Track embedding model privacy leakage risk assessment method and device, medium and product

Abstract

The invention discloses a track embedding model privacy leakage risk assessment method and device, a medium and a product, and relates to the field of track data privacy risk assessment, and the method comprises the steps: obtaining a target track non-noise-added embedding vector and a target track noise-added embedding vector through a to-be-assessed track embedding model; inputting the embedded vector into a sequence generation network to generate a candidate node sequence; determining a matching track of the target track according to the candidate node sequence; according to the embedded vector and the mark point track embedded vector, constructing a target track estimation distance vector by using a neural network model; according to the target trajectory estimation distance vector and the candidate trajectory estimation distance vector, determining a rough estimation trajectory of the target trajectory; and in combination with the target trajectory node sequence, determining a non-noise-added comprehensive risk score and a noise-added comprehensive risk score by using a comprehensive risk scoring function, and evaluating the privacy leakage risk of the trajectory embedding model to be evaluated. According to the method and the device, the privacy leakage risk of the trajectory embedding model is evaluated.

Description

Technical Field

[0001] This application relates to the field of trajectory data privacy risk assessment, and in particular to a method, device, medium and product for assessing the privacy leakage risk of trajectory embedding models. Background Technology

[0002] With the rapid development of mobile internet and intelligent transportation systems, massive amounts of user location trajectories are continuously recorded and widely used in areas such as route recommendation, behavior modeling, and urban planning. In recent years, trajectory embedding technology has become a mainstream representation learning method. It uses deep neural networks to compress high-dimensional trajectory sequences into fixed-length vector representations, which are widely integrated into third-party trajectory mining service interfaces for downstream clustering, prediction, and personalized analysis tasks. However, these services typically expose their APIs (Application Program Interfaces) in a "black box embedding" manner, only returning the embedding vectors, hiding the internal logic of the trajectory mapping process, thus creating a superficial privacy isolation between users and the platform.

[0003] Existing research generally agrees that while embedded vectors compress trajectory information, they no longer possess explicit spatial semantics, making it difficult to invert the original trajectory and thus considered a privacy-preserving method. Although existing work has theoretically analyzed the reversibility of trajectory embedding, in practical scenarios, there is still a lack of systematic and operational "black box trajectory inversion methods" to verify whether such services pose a privacy risk.

[0004] On the other hand, as access controls for the external interfaces of embedded services become stricter, many systems impose limits on the number of queries per user, rendering privacy attack strategies centered on "intensive calls" ineffective. There is an urgent need to develop new mechanisms that remain effective even under conditions of limited call counts. Furthermore, existing inversion methods largely rely on end-to-end trained interpretable models, which are difficult to deploy compatiblely with closed APIs, resulting in poor technical adaptability.

[0005] In summary, current technologies suffer from the following core pain points. First, there is a lack of practical methods for "trajectory embedding → original trajectory" inversion, making it difficult to verify the potential privacy risks of embedded services. Second, there is a lack of low-invocation, low-cost, and scalable trajectory attack frameworks, making them unsuitable for scenarios with limited interface resources. Third, existing methods struggle to provide structural interpretation and error control for the inversion process, resulting in uncontrollable and unreadable attack effects. Summary of the Invention

[0006] The purpose of this application is to provide a method, device, medium, and product for assessing the privacy leakage risk of trajectory embedding models, so as to achieve the assessment of the privacy leakage risk of trajectory embedding models.

[0007] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for assessing the privacy leakage risk of trajectory embedding models, including: Obtain the target trajectory; the target trajectory consists of the spatial coordinates of multiple sampling points and their corresponding timestamps; Based on the target trajectory, a trajectory embedding dataset is obtained using the trajectory embedding model to be evaluated; the trajectory embedding dataset includes the target trajectory un-noised embedding vector and the target trajectory noisy embedding vector. The target trajectory's un-noised embedding vector and its noisy embedding vector are respectively input into a sequence generation network to generate un-noised candidate node sequences and noisy candidate node sequences. The sequence generation network is trained on an initial sequence generation network using an auxiliary trajectory set and its real node sequences in a spatiotemporal graph. The auxiliary trajectory set is generated by randomly selecting points on a map using a black-box model. The spatiotemporal graph is a weighted directed graph constructed based on a historical trajectory database. Based on the sequence of candidate nodes without noise, determine the noisy matching trajectory of the target trajectory; Based on the noisy candidate node sequence, determine the noisy matching trajectory of the target trajectory; Based on the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, and to construct the target trajectory un-noiseed estimated distance vector. The neural network model is obtained by training an initial neural network model using the training trajectory embedding vector, the marker point trajectory embedding vector, and the distance between the training trajectory embedding vector and the marker point trajectory embedding vector. The marker point trajectory embedding vector is determined based on the marker point trajectory. The marker point trajectory is obtained by clustering the auxiliary trajectory set. Based on the target trajectory denoised embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory denoised embedding vector and the marker point trajectory embedding vector, and a target trajectory denoised estimation distance vector is constructed. Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, a noisy coarse estimated trajectory of the target trajectory is determined; the estimated distance vector of the candidate trajectory is the distance vector between the candidate trajectory and the embedding vector of the marker point trajectory; the candidate trajectory is a historical trajectory segment extracted based on the weighted directed graph. Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, a noisy coarse estimated trajectory of the target trajectory is determined; Based on the unnoised matched trajectory of the target trajectory, the unnoised coarsely estimated trajectory of the target trajectory, and the target trajectory node sequence, the unnoised comprehensive risk score is determined using a comprehensive risk scoring function. Based on the noisy matched trajectory of the target trajectory, the noisy coarse estimated trajectory of the target trajectory, and the target trajectory node sequence, the noisy comprehensive risk score is determined using a comprehensive risk scoring function; The privacy leakage risk of the trajectory embedding model to be evaluated is assessed based on the unnoised comprehensive risk score and the noisy comprehensive risk score.

