On the Adaptation of Trajectory Generative Models to Enforce Differential Privacy Through Gradient Perturbation

Abstract

Synthetic trajectories have become a crucial tool for enabling data sharing in domains such as telecommunications and urban planning, yet most generators provide neither formal privacy guarantees nor empirical validation of the protection they claim. This paper investigates whether state-of-the-art deep learning trajectory generators can be adapted to satisfy differential privacy (DP) while retaining usable utility, and makes three contributions. First, we analyze 16 state-of-the-art generators and determine which can be trained with Differentially Private Stochastic Gradient Descent (DP-SGD), showing that common architectural choices — such as index-based coordinate look-ups at inference — silently void the guarantee. Second, we present Sec-LSTM-TrajGAN, a DP adaptation of LSTM-TrajGAN, a well-known trajectory generator chosen after the analysis of the existing models. Third, we introduce RouteMIA, to our knowledge the first closed-box membership inference attack tailored to synthetic trajectories, which adapts the distance-to-closest-record attack to sequential spatio-temporal data and requires access only to the released dataset. Evaluating on GeoLife (<inline-formula> <tex-math notation="LaTeX">$17,000$ </tex-math></inline-formula> trajectories) and Porto (<inline-formula> <tex-math notation="LaTeX">$100,000$ </tex-math></inline-formula> trajectories) datasets for several scenarios of increasing privacy. RouteMIA attains an AUC of 0.59 and 0.55 against the non-private models, which drops to <inline-formula> <tex-math notation="LaTeX">$\approx 0.50$ </tex-math></inline-formula> — chance level — for every private configuration. Notably, gradient clipping alone, with no noise added, already accounts for this entire empirical gain, at a utility cost of a distance JSD rising from 0.12 to 0.20 on Porto and essentially none on GeoLife, whereas strict budgets (<inline-formula> <tex-math notation="LaTeX">$\varepsilon \leq 3$ </tex-math></inline-formula>) degrade GeoLife markedly (distance JSD up to 0.35). Per-example clipping, not the noise, therefore delivers the measurable protection against this attack — a cheap empirical complement to, but not a replacement for, formal guarantees.