Trajectory embedding model privacy leakage risk assessment method, device, medium and product

Abstract

The application discloses a trajectory embedding model privacy leakage risk evaluation method, device, medium and product, relates to the field of trajectory data privacy risk evaluation, and comprises the following steps: obtaining a target trajectory un-noised embedding vector and a target trajectory noised embedding vector by using a trajectory embedding model to be evaluated; inputting the embedding vector into a sequence generation network to generate a candidate node sequence; determining a matching trajectory of the target trajectory according to the candidate node sequence; constructing a target trajectory estimated distance vector by using a neural network model according to the embedding vector and a landmark trajectory embedding vector; determining a rough estimated trajectory of the target trajectory according to the target trajectory estimated distance vector and a candidate trajectory estimated distance vector; and determining un-noised comprehensive risk scores and noised comprehensive risk scores by using a comprehensive risk scoring function in combination with the target trajectory node sequence, so as to evaluate the privacy leakage risk of the trajectory embedding model to be evaluated. The application realizes the evaluation of the privacy leakage risk of the trajectory embedding model.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of trajectory data privacy risk assessment, and particularly relates to a trajectory embedding model privacy leakage risk assessment method, device, medium and product. BACKGROUND

[0002] With the rapid development of mobile Internet and intelligent transportation systems, massive user location trajectories are continuously recorded and widely used in path recommendation, behavior modeling, urban planning and other fields. In recent years, trajectory embedding technology has become a mainstream representation learning method, which compresses high-dimensional trajectory sequences into fixed-length vector representations through deep neural networks. It is widely integrated into third-party trajectory mining service interfaces for clustering, prediction and personalized analysis tasks in downstream. However, such services usually open API (Application Program Interface) in the form of "black box embedding", only return embedding vectors, and hide the internal logic of the trajectory mapping process, thereby forming a surface privacy isolation between the user and the platform.

[0003] Existing research generally believes that the embedding vector, although compresses the trajectory information, no longer has explicit spatial semantics, so it is difficult to reverse the original trajectory, and thus is considered to be privacy-safe. Although some existing works have theoretically analyzed the reversibility of trajectory embedding, in actual scenarios, there is still a lack of systematic and operable "black box trajectory inversion method" to verify whether such services have privacy leakage risks.

[0004] On the other hand, with the tightening of access control for the opening of embedding services interfaces, many systems impose restrictions on the number of queries for a single user, making the privacy attack strategy centered on "intensive calls" ineffective, and there is an urgent need to develop new mechanisms that are still effective under the condition of limited number of calls. In addition, existing inversion methods rely on explainable models trained end-to-end, which are difficult to deploy when facing closed APIs, and have the problem of poor technical adaptability.

[0005] In summary, the current technology has the following core pain points. First, there is a lack of practical "trajectory embedding to original trajectory" inversion method, making it difficult to verify the potential privacy risks of embedding services. Second, there is a lack of low-call, low-cost, and scalable trajectory attack framework, which cannot adapt to interface resource-limited scenarios. Third, existing methods cannot achieve structural explanation and error control of the inversion process, and the attack effect is uncontrollable and unreadable. SUMMARY

[0006] The purpose of the present application is to provide a trajectory embedding model privacy leakage risk assessment method, device, medium and product to assess the privacy leakage risk of trajectory embedding models.

[0007] To achieve the above object, the application provides the following scheme:

[0008] In a first aspect, the application provides a trajectory embedding model privacy leakage risk assessment method, comprising:

[0009] Obtaining a target trajectory; the target trajectory is composed of spatial coordinates and corresponding time stamps of a plurality of sampling points;

[0010] According to the target trajectory, a trajectory embedding data set is obtained by using a trajectory embedding model to be evaluated; the trajectory embedding data set includes a target trajectory non-noisy embedding vector and a target trajectory noisy embedding vector;