[0008] In one embodiment, based on the target trajectory, a trajectory embedding dataset is obtained using the trajectory embedding model to be evaluated, specifically including: The target trajectory is encrypted using a homomorphic hash encryption protocol to obtain the encrypted target trajectory; Based on the encrypted target trajectory, the target trajectory un-noised embedding vector is obtained using the trajectory embedding model to be evaluated; Based on the encrypted target trajectory and noise vector, the target trajectory with added noise is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution.

[0009] In one embodiment, the construction process of a weighted directed graph specifically includes: Obtain historical trajectory database; Based on the historical trajectory database, map matching is performed to map each historical trajectory into a discrete node sequence. Based on the discretized node sequence, determine the node set and the edge set; Determine the transition probability and time type label between adjacent nodes; A weighted directed graph is constructed based on the set of nodes, the set of edges, the transition probabilities between adjacent nodes, and the time type label.

[0010] In one embodiment, the initial sequence generation network is trained using an auxiliary trajectory set and a sequence of real nodes of the auxiliary trajectory set in a spatiotemporal graph, specifically including: The auxiliary trajectory is encrypted using a homomorphic hash encryption protocol to obtain the encrypted auxiliary trajectory; Based on the encrypted auxiliary trajectory, the noisy embedding vector of the auxiliary trajectory is obtained using the trajectory embedding model to be evaluated; Based on the encrypted auxiliary trajectory and noise vector, the noisy embedding vector of the auxiliary trajectory is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution. Obtain the actual node sequence of the auxiliary trajectory on the spatiotemporal graph; Using the unnoised embedding vector and the noisy embedding vector of the auxiliary trajectory as inputs, and the real node sequence of the auxiliary trajectory on the spatiotemporal map as outputs, the initial sequence generation network is trained to obtain the sequence generation network.

[0011] In one embodiment, determining the noisy matching trajectory of the target trajectory based on the noisy candidate node sequence specifically includes: Determine whether the transition probability of adjacent node pairs in the noisy candidate node sequence is greater than 0; If so, the sequence of candidate nodes without noise is taken as the unnoised matching trajectory of the target trajectory; If not, Dijkstra's algorithm is used to find the shortest path on the spatiotemporal graph and insert the shortest path into the noisy candidate node sequence to obtain the noisy matching trajectory of the target trajectory.

[0012] In one embodiment, the comprehensive risk scoring function is: ; in, For comprehensive risk scoring; Here is the weighting constant. ; For indicator functions; The Hausdorff distance between the matching trajectory and the node sequence of the target trajectory; The discrete Friesian distance between the matching trajectory of the target trajectory and the node sequence of the target trajectory; To accurately estimate the error threshold; A rough estimate of the target trajectory and the Hausdorff distance to the target trajectory node sequence; A rough estimate of the target trajectory and the discrete Friesian distance of the target trajectory node sequence; To roughly estimate the error threshold; To restore point coverage.

[0013] In one embodiment, the privacy leakage risk of the trajectory embedding model to be evaluated is assessed based on the un-noiseed comprehensive risk score and the noisy comprehensive risk score, specifically including: Determine whether the difference between the noise-added comprehensive risk score and the unnoise-added comprehensive risk score is less than a preset risk threshold; If so, then the trajectory embedding model to be evaluated is determined to have a privacy leakage risk; If not, then it is determined that the trajectory embedding model to be evaluated does not pose a privacy leakage risk.

[0014] In a second aspect, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the trajectory embedding model privacy leakage risk assessment method described in any one of the above.

[0015] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the trajectory embedding model privacy leakage risk assessment method described in any one of the above.

[0016] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the trajectory embedding model privacy leakage risk assessment method described in any one of the above.

