# Where you go is who you are - A study on machine learning based semantic
privacy attacks

Nina Wiedemann1,∗, Ourania Kounadi2, Martin Raubal1, Krzysztof Janowicz2

###### Abstract

Concerns about data privacy are omnipresent, given the increasing usage of
digital applications and their underlying business model that includes selling
user data. Location data is particularly sensitive since they allow us to
infer activity patterns and interests of users, e.g., by categorizing visited
locations based on nearby points of interest (POI). On top of that, machine
learning methods provide new powerful tools to interpret big data. In light of
these considerations, we raise the following question: What is the actual risk
that realistic, machine learning based privacy attacks can obtain meaningful
semantic information from raw location data, subject to inaccuracies in the
data? In response, we present a systematic analysis of two attack scenarios,
namely location categorization and user profiling. Experiments on the
Foursquare dataset and tracking data demonstrate the potential for abuse of
high-quality spatial information, leading to a significant privacy loss even
with location inaccuracy of up to 200m. With location obfuscation of more than
1 km, spatial information hardly adds any value, but a high privacy risk
solely from temporal information remains. The availability of public context
data such as POIs plays a key role in inference based on spatial information.
Our findings point out the risks of ever-growing databases of tracking data
and spatial context data, which policymakers should consider for privacy
regulations, and which could guide individuals in their personal location
protection measures.

∗ Corresponding author<EMAIL_ADDRESS>
1 Institute of Cartography and Geoinformation, ETH Zurich, Zurich, Switzerland

2 Department of Geography and Regional Research, University of Vienna, Vienna,
Austria

_K_ eywords location privacy, place labelling, semantic privacy, human
mobility

## Introduction

In the age of big data, an unprecedented amount of information about
individuals is publicly available. Not only the information from social media
profiles can be exploited to gain rich insights into the private life of
individuals, but also data that is collected by applications on-the-fly.
Collecting and selling such data has become a business model of commercial
consumer data brokers, who distribute individual data of users, oftentimes
without their awareness [14]. A particularly popular source is location data,
as the whereabouts of people allow rich insights into their daily activities
[36, 5, 20, 58], for example, for the purpose of profiling. Even though
awareness for (location) privacy has increased in recent years [2], this is
oftentimes not reflected in user behavior, which has been termed the “privacy
paradox” [63, 7]. Only gradually, companies are reacting to imposed privacy
regulations and the efforts of privacy advocates’ groups [27]. For example,
AppleTM is giving back control over data sharing decisions in the iPhoneTM,
including location data111https://support.apple.com/guide/iphone/control-the-
location-information-you-share-iph3dd5f9be/ios, and StravaTM offers to
restrict track-visibility in their app for recording physical
activities.222https://support.strava.com/hc/en-us/articles/115000173384-Edit-
Map-Visibility

The simplest way to protect location data is a form of masking or obfuscation
of the exact geographic coordinates [44]; i.e., deliberately reducing the data
quality [19]. While hiding the exact location may provide some anonymity, the
risk of unwanted semantic inference from the raw location data remains. For
example, if a user is detected in a busy city district at night, it is very
likely that the user is in a bar or club. This type of inference was recently
termed ”semantic privacy attack” [75], in contrast to previous work on
location privacy that was mainly concerned with user re-identification attacks
[17, 67, 49, 50, 45].

In this work, we define and analyze a special type of semantic privacy attack
that is motivated by the real-life problem that brokers obtain location data
and sell them as valuable information about user behavior, for example, for
targeted advertisement or for insurance policy offer. Here, we disregard how
an adversary would obtain location data but instead focus on the question of
how he would derive meaningful user profiles from the raw location data of a
single user. We argue that a smart attacker would tackle this problem by
utilizing spatial and temporal information for categorizing the locations that
a user has visited, drawing from methods developed in reverse geocoding [43,
12, 22, 1, 47, 62], activity categorization [61, 77, 69, 57, 16, 23] and place
labeling [83, 40, 18] research. For example, if the location data indicates a
two-hour stay in a place with many bars nearby, the attacker may derive that
the activity falls into the category ”Nightlife”. In a second step, the
attacker could aggregate the (predicted) categories of all locations that a
user visited into a location-based user profile. For example, the profile is
60% ”Dining”, 30% ”Retail”, and 10% ”Nightlife”. In short, we consider the
following two semantic attack scenarios:

  * Task 1: Given a location visit defined by geographic coordinates and a visitation time, the attacker aims to assign the place to the correct category.

  * Task 2: Given the location visitation pattern of a user, the attacker aims to derive a user profile, defined as the visitation frequencies to each of the location categories.

To the best of our knowledge, this type of location-based user profiling has
not been regarded as a privacy attack, and similar definitions for user
profiles are mainly found in literature on recommender systems [78, 85]. Note
that if these tasks are feasible, the attacker would not only know about
activity frequencies but also about when and where each type of activity is
preferably carried out. The input data of the attacker is assumed to consist
only of geographic coordinates and timestamps. Such data could stem from GNSS
tracking data, from Call-Detail-Records [86], or other forms of movement data.

According to [41], ”an individual’s level of geoprivacy cannot be reliably
assessed because it is impossible to know what auxiliary information a third
party may have access to.” (p. 11). However, one can attempt to quantify the
level of privacy by simulating realistic scenarios and measuring the accuracy
of the attacker [71, 70]. By realistic, we mean that an attacker tries to
enrich the raw data with as much information as possible and employs
sophisticated algorithms to analyze patterns in such information. We believe
that there is a lack of work analyzing 1) which spatial and temporal
information may be exploited, 2) how the data quality, as well as the level of
intended inaccuracy due to location protection measures, affects an attacker’s
accuracy, and 3) what is the relation to the density and quality of spatial
context data, e.g., public POIs. We, therefore, evaluate the effectiveness of
machine learning based semantic privacy attacks in different scenarios with
respect to the information available to the attacker and, similar to [25],
varying the data accuracy by means of random perturbations of the location.

## Related work

### Reverse geocoding and activity categorization

Many studies utilize a well-known dataset of location check-ins from the
Location-based Social Network (LBSN) Foursquare, which is very suitable due to
its size, its detailed POI categorization taxonomy, and the availability of
user-wise check-in data. The POIs and visitation patterns were analyzed for
recommender system applications [84], for deriving interpretable latent
representations of venues [3] or to infer urban land-use via clustering of POI
data [24]. Yang et al. [81] train models on the Foursquare dataset to infer
spatio-temporal activity preferences of users for the purpose of place
recommendation. In this work, we take a machine learning viewpoint and regard
the Foursquare data as a labeled dataset that is suitable to model the real-
life scenario where an attacker aims to categorize the locations of an
_unseen_ user.
However, it was shown that not only spatial but also temporal information
about location visits could be exploited to infer location categories [52].
This has been reported implicitly in other work, for example, Do and Gatica-
Perez [18] regard the problem of automatic place labeling into 10 categories,
leveraging visitation patterns, e.g., temporal features (start and end time or
duration) and visitation frequency from smartphone data. McKenzie et al. [54]
connect this observation to geoprivacy research by showing that temporal
information or texts from social media posts can be exploited for inference
about user locations by matching their semantic signatures [39, 53]. While our
study is on location categorization and user profiling, in contrast to user
localization, their study inspired us to include temporal features in the
attack scenario and to contrast their effect on the attacker’s success to the
one due to spatial information.
Furthermore, work on user profiling from location data (our second attack
task) can mainly be found in the literature on recommender systems, which is
surveyed in [6]. The POI embedding of users can be viewed as their location
profile, for example, with graph-based embeddings [78]. Ying et al. [85]
compare users by their ”semantic trajectory”, defined as the categories of
sequentially visited places. We follow their approach but disregard the order
of places.

### Location privacy research

Privacy risks and potential privacy preservation techniques were studied
extensively in the past years [64]. In location privacy research, it was found
that a few track points are sufficient to uniquely identify users [17, 67,
28], that it is possible to track people just by the speed and starting
location [26] or by accelerometer readings [34], and that even topological
representations of movement data without coordinates can be exploited to match
users [49, 50]. A common aim of many works is to maintain the performance of a
location-based service while providing privacy guarantees; i.e., to optimize
the privacy-utility trade-off [72, 9]. Various frameworks for protecting
sensitive location data were proposed [19, 55, 10, 68, 56], oftentimes based
on k-anonymity [73, 31, 33] or $\epsilon$-differential privacy [35, 4, 21,
38]. For an overview of possible privacy attacks on location data and
protection methods we refer to the reviews by Kounadi et al. [44] and Wernke
et al. [76].
This work instead analyzes privacy attacks that aim to reveal personal
information, i.e., interests and behavioural patterns. Related work in this
direction, for example, investigates to what extent demographics (e.g., age or
gender) and visited POIs can be derived from location traces [46]. Crandall et
al. [15] and Olteanu et al. [59] analyze co-location events and the risk to
infer social ties. Tu et al. [75] recently termed the inference of private
semantic information from movement trajectories as a ”semantic” privacy
attack, and they specifically regard contextual POI data as semantics. We
build up on their definition and consider attacks that aim to infer POI
categories. Tu et al. [75] propose l-diversity and t-closeness measures to
protect trajectories from semantic inference. However, these approaches rely
on trusted third-party (TTP) services that mask the data of multiple users and
update their data iteratively in online applications [60, 42]. Omitting the
dependence on a TTP is possible, for example, with simple location obfuscation
methods, i.e., adding random noise to coordinates or methodologically
translating geographic coordinates in space [19, 4]. Zhang et al. [88] and
Götz et al. [29] further propose context-aware masking techniques that are
applicable to new users. Here, we do not aim to compare location protection
methods, but to quantify the risks of realistic semantic privacy attacks
without access to a TTP service. Thus, we utilize location obfuscation mainly
as a tool for modelling reduced data quality in real-world scenarios. As
proposed by Shokri [70], we evaluate the attacker’s accuracy to quantify
privacy loss.