[0011] The target trajectory non-noisy embedding vector and the target trajectory noisy embedding vector are respectively input into a sequence generation network to generate a non-noisy candidate node sequence and a noisy candidate node sequence; the sequence generation network is obtained by training an initial sequence generation network using an auxiliary trajectory set and a real node sequence of the auxiliary trajectory set on a space-time graph; the auxiliary trajectory set is generated by randomly selecting points on a map using a black box model; the space-time graph is a weighted directed graph; the weighted directed graph is constructed according to a historical trajectory database;

[0012] According to the non-noisy candidate node sequence, a non-noisy matching trajectory of the target trajectory is determined;

[0013] According to the noisy candidate node sequence, a noisy matching trajectory of the target trajectory is determined;

[0014] According to the target trajectory non-noisy embedding vector and a landmark trajectory embedding vector, a distance between the target trajectory non-noisy embedding vector and the landmark trajectory embedding vector is estimated using a neural network model, and a target trajectory non-noisy estimated distance vector is constructed; the neural network model is obtained by training an initial neural network model using a training trajectory embedding vector, a landmark trajectory embedding vector, and a distance between the training trajectory embedding vector and the landmark trajectory embedding vector; the landmark trajectory embedding vector is determined according to a landmark trajectory; the landmark trajectory is obtained by clustering the auxiliary trajectory set;

[0015] According to the target trajectory noisy embedding vector and the landmark trajectory embedding vector, a distance between the target trajectory noisy embedding vector and the landmark trajectory embedding vector is estimated using a neural network model, and a target trajectory noisy estimated distance vector is constructed;

[0016] determine an un-noised rough estimation trajectory of the target trajectory according to the un-noised estimation distance vectors of the target trajectory and the candidate trajectory estimation distance vectors; the candidate trajectory estimation distance vectors are distance vectors between candidate trajectories and landmark trajectory embedding vectors; the candidate trajectories are historical trajectory segments extracted based on the weighted directed graph;

[0017] determine a noised rough estimation trajectory of the target trajectory according to the noised estimation distance vectors of the target trajectory and the candidate trajectory estimation distance vectors;

[0018] determine an un-noised comprehensive risk score by using a comprehensive risk score function according to the un-noised matching trajectory of the target trajectory, the un-noised rough estimation trajectory of the target trajectory and the target trajectory node sequence;

[0019] determine a noised comprehensive risk score by using a comprehensive risk score function according to the noised matching trajectory of the target trajectory, the noised rough estimation trajectory of the target trajectory and the target trajectory node sequence;

[0020] evaluate the privacy leakage risk of the trajectory embedding model to be evaluated according to the un-noised comprehensive risk score and the noised comprehensive risk score.

[0021] In an embodiment, the trajectory embedding dataset is obtained by using the trajectory embedding model to be evaluated according to the target trajectory, and specifically includes:

[0022] perform encryption processing on the target trajectory by using a homomorphic hash encryption protocol to obtain an encrypted target trajectory;

[0023] obtain a target trajectory un-noised embedding vector by using the trajectory embedding model to be evaluated according to the encrypted target trajectory;

[0024] obtain a target trajectory noised embedding vector by using the trajectory embedding model to be evaluated according to the encrypted target trajectory and a noise vector; the noise vector is sampled from a Laplace distribution.

[0025] In an embodiment, the construction process of the weighted directed graph specifically includes:

[0026] obtain a historical trajectory database;

[0027] perform map matching based on the historical trajectory database to map each historical trajectory into a discretized node sequence;

[0028] determine a node set and an edge set according to the discretized node sequence;

[0029] determine transition probabilities and time type labels between adjacent nodes;

[0030] Construct a weighted directed graph based on the node set, the edge set, the transition probability between adjacent nodes and the time type label.