[0017] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides a method, device, medium, and product for assessing the privacy leakage risk of a trajectory embedding model. The method involves acquiring a target trajectory; obtaining a noisy embedding vector and a noisy embedding vector using the trajectory embedding model to be evaluated; inputting these two embedding vectors into a sequence generation network to generate a sequence of noisy candidate nodes and a sequence of noisy candidate nodes; determining the matching trajectory of the target trajectory based on the candidate node sequences; estimating the distance between the two embedding vectors and the marker point trajectory embedding vector using a neural network model, and constructing an estimated distance vector for the target trajectory; determining a coarsely estimated trajectory based on the estimated distance vectors of the target trajectory and the candidate trajectories; and determining a comprehensive risk score (both noisy and noisy) based on the matching trajectory, the coarsely estimated trajectory, and the target trajectory node sequence using a comprehensive risk scoring function, thereby assessing the privacy leakage risk of the trajectory embedding model to be evaluated. This application can reconstruct the target trajectory with high precision and use the reconstruction results to measure privacy risk. Furthermore, it can roughly reproduce the spatial distribution and movement trend of the target trajectory with only a few queries, forming multi-scale privacy leakage risk analysis results. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1A schematic flowchart illustrating a method for assessing the privacy leakage risk of a trajectory embedding model, provided in an embodiment of this application; Figure 2 A flowchart illustrating the practical application of the trajectory embedding model privacy leakage risk assessment method of this application; Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] This application belongs to the field of trajectory data privacy risk assessment. The subject of the trajectory embedding model privacy leakage risk assessment method is a trajectory analysis system deployed on a server or edge computing node. The system performs structural reconstruction and privacy sensitivity assessment on the target embedded trajectory through modules such as trajectory graph construction, encrypted query, and graph neural network decoding.

[0023] To address the problems in the background technology, this application proposes a method for assessing privacy leakage risks using trajectory embedding models. Based on trajectory embedding and sequence decoding, it accurately reconstructs the original path structure: A publicly available black-box trajectory representation model is used to query a large-scale set of auxiliary trajectories to obtain corresponding embedding vectors; these embedding vectors are mapped to a sequence of road nodes via a sequence generation network, and then restored to a target trajectory conforming to the road network topology using a map matching algorithm; the decoding network, constrained by cross-entropy loss, can achieve high-precision reconstruction of the target trajectory while ensuring consistency between the start and end points and the direction of travel, and the reconstruction results are used to measure privacy risks. Under limited query conditions, trajectory spatial trends are reconstructed using marker point distance estimation: When the number of queries is limited, a small number of auxiliary trajectories are selected as marker points, and a neural network model is trained to predict the distance coordinates between each sub-segment of the target trajectory and the marker points; the multi-dimensional distance vectors between all network segments and marker points are matched with the estimated target trajectory vector for similarity, and each sub-segment node is located sequentially and connected to form a complete trajectory reconstruction; this method can roughly reproduce the spatial distribution and movement trend of the target trajectory with only a few queries, forming multi-scale privacy risk analysis results. This method is not only applicable to attack simulation of real closed systems, but can also be used for robustness evaluation of trajectory privacy protection algorithms and security auditing of interface design, which has important practical significance and engineering value.

[0024] In one exemplary embodiment, such as Figure 1 and Figure 2 As shown, a method for assessing the privacy leakage risk of a trajectory embedding model is provided, including the following steps: S1: Obtain the target trajectory; the target trajectory consists of the spatial coordinates of multiple sampling points and their corresponding timestamps.

[0025] S2: Based on the target trajectory, use the trajectory embedding model to be evaluated to obtain the trajectory embedding dataset; the trajectory embedding dataset includes the target trajectory un-noised embedding vector and the target trajectory noisy embedding vector.

[0026] As an optional implementation, S2 specifically includes: S21: Encrypt the target trajectory using a homomorphic hash encryption protocol to obtain the encrypted target trajectory.

[0027] S22: Based on the encrypted target trajectory, the target trajectory un-noiseed embedding vector is obtained using the trajectory embedding model to be evaluated.

[0028] S23: Based on the encrypted target trajectory and noise vector, the target trajectory with added noise is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution.

[0029] In this embodiment, trajectory encryption embedding is performed first: the trajectory data (target trajectory) is input into the trajectory embedding model that requires privacy risk assessment, resulting in a trajectory embedding dataset. Specifically: To simulate a real service interface, the system performs homomorphic encryption on the target trajectory. The trajectory is encoded into ciphertext using a homomorphic hash encryption protocol and sent to the embedding service interface (the trajectory embedding model to be evaluated) for invocation, returning a trajectory embedding vector. Let the target trajectory be denoted as: .

[0030] in, Indicates the first Spatial coordinates of each sampling point For the corresponding timestamps, j=1,2,...,k, This represents the number of sampling points.

[0031] Each sampling point is encrypted using a homomorphic hash encryption protocol: .

[0032] in, For the encrypted first The x-coordinate of each sampling point; For the encrypted first The ordinate of each sampling point; For the encrypted first The timestamp of each sampling point.

[0033] The entire target trajectory is represented in encrypted form: .

[0034] This homomorphic encryption satisfies: for any two plaintexts : .

[0035] This ensures that vector computations can be performed in the ciphertext field without exposing the plaintext.