## Experimental design

We take a machine learning viewpoint and assume that the attacker aims to
learn a mapping from visited locations to categories. The available data are a
time series of location visits of a new user $u$. We group the raw data by
location in order to gather temporal information about the visitation patterns
to one location. The dataset $D_{u}$ for one user $u$ can be formalized as

$\displaystyle
D_{u}=\\{\big{(}l_{i}^{u},[t_{1}(l_{i}^{u}),t_{2}(l_{i}^{u}),\dots]\big{)}\ |\
l_{i}^{u}\in L_{u}\\}\ =\\{\big{(}l_{i}^{u},T_{u}(l_{i}^{u})\big{)}\ |\
l_{i}^{u}\in L_{u}\\}\,$ (1)

where $L_{u}$ is the set of all locations visited by the user $u$, $l_{i}^{u}$
is one location in $L_{u}$, and $t_{j}(l_{i}^{u})$ is the time of the $j$-th
visit of user $u$ to location $l_{i}^{u}$. For simplicity, we abbreviate the
ordered list of visit times as $T_{u}(l_{i}^{u})$. Furthermore, we assume
there exists an unambiguous mapping $c:L\longrightarrow C$ from each location
to a category from a predefined location-category set $C$. For example,
$C=\\{\text{ Dining, Sports, Shopping}\\}$ and the categories for user $u$ are
$c(l_{1}^{u})=\text{Shopping}$, $c(l_{2}^{u})=\text{Dining}$, etc.

The attacker aims to learn a model $\hat{c}$ that approximates the true
mapping $c$. The most straightforward approach for $\hat{c}$ is a spatial
nearest neighbor join with a public POI dataset; i.e., if the spatially
closest POI is a restaurant, then $\hat{c}(l_{i}^{u})=\text{Dining}$. More
sophisticated methods could pool the spatial and temporal information and
frame $\hat{c}$ as a machine learning model. Here, we simulate the latter via
the XGBoost (XGB) algorithm [13]. XGB is a tree-based boosting method that was
repeatedly shown to outperform Neural Networks on tabular data [30] and is
known to perform particularly well in classification tasks with unbalanced
data, as it is the case here. We also chose XGB for its interpretability and
since it was empirically superior to a multi-layer perceptron approach in our
tests (see Methods - Machine learning model). Together, we consider the
following attack scenarios:

  * •

Spatial join: For each user-location $l_{i}^{u}$, the category of the public
POI that is closest to its geographic location $(x(l_{i}^{u}),y(l_{i}^{u}))$
is assigned.

  * •

XGB temporal: The attacker employs a learning approach, namely XGBoost, based
on temporal information derived from $T_{u}(l_{i}^{u})$ (see Methods -
Temporal features).

  * •

XGB spatial: The attacker trains a model on spatial context features (see
Methods - Spatial features). No temporal visit information is considered, only
coordinates and publicly available POI data.

  * •

XGB spatiotemporal: The model is trained on all available features, i.e.,
features derived from $(x(l_{i}^{u}),y(l_{i}^{u}))$ and $T_{u}(l_{i}^{u})$ as
well as available POI data.

In addition, we report the results for an uninformed attacker, where the
predictions are drawn randomly from a categorical distribution, with the class
probabilities corresponding to the class frequency in the training data.

Figure 1: Overview of the experimental setup. The samples are spatiotemporal
data about location visitation patterns. We simulate reduced data quality and
potential protection measures by obfuscating the geographic coordinates. The
samples are then featurized into vectors encoding temporal visitation patterns
and spatial context. We simulate a privacy attack with a trained ML model on
new users by a train-test split and evaluate the attacker’s accuracy on the
test data.

In our experimental setup, we take an ML perspective and simulate the attack
on new users via a train-test data split. Evaluating the accuracy of this
attack requires a labeled dataset $\mathcal{D}$ of user-location pairs
$l_{i}^{u}$; i.e., the location category $c(l_{i}^{u})$ must be known. GNSS
tracking datasets usually do not provide detailed and reliably place labels.
Instead, we found a public dataset from the location-based social network
Foursquare most suitable for this experiments since location visits are given
as check-ins to places of known categories. The dataset was already used for
related tasks [84, 3, 81, 24], but without regarding privacy aspects. The
places are categorized into 12 distinct classes according to the Foursquare
place taxonomy (see Figure 3 for the list of categories and section Methods -
Data and preprocessing for details). Additionally, we also use the Foursquare
places as public POI data that may be exploited by the attacker as auxiliary
spatial context data. Figure 1 provides a visual overview of the experimental
setup. The input data (geographic coordinates and time points) are enriched
with spatial and temporal features. Before computing spatial features, the
location is obfuscated within a varying radius $r$ to simulate GNSS
inaccuracies and possible privacy protection measures (see Methods - Location
masking). Then, the data is split into train and test sets, either by user or
spatially, to simulate transfer to new users or even to other geographic
regions. All results are reported on the combination of all test sets from
10-fold cross validation (Methods - Data split).

## Results

### Effect of location obfuscation on place labeling accuracy

The results for task 1 (location categorization) are evaluated in terms of
accuracy, i.e., the number of correctly categorized places divided by the
total number of samples, across all users and all locations (90790 samples in
NYC and 211834 in Tokyo):

$\displaystyle
Acc(\hat{c},c)=\frac{\sum_{l_{i}^{u}\in\mathcal{D}}\mathbbm{1}[\hat{c}(l_{i}^{u})=c(l_{i}^{u})]}{|\mathcal{D}|}$
(2)

Figure 2: Effect of location obfuscation radius on the attacker’s performance
in categorizing locations. Spatial information are valuable for an ML
algorithm even with up to 1km of obfuscation.

Figure 2 shows the classification accuracy of the attack scenarios by the
obfuscation radius. Note that $r=0$ is an unrealistic scenario, since the
check-in data and the public POI context data are both from the Foursquare
dataset and are based on the exact same set of geographic coordinates. Thus, a
simple spatial nearest neighbor join of the check-in location with public POIs
achieves 100% accuracy if no obfuscation is applied. Deriving a user’s
location from tracking data would obviously hardly yield the exact same point
coordinates as a public POI. We, therefore, consider more realistic scenarios
with weak obfuscation, and, additionally, protective scenarios with strongly
obfuscated coordinates. The results presented in Figure 2 indicate that the
accuracy decreases rapidly with the obfuscation radius. However, even when the
attacker uses only temporal information, the accuracy is 39.1% for Tokyo and
29.7% for NYC, which is significantly better than random (grey line). On top
of that, spatial context information can benefit the attack even when the
location is obfuscated within a radius of 1km. This is remarkable and
demonstrates the danger of powerful privacy attacks that make use of public
POI data. In the appendix, we relate these findings to the spatial
autocorrelation of place types (Figure 17) and we demonstrate that the results
of NYC and Tokyo are surprisingly similar (see appendix Figure 13).
Furthermore, the categorization accuracy depends on the place type; i.e., some
categories are harder to detect than others. Figure 3 presents the confusion
matrix for the attack scenario at 100m obfuscation. The error is more evenly
distributed over categories than expected, although ”Dining” and ”Retail” are
predicted disproportionally often (see appendix Figure 11).

Figure 3: Normalized confusion matrix of predictions in NYC with Foursquare
data and location prediction with an obfuscation radius of 100m. The accuracy
is rather balanced across categories; however, many activities are erroneously
classified as ”Dining”.

Figure 2 additionally compares a user split to a spatial split to analyze
generalization across space (see Methods - Data split). Note that a user split
is expected to be strictly better than the spatial split because the input
data does not include user-identifying information such as age or gender,
rendering the generalization to new users as easy as to any new samples.
Surprisingly, the spatial cross-validation split only has a minor effect on
the attacker’s accuracy (decrease of $\sim 5$%). We conclude that the
attacker’s training data set is not required to cover the exact same region
for the privacy attack to be successful.

### User profiling error for probabilistic and frequency-based profiling

While the ability of a potential attacker to categorize visited locations is
concerning, we argue that the main risk is user profiling based on the
predicted categories. It is unclear to what extent the high categorization
accuracy on a location level transfers to a high profiling accuracy on a user
level. Here, we define a user profile as the frequency of different types of
locations in the user’s mobility patterns. Our definition corresponds to the
term-frequency in the TF-IDF statistic333The inverse term frequency (IDF)
would correspond to a weighting of the user’s category-frequency by the
overall frequency of this category in the data, giving higher weights to rare
categories. Since the weights are the same for all users, IDF does not help to
distinguish users, neither intuitively nor empirically. We therefore only
characterize users by the easily interpretable TF term., which measures the
frequency of a word in a specific document in relation to the overall
occurrence of the term (in the corpus). Here, the ”words” are place categories
and a ”document” is the location trace of one user. We provide examples for
such TF-based user profiles in Figure 4b (”Ground truth”). In the following,
we define $p(u)$ as the profile of user $u$, and $p_{c}(u)$ as the entry of
the vector corresponding to the frequency of category $c\in C$. For example,
the ground truth profile of User 1 in Figure 4b corresponds to
$[0.25,0.5,0.25]$, since $p_{\text{Dining}}(\text{User
1})=0.25,p_{\text{Retail}}(\text{User 1})=0.5,p_{\text{Nightlife}}(\text{User
1})=0.25$. In this study, we aim to quantify how accurately the adversary
could predict $p(u)$. The evaluation of user profiling performance boils down
to comparing the difference between two categorical distributions, namely the
distributions of the real profile $p(u)$ versus the predicted category
frequencies $\hat{p}(u)$:

$\displaystyle E_{\hat{p}(u),p(u)}=\sqrt{\sum_{c\in
C}(\hat{p}_{c}(u)-p_{c}(u))^{2}}$ (3)

Figure 4: User profiling from location labelling. The predicted labels for
individual location visits can be aggregated per user to yield an estimated
user profile, either by the frequency or the average probability of the
predictions. Figure 5: Comparison of user-profiling errors achieved from
averaging ”hard” predictions or ”soft” prediction probabilities for each
category. Probabilistic classifications improve the spatial attack, in
particular for lower-quality location data.