[0031] In an embodiment, the initial sequence generation network is trained by using the auxiliary trajectory set and the real node sequence of the auxiliary trajectory set on the spatio-temporal graph, specifically including:

[0032] The auxiliary trajectory is encrypted by using a homomorphic hash encryption protocol to obtain an encrypted auxiliary trajectory;

[0033] According to the encrypted auxiliary trajectory, a trajectory embedding model to be evaluated is used to obtain an un-noisy embedding vector of the auxiliary trajectory;

[0034] According to the encrypted auxiliary trajectory and a noise vector, a trajectory embedding model to be evaluated is used to obtain a noisy embedding vector of the auxiliary trajectory; the noise vector is sampled from a Laplace distribution;

[0035] The real node sequence of the auxiliary trajectory on the spatio-temporal graph is obtained;

[0036] The initial sequence generation network is trained by taking the un-noisy embedding vector of the auxiliary trajectory and the noisy embedding vector of the auxiliary trajectory as input and taking the real node sequence of the auxiliary trajectory on the spatio-temporal graph as output to obtain a sequence generation network.

[0037] In an embodiment, according to the un-noisy candidate node sequence, an un-noisy matching trajectory of the target trajectory is determined, specifically including:

[0038] It is judged whether the transition probability of an adjacent node pair in the un-noisy candidate node sequence is greater than 0;

[0039] If yes, the un-noisy candidate node sequence is taken as the un-noisy matching trajectory of the target trajectory;

[0040] If no, a shortest path is found on the spatio-temporal graph by using a Dijkstra algorithm, and the shortest path is inserted into the un-noisy candidate node sequence to obtain the un-noisy matching trajectory of the target trajectory.

[0041] In an embodiment, the comprehensive risk score function is:

[0042] ;

[0043] wherein, is a comprehensive risk score; is a weight constant, ; is an indicator function; a Hausdorff distance of the matching trajectory of the target trajectory and the target trajectory node sequence; a discrete Frechet distance of the matching trajectory of the target trajectory and the target trajectory node sequence; an accurate estimation error threshold; a Hausdorff distance of the coarse estimation trajectory of the target trajectory and the target trajectory node sequence; a discrete Frechet distance of the coarse estimation trajectory of the target trajectory and the target trajectory node sequence; a coarse estimation error threshold; a recovery point coverage.

[0044] In an embodiment, according to the un-noised comprehensive risk score and the noised comprehensive risk score, the privacy leakage risk of the trajectory embedding model to be evaluated is evaluated, specifically comprising:

[0045] determining whether a difference between the noised comprehensive risk score and the un-noised comprehensive risk score is less than a preset risk threshold;

[0046] if yes, it is determined that the trajectory embedding model to be evaluated has a privacy leakage risk;

[0047] if no, it is determined that the trajectory embedding model to be evaluated does not have a privacy leakage risk.

[0048] In a second aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the trajectory embedding model privacy leakage risk evaluation method according to any one of the above.

[0049] In a third aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the trajectory embedding model privacy leakage risk evaluation method according to any one of the above.

[0050] In a fourth aspect, the present application provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the trajectory embedding model privacy leakage risk evaluation method according to any one of the above.

[0051] According to the specific embodiments provided by the present application, the present application has the following technical effects:

[0052] The application provides a trajectory embedding model privacy leakage risk evaluation method, device, medium and product. A target trajectory is obtained. According to the target trajectory, a target trajectory non-noisy embedding vector and a target trajectory noisy embedding vector are obtained by using a trajectory embedding model to be evaluated. The two embedding vectors are respectively input into a sequence generation network to generate a non-noisy candidate node sequence and a noisy candidate node sequence. According to the candidate node sequence, a matching trajectory of the target trajectory is determined. According to the two embedding vectors and a landmark trajectory embedding vector, a neural network model is used to estimate the distance between the embedding vectors and the landmark trajectory embedding vector, and a target trajectory estimated distance vector is constructed. According to the target trajectory estimated distance vector and a candidate trajectory estimated distance vector, a rough estimated trajectory of the target trajectory is determined. According to the matching trajectory of the target trajectory, the rough estimated trajectory of the target trajectory and a target trajectory node sequence, a comprehensive risk score function is used to determine a non-noisy comprehensive risk score and a noisy comprehensive risk score, and the privacy leakage risk of the trajectory embedding model to be evaluated is evaluated. The application can restore the target trajectory with high precision, measure the privacy risk by using the restoration condition. And under the condition of only a small amount of queries, the spatial distribution and motion trend of the target trajectory can be roughly reproduced, and a multi-scale privacy leakage risk analysis result is formed. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor.

