.09 2.60 3.11 3.62 4.13 4.64 Privacy Budget Setting(ε) MAE Sta−HP Dy−HP Sta−HP without PP Dy−HP without PP (a) MAE 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 25 526 102…
Figure 12
Figure 12. Figure 12: Utility vs ϵ on taxi dataset privacy budget is small (eg., ϵ is 0.1), the post-process mechanism has a significant effect on reducing the error. And as the privacy budget becomes larger, the effect becomes less obvious. This is because when the privacy budget ϵ is lar…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 30 canonical work pages

  1. [1]

    Avrim Blum, Cynthia Dwork, Frank Mcsherry, and Kobbi Nissim. 2005. Practical privacy: The SulQ framework. In Proceedings of the Twenty-fourth ACM SIGACT- SIGMOD-SIGART Symposium on Principles of Database Systems . ACM, Baltimore, 128–138

    work page 2005

  2. [2]

    Jinzhou Cao, T. U. Wei, L. I. Qingquan, and Rui Cao. 2017. Spatio-temporal Anal- ysis of Aggregated Human Activities Based on Massive Mobile Phone Tracking Data. Journal of Geo-Information Science 19, 4 (2017), 467–474

    work page 2017

  3. [3]

    Lina Chen, W. U. Sheng, Jie Chen, L. I. Mingxiao, and L. U. Feng. 2018. The Near-real-time Prediction of Urban Population Distributions Based on Mobile Phone Location Data. Journal of Geo-Information Science 20, 4 (2018)

    work page 2018

  4. [4]

    Irit Dinur and Kobbi Nissim. 2003. Revealing Information while Preserving Privacy. InAcm Sigmod-sigact-sigart Symposium on Principles of Database Systems. ACM, San Diego, 202–210

    work page 2003

  5. [5]

    Cynthia Dwork. 2006. Differential privacy. (2006), 1–12

    work page 2006

  6. [6]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. 2006. Cali- brating Noise to Sensitivity in Private Data Analysis . Springer, New York. 265–284 pages

    work page 2006

  7. [7]

    Cynthia Dwork and Kobbi Nissim. 2004. Privacy-Preserving Datamining on Vertically Partitioned Databases. In Advances in Cryptology - CRYPTO 2004, 24th Annual International CryptologyConference,. Springer, Santa Barbara, 528–544

    work page 2004

  8. [8]

    Cynthia Dwork and Aaron Roth. 2014. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    work page 2014

Show all 31 references
  1. [9]

    Stefanakis E. 2012. Trajectory Generalization under Space Constraints. InSeventh International Conference on Geographic Information Science . 18–21

    2012

  2. [10]

    Lynn E. Eberly. 2003. Correlation and Simple Linear Regression. Radiology 227, 3 (2003), 617–622

    2003

  3. [11]

    Liyue Fan and Li Xiong. 2012. Real-time aggregate monitoring with differential privacy. In 21st ACM International Conference on Information and Knowledge Management, CIKM’12. ACM, Maui, 2169–2173

    2012

  4. [12]

    Sibren Isaacman, Richard Becker, Ramĺőn Cĺćceres, Margaret Martonosi, James Rowland, Alexander Varshavsky, and Walter Willinger. 2012. Human mobility modeling at metropolitan scales. In International Conference on Mobile Systems . ACM, 239–252

    2012

  5. [13]

    Georgios Kellaris, Stavros Papadopoulos, Xiaokui Xiao, and Dimitris Papadias

  6. [14]

    Byoungyoung Lee, Jinoh Oh, Hwanjo Yu, and Jong Kim. 2011. Protecting loca- tion privacy using location semantics. In Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . ACM, San Diego, 1289–1297

    2011

  7. [15]

    Haoran Li, Li Xiong, Xiaoqian Jiang, and Jinfei Liu. 2015. Differentially Private Histogram Publication For Dynamic Datasets: An Adaptive Sampling Approach. (2015), 1001–1010

    2015

  8. [16]

    Ninghui Li, Min Lyu, Dong Su, and Weining Yang. 2016. Differential Privacy: From Theory to Practice. Synthesis Lectures on Information Security Privacy and Trust 8, 4 (2016), 1–138