[0036] This application allows the system to conduct attack simulations without exposing plaintext trajectories, ensuring the legitimacy and reproducibility of the testing phase. The system introduces a Laplace differential privacy noise injection mechanism to implement protection strategies within the embedded service. Subsequent attack methods are applied to both "noisy" and "unnoisy" versions, and the attack success rates are compared. The embedding interface mapping function (trajectory embedding model) is denoted as: .

[0037] in, For embedded space; The trajectory is encrypted.

[0038] The corresponding output embedding vector dimension is The un-noiseed version directly... Send the vector to the embedding service interface to obtain the target trajectory's noisy embedding vector: .

[0039] Noise-added version satisfies - Differential privacy, from the Laplace distribution Medium-sampled noise vector: .

[0040] Where b is the scale parameter; For privacy budgeting, the noisy embedding vector of the target trajectory is obtained: .

[0041] Finally, two versions of the target trajectory embedding vector are saved: .

[0042] If the recovered trajectory maintains a stable restored path after introducing differential privacy perturbations, it is determined that the trajectory embedding after adding noise still has a significant risk of leakage; otherwise, it is considered to have a certain degree of resistance to attacks. The method of this application has high efficiency and privacy risk assessment capabilities, and is particularly suitable for structural diagnosis and trajectory inversion in scenarios with limited embedding interface resources. Each step is implemented through software, and the execution entity is a computing device with network access and model calculation capabilities.

[0043] S3: Input the unnoised embedding vector and the noisy embedding vector of the target trajectory into the sequence generation network respectively to generate an unnoised candidate node sequence and a noisy candidate node sequence; the sequence generation network is obtained by training the initial sequence generation network using an auxiliary trajectory set and the real node sequence of the auxiliary trajectory set on the spatiotemporal graph; the auxiliary trajectory set is generated by randomly selecting points on the map using a black box model; the spatiotemporal graph is a weighted directed graph; the weighted directed graph is constructed based on a historical trajectory database.

[0044] As an optional implementation, the construction process of a weighted directed graph specifically includes: Obtain the historical trajectory database.

[0045] Based on the historical trajectory database, map matching is performed to map each historical trajectory into a discrete node sequence.

[0046] Based on the discretized node sequence, determine the node set and the edge set.

[0047] Determine the transition probability and time type label between adjacent nodes.

[0048] A weighted directed graph is constructed based on the set of nodes, the set of edges, the transition probabilities between adjacent nodes, and the time type label.

[0049] As an optional implementation, the initial sequence generation network is trained using an auxiliary trajectory set and the real node sequences of the auxiliary trajectory set in the spatiotemporal graph, specifically including: The auxiliary trajectory is encrypted using a homomorphic hash encryption protocol to obtain the encrypted auxiliary trajectory.

[0050] Based on the encrypted auxiliary trajectory, the un-noiseed embedding vector of the auxiliary trajectory is obtained using the trajectory embedding model to be evaluated.

[0051] Based on the encrypted auxiliary trajectory and noise vector, the auxiliary trajectory with added noise is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution.

[0052] Obtain the actual node sequence of the auxiliary trajectory on the spatiotemporal graph.

[0053] Using the unnoised embedding vector and the noisy embedding vector of the auxiliary trajectory as inputs, and the real node sequence of the auxiliary trajectory on the spatiotemporal map as outputs, the initial sequence generation network is trained to obtain the sequence generation network.

[0054] In this embodiment, after the trajectory encryption embedding is completed, reverse embedding recovery is performed: based on the target trajectory's un-noisy embedding vector and the target trajectory's noisy embedding vector in S2, the original trajectory is obtained. Specifically: The system first constructs the historical trajectory database into a time-labeled spatial map structure (i.e., a spatiotemporal map). From the historical trajectory database, map matching is performed to map each historical trajectory into a discrete sequence of nodes. .

[0055] in, For the corresponding nodes on the map, i is the trajectory number; k i This represents the node index. The node set is defined as follows: .

[0056] in, Let v be the longitude of node v; Let v be the latitude of node v.

[0057] Construct edge set , where each edge This indicates possible node jumps on the map, along with labels for the transfer probability and time type: .

[0058] .

[0059] in, For the transition probability; For time-type tags; For counting.

[0060] Furthermore, the spatiotemporal graph is represented as a weighted directed graph: .

[0061] Next, the system calls the black-box model of the external trajectory embedding interface to perform an embedding query on the large-scale auxiliary trajectory set (auxiliary trajectory set) generated by randomly selecting points on the map, obtaining the embedding vector set. Following the method of obtaining the trajectory embedding vectors in S2, the auxiliary trajectory set is then... Homomorphic encryption and embedding are then performed to obtain the noisy embedding vectors of the auxiliary trajectory. and auxiliary trajectory noise embedding vector And their actual node sequences in the spatiotemporal graph Jointly train a sequence generation network This enables it to embed vectors Decoded into node sequence .

[0062] The network enhances trajectory generation accuracy through a cross-entropy loss function and topological constraint regularization.

[0063] The cross-entropy loss function is: .