[0054] Figure 1 A flowchart of a trajectory embedding model privacy leakage risk evaluation method provided by an embodiment of the present application is shown in the figure.

[0055] Figure 2 A flowchart of the trajectory embedding model privacy leakage risk evaluation method of the present application in actual application is shown in the figure.

[0056] Figure 3 A structural diagram of a computer device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0058] In order to make the above purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0059] The present application belongs to the field of trajectory data privacy risk assessment, and the execution subject of the trajectory embedding model privacy leakage risk assessment method is a trajectory analysis system deployed on a server or an edge computing node. The system restores the structure and assesses the privacy sensitivity of the target embedded trajectory through trajectory graph construction, encrypted query, graph neural network decoding and other modules.

[0060] In view of the problems in the background art, the present application proposes a trajectory embedding model privacy leakage risk assessment method, which accurately restores the original path structure based on trajectory embedding and sequence decoding: a large-scale auxiliary trajectory set is queried by using an open black box trajectory representation model to obtain the corresponding embedding vector; the embedding vector is mapped to a road node sequence through a sequence generation network, and is restored to a target trajectory conforming to the road network topology through a map matching algorithm; wherein, the decoding network is constrained by cross-entropy loss, which can realize high-precision restoration of the target trajectory under the premise of ensuring the consistency of the starting and ending points and the direction of travel, and measure the privacy risk by using the restoration. Under the condition of limited query, the trajectory space trend is reconstructed by means of landmark distance estimation: under the condition of limited query times, a small number of auxiliary trajectories are selected as landmarks, and a neural network model is trained to predict the distance coordinates between each segment of the target trajectory and the landmarks; the multi-dimensional distance vector of the entire network segment and the landmark is matched with the estimated vector of the target trajectory, and each segment node is positioned in turn, and the nodes are connected to form a complete trajectory restoration; this method can roughly reproduce the spatial distribution and motion trend of the target trajectory under the condition of only a small number of queries, forming a multi-scale privacy risk analysis result. This method is not only suitable for attack simulation of real closed systems, but also can be used for robustness evaluation of trajectory privacy protection algorithms and security audit of interface design, which has important practical significance and engineering value.

[0061] In one exemplary embodiment, as shown in Figure 1 and Figure 2 a trajectory embedding model privacy leakage risk assessment method is provided, comprising the following steps:

[0062] S1: obtaining a target trajectory; the target trajectory is composed of spatial coordinates and corresponding time stamps of a plurality of sampling points.

[0063] S2: obtaining a trajectory embedding dataset by using a trajectory embedding model to be evaluated according to the target trajectory; the trajectory embedding dataset includes a target trajectory non-noisy embedding vector and a target trajectory noisy embedding vector.

[0064] As an optional implementation, S2 specifically includes:

[0065] S21: Perform encryption processing on the target trajectory using a homomorphic hash encryption protocol to obtain an encrypted target trajectory.

[0066] S22: According to the encrypted target trajectory, use the trajectory embedding model to be evaluated to obtain a target trajectory non-noisy embedding vector.

[0067] S23: According to the encrypted target trajectory and the noise vector, use the trajectory embedding model to be evaluated to obtain a target trajectory noisy embedding vector; the noise vector is obtained by sampling from a Laplace distribution.

[0068] In this embodiment, first, trajectory encryption embedding is performed: input the trajectory data (target trajectory) into the trajectory embedding model that needs privacy risk evaluation to obtain a trajectory embedding dataset. Specifically:

[0069] To simulate the real service interface, the system performs homomorphic encryption processing on the target trajectory, encodes the trajectory into ciphertext form through the homomorphic hash encryption protocol, sends it to the embedding service interface (trajectory embedding model to be evaluated) for calling, and returns the trajectory embedding vector. Let the target trajectory be:

[0070] .

