Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy

2026-06-02

AI Summary

Publishing user check-in trajectories risks revealing future locations and compromising privacy. To address this, this work proposes Ghost, a framework that generates geographically and semantically plausible yet non-learnable trajectories to preserve data utility while undermining adversaries’ ability to predict future points of interest. Ghost leverages a frozen trajectory language model to constrain perturbations within the manifold of real trajectories and integrates manifold-aligned trajectory replacement with adversarial sample generation. This approach effectively resists adaptive sanitization attacks such as denoising bridging and frequency tables. Experimental results on two benchmark datasets across four attack settings demonstrate that Ghost matches the privacy protection performance of the strongest deterministic baseline, PGD, and achieves the lowest recovery accuracy under bigram adaptive attacks.

Abstract

A publisher who releases check-in trajectories inadvertently publishes a strong predictor of every user's future locations. We address this risk by generating unlearnable trajectories, perturbed sequences that yield victim models with degraded next-Point-of-Interest (next-POI) accuracy on clean test inputs. Direct ports of image-domain unlearnable examples fail on two counts. The published data must remain geographically and semantically plausible, and the perturbation must resist purification adversaries that exploit the structure of randomized defences. We propose Ghost, a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind. Ghost steers each substitution onto the real-trajectory manifold through a frozen trajectory language model, so a denoising-bridge adversary has nothing to invert and a context-free frequency-table adversary recovers a near-uniform distribution. Across two standard benchmarks, and four attacker postures, Ghost achieves protection-gap competitive with the strongest deterministic baseline (PGD) while attaining the lowest restored accuracy under the bigram adaptive purification adversary on both datasets, and lies within one per-cell standard deviation of PGD on the protection-versus-purification-resistance plane. Ablations confirm the manifold prior subsumes the entropy-floor knob of prior randomized defences, with the frequency-table adversary's survival gap remaining within 0.04 even when twenty percent of the pairs are leaked.

Problem

• next-POI privacy
• unlearnable trajectories
• trajectory perturbation
• privacy-preserving publishing
• manifold alignment

Innovation

• unlearnable trajectories
• manifold-aligned perturbation
• next-POI privacy
• trajectory language model
• purification-resistant defense