[0064] in, This represents the cross-entropy loss function used in training sequence generation networks. For a given sequence of historical nodes and embedding vector Under these conditions, the model predicts the next node. The probability value is θ. θ is a network model parameter. By optimizing this loss function (maximizing the log probability), the model learns to generate a more accurate sequence of trajectory nodes, thereby improving the accuracy of trajectory reconstruction.

[0065] Topological constraint regularization is as follows: .

[0066] in, This represents a penalty term applied to the transition probabilities of all adjacent node pairs in the generated trajectory path on the pre-constructed spatiotemporal graph. For adjacent node pairs in the i-th auxiliary trajectory In the spatiotemporal map The transition probability on It is the j-th node in the i-th auxiliary trajectory; Let be the (j+1)th node in the i-th auxiliary trajectory.

[0067] Supervised training is performed on the original trajectory to ensure that the generated trajectory is consistent with the target trajectory in terms of direction and path structure. Specifically, when adjacent nodes in the generated path are... In the spatiotemporal map Uptransition probability At lower values, a larger penalty is incurred. Overall, the total network loss is: .

[0068] in, The optimal parameters are obtained through backpropagation, serving as the balance coefficients. .

[0069] During inference, the target embedding vector obtained from S2 is used. Input after training Generate a sequence of candidate nodes: .

[0070] For candidate node sequences Check adjacent node pairs in turn. In the spatiotemporal map Does an edge exist in the middle? like If so, the original order (i.e., the candidate node sequence) is retained. For adjacent node pairs The transition probability.

[0071] Otherwise, Dijkstra's algorithm can be used in the spatiotemporal graph. Find the shortest path Then, insert it into the candidate node sequence to obtain the matching trajectory of the target trajectory. This is to ensure the continuity of the final path.

[0072] The matched trajectory will be compared with the original real trajectory in S10 to measure the spatial error, providing a basis for accurate restoration effect for privacy risk assessment.

[0073] S4: Determine the noisy matching trajectory of the target trajectory based on the noisy candidate node sequence.

[0074] S5: Determine the noisy matching trajectory of the target trajectory based on the noisy candidate node sequence.

[0075] As an optional implementation, S4 specifically includes: S41: Determine whether the transition probability of adjacent node pairs in the unnoised candidate node sequence is greater than 0.

[0076] S42: If so, the sequence of candidate nodes without noise is taken as the unnoised matching trajectory of the target trajectory.

[0077] S43: If not, then use Dijkstra's algorithm to find the shortest path on the spatiotemporal graph and insert the shortest path into the noisy candidate node sequence to obtain the noisy matching trajectory of the target trajectory.

[0078] Similarly, generate a noisy matching trajectory for the target trajectory.

[0079] S6: Based on the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, and a target trajectory un-noiseed estimated distance vector is constructed; the neural network model is obtained by training an initial neural network model using the training trajectory embedding vector, the marker point trajectory embedding vector, and the distance between the training trajectory embedding vector and the marker point trajectory embedding vector; the marker point trajectory embedding vector is determined based on the marker point trajectory; the marker point trajectory is obtained by clustering the auxiliary trajectory set.

[0080] S7: Based on the target trajectory noise-added embedding vector and the marker point trajectory embedding vector, use a neural network model to estimate the distance between the target trajectory noise-added embedding vector and the marker point trajectory embedding vector, and construct the target trajectory noise-added estimated distance vector.

[0081] In this embodiment, after the embedding reverse recovery is completed, finite query structure optimization is performed: based on the target trajectory un-noisy embedding vector and the target trajectory noisy embedding vector in S2, a structure optimization evaluation under finite queries is performed, specifically: Under the condition of limited number of embedded interface calls, the system uses the auxiliary trajectory set In the middle, first in the embedded space Upper pair Clustering The first cluster represents a region with high popularity. For the second... For each cluster, the trajectory corresponding to the cluster center or the most representative trajectory within the cluster is selected as the marker point trajectory, resulting in: .

[0082] Let the embedded trajectory of the marker point be... .

[0083] The system designs a neural network model to learn the distance function between the input trajectory (training trajectory) and the marker point trajectories, with the objective of estimating the embedding spatial distance between the target trajectory and each marker point. The distance regression function is defined as follows: .

[0084] Make it satisfy: .

[0085] in, For training trajectory embedding, Embedding of marker point trajectories, To train the trajectory embedding to the corresponding real trajectory, Embed the corresponding real trajectory into the trajectory of the marker point. Let F be the discrete Fréchet distance between the trajectories, i.e.: .

[0086] in, They are respectively The node sequence, This is a non-decreasing parameterized time mapping. The network training set is selected in pairs from the auxiliary embeddings. The actual tag is: .

[0087] The regression loss is defined as the mean squared error loss, i.e.: .