The attacker can estimate the profile $\hat{p}(u)$ simply by counting the
predicted place categories. For example, in Figure 4 the ”Retail” category is
predicted one out of four times for user 2 and therefore takes a value of 0.25
in the profile (see orange arrow). However, many ML-based classification
models actually predict a ”probability”444The probability distribution over
categories is usually derived from the predicted values with a softmax
function or by averaging hard predictions of base estimators and is,
therefore, by no means the actual posterior distribution. While the provided
uncertainties are oftentimes poorly calibrated [32], they nevertheless add
information to the final predicted label. for each category, as shown in
Figure 4a. The XGBoost model, for example, outputs the prediction frequency of
each category among its base learners (decision trees). Probabilistic
predictions provoke a second way to estimate $\hat{p}(u)$, namely by averaging
the predicted probabilities per category (see blue arrow in Figure 4). In the
following, we term the first option (computing the frequency of predicted
categories, orange) as ”hard” profiling and the second option (averaging
category-wise probabilities, blue) as ”soft” user profiling. As shown in the
toy example in Figure 4, soft profiling can increase or decrease the error
compared to hard profiling (e.g., decrease from 0.354 to 0.219 for user 1, but
increase from 0 to 0.071 for user 2).

In Figure 5, we empirically compare both strategies on our dataset in terms of
the error $E$ defined above. Only the error for the strongest attack scenario
(XGB spatio-temporal) is shown, averaged over cities (NYC and Tokyo). The
profiling error is significantly lower for the soft profiling strategy that is
based on probabilistic predictions. In particular, the error of ”hard”
profiling increases proportionally with a doubling of the obfuscation radius,
while the error of soft-labeling increases sub-linearly (see Figure 5). This
result is consistent for all considered scenarios. It demonstrates that well-
calibrated probabilistic prediction methods are more dangerous in terms of
user profiling than point predictors, even if the latter may achieve a higher
place classification accuracy.

All further results are reported for the soft predictions in order to simulate
the strongest attack.

### User reidentification accuracy based on the estimated profiles

Judging from the error alone it is difficult to interpret how much the user
profile actually reveals. Such interpretation depends on the variance of the
user profiles: For example, if all users have the same profile, the prediction
error may be very low, but there is no value in profiling. As a more
interpretable metric, we follow previous privacy research and analyze the
possibility of re-identifying users by their predicted profile. Given the pool
of ground-truth user profiles (Figure 4b green), we match the predicted
profiles by finding their nearest neighbors in the pool based on the Euclidean
distance of their profile vectors. We report the results in terms of top-5 re-
identification accuracy, also called hit@5.

In Figure 7, the re-identification accuracy is shown by the attack scenario. A
corresponding plot of the profiling error is given in the appendix (Figure
15). Although the accuracy decreases quickly with stronger obfuscation, it is
still larger than 10% even with an obfuscation radius of 1.2km. The average
uninformed (random) identification accuracy is 0.6% on average, with 1083
users in NYC and 2293 users in Tokyo. To compare the decay of the user
profiling performance to the decay in place categorization accuracy (Figure
2), we fit an exponential function of the form $f(x)=a+c\cdot
e^{-x\cdot\lambda}$ to both results. The place categorization accuracy decays
with $a=0.3439,\beta=0.0097,c=0.6216$, indicating that the accuracy decreases
with a rate of $e^{-0.0097}=0.9903$ but converges to around $0.3439$. The
function fit for the user identification accuracy yields
$a=0.0625,\beta=0.0121,c=0.9518$. In other words, with every 50 meters added
to the location obfuscation radius, the user re-identification accuracy is
reduced by a factor of $0.5488$ ($=e^{-0.0121*50}$). With $r=57.43$, the
accuracy has approximately halved. This firstly demonstrates that place
categorization does not directly translate into user profiling, as the
profiling accuracy decays faster than the categorization accuracy, and
secondly gives guidance for selecting a suitable masking radius.

Figure 6: User-profiling performance of different semantic attacks, in terms
of the top-5 accuracy of re-identifying users by their profile. With an
obfuscation radius of around 400m, the user profiling accuracy converges.

Figure 7: Cumulative distribution of the privacy loss per user caused by the
strongest attack scenario.

### Induced privacy loss of ML-based privacy attacks

Finally, we transform the re-identification accuracy into a privacy loss
metric following [49]. They define the privacy loss $PL$ for one user $u\in U$
as

$\displaystyle PL(u)=\frac{P_{attack}\big{(}u=u^{*}\ |\
D_{u}\big{)}}{P_{uniformed}(u=u^{*})}$ (4)

where $P_{uniformed}$ is the probability of an uninformed adversary to match
$u$ to the true user $u^{*}$, corresponding to a random pick from all users
$U$, so $P_{uninformed}=\frac{1}{|U|}$. The probability of an informed
adversary, on the other hand, is the probability to match the user to the
correct profile by utilizing sensitive user data including geographic
coordinates and visitation times. We assume that given a pool of users $U$,
the attacker would match $u$ to a user $u_{i}\in U$ from the pool with a
probability proportional to the similarity of their profiles:

$\displaystyle P_{attack}(u=u_{i}|\mathcal{D})\propto
softmax\big{(}sim(u,u_{i})\big{)}=\frac{e^{sim(u,u_{i})}}{\sum_{j=1}^{|U|}e^{sim(u,u_{j})}}$
(5)

where we define the similarity as the inverse distance of the user profile
vectors $sim(u,u_{i})=\big{(}E_{\hat{p}(u),p(u_{i})}\big{)}^{-1}$. Note that
Manousakas et al. [49] use a rank-based measure of similarity, which however
seems unintuitive given that we know the exact distance between each pair of
user-profiles and not only their respective rank.

The median privacy loss is $11$ if the adversary is given spatio-temporal
information where the locations are obfuscated by 100m (see appendix Table 1).
In other words, the adversary is still 11 times better at re-identifying a
user by his profile than with a random strategy. Moreover, the adversary with
spatio-temporal data is $9.9$ times better than an adversary that uses only
temporal information, even though the spatial data are obfuscated up to 100m.
At higher location obfuscation, the privacy loss converges. The strongest
attack only yields a median privacy loss of $3.74$ at 200 meters obfuscation
radius and $2.13$ at 400m. However, the privacy loss strongly varies across
users. Figure 7 shows the cumulative distribution of users. If the locations
are obfuscated by 100m, around 80% of the users have a privacy loss lower than
250; however, the distribution is heavy-tailed with a considerable number of
users that are still easy to identify. Nevertheless, we conclude that
obfuscating the location with a radius between 100 and 200 meters would
significantly reduce the risk of successful profiling attacks for a large
majority of users.

### Features that affect the predictability of place categories

One advantage of boosted-tree based machine learning methods such as XGBoost
is that decision trees are interpretable. While the individual decision
boundaries are not transparent in large ensembles of trees, one can still
compute the importance of individual features in terms of their mean decrease
of data impurity. The respective importance of the spatial and temporal
features included in our study are shown in Figure 8. The most important
spatial features are the number of POIs per category among the $k$ nearest
POIs. The spatial embedding features derived with the space2vec (embed 0 -
embed 16) method apparently do not add much information. The time of the day,
expressed in sinus and cosinus of the hour and binary variables for morning,
afternoon and evening, also play a significant role, highlighting the
relevance of temporal information.

Figure 8: Feature importances in the XGBoost classifier. The occurence of
different categories and their mean distance are the most important features
for place categorization.

### Dependency on POI data quality

To simulate incomplete POI data, we subsample 75% or 50% randomly from the
Foursquare POIs. Furthermore, the performance with POI data from OSM instead
of Foursquare is evaluated. In this experiment, only the predictions of the
strongest attack (XGB spatio-temporal) on NYC check-in data are evaluated.
Figure 10 depicts the results, where ”Foursquare (all)” corresponds to the
results in Figure 2. The removal of Foursquare POIs has surprisingly little
effect on the user identification accuracy. Even with 50% of the POIs, 84.8%
of the check-ins can be classified correctly (see appendix Figure 13),
translating to a top-5 identification accuracy of 94%. This is due to the
spatial autocorrelation between places of certain categories (see appendix
Figure 17).

Figure 9: Dependency of the attacker’s success on the POI quality. The
strongest attack scenario based on spatio-temporal data is shown. While the
completeness of POI data has a disproportionally low impact on user profiling,
using OSM data decreases the attacker’s success.

Figure 10: Place categorization accuracy by POI density (number of POIs within
500m). Visited places in very dense areas are harder to classify.

Meanwhile, it is much harder to classify the category of Foursquare check-ins
with OSM POIs. We hypothesize that this is due to substantial differences
between OSM and Foursquare POI data. Previous work [87] tried to match cafes
in the OSM dataset to cafes in the Foursquare set and find that only around
35% can be matched exactly (Levenshtein distance of labels=1), with a spatial
accuracy of around 30-40m. In addition to these location differences, in our
case there are also differences in the place categories, which we partly had
to assign manually to the OSM POIs (see Methods - Data and preprocessing).
Nevertheless, the low performance with OSM data unveils important difficulties
for an attacker to utilize inaccurate, incomplete and dissenting datasets of
POIs.

### Influence of the POI density

Furthermore, the difficulty level of the attack depends on the density of
spatial context data, since it is easier to match a location to a nearby POI
if the number of nearby POIs is low. We quantify this relation by computing
the number of surrounding POIs within 200m for all considered places in NYC
and Tokyo. In Figure 10, the place labelling accuracy is shown by POI density
groups. Places in dense areas; i.e., with many surrounding POIs, are harder to
classify. For example, when the obfuscation radius is 100m, the mean number of
POIs within 200m around the (non-obfuscated) location is 58 for correctly
predicted samples, but 85 for erroneously classified samples. However, the
variance between the curves shown in Figure 10 is lower than expected. Only
points with less than ten nearby POIs are significantly easier to match.