    2016

  9. [17]

    Frank Mcsherry and Kunal Talwar. 2007. Mechanism Design via Differential Privacy. In IEEE Symposium on Foundations of Computer Science , Vol. 8. IEEE, 97–103

    2007

  10. [18]

    Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. 2018. Foundations of Machine Learning

    2018

  11. [19]

    Ben Niu, Qinghua Li, Xiaoyan Zhu, Guohong Cao, and Li Hui. 2014. Achieving k-anonymity in privacy-aware location-based services. In 2014 IEEE Conference 11 Anonymous submission #231 to ACM CCS 2019 on Computer Communications, INFOCOM 2014 . IEEE, Toronto, 754–762

    2014

  12. [20]

    Ben Niu, Zhengyan Zhang, Xiaoqing Li, and Hui Li. 2014. Privacy-area aware dummy generation algorithms for Location-Based Services. In IEEE International Conference on Communications, ICC 2014 . IEEE, Sydney, 957–962

    2014

  13. [21]

    Roman Schlegel, Chi-Yin Chow, Qiong Huang, and Duncan S. Wong. 2015. User- Defined Privacy Grid System for Continuous Location-Based Services. IEEE Trans. Mob. Comput. 14, 10 (2015), 2158–2172

    2015

  14. [22]

    Huandong Wang, Fengli Xu, Li Yong, Pengyu Zhang, and Depeng Jin. 2015. Understanding Mobile Traffic Patterns of Large Scale Cellular Towers in Urban Environment. In Internet Measurement Conference. ACM, 225–238

    2015

  15. [23]

    Qian Wang, Yan Zhang, Xiao Lu, Zhibo Wang, Zhan Qin, and Kui Ren. 2016. RescueDP: Real-time spatio-temporal crowd-sourced data publishing with dif- ferential privacy. In 35th Annual IEEE International Conference on Computer Communications, INFOCOM 2016. IEEE, San Francisco, 1–9

    2016

  16. [24]

    Shibin Wang, Nianmin Yao, Ning Gong, and Zhenguo Gao. 2018. A trigger- based pseudonym exchange scheme for location privacy preserving in VANETs. Peer-to-Peer Networking and Applications 11, 3 (2018), 548–560

    2018

  17. [25]

    Fengli Xu, Zhen Tu, Yong Li, Pengyu Zhang, Xiaoming Fu, and Depeng Jin. 2017. Trajectory Recovery From Ash: User Privacy Is NOT Preserved in Aggregated Mobility Data. In Proceedings of the 26th International Conference on World Wide Web, WWW 2017. ACM, Perth, 1241–1250

    2017

  18. [26]

    Jing Yuan, Yu Zheng, Xing Xie, and Guangzhong Sun. 2011. Driving with knowledge from the physical world. In Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . ACM, San Diego, 316–324

    2011

  19. [27]

    Jing Yuan, Yu Zheng, Chengyang Zhang, Wenlei Xie, Xing Xie, Guangzhong Sun, and Yan Huang. 2010. T-drive: driving directions based on taxi trajectories. In 18th ACM SIGSPATIAL International Symposium on Advances in Geographic Information Systems. ACM, San Jose, 99–108

    2010

  20. [28]

    XJ Zhang, XL Gui, and ZD Wu. 2015. Privacy preservation for location-based services: a survey. Journal of Software 26, 9 (2015), 2373–2395

    2015

  21. [29]

    Xiaojian Zhang, Xiaofeng Meng, and Rui Chen. 2013. Differentially Private Set- Valued Data Release against Incremental Updates . Springer, Wuhan. 392–406 pages

    2013

  22. [30]

    Ao Ying Zhou and Shanghai. 2011. Location-Based Services: Architecture and Progress. Chinese Journal of Computers 34, 7 (2011), 1155–1171. 12

    2011

  23. [2014]

    PVLDB 7, 12 (2014), 1155–1166

    Differentially private event sequences over infinite streams. PVLDB 7, 12 (2014), 1155–1166

    2014

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.