[0088] Where, N pair Let represent the total number of pairs of trajectory embedding combinations participating in training. Specifically, it refers to the number of pairs of samples (z) selected from the auxiliary embedding trajectories. i , z j The number of (i.e., the total number of combinations of (training trajectory embeddings, marker embeddings)). Its function is to standardize the loss value: by dividing by N. pair By averaging the loss function, the loss values ​​generated by different batches of training data can be compared, avoiding the influence of the sample size on the magnitude of the loss and ensuring the stability of model optimization.

[0089] The final network parameters are obtained by minimizing this loss. Used for target trajectory distance estimation and matching. Using a trained [program / preset / preset]... Estimating target embedding Embedded with each marker point Distance between: .

[0090] And construct the estimated distance vector: .

[0091] S8: Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, determine the noisy coarse estimated trajectory of the target trajectory; the estimated distance vector of the candidate trajectory is the distance vector between the candidate trajectory and the embedded vector of the marker point trajectory.

[0092] S9: Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, determine the noisy coarse estimated trajectory of the target trajectory. The candidate trajectory is a historical trajectory segment extracted based on the weighted directed graph.

[0093] Candidate trajectories refer to a set of possible trajectory segments pre-extracted from the spatiotemporal graph. These segments originate from a weighted directed graph constructed from a historical trajectory database. Fixed-length feasible sub-paths are generated by cutting long trajectories to form a candidate set. For each candidate trajectory segment, the discrete Friesian distance to all marker point trajectories is calculated, forming a multi-dimensional distance vector. These vectors are stored in the system and used for subsequent similarity matching with the estimated distance vector of the target trajectory, thereby selecting the segments with the closest spatial distribution and splicing them together to form a coarsely estimated trajectory.

[0094] In this embodiment, a set of candidate trajectory segments is considered. Each segment The representation in the embedding space is: Calculate the distance vector of each segment relative to the set of marker points: .

[0095] Based on the evaluation target vector With candidate vectors Match degree: .

[0096] according to Take first in descending order A fragment And according to the map connectivity, they are pieced together to form a rough estimated trajectory. .Should Matching trajectory with the target trajectory They will be sent to the next step for error comparison and risk assessment.

[0097] S10: Based on the unnoised matched trajectory of the target trajectory, the unnoised rough estimated trajectory of the target trajectory, and the target trajectory node sequence, the unnoised comprehensive risk score is determined using the comprehensive risk scoring function.

[0098] S11: Based on the noisy matching trajectory of the target trajectory, the noisy rough estimated trajectory of the target trajectory, and the target trajectory node sequence, the noisy comprehensive risk score is determined using the comprehensive risk scoring function.

[0099] S12: Based on the unnoised comprehensive risk score and the noisy comprehensive risk score, assess the privacy leakage risk of the trajectory embedding model to be evaluated.

[0100] In this embodiment, a privacy risk assessment is performed last: based on the matching trajectory and the coarsely estimated trajectory of the target trajectory, the privacy risks of the trajectory embedding system are assessed, specifically: The system compares the distance distributions of the roughly estimated trajectory with the original embedding, including Hausdorff distance and discrete Fraser distance, and calculates the reconstruction error index.

[0101] Calculate the accurate path reconstruction (the matching trajectory of the target trajectory). With target trajectory node sequence Hausdorf distance between them: .

[0102] in, This represents the Euclidean distance between two points p and q.

[0103] And the discrete Friesian distance defined above. If both conditions are met... If the trajectory is successfully recovered at the level of precise reconstruction, then it is determined that the high-precision reconstruction poses an extremely high privacy risk.

[0104] in, For an acceptable level of accuracy, the estimation error threshold can be set to 1000 meters in practical applications.

[0105] For a finite query, the coarse estimation error is related to the coarse estimated trajectory. With target trajectory node sequence Also calculate the Hausdorff distance and the discrete Fraser distance: .

[0106] If satisfied They argue that even under limited query conditions, the target trajectory can still be recovered within a relatively high accuracy range, but privacy risks still exist.

[0107] in, To provide an acceptable, rough estimate of the error threshold, In practical applications, it can be set to 2000 meters.

[0108] Additional system metrics for calculating recovery point coverage: .

[0109] The effectiveness of privacy attacks can be measured using map classification metrics.

[0110] Define the comprehensive risk scoring function: .

[0111] in, For comprehensive risk scoring; Here is the weighting constant. ; For indicator functions; The Hausdorff distance between the matching trajectory and the node sequence of the target trajectory; The discrete Friesian distance between the matching trajectory of the target trajectory and the node sequence of the target trajectory; To accurately estimate the error threshold; A rough estimate of the target trajectory and the Hausdorff distance to the target trajectory node sequence; A rough estimate of the target trajectory and the discrete Friesian distance of the target trajectory node sequence; To roughly estimate the error threshold; To restore point coverage.

[0112] In one embodiment, S12 specifically includes: Determine whether the difference between the noise-added comprehensive risk score and the unnoise-added comprehensive risk score is less than a preset risk threshold.

[0113] If so, then the trajectory embedding model to be evaluated is determined to have a privacy leakage risk.

[0114] If not, then it is determined that the trajectory embedding model to be evaluated does not pose a privacy leakage risk.