The dependence of the predictability on the POI density calls for a context-
aware protection scheme [88, 4]. We implement such scheme by setting the
obfuscation radius $r$ for a specific location such that at least $m$ public
POIs lie within the radius. For the sake of comparability, we tune $m$ to a
value that leads to an average obfuscation radius of $200m$ ($m=16$). In other
words, when obfuscating each location $l$ within a context-aware radius $r(l)$
that covers exactly 16 public POIs, then
$\frac{1}{|\mathcal{D}|}\sum_{l\in\mathcal{D}}r(l)\approx 200$. As desired,
this masking scheme destroys the relation between POI density and accuracy.
However, our experiments show that the average accuracy increases compared to
the accuracy reported for location-independent masking in Figure 2 (accuracy
of $0.52$ compared to $0.49$ for the experiment on NYC-Foursquare data with
XGB spatio-temporal). This also holds at a user-level, where the user-
profiling performance is higher with context-aware location obfuscation
($0.27$ vs. $0.23$). It seems that the weak obfuscation of locations in high-
density regions has a greater effect than the strong obfuscation of isolated
places. We conclude that simple context-aware obfuscation based on POI density
is not sufficient to reduce privacy risks, at least not at the same average
obfuscation level. While the evaluation of protection methods is out of the
scope of this work, further work is needed to understand their effectiveness
against undesired user-profiling.

## Discussion

We have quantified the risks of undesired user profiling in different attack
scenarios, varying 1) the information available to the attacker, 2) the
location data quality in terms of obfuscation radius, and 3) the POI data
quality. We comment on each aspect in the following.

First, our experiments reveal that machine learning methods can efficiently
exploit spatial context data, even with low data quality or incomplete data.
We further confirm previous findings by [52] that even only temporal
information about location visits poses a significant privacy risk. This risk
may be further increased, for example, if also the opening times of
surrounding POIs are used as input features [80]. In general, more powerful ML
methods may increase privacy risks beyond our results. A particularly
interesting finding is the superiority of probabilistic predictions for
deriving user profiles. In other words, a potential attacker can estimate the
importance of different place types in a user’s life without knowing the
category for each individual place exactly.

Furthermore, we took a user-centric viewpoint and derived location protection
recommendations. The exponential decay of user identification accuracy
demonstrates the high effectiveness of simple protective measures, and the
results suggest that the privacy risks become negligible when the location is
obfuscated with a radius of around $200$m. While such inaccuracy may be
intolerable in navigation apps, it yields a good trade-off in other
applications such as social media, where the approximate location is still
interesting to friends but not yet informative for profiling attacks. However,
further experiments on other datasets are necessary to validate the results.
Our analysis is based on an experimental setting where each visited location
can for sure be matched to a public POI. An attack that aims to classify user
activities that are not related to public POIs is, therefore, expected to be
more difficult (e.g., detecting a visit to a friend’s place). In the appendix
(Figure 15), we provide a study on a GNSS-based tracking dataset where stay
points are labeled with a few broad activity categories, but it would be
highly interesting to reproduce our results on a GNSS dataset with more
detailed place categories. However, datasets that are large and labeled at the
same time are rare [11]. Finally, we see a strong dependency of the attacker’s
success on the density and completeness of spatial context data. Thus, future
privacy protection algorithms should not only regard past studies on
protection efficiency, but also improvements in public databases. We hope to
inspire future research on the risks and, importantly, on suitable protection
methods against such novel semantic privacy attacks. Further analysis may, for
example, investigate which users are particularly easy or hard to profile. The
classification of users into a predefined set of profiles or a cluster of
profiles could provide further insights into the actual dangers of unwanted
behavior analysis. Finally, it may be an interesting endeavor to develop
location protection techniques that specifically target the weaknesses of
machine learning models, similar to adversarial attacks [37].

## Conclusion

Semantic privacy deserves more attention in geoprivacy research, considering
the business case of data brokers and the interest of companies in semantic
information in contrast to raw data. Our analysis is a first step towards a
better understanding of the actual risk for a user to reveal sensitive
behavioral data when sharing location data with applications. Spatial and
temporal patterns in location data lead to a significant opportunity for user
profiling, even if the coordinates are not accurate. However, this effect
diminishes with stronger location protection. Our analysis, therefore, enables
users and policy-makers to derive recommendations on a suitable protection
strength.

## Methods

In the following, our methods are described in detail. Our implementation is
available open-source at https://github.com/mie-lab/trip_purpose_privacy.

### Data and preprocessing

#### Check-in data from Foursquare

Our study mainly uses data from the location-based social network Foursquare.
In contrast to tracking datasets or data from other social networks (e.g.,
tweets), the Foursquare dataset offers labeled and geo-located place
visitation data. Specifically, users check-in at venues, e.g., a restaurant,
and the geographic location of the venue as well as a detailed semantic label,
e.g., ”Mexican restaurant”, are known. Similar to other studies [81, 82], we
use the Foursquare subset of New York City and Tokyo in order to simplify
location processing and to study the variability of the results over two
different cities. The data was collected by [81] from 12 April 2012 to 16
February 2013 and was downloaded from their
website555https://sites.google.com/site/yangdingqi/home/foursquare-
dataset?pli=1. Note that Foursquare has changed over the years, and the data
thus differs from today’s usage of this LBSN. This is not an issue for our
study, as the underlying location visitation patterns are expected to remain
similar.

As a first step, we clean the category labels of place check-ins of users. We
focus on leisure activities and do not consider home and work check-ins for
several reasons: 1) Home and work location can be inferred by temporal
features such as the time of the day and visit duration. Spatial POI data are
not necessary. 2) Identifying home and work is possible with simple
heuristics, e.g., assigning the most often visited location as home and the
second-most-frequently visited location as work. We believe that previous
attempts on this task mainly suffer from insufficient data quality and the
lack of reference data, and not the difficulty of the task itself. 3) Many
Foursquare users in the dataset do not check-in at home or work since the
social network was mainly used to share leisure activities, at least in 2012
when the data was gathered and before changes where made to their (check-in)
app.

In total, the Foursquare POIs in NYC and Tokyo are labeled with 1146 distinct
categories. A taxonomy is provided with 11 groups on the highest level, such
as Dining and Drinking or Arts and Entertainment. We use this categorization
as the ground-truth location categories, but make a few changes in order to
sufficiently distinguish common types of leisure activities that are relevant
for user profiling. Specifically, we divide the category Dining and Drinking
into categories Dining (all kinds of restaurants), Nightlife (bars), and
Coffee and Dessert, based on the label given on lower levels of the taxonomy.
Furthermore, the category Community and Government is split into the
categories Education and Spiritual Centers. Other subcategories that can not
be fitted into these two, e.g. ”government building” or ”veteran club”, are
omitted. Finally, there are around 100 labels in the NYC-Tokyo Foursquare
dataset from 2012 that do not appear in the (up-to-date) Foursquare POI
taxonomy. We manually assign these labels to categories. The final
distribution of the labels in NYC check-ins is shown in the appendix in 16(a).

Furthermore, the check-in dataset is cleaned by merging subsequent check-ins
of the same user at the same location. A check-in event is deleted if it
occurs within one hour of the previous check-in at that location, leading to
the removal of 0.496% of the NYC check-ins and 0.63% of the ones in Tokyo.

#### Public POI data

We assume that the attacker can access public POI data, such as the POIs from
Foursquare. However, categorizing check-in locations in the Foursquare data is
easy when the Foursquare POIs are given since they correspond exactly in their
geographic location and each check-in can (in theory) be matched to a known
POI. Apart from obfuscating the check-in location to simulate inaccurate GNSS
data, we also simulate incomplete POI data by sampling 50% and 75% of the
Foursquare POIs at random.

Last, we simulate a situation with substantially different POI data by using
POIs from OSM. The Python package pyrosm [74] is used to download all places
of the categories ”healthcare”, ”shop”, ”amenity”, ”museum”, ”religious”,
”transportation”, and ”station” (public transport) from OSM. The ”amenity”
category in particular contains a large collection of places, and we first
delete all places labeled as ”parking space” since they accounted for a large
fraction of the data and are irrelevant to our analysis. We further manually
re-label the POIs in order to assign place categories. The same categories as
in the Foursquare dataset are used and the mapping from OSM-POI-types to our
categories is given in detail in our code base666https://github.com/mie-
lab/trip_purpose_privacy/blob/main/data/osm_poi_mapping.json.

### Spatial and temporal input features to machine learning model

#### Temporal features

Temporal features are computed from $T_{u}(l_{i}^{u})$ as the following:

  * •

Visit frequency features: The absolute visit frequencies of location
$l^{u}_{i}$, corresponding to $|T_{u}(l_{i}^{u})|$, and the relative frequency
with respect to all check-ins by $u$, formally

$\displaystyle\text{f}_{\text{visit\\_frequency}}(l_{i}^{u})=\frac{|T_{u}(l_{i}^{u})|}{\sum_{l^{u}_{i}\in
L_{u}}\sum_{t_{j}\in T_{u}(l_{i}^{u})}t_{j}}$ (6)

The absolute frequencies are scaled with a logarithm to reflect well-known
power-law properties of location visitation patterns [8, 66].

  * •

Duration features: In the Foursquare dataset used as training data, the check-
outs of location visits are not provided, so only the start time is known.
Thus, we approximate the visit duration by computing the time until the next
check-in. Since no check-outs are (publicly) available, there are many
outliers with gaps over more than a day. We flatten these outliers by scaling
logarithmically, and finally, we take the average over the individual visit
durations. Formally, the visit time is subtracted from the time of its
subsequent check-in, given as the minimum time of all following check-ins of
the user:

$\displaystyle\text{f}_{\text{dur}}(l_{i}^{u})=\frac{1}{|T_{u}(l_{i}^{u})|}\sum_{j=0}^{|T_{u}(l_{i}^{u})|}\log{\Big{(}\min_{\begin{subarray}{c}k,m\\\
\text{s.t.
}t_{m}(l_{k}^{u})>t_{j}(l_{i}^{u})\end{subarray}}t_{m}(l_{k}^{u})-t_{j}(l_{i}^{u})\Big{)}}$
(7)

The duration of the last check-in overall is omitted. Although this
approximation is very rough due to the dependence on the LBSN usage frequency
of users, we empirically observed that it is still helpful for inference.