[0071] Wherein, represents the spatial coordinates of the i-th sampling point, is the corresponding timestamp, j = 1, 2,..., k, is the number of sampling points.

[0072] Use the homomorphic hash encryption protocol to encrypt each sampling point:

[0073] .

[0074] Wherein, is the horizontal coordinate of the i-th encrypted sampling point; is the vertical coordinate of the i-th encrypted sampling point; is the timestamp of the i-th encrypted sampling point. And represent the entire target trajectory as ciphertext:

[0075]

[0076] .

[0077] The homomorphic encryption satisfies: for any two plaintext :

[0078] .​​​​

[0079] Ensure that vector calculation can be performed in the ciphertext domain without exposing the plaintext.

[0080] The present application allows the system to carry out attack simulation without exposing the plaintext trajectory, ensuring the legality and reproducibility of the test phase. The system introduces a Laplace differential privacy noise injection mechanism to implement the protection strategy embedded in the service, and applies the subsequent attack method on the "noisy" and "non-noisy" versions respectively, and compares the attack success rate. The embedded interface mapping function (trajectory embedding model) is denoted as:

[0081] .

[0082] wherein, is the embedding space; is the encrypted trajectory.

[0083] The output embedding vector corresponding to the trajectory is of dimension . The non-noisy version directly sends to the embedding service interface to obtain the target trajectory non-noisy embedding vector:

[0084] .

[0085] The noisy version satisfies - differential privacy, and the noise vector is sampled from the Laplace distribution :

[0086] .

[0087] wherein, b is the scale parameter; is the privacy budget, and the target trajectory noisy embedding vector is obtained:

[0088] .

[0089] Finally, the target trajectory embedding vectors of the two versions are saved: .

[0090] If the trajectory can still maintain a stable recovery path after introducing differential privacy disturbance, it is determined that the trajectory embedding after adding noise still has a high risk of leakage; otherwise, it is considered to have certain anti-attack ability. The method of the present application has high efficiency and privacy risk assessment ability, and is especially suitable for structure diagnosis and trajectory inversion in the scenario of limited embedded interface resources. Each step is implemented through software, and the execution subject is a computing device with network access and model calculation capability.

[0091] S3: input the target trajectory non-noisy embedding vector and the target trajectory noisy embedding vector into a sequence generation network respectively to generate a non-noisy candidate node sequence and a noisy candidate node sequence; the sequence generation network is obtained by training an initial sequence generation network using an auxiliary trajectory set and a real node sequence of the auxiliary trajectory set on a spatio-temporal graph; the auxiliary trajectory set is generated by randomly selecting points on a map using a black box model; the spatio-temporal graph is a weighted directed graph; and the weighted directed graph is constructed according to a historical trajectory database.

[0092] As an optional implementation, the construction process of the weighted directed graph specifically comprises:

[0093] obtaining a historical trajectory database.

[0094] performing map matching based on the historical trajectory database to map each historical trajectory into a discretized node sequence.

[0095] determining a node set and an edge set according to the discretized node sequence.

[0096] determining a transition probability and a time type label between adjacent nodes.

[0097] constructing a weighted directed graph based on the node set, the edge set, the transition probability between adjacent nodes and the time type label.

[0098] As an optional implementation, the training of the initial sequence generation network using an auxiliary trajectory set and a real node sequence of the auxiliary trajectory set on a spatio-temporal graph specifically comprises:

[0099] encrypting the auxiliary trajectory using a homomorphic hash encryption protocol to obtain an encrypted auxiliary trajectory.

[0100] obtaining an auxiliary trajectory non-noisy embedding vector using a trajectory embedding model to be evaluated according to the encrypted auxiliary trajectory.

[0101] obtaining an auxiliary trajectory noisy embedding vector using the trajectory embedding model to be evaluated according to the encrypted auxiliary trajectory and a noise vector; the noise vector is sampled from a Laplace distribution.

[0102] obtaining a real node sequence of the auxiliary trajectory on a spatio-temporal graph.