[0115] Calculate the integrated risk scoring function with and without noise embeddings respectively. ,in, If a preset risk threshold is set, the system will determine that privacy protection is insufficient; otherwise, it will consider that differential privacy noise has a good effect on the location privacy of the trajectory.

[0116] The trajectory embedding model privacy leakage risk assessment method in this application has the following advantages: 1. High-precision trajectory reconstruction capability: Through a trajectory embedding reverse recovery attack method, the system directly generates embedding vectors using a black-box embedding model, reconstructs the trajectory node sequence with the help of a structure decoding network, and then recovers feasible road paths through map matching, ensuring that the recovered trajectory is highly consistent in terms of start and end points, path direction, and road segment connectivity. The effectiveness of this technology mainly stems from the structure mapping mechanism based on sequence generation network and the road map matching strategy used in S3, which together ensure the compliance and integrity of the trajectory structure.

[0117] 2. Usable Recovery under Finite Invocation Conditions: The finite query structure optimization method only requires embedding invocations on a small number of auxiliary trajectories to estimate the embedding similarity of any target trajectory, thus completing a rough reconstruction of the trajectory. Compared to traditional trajectory recovery attacks that rely on a large number of queries, this significantly reduces interface costs and is more adaptable. This advantage stems from the neural network model training mechanism and multi-dimensional distance matching algorithm, which can effectively establish a similarity mapping between the target trajectory and auxiliary trajectories.

[0118] 3. Balancing Efficiency and Scalability: This application's method adopts a modular design. The privacy assessment attack method is applicable to scenarios with abundant open access resources, and the finite query structure optimization method is optimized for scenarios with limited call frequency. The system can flexibly switch attack strategies according to resource constraints, exhibiting good scalability. This advantage stems from the optimized design of the call strategy for the trajectory embedding model within the overall system architecture, as well as the structural reuse of the embedding representation.

[0119] 4. Privacy-interpretable and process-transparent: Compared to methods that only provide binary results of "privacy leakage" and "no privacy leakage," this method can intuitively reflect the degree of privacy exposure of the target trajectory through indicators such as path offset and distance error in the reconstructed trajectory, and provides auxiliary trajectory contribution ranking, facilitating auditing and analysis. This technical effectiveness benefits from the error assessment and indicator output mechanism, supporting fine-grained quantification and interpretation of the attack process.

[0120] 5. Adaptable to black-box models and possessing algorithmic versatility: The proposed method is independent of the trajectory embedding model structure and supports arbitrary forms of trajectory encoding interfaces, including closed API services based on deep learning. This feature significantly enhances the adaptability of the attack model in real-world systems. This advantage stems from the design that relies solely on the embedding vector rather than the embedding process itself, ensuring compatibility with mainstream trajectory service systems (such as privacy-sensitive location recommendation and path prediction APIs).

[0121] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described trajectory embedding model privacy leakage risk assessment method.

[0122] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the above-described trajectory embedding model privacy leakage risk assessment method.

[0123] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described trajectory embedding model privacy leakage risk assessment method.

[0124] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 3 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a trajectory embedding model privacy leakage risk assessment method.

[0125] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0126] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0127] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0128] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0129] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0130] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for assessing the privacy leakage risk of a trajectory embedding model, characterized in that, include: Obtain the target trajectory; The target trajectory consists of the spatial coordinates of multiple sampling points and their corresponding timestamps; Based on the target trajectory, a trajectory embedding dataset is obtained using the trajectory embedding model to be evaluated; the trajectory embedding dataset includes the target trajectory un-noised embedding vector and the target trajectory noisy embedding vector. The target trajectory un-noised embedding vector and the target trajectory noisy embedding vector are respectively input into the sequence generation network to generate un-noised candidate node sequences and noisy candidate node sequences; the sequence generation network is obtained by training the initial sequence generation network using an auxiliary trajectory set and the real node sequences of the auxiliary trajectory set on the spatiotemporal map; the auxiliary trajectory set is generated by randomly selecting points on the map using a black box model; The spatiotemporal graph is a weighted directed graph; the weighted directed graph is constructed based on a historical trajectory database; Based on the sequence of candidate nodes without noise, determine the noisy matching trajectory of the target trajectory; Based on the noisy candidate node sequence, determine the noisy matching trajectory of the target trajectory; Based on the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, and to construct the target trajectory un-noiseed estimated distance vector. The neural network model is obtained by training an initial neural network model using the training trajectory embedding vector, the marker point trajectory embedding vector, and the distance between the training trajectory embedding vector and the marker point trajectory embedding vector. The marker point trajectory embedding vector is determined based on the marker point trajectory. The marker point trajectory is obtained by clustering the auxiliary trajectory set. Based on the target trajectory denoised embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory denoised embedding vector and the marker point trajectory embedding vector, and a target trajectory denoised estimation distance vector is constructed. Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, a noisy coarse estimated trajectory of the target trajectory is determined; the estimated distance vector of the candidate trajectory is the distance vector between the candidate trajectory and the embedding vector of the marker point trajectory; the candidate trajectory is a historical trajectory segment extracted based on the weighted directed graph. Based on the noisy estimated distance vector of the target trajectory and the estimated distance vector of the candidate trajectory, a noisy coarse estimated trajectory of the target trajectory is determined; Based on the unnoised matched trajectory of the target trajectory, the unnoised coarsely estimated trajectory of the target trajectory, and the target trajectory node sequence, the unnoised comprehensive risk score is determined using a comprehensive risk scoring function. Based on the noisy matched trajectory of the target trajectory, the noisy coarse estimated trajectory of the target trajectory, and the target trajectory node sequence, the noisy comprehensive risk score is determined using a comprehensive risk scoring function; The privacy leakage risk of the trajectory embedding model to be evaluated is assessed based on the unnoised comprehensive risk score and the noisy comprehensive risk score.