  * •

Daytime features: Last, the start time is represented by a variety of
features: Binary features to indicate whether it is on the weekend, in the
morning (before 12pm), in the afternoon (12pm - 5pm), in the evening (5pm -
10pm), or at night (10pm - midnight). The time thresholds were selected to
reflect different activities (e.g. dining vs nightlife). The exact daytime was
encoded with trigonometric functions (sine and cosine) to reflect their
cyclical properties, as is common in machine learning.

#### Spatial features

The attacker can utilize the recorded geographic coordinates to predict the
location category. However, inputting the raw coordinates to a model is not
advisable as they suffer from uncertainty and, more importantly, the model
would not generalize to other spatial regions. Thus, spatial features are
usually derived from the context of the spatial location, here public POI
data, since the categories of surrounding POIs are a valuable predictor [79]
for the user’s location category. POI data are, for example, available from
the public Foursquare API or from Open Street Map (OSM). In either case, the
dataset includes geographic point data and a categorization taxonomy of broad
and more specific POI labels, e.g., a POI may be part of both the ”Shoe Store”
and the overarching ”Retail” category. For most spatial features, we only use
the broadest level and denote its categories as
$\Psi=\\{\psi_{1},\dots,\psi_{n}\\}$. A POI $p$ has a set of coordinates
$(x(p),y(p))$, and is assigned to a main POI category, $c_{p}(p)$.777Note that
our notation explicitly distinguishes location categories ($c(l_{i}^{u})\in
C$) from POI categories ($c_{p}(p)\in\Psi$), since they may be different. For
example, an attacker could use POI data with 10 categories ($|\Psi|=10$) to
classify user location data into only three categories such as
$C=\\{\text{Work, Leisure, Eating}\\}$. For example, $p$ may be assigned to
$c_{p}(p)=\psi_{2}=\text{Retail}$.

In the literature, different approaches have been used to extract features
from the POI distribution around a specific point. We found empirically that a
combination of the following methods yields the best results for our
attacker’s task:

  * •

Category-count of the k-nearest POIs: Given a location
$(x(l_{i}^{u}),y(l_{i}^{u}))$, the $k$ closest POIs $p_{1},\dots,p_{k}$ are
found via a ball tree search, and the count of each category among those is
computed. The result is a feature vector where the first element corresponds
to the number of occurrences of the first category among the $k$ closest POIs
and accordingly for the other categories; formally

$\displaystyle\Big{[}\sum_{i=1}^{k}\mathbbm{1}[c_{p}(p_{i})=\psi_{1}],\ \
\sum_{i=1}^{k}\mathbbm{1}[c_{p}(p_{i})=\psi_{2}],\ \ \dots\Big{]}$ (8)

Furthermore, as an indicator of the POI density at $(x,y)$, the mean distance
from the $k$ nearest POIs is extracted as a feature. We set $k=20$ in our
experiments.

  * •

Count and distance of POIs within a fixed radius: The semantic attack requires
more specific distance information of the POIs for each category. For example,
if there is no restaurant within 1km, it is unlikely that the location
category is ”Dining”. Thus, we consider all POIs around
$(x(l_{i}^{u}),y(l_{i}^{u}))$ within a specified radius $r$, denoted as the
set $P(x,y,r)$888for brevity, we omit $l_{i}^{u}$ here, and again compute the
count of each category.

$\displaystyle\Big{[}\sum_{p\in P(x,y,r)}\mathbbm{1}[c_{p}(p)=\psi_{1}],\ \
\sum_{p\in P(x,y,r)}\mathbbm{1}[c_{p}(p)=\psi_{2}],\ \ \dots\Big{]}$ (9)

In addition, we consider the minimum distance of POIs of one category to the
location:

$\displaystyle\Big{[}\min_{\begin{subarray}{c}p\in P(x,y,r)\\\
c_{p}(p)=\psi_{1}\end{subarray}}\|\big{(}\begin{subarray}{c}x\\\
y\end{subarray}\big{)}-\big{(}\begin{subarray}{c}x(p)\\\
y(p)\end{subarray}\big{)}\|,\ \ \min_{\begin{subarray}{c}p\in P(x,y,r)\\\
c_{p}(p)=\psi_{2}\end{subarray}}\|\big{(}\begin{subarray}{c}x\\\
y\end{subarray}\big{)}-\big{(}\begin{subarray}{c}x(p)\\\
y(p)\end{subarray}\big{)}\|,\ \ \dots\Big{]}$ (10)

We set the radius to $200$m based on the results of preliminary experiments.
If a category does not appear within the radius, we fill the corresponding
vector field by the radius $r$. As an example, consider that three POIs are
found within radius $r=200$m of the location: $p_{1}$ of category $\psi_{3}$
with 50m distance, $p_{2}$ of category $\psi_{2}$ with 10m distance, and
$p_{3}$ of category $\psi_{2}$ with 80m distance. The resulting vectors
(assuming there are only three categories) are $[0,2,1]$ and $[200,10,50]$.

  * •

Space2vec: In contrast to hand-crafted features based on distance and category
counts, there is the option to learn coordinate representations. The task of
finding an efficient and informative representation of points, dependent on
their coordinates and POI context, was tackled recently in work on space
embeddings. We employ the state-of-the-art space-to-vec approach by [48].
Inspired by word embeddings in natural language processing, the idea is to
learn a compact vector representation for points. The training is based on a
supervised learning task, namely to distinguish surrounding points from
unrelated, arbitrary distant samples that were drawn as negative samples. We
deploy their public code base999https://github.com/gengchenmai/space2vec to
train the algorithm on our POI datasets $\mathcal{P}$, including the first two
category levels. Specifically, we split $\mathcal{P}$ into training,
validation (10%), and testing set (10%) and employ the joined approach by
[48]; i.e., training a location decoder and a spatial context decoder jointly.
We set the embedding size to 16 but retained all other parameters as suggested
by the authors. The model, which was trained only on $\mathcal{P}$, can be
applied on a new location given its coordinates and its spatial context
(coordinates and categories of the surrounding POIs) as input.

### Model training

#### Machine learning model

We chose the XGB approach over other machine learning models for its
interpretability and its suitability for unbalanced data, rendering it
superior in many applications. Nevertheless, we also implemented a multi-layer
perceptron (MLP) for comparison. A model was implemented with two layers of
128 neurons respectively, with dropout regularization, ReLU activation and a
softmax function in the output layer. The network was trained with the
AdamOptimizer (learning rate 0.001) and with early stopping. For the XGBoost
model, we utilize the XGBoost implementation in the xgboost Python
package101010https://xgboost.readthedocs.io/en/stable/python/python_intro.html
and only tune the parameter that determines the maximum depth of the base
learners. A depth of 10 turned out most suitable in our experiments. The MLP
also exhibits good place categorization ability, but was consistently inferior
to XGB. For example, with the Foursquare data for NYC and an obfuscation
radius of 100m, the accuracy is 52.2% for the MLP compared to 59.4% for XGB
(41.6% vs 49.8% for 200m obfuscation, etc.). We, therefore, only report the
results for XGB in this study.

#### Location masking

A simple protection method for the use of location-based services is a random
displacement of the coordinates to mask the real location. For example, iPhone
users can withhold the precise locations from applications and only allow them
to access the ”approximate” location. Here, we utilize location obfuscation to
model imprecise GNSS data or basic data protection. The user’s location is
simply replaced by a new location sampled from a uniform distribution within a
given radius $r$ (see Figure 1a). Note that we focus on the obfuscation of the
spatial information and leave the possibility of masking temporal information
as in [54] for future work on semantic privacy. After the location masking
step (Figure 1a), the raw (and obfuscated) spatio-temporal data are featurized
(Figure 1b) by deriving temporal features from the check-in time and spatial
features from the coordinates matched with public POI data.

#### Data split

We test for the attacker’s accuracy by splitting the data into train and test
sets, as shown in Figure 1c. By default, the dataset is split by user, i.e.,
10% of the users are taken as the test set while the model is trained on 90%.
In practice, we report all results upon 10-fold cross validation such that all
users were part of the test set once. The results simulate the scenario where
the attacker obtains a labeled train dataset from a specific region and
utilizes it to train an ML model with the goal to infer location profiles of
new users but in the same region. However, the attacker may not always have
labeled data from exactly the same spatial region. To analyze this scenario,
we additionally simulate the attack with a spatial split. In detail, the
dataset is divided by separating the x- and y- coordinates in a $3\times 3$
grid, to yield nine roughly equal-sized subsets. The samples from each grid
cell are used as the test set once.

### Availability of data and materials

All source code for reproducing our results is published on GitHub:
https://github.com/mie-lab/trip_purpose_privacy. The Foursquare data is
publicly available at
https://sites.google.com/site/yangdingqi/home/foursquare-dataset?pli=1.

### Competing interests

The authors declare that they have no competing interests.

### Authors’ contributions

N.W., O.K. and K.J. conceptualized the project. N.W. and O.K. performed the
literature research. N.W. developed the methodology, implemented the
algorithms, prepared all visualizations and wrote the main manuscript draft.
K.J. revised the manuscript. O.K. and M.R. supervised the project and reviewed
the manuscript.