[0103] training the initial sequence generation network using the auxiliary trajectory non-noisy embedding vector and the auxiliary trajectory noisy embedding vector as input and the real node sequence of the auxiliary trajectory on the spatio-temporal graph as output to obtain a sequence generation network.

[0104] In this embodiment, after the trajectory encryption embedding is completed, the embedding reverse recovery is carried out: based on the target trajectory non-noisy embedding vector in S2 and the target trajectory noisy embedding vector, the original trajectory is obtained. Specifically:

[0105] The system first constructs a historical trajectory database into a time-labeled spatial graph structure (i.e. a space-time graph), and maps each historical trajectory to a discrete node sequence from the historical trajectory database:

[0106] .

[0107] wherein, is the node on the corresponding map, i is the trajectory number; k i is the node number. Define the node set as:

[0108] .

[0109] wherein, is the longitude of node v; is the latitude of node v.

[0110] The edge set is constructed , wherein each edge represents a feasible node jump on the map, and is accompanied by a transition probability and a time type label:

[0111] .

[0112] .

[0113] wherein, is the transition probability; is the time type label; is the count.

[0114] Further, the space-time graph is represented as a weighted directed graph:

[0115] .

[0116] Next, the system calls the black box model of the external trajectory embedding interface to perform embedding query on the large-scale auxiliary trajectory set (auxiliary trajectory set) generated by random point selection of the map, and obtains an embedding vector set. According to the method of obtaining the trajectory embedding vector in S2, the auxiliary trajectory set is also homomorphically encrypted and embedded, respectively obtaining the auxiliary trajectory non-noisy embedding vector and the auxiliary trajectory noisy embedding vector and their real node sequences on the space-time graph , a sequence generation network to enable it to convert the embedding vector into a sequence of nodes .

[0117] The network enhances the accuracy of trajectory generation and regularizes the topology constraint through a cross-entropy loss function.

[0118] The cross-entropy loss function is:

[0119] .

[0120] wherein, represents the cross-entropy loss function used in the training of the sequence generation network; is the probability value of the model predicting the next node under the condition of a given historical node sequence and embedding vector . θ is the network model parameter, and by optimizing the loss function (maximizing the logarithmic probability), the model learns to generate more accurate trajectory node sequences, thereby improving the accuracy of trajectory restoration.

[0121] The topology constraint regularization is:

[0122] .

[0123] wherein, represents a penalty term for the transition probability of all adjacent node pairs in the generated trajectory path on the pre-constructed spatiotemporal graph, is the transition probability of adjacent node pair in the i-th auxiliary trajectory on the spatiotemporal graph , is the j-th node in the i-th auxiliary trajectory; is the j+1-th node in the i-th auxiliary trajectory.

[0124] The original trajectory is supervised to ensure that the generated trajectory is consistent with the target trajectory in terms of direction and path structure, wherein a greater penalty is generated when the transition probability of adjacent node pair in the generated path on the spatiotemporal graph is low. Overall, the total loss of the network is:

[0125] .

[0126] wherein, is a balance coefficient, and the optimal parameter is obtained through backpropagation.

[0127] In inference, the target embedding vector obtained by S2 is input the trained , generate a candidate node sequence:

[0128] .

[0129] for the candidate node sequence , check the adjacent node pairs in the spatiotemporal graph whether there is an edge:

[0130] if , keep the original order (i.e. the candidate node sequence), the transition probability of the adjacent node pair .

[0131] otherwise, find the shortest path on the spatiotemporal graph using Dijkstra algorithm, and insert it into the candidate node sequence to obtain the matching trajectory of the target trajectory, to ensure the continuity of the final path.

[0132] The matching trajectory will be compared with the original real trajectory in space error in S10, to provide a measurement basis for the accurate restoration effect of privacy risk assessment.

[0133] S4: determining the un-noised matching trajectory of the target trajectory according to the un-noised candidate node sequence.

[0134] S5: determining the noised matching trajectory of the target trajectory according to the noised candidate node sequence.

[0135] As an optional implementation, S4 specifically includes:

[0136] S41: judging whether the transition probability of the adjacent node pair in the un-noised candidate node sequence is greater than 0.