2. The method for assessing privacy leakage risk of trajectory embedding model according to claim 1, characterized in that, Based on the target trajectory, a trajectory embedding dataset is obtained using the trajectory embedding model to be evaluated, specifically including: The target trajectory is encrypted using a homomorphic hash encryption protocol to obtain the encrypted target trajectory; Based on the encrypted target trajectory, the target trajectory un-noised embedding vector is obtained using the trajectory embedding model to be evaluated; Based on the encrypted target trajectory and noise vector, the target trajectory with added noise is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution.

3. The method for assessing the privacy leakage risk of trajectory embedding models according to claim 1, characterized in that, The construction process of a weighted directed graph specifically includes: Obtain historical trajectory database; Based on the historical trajectory database, map matching is performed to map each historical trajectory into a discrete node sequence. Based on the discretized node sequence, determine the node set and the edge set; Determine the transition probability and time type label between adjacent nodes; A weighted directed graph is constructed based on the set of nodes, the set of edges, the transition probabilities between adjacent nodes, and the time type label.

4. The method for assessing the privacy leakage risk of trajectory embedding models according to claim 1, characterized in that, The initial sequence generation network is trained using an auxiliary trajectory set and its real node sequences in a spatiotemporal graph. Specifically, this includes: The auxiliary trajectory is encrypted using a homomorphic hash encryption protocol to obtain the encrypted auxiliary trajectory; Based on the encrypted auxiliary trajectory, the noisy embedding vector of the auxiliary trajectory is obtained using the trajectory embedding model to be evaluated; Based on the encrypted auxiliary trajectory and noise vector, the noisy embedding vector of the auxiliary trajectory is obtained using the trajectory embedding model to be evaluated; the noise vector is sampled from the Laplace distribution. Obtain the actual node sequence of the auxiliary trajectory on the spatiotemporal graph; Using the unnoised embedding vector and the noisy embedding vector of the auxiliary trajectory as inputs, and the real node sequence of the auxiliary trajectory on the spatiotemporal map as outputs, the initial sequence generation network is trained to obtain the sequence generation network.

5. The method for assessing privacy leakage risk of trajectory embedding model according to claim 1, characterized in that, Based on the sequence of candidate nodes without noise, the noisy matching trajectory of the target trajectory is determined, specifically including: Determine whether the transition probability of adjacent node pairs in the noisy candidate node sequence is greater than 0; If so, the sequence of candidate nodes without noise is taken as the unnoised matching trajectory of the target trajectory; If not, Dijkstra's algorithm is used to find the shortest path on the spatiotemporal graph and insert the shortest path into the noisy candidate node sequence to obtain the noisy matching trajectory of the target trajectory.

6. The method for assessing the privacy leakage risk of trajectory embedding models according to claim 1, characterized in that, The comprehensive risk scoring function is as follows: ； in, For comprehensive risk scoring; Here is the weighting constant. ; For indicator functions; The Hausdorff distance between the matching trajectory and the node sequence of the target trajectory; The discrete Friesian distance between the matching trajectory and the target trajectory node sequence; To accurately estimate the error threshold; The rough estimate of the target trajectory and the Hausdorff distance of the target trajectory node sequence; The coarse estimate of the target trajectory and the discrete Friesian distance of the target trajectory node sequence; To roughly estimate the error threshold; To restore point coverage.

7. The method for assessing the privacy leakage risk of trajectory embedding models according to claim 1, characterized in that, Based on the un-noiseed comprehensive risk score and the noiseed comprehensive risk score, the privacy leakage risk of the trajectory embedding model to be evaluated is assessed, specifically including: Determine whether the difference between the noise-added comprehensive risk score and the unnoise-added comprehensive risk score is less than a preset risk threshold; If so, then the trajectory embedding model to be evaluated is determined to have a privacy leakage risk; If not, then it is determined that the trajectory embedding model to be evaluated does not pose a privacy leakage risk.

8. A computer device, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the trajectory embedding model privacy leakage risk assessment method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the trajectory embedding model privacy leakage risk assessment method as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the trajectory embedding model privacy leakage risk assessment method as described in any one of claims 1-7.

Images