## References

  * Al Hasan Haldar et al. [2019] N. Al Hasan Haldar, J. Li, M. Reynolds, T. Sellis, and J. X. Yu.  Location prediction in large-scale social networks: an in-depth benchmarking study.  _The VLDB Journal_ , 28(5):623–648, 2019.
  * Alrayes and Abdelmoty [2014] F. Alrayes and A. Abdelmoty.  No place to hide: A study of privacy concerns due to location sharing on geo-social networks.  _International Journal On Advances in Security_ , 7(3/4):62–75, 2014.
  * An et al. [2022] N. An, M. Chen, L. Lian, P. Li, K. Zhang, X. Yu, and Y. Yin.  Enabling the interpretability of pretrained venue representations using semantic categories.  _Knowledge-Based Systems_ , 235:107623, 2022.
  * Andrés et al. [2013] M. E. Andrés, N. E. Bordenabe, K. Chatzikokolakis, and C. Palamidessi.  Geo-indistinguishability: Differential privacy for location-based systems.  In _Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security_, pages 901–914, 2013.
  * Banerjee [2019] S. Banerjee.  Geosurveillance, location privacy, and personalization.  _Journal of Public Policy & Marketing_, 38(4):484–499, 2019.
  * Bao et al. [2015] J. Bao, Y. Zheng, D. Wilkie, and M. Mokbel.  Recommendations in location-based social networks: a survey.  _GeoInformatica_ , 19(3):525–565, 2015.
  * Barth and De Jong [2017] S. Barth and M. D. De Jong.  The privacy paradox–investigating discrepancies between expressed privacy concerns and actual online behavior–a systematic literature review.  _Telematics and informatics_ , 34(7):1038–1058, 2017.
  * Brockmann et al. [2006] D. Brockmann, L. Hufnagel, and T. Geisel.  The scaling laws of human travel.  _Nature_ , 439(7075):462–465, 2006.
  * Cerf et al. [2017] S. Cerf, V. Primault, A. Boutet, S. B. Mokhtar, R. Birke, S. Bouchenak, L. Y. Chen, N. Marchand, and B. Robu.  Pulp: Achieving privacy and utility trade-off in user mobility data.  In _2017 IEEE 36th symposium on reliable distributed systems (SRDS)_ , pages 164–173. IEEE, 2017.
  * Charleux and Schofield [2020] L. Charleux and K. Schofield.  True spatial k-anonymity: adaptive areal elimination vs. adaptive areal masking.  _Cartography and Geographic Information Science_ , 47(6):537–549, 2020.
  * Chen et al. [2016] C. Chen, J. Ma, Y. Susilo, Y. Liu, and M. Wang.  The promises of big data and small data for travel behavior (aka human mobility) analysis.  _Transportation research part C: emerging technologies_ , 68:285–299, 2016.
  * Chen and Poorthuis [2021] Q. Chen and A. Poorthuis.  Identifying home locations in human mobility data: an open-source r package for comparison and reproducibility.  _International Journal of Geographical Information Science_ , 35(7):1425–1448, 2021.
  * Chen and Guestrin [2016] T. Chen and C. Guestrin.  Xgboost: A scalable tree boosting system.  In _Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining_ , pages 785–794, 2016.
  * Crain [2018] M. Crain.  The limits of transparency: Data brokers and commodification.  _New media & society_, 20(1):88–104, 2018.
  * Crandall et al. [2010] D. J. Crandall, L. Backstrom, D. Cosley, S. Suri, D. Huttenlocher, and J. Kleinberg.  Inferring social ties from geographic coincidences.  _Proceedings of the National Academy of Sciences_ , 107(52):22436–22441, 2010.
  * Cui et al. [2018] Y. Cui, C. Meng, Q. He, and J. Gao.  Forecasting current and next trip purpose with social media data and Google Places.  _Transportation Research Part C: Emerging Technologies_ , 97:159–174, 2018.
  * de Montjoye et al. [2013] Y.-A. de Montjoye, C. A. Hidalgo, M. Verleysen, and V. D. Blondel.  Unique in the Crowd: The privacy bounds of human mobility.  _Scientific Reports_ , 3(1):1376, 2013.
  * Do and Gatica-Perez [2014] T. M. T. Do and D. Gatica-Perez.  The Places of Our Lives: Visiting Patterns and Automatic Labeling from Longitudinal Smartphone Data.  _IEEE Transactions on Mobile Computing_ , 13(3):638–648, 2014.
  * Duckham and Kulik [2005] M. Duckham and L. Kulik.  A Formal Model of Obfuscation and Negotiation for Location Privacy.  In D. Hutchison, T. Kanade, J. Kittler, J. M. Kleinberg, F. Mattern, J. C. Mitchell, M. Naor, O. Nierstrasz, C. Pandu Rangan, B. Steffen, M. Sudan, D. Terzopoulos, D. Tygar, M. Y. Vardi, G. Weikum, H. W. Gellersen, R. Want, and A. Schmidt, editors, _Pervasive Computing_ , volume 3468, pages 152–170. Springer Berlin Heidelberg, Berlin, Heidelberg, 2005.
  * Duckham and Kulik [2006] M. Duckham and L. Kulik.  Location privacy and location-aware computing.  In _Dynamic and mobile GIS_ , pages 63–80. CRC press, 2006.
  * Dwork [2008] C. Dwork.  Differential privacy: A survey of results.  In _International conference on theory and applications of models of computation_ , pages 1–19. Springer, 2008.
  * Efstathiades et al. [2015] H. Efstathiades, D. Antoniades, G. Pallis, and M. D. Dikaiakos.  Identification of key locations based on online social network activity.  In _2015 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM)_ , pages 218–225. IEEE, 2015.
  * Falcone et al. [2014] D. Falcone, C. Mascolo, C. Comito, D. Talia, and J. Crowcroft.  What is this place? Inferring place categories through user patterns identification in geo-tagged tweets.  In _6th International Conference on Mobile Computing, Applications and Services_ , pages 10–19, 2014.
  * Gao et al. [2017] S. Gao, K. Janowicz, and H. Couclelis.  Extracting urban functional regions from points of interest and human activities on location-based social networks.  _Transactions in GIS_ , 21(3):446–467, 2017.
  * Gao et al. [2019] S. Gao, J. Rao, X. Liu, Y. Kang, Q. Huang, and J. App.  Exploring the effectiveness of geomasking techniques for protecting the geoprivacy of twitter users.  _Journal of Spatial Information Science_ , (19):105–129, 2019.
  * Gao et al. [2014] X. Gao, B. Firner, S. Sugrim, V. Kaiser-Pendergrast, Y. Yang, and J. Lindqvist.  Elastic pathing: Your speed is enough to track you.  In _Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing_ , pages 975–986, 2014.
  * Georgiadou et al. [2019] Y. Georgiadou, R. A. de By, and O. Kounadi.  Location privacy in the wake of the gdpr.  _ISPRS international journal of geo-information_ , 8(3):157, 2019.
  * Golle and Partridge [2009] P. Golle and K. Partridge.  On the anonymity of home/work location pairs.  In _Pervasive Computing: 7th International Conference, Pervasive 2009, Nara, Japan, May 11-14, 2009. Proceedings 7_ , pages 390–397. Springer, 2009.
  * Götz et al. [2012] M. Götz, S. Nath, and J. Gehrke.  Maskit: Privately releasing user context streams for personalized mobile applications.  In _Proceedings of the 2012 ACM SIGMOD International Conference on Management of Data_ , pages 289–300, 2012.
  * Grinsztajn et al. [2022] L. Grinsztajn, E. Oyallon, and G. Varoquaux.  Why do tree-based models still outperform deep learning on typical tabular data?  In _Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track_ , 2022.
  * Gruteser and Grunwald [2003] M. Gruteser and D. Grunwald.  Anonymous usage of location-based services through spatial and temporal cloaking.  In _Proceedings of the 1st international conference on Mobile systems, applications and services_ , pages 31–42, 2003.
  * Guo et al. [2017] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger.  On calibration of modern neural networks.  In _International Conference on Machine Learning_ , pages 1321–1330. PMLR, 2017.
  * Gurung et al. [2014] S. Gurung, D. Lin, W. Jiang, A. Hurson, and R. Zhang.  Traffic information publication with privacy preservation.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ , 5(3):1–26, 2014.
  * Han et al. [2012] J. Han, E. Owusu, L. T. Nguyen, A. Perrig, and J. Zhang.  Accomplice: Location inference using accelerometers on smartphones.  In _2012 Fourth International Conference on Communication Systems and Networks (COMSNETS 2012)_ , pages 1–9. IEEE, 2012.
  * Haydari et al. [2021] A. Haydari, M. Zhang, C.-N. Chuah, J. Macfarlane, and S. Peisert.  Adaptive Differential Privacy Mechanism for Aggregated Mobility Dataset.  _arXiv:2112.08487 [cs]_ , 2021.
  * Huang et al. [2018] H. Huang, G. Gartner, J. M. Krisp, M. Raubal, and N. Van de Weghe.  Location based services: ongoing evolution and research agenda.  _Journal of Location Based Services_ , 12(2):63–93, 2018.
  * Huang et al. [2017] S. Huang, N. Papernot, I. Goodfellow, Y. Duan, and P. Abbeel.  Adversarial attacks on neural network policies.  _arXiv preprint arXiv:1702.02284_ , 2017.
  * Jain et al. [2018] P. Jain, M. Gyanchandani, and N. Khare.  Differential privacy: its technological prescriptive using big data.  _Journal of Big Data_ , 5(1):1–24, 2018.
  * Janowicz [2012] K. Janowicz.  Observation-driven geo-ontology engineering.  _Transactions in GIS_ , 16(3):351–374, 2012.
  * Jenson et al. [2017] S. Jenson, M. Reeves, M. Tomasini, and R. Menezes.  Mining location information from users’ spatio-temporal data.  In _2017 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computed, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI)_, pages 1–7, 2017.
  * Keßler and McKenzie [2018] C. Keßler and G. McKenzie.  A geoprivacy manifesto.  _Transactions in GIS_ , 22(1):3–19, 2018.
  * Khan et al. [2022] S. I. Khan, A. B. A. Khan, and A. S. M. L. Hoque.  Privacy preserved incremental record linkage.  _Journal of Big Data_ , 9(1):1–27, 2022.
  * Kounadi et al. [2013] O. Kounadi, T. J. Lampoltshammer, M. Leitner, and T. Heistracher.  Accuracy and privacy aspects in free online reverse geocoding services.  _Cartography and Geographic Information Science_ , 40(2):140–153, 2013.
  * Kounadi et al. [2018] O. Kounadi, B. Resch, and A. Petutschnig.  Privacy Threats and Protection Recommendations for the Use of Geosocial Network Data in Research.  _Social Sciences_ , 7(10):191, 2018.
  * Krumm [2007] J. Krumm.  Inference attacks on location tracks.  In _Proceedings of the 5th international conference on Pervasive computing_ , PERVASIVE’07, pages 127–143, Berlin, Heidelberg, 2007. Springer-Verlag.
  * Li et al. [2016] H. Li, H. Zhu, S. Du, X. Liang, and X. Shen.  Privacy leakage of location sharing in mobile social networks: Attacks and defense.  _IEEE Transactions on Dependable and Secure Computing_ , 15(4):646–660, 2016.
  * Liu et al. [2016] R. Liu, S. Buccapatnam, W. M. Gifford, and A. Sheopuri.  An Unsupervised Collaborative Approach to Identifying Home and Work Locations.  In _2016 17th IEEE International Conference on Mobile Data Management (MDM)_ , volume 1, pages 310–317, 2016.
  * Mai et al. [2020] G. Mai, K. Janowicz, B. Yan, R. Zhu, L. Cai, and N. Lao.  Multi-scale representation learning for spatial feature distributions using grid cells.  _arXiv preprint arXiv:2003.00824_ , 2020.
  * Manousakas et al. [2018] D. Manousakas, C. Mascolo, A. R. Beresford, D. Chan, and N. Sharma.  Quantifying Privacy Loss of Human Mobility Graph Topology.  _Proceedings on Privacy Enhancing Technologies_ , 2018(3):5–21, 2018.
  * Martin et al. [2022] H. Martin, N. Wiedemann, E. Suel, Y. Hong, and Y. Xin.  Influence of tracking duration on the privacy of individual mobility graphs.  In _Proceedings of the 17th International Conference on Location-Based Services_. Technical University of Munich, 2022.
  * Martin et al. [2023] H. Martin, Y. Hong, N. Wiedemann, D. Bucher, and M. Raubal.  Trackintel: An open-source python library for human mobility analysis.  _Computers, Environment and Urban Systems_ , 101:101938, 2023.
  * McKenzie and Janowicz [2015] G. McKenzie and K. Janowicz.  Where is also about time: A location-distortion model to improve reverse geocoding using behavior-driven temporal semantic signatures.  _Computers, Environment and Urban Systems_ , 54:1–13, 2015.
  * McKenzie et al. [2015] G. McKenzie, K. Janowicz, S. Gao, J.-A. Yang, and Y. Hu.  Poi pulse: A multi-granular, semantic signature–based information observatory for the interactive visualization of big geosocial data.  _Cartographica: The International Journal for Geographic Information and Geovisualization_ , 50(2):71–85, 2015.
  * McKenzie et al. [2016] G. McKenzie, K. Janowicz, and D. Seidl.  Geo-privacy beyond coordinates.  In _Geospatial data in a changing world_ , pages 157–175. Springer, 2016.
  * McKenzie et al. [2022] G. McKenzie, D. Romm, H. Zhang, and M. Brunila.  PrivyTo: A privacy preserving location sharing platform.  _Transactions in GIS_ , page 16, 2022.
  * Miranda-Pascual et al. [2023] À. Miranda-Pascual, P. Guerra-Balboa, J. Parra-Arnau, J. Forné, and T. Strufe.  Sok: Differentially private publication of trajectory data.  _Proceedings on Privacy Enhancing Technologies_ , 2:496–516, 2023.
  * Montini et al. [2014] L. Montini, N. Rieser-Schüssler, A. Horni, and K. W. Axhausen.  Trip purpose identification from gps tracks.  _Transportation Research Record_ , 2405(1):16–23, 2014.
  * Nelson et al. [2022] T. Nelson, M. Goodchild, and D. Wright.  Accelerating ethics, empathy, and equity in geographic information science.  _Proceedings of the National Academy of Sciences_ , 119(19):e2119967119, 2022.
  * Olteanu et al. [2016] A.-M. Olteanu, K. Huguenin, R. Shokri, M. Humbert, and J.-P. Hubaux.  Quantifying interdependent privacy risks with location data.  _IEEE Transactions on Mobile Computing_ , 16(3):829–842, 2016.
  * Pei et al. [2007] J. Pei, J. Xu, Z. Wang, W. Wang, and K. Wang.  Maintaining k-anonymity against incremental updates.  In _19th International Conference on Scientific and Statistical Database Management (SSDBM 2007)_ , pages 5–5. IEEE, 2007.
  * Penha Natal et al. [2017] I. d. Penha Natal, R. d. Avellar Campos Cordeiro, and A. C. B. Garcia.  Activity recognition model based on gps data, points of interest and user profile.  In _International Symposium on Methodologies for Intelligent Systems_ , pages 358–367. Springer, 2017.
  * Pontes et al. [2012] T. Pontes, M. Vasconcelos, J. Almeida, P. Kumaraguru, and V. Almeida.  We know where you live: privacy characterization of foursquare behavior.  In _Proceedings of the 2012 ACM conference on ubiquitous computing_ , pages 898–905, 2012.
  * Pötzsch [2008] S. Pötzsch.  Privacy awareness: A means to solve the privacy paradox?  In _IFIP Summer School on the Future of Identity in the Information Society_ , pages 226–236. Springer, 2008.
  * Ram Mohan Rao et al. [2018] P. Ram Mohan Rao, S. Murali Krishna, and A. Siva Kumar.  Privacy preservation techniques in big data analytics: a survey.  _Journal of Big Data_ , 5:1–12, 2018.
  * Reck et al. [2022] D. J. Reck, H. Martin, and K. W. Axhausen.  Mode choice, substitution patterns and environmental impacts of shared and personal micro-mobility.  _Transportation Research Part D: Transport and Environment_ , 102:103134, 2022.
  * Rhee et al. [2011] I. Rhee, M. Shin, S. Hong, K. Lee, S. J. Kim, and S. Chong.  On the Levy-Walk Nature of Human Mobility.  _IEEE/ACM Transactions on Networking_ , 19(3):630–643, 2011.
  * Rossi et al. [2015] L. Rossi, J. Walker, and M. Musolesi.  Spatio-temporal techniques for user identification by means of GPS mobility data.  _EPJ Data Science_ , 4(1):11, 2015.
  * Seidl et al. [2016] D. E. Seidl, P. Jankowski, and M.-H. Tsou.  Privacy and spatial pattern preservation in masked gps trajectory data.  _International Journal of Geographical Information Science_ , 30(4):785–800, 2016.
  * Shen and Stopher [2013] L. Shen and P. R. Stopher.  A process for trip purpose imputation from Global Positioning System data.  _Transportation Research Part C: Emerging Technologies_ , 36:261–267, 2013.
  * Shokri [2015] R. Shokri.  Quantifying and protecting location privacy.  _it-Information Technology_ , 57(4):257–263, 2015.
  * Shokri et al. [2011] R. Shokri, G. Theodorakopoulos, J.-Y. Le Boudec, and J.-P. Hubaux.  Quantifying Location Privacy.  In _2011 IEEE Symposium on Security and Privacy_ , pages 247–262, 2011.
  * Sreekumar and Gündüz [2019] S. Sreekumar and D. Gündüz.  Optimal privacy-utility trade-off under a rate constraint.  In _2019 IEEE International Symposium on Information Theory (ISIT)_ , pages 2159–2163. IEEE, 2019.
  * Sweeney [2002] L. Sweeney.  k-anonymity: A model for protecting privacy.  _International journal of uncertainty, fuzziness and knowledge-based systems_ , 10(05):557–570, 2002.
  * Tenkanen [2022] H. Tenkanen.  pyrosm v0.6.1., 2022.
  * Tu et al. [2019] Z. Tu, K. Zhao, F. Xu, Y. Li, L. Su, and D. Jin.  Protecting Trajectory From Semantic Attack Considering k-Anonymity, l-Diversity, and t-Closeness.  _IEEE Transactions on Network and Service Management_ , 16(1):264–278, 2019.
  * Wernke et al. [2014] M. Wernke, P. Skvortsov, F. Dürr, and K. Rothermel.  A classification of location privacy attacks and approaches.  _Personal and ubiquitous computing_ , 18:163–175, 2014.
  * Xiao et al. [2016] G. Xiao, Z. Juan, and C. Zhang.  Detecting trip purposes from smartphone-based travel surveys with artificial neural networks and particle swarm optimization.  _Transportation Research Part C: Emerging Technologies_ , 71:447–463, 2016.
  * Xie et al. [2016] M. Xie, H. Yin, H. Wang, F. Xu, W. Chen, and S. Wang.  Learning graph-based poi embedding for location-based recommendation.  In _Proceedings of the 25th ACM international on conference on information and knowledge management_ , pages 15–24, 2016.
  * Yan et al. [2017] B. Yan, K. Janowicz, G. Mai, and S. Gao.  From itdl to place2vec: Reasoning about place type similarity and relatedness by learning embeddings from augmented spatial contexts.  In _Proceedings of the 25th ACM SIGSPATIAL international conference on advances in geographic information systems_ , pages 1–10, 2017.
  * Yan et al. [2022] Y. Yan, F. Xu, A. Mahmood, Z. Dong, and Q. Z. Sheng.  Perturb and optimize users’ location privacy using geo-indistinguishability and location semantics.  _Scientific Reports_ , 12(1):1–20, 2022.
  * Yang et al. [2015] D. Yang, D. Zhang, V. W. Zheng, and Z. Yu.  Modeling user activity preference by leveraging user spatial temporal characteristics in lbsns.  _IEEE Transactions on Systems, Man, and Cybernetics: Systems_ , 45(1):129–142, 2015.
  * Yang et al. [2016] D. Yang, D. Zhang, B. Qu, and P. Cudré-Mauroux.  Privcheck: Privacy-preserving check-in data publishing for personalized location based services.  In _Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing_ , pages 545–556, 2016.
  * Ye et al. [2011a] M. Ye, D. Shou, W.-C. Lee, P. Yin, and K. Janowicz.  On the semantic annotation of places in location-based social networks.  In _Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining - KDD ’11_ , page 520, San Diego, California, USA, 2011a. ACM Press.
  * Ye et al. [2011b] M. Ye, P. Yin, W.-C. Lee, and D.-L. Lee.  Exploiting geographical influence for collaborative point-of-interest recommendation.  In _Proceedings of the 34th international ACM SIGIR conference on Research and development in Information Retrieval_ , pages 325–334, 2011b.
  * Ying et al. [2010] J. J.-C. Ying, E. H.-C. Lu, W.-C. Lee, T.-C. Weng, and V. S. Tseng.  Mining user similarity from semantic trajectories.  In _Proceedings of the 2nd acm sigspatial international workshop on location based social networks_ , pages 19–26, 2010.
  * Yuan and Raubal [2016] Y. Yuan and M. Raubal.  Analyzing the distribution of human activity space from mobile phone usage: an individual and urban-oriented study.  _International Journal of Geographical Information Science_ , 30(8):1594–1621, 2016.
  * Zhang and Pfoser [2019] L. Zhang and D. Pfoser.  Using openstreetmap point-of-interest data to model urban change—a feasibility study.  _PloS one_ , 14(2):e0212606, 2019.
  * [88] X. Zhang, H. Huang, S. Huang, Q. Chen, T. Ju, and X. Du.  A context-aware location differential perturbation scheme for privacy-aware users in mobile environment.  _Wireless Communications and Mobile Computing_ , 2018.