[0137] S42: if yes, taking the un-noised candidate node sequence as the un-noised matching trajectory of the target trajectory.

[0138] S43: if no, finding the shortest path on the spatiotemporal graph using Dijkstra algorithm, and inserting the shortest path into the un-noised candidate node sequence to obtain the un-noised matching trajectory of the target trajectory.

[0139] Similarly, the noised matching trajectory of the target trajectory is generated.

[0140] S6: Based on the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory un-noiseed embedding vector and the marker point trajectory embedding vector, and a target trajectory un-noiseed estimated distance vector is constructed; the neural network model is obtained by training an initial neural network model using the training trajectory embedding vector, the marker point trajectory embedding vector, and the distance between the training trajectory embedding vector and the marker point trajectory embedding vector; the marker point trajectory embedding vector is determined based on the marker point trajectory; the marker point trajectory is obtained by clustering the auxiliary trajectory set.

[0141] S7: Based on the target trajectory noise-added embedding vector and the marker point trajectory embedding vector, use a neural network model to estimate the distance between the target trajectory noise-added embedding vector and the marker point trajectory embedding vector, and construct the target trajectory noise-added estimated distance vector.

[0142] In this embodiment, after the embedding reverse recovery is completed, finite query structure optimization is performed: based on the target trajectory un-noisy embedding vector and the target trajectory noisy embedding vector in S2, a structure optimization evaluation under finite queries is performed, specifically:

[0143] Under the condition of limited number of embedded interface calls, the system uses the auxiliary trajectory set In the middle, first in the embedded space Top Clustering The first cluster represents a region with high popularity. For the second... For each cluster, select the trajectory corresponding to the cluster center or the most representative trajectory within the cluster as the marker point trajectory, and obtain:

[0144] .

[0145] Let the embedded trajectory of the marker point be... .

[0146] The system designs a neural network model to learn the distance function between the input trajectory (training trajectory) and the marker point trajectories, with the objective of estimating the embedding spatial distance between the target trajectory and each marker point. The distance regression function is defined as follows:

[0147] .

[0148] Make it satisfy:

[0149] .

[0150] in, For training trajectory embedding, Embedding of marker point trajectories, To train the trajectory embedding to the corresponding real trajectory, For each landmark point trajectory, a corresponding real trajectory is embedded, The discrete Frechet distance between trajectories, i.e.,

[0151] .

[0152] where, are the node sequences of , respectively, is a non-decreasing parametric time mapping. The network training set is selected from the auxiliary embedding pairs , and the real label is:

[0153] .

[0154] The regression loss is defined as the mean squared error loss, i.e.,

[0155] .

[0156] where, N pair is the total number of pairs of trajectory embedding combinations participating in training. Specifically, it refers to the number of pairs of samples (z i , z j ) selected from the auxiliary embedding trajectories (i.e., the total number of combinations of (training trajectory embedding, landmark point embedding)). Its role is to standardize the loss value: by dividing N pair , the loss value generated by different batches of training data is comparable, avoiding the influence of the number of samples on the magnitude of the loss, and ensuring the stability of model optimization.

[0157] The final network parameters are learned by minimizing the loss to estimate the distance of the target trajectory. and each landmark point embedding :

[0158] .

[0159] and construct the estimated distance vector:

[0160] .

[0161] S8: According to the un-noised estimated distance vector of the target trajectory and the candidate trajectory estimated distance vector, determine the un-noised rough estimated trajectory of the target trajectory; the candidate trajectory estimated distance vector is the distance vector between the candidate trajectory and the landmark point trajectory embedding vector.

[0162] S9: determining a noisy rough estimation trajectory of the target trajectory according to the target trajectory and the candidate trajectory estimation distance vectors. The candidate trajectory is a historical trajectory segment extracted from the weighted directed graph.

[0163] The candidate trajectory refers to a set of possible trajectory segments pre-extracted from the spatio-temporal graph. These segments are derived from the weighted directed graph constructