# Reconstruction Attack on Differential Private Trajectory Protection Mechanisms

arXiv: https://arxiv.org/abs/2210.09375 · HTML: https://mlsanity.com/paper/2210.09375/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Oct 2022.

## Built on by (most cited first, 7 of 7)

- [SoK: Can Trajectory Generation Combine Privacy and Utility?](https://mlsanity.com/paper/2403.07218/) (2024)
- [Empirical Calibration and Metric Differential Privacy in Language Models](https://mlsanity.com/paper/2503.13872/) (2025)
- [Learning to Attack: Uncovering Privacy Risks in Sequential Data Releases](https://mlsanity.com/paper/2510.24807/) (2025)
- [Synthetic Trajectory Generation Through Convolutional Neural Networks](https://mlsanity.com/paper/2407.16938/) (2024)
- [Demystifying Trajectory Recovery From Ash: An Open-Source Evaluation and Enhancement](https://mlsanity.com/paper/2409.14645/) (2024)
- [What is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?](https://mlsanity.com/paper/2506.09312/) (2025)
- [Privacy Evaluation of Generative Models for Trajectory Generation](https://mlsanity.com/paper/2605.15246/) (2026)

## Abstract (arXiv)

Location trajectories collected by smartphones and other devices represent a valuable data source for applications such as location-based services. Likewise, trajectories have the potential to reveal sensitive information about individuals, e.g., religious beliefs or sexual orientations. Accordingly, trajectory datasets require appropriate sanitization. Due to their strong theoretical privacy guarantees, differential private publication mechanisms receive much attention. However, the large amount of noise required to achieve differential privacy yields structural differences, e.g., ship trajectories passing over land. We propose a deep learning-based Reconstruction Attack on Protected Trajectories (RAoPT), that leverages the mentioned differences to partly reconstruct the original trajectory from a differential private release. The evaluation shows that our RAoPT model can reduce the Euclidean and Hausdorff distances between the released and original trajectories by over 68% on two real-world datasets under protection with varepsilon ≤ 1. In this setting, the attack increases the average Jaccard index of the trajectories' convex hulls, representing a user's activity space, by over 180%. Trained on the GeoLife dataset, the model still reduces the Euclidean and Hausdorff distances by over 60% for T-Drive trajectories protected with a state-of-the-art mechanism (varepsilon = 0.1). This work highlights shortcomings of current trajectory publication mechanisms, and thus motivates further research on privacy-preserving publication schemes.