## Appendix

### Scenario comparison results

Table 1 provides an overview of the considered scenarios and metrics, and
lists the results for protected location data with an obfuscation radius of
100m as an example. In the first scenario, both the check-in train data and
the POI data are taken from the Foursquare dataset, and a machine-learning
attack with the XGBoost model trained on spatio-temporal features can achieve
a place categorization accuracy of 61.6%. This is remarkable considering that
there are 12 categories. It further translates to a user profiling
error111111The user profiling error is the average Euclidean distance between
real and predicted profiles, $E_{\hat{p}(u),p(u)}$ of 0.124 which corresponds
to a top-5 user re-identification accuracy (hit@5) of 40.4%. In other words,
given (obfuscated) location data and temporal visitation patterns, the
attacker can infer an approximate profile $\hat{p}(u)$ for user $u$ such that,
in 40.4% cases, his real profile $p(u)$ is among the five real user profiles
most similar to $\hat{p}(u)$.

|  |  | Place categorization | User profiling
---|---|---|---|---
Check-in data | POI data | Method | Accuracy | Profiling error |  | Top-5 identifi-
---
cation accuracy
Privacy loss (median)
Foursquare | Foursquare | random | 0.159 | 0.235 | 0.003 | 1.000
(NYC & Tokyo) |  | XGB (temporal) | 0.344 | 0.205 | 0.023 | 1.112
|  | spatial join | 0.459 | 0.208 | 0.183 | 2.296
|  | XGB (spatial) | 0.580 | 0.140 | 0.328 | 5.574
|  | XGB (spatio-temporal) | 0.616 | 0.124 | 0.404 | 11.001
| OSM | random | 0.157 | 0.235 | 0.002 | 1.000
|  | spatial join | 0.224 | 0.341 | 0.013 | 1.051
|  | XGB (temporal) | 0.328 | 0.206 | 0.022 | 1.116
|  | XGB (spatial) | 0.476 | 0.172 | 0.117 | 1.949
|  | XGB (spatio-temporal) | 0.503 | 0.157 | 0.160 | 2.316
Yumuv study | Foursquare | random | 0.370 | 0.367 | 0.010 | 1.000
(Switzerland) |  | spatial join | 0.453 | 0.698 | 0.009 | 1.000
|  | XGB (spatial) | 0.541 | 0.331 | 0.034 | 1.095
|  | XGB (temporal) | 0.553 | 0.333 | 0.038 | 1.108
|  | XGB (spatio-temporal) | 0.618 | 0.293 | 0.065 | 1.225
| OSM | random | 0.372 | 0.367 | 0.010 | 1.000
|  | spatial join | 0.384 | 0.698 | 0.009 | 1.000
|  | XGB (spatial) | 0.541 | 0.332 | 0.034 | 1.093
|  | XGB (temporal) | 0.553 | 0.333 | 0.038 | 1.108
|  | XGB (spatio-temporal) | 0.623 | 0.289 | 0.060 | 1.256

Table 1: Comparing attack-scenarios with an obfuscation radius of $r=100$. For
the place categorization task, the accuracy over location-visit events is
reported. User-profiling error, user identification accuracy and privacy loss
measure the success of the attacker in user-profiling.

Furthermore, as shown shown in the confusion matrix in Figure 3, the place
classification accuracy clearly differs between categories. A more detailed
analysis of this effect is provided in Figure 11. At stronger obfuscation,
many places are erroneously labeled as ”Dining” or ”Travel and
Transportation”. Therefore, the sensitivity for these places remains high,
while decreasing for the other place categories.

Figure 11: Sensitivity of place recognition by category

### Tokyo vs NYC - effect of location obfuscation

In Figure 13, we compare the results on two diverse cities, NYC and Tokyo.
While the results show the same decrease- and convergence behavior in both
cities, the accuracy is generally larger for Tokyo. This is, however, due to
label imbalance in Tokyo which leads to a better performance of the random
baseline (grey lines Figure 13).

Figure 12: Place categorization accuracy of Tokyo compared to NYC

Figure 13: Effect of reduced POI context data quality on task 1 (place
categorization)

### Effect of POI data completeness on place categorization task

Figure 13 provides the results for the first task (place categorization) by
POI data completeness, complementing the user-identification results in Figure
10. As was already seen for user-identification, the accuracy decreases
disproportionally.

### User profiling error

Corresponding to the user identification accuracy presented in Figure 7, we
show the changes of the profiling errors in Figure 15, where the error is the
Euclidean distance between the user’s real profile vector $p_{c}(u)$ and the
estimated profile vector $\hat{p}_{c}(u)$.

Figure 14: User profiling error (Euclidean distance between true and predicted
user profile) by obfuscation radius

Figure 15: Profiling results on GNSS tracking data. The profiling accuracy is
low even with low location obfuscation, and the relation between obfuscation
radius and profiling accuracy is noisy.

### Study on GNSS tracking data

The Foursquare check-in dataset is suitable for our analysis since it is
reliably labeled with detailed place categories. For comparison, we evaluate
results on a GNSS-based tracking dataset from the so-called yumuv study. yumuv
is a tracking study in Switzerland that was conducted to investigate the
mobility behavior with a micro-mobility-bundle subscription [65]. Participants
of the study were tracked via the Myway
app121212https://www.sbb.ch/en/timetable/mobile-apps/myway.html for 2-3 months
and manually labeled their activities. The app provides a preprocessed version
of the raw GNSS data, namely (labeled) staypoints and triplegs. We further use
the Python library Trackintel [51] to group staypoints into locations via
DBSCAN. As for Foursquare, we remove the ”home” check-ins as well as further
categories that are uninformative, such as ”wait”, ”errand”, and ”unknown”.
This leads to a set of five location categories, namely C = {’Work’,
’Education’, ’Sports and Recreation’, ’Dining’, ’Leisure’}. The categorical
distribution is shown in 16(b).

The dataset is more challenging due to noisy GNSS tracking data as well as
unreliable and incomplete activity labels (the labels were estimated by an app
and manually corrected by the user). Additionally, different users hardly
visit the same places, and, thus, a training dataset has limited value for an
attacker. Indeed, the main source of information for the attacker are temporal
features in the case of the yumuv data. Figure 15 shows that the attacker can
still achieve semantic inference that is significantly better than random;
however, spatial information only plays a limited role. Consequently, location
protection hardly hinders the semantic attack, and the performance converges
already at an obfuscation radius of 100m. In Table 1, other metrics are
listed, and it is also shown that the danger for privacy on a user level is
limited, with a top-5 user identification accuracy of only up to 7.7% (100m
location obfuscation). We hypothesize that the main reason for the limited
value of spatial context data for the attacker lies in the activity categories
of the yumuv study (see 16(b)), including ”Work” and ”Leisure” as the largest
classes, which are too generic and too difficult to locate with POI data.

### Dataset analysis

In Figure 16, the distribution of category types over visited places is shown
for Foursquare (16(a)) and the yumuv (16(b)) data.

(a) Foursquare check-ins

(b) Yumuv tracking data

Figure 16: Location category counts in Foursquare and Yumuv datasets

### Analyzing place category autocorrelation in a semivariogram

The categories of user locations are predicted based on information from
surrounding public POIs. Even if the location is obfuscated, the category of
the closest POI is a good predictor for the location’s category. This is due
to the spatial autocorrelation of place categories. For example, there are
urban areas with many restaurants in one street, such that there is a high
probability of finding several nearby places with the same category. We relate
our results to the spatial autocorrelation of POIs by comparing our place
categorization accuracy (Figure 2) to the semivariogram of place category
differences. To compute the variogram, we bin the distances and report the
category correspondence in each bin, thereby accounting for the categorical
nature of place categories and the continuous nature of the place coordinates.
In detail, given a minimum and maximum distance $d_{min},d_{max}$, the
category variance is computed as

$\gamma(d_{min},d_{max})=\frac{\sum_{l_{1},l_{2}\in
N(d_{min},d_{max})}\mathbbm{1}[c(l_{1})==c(l_{2})]}{|N(d_{min},d_{max})|}$

where $N(d_{min},d_{max})$ is the set of all pairs of locations with
$d_{min}<d(l_{1},l_{2})\leq d_{max}$, and $\mathbbm{1}$ is the indicator
function that counts the number of pairs with corresponding category. Due to
the high number of POIs in the dataset, we only take a 20 x 20km subregion of
New York City and sample pairs of POIs randomly.

Figure 17 shows the change of $\gamma$ with increasing $d_{min}$ and
$d_{max}$, as common in a semivariogram. Even places with less than 25m
distance only have a 33% chance of their categories to correspond
($\gamma(0,25)=0.67$). At a distance of more than 3.2km, the category variance
converges to around 89%, which is slightly lower than the expected variance of
8.3% for 12 categories. However, the imbalance of categories explains this
difference. The semivariogram confirms our finding in Figure 2 that spatial
context data is hardly informative for location data that is obfuscated more
than 1km.

Figure 17: Semivariogram for measuring spatial autocorrelation of place
categories. The y-axis shows the percentage of POI-pairs with different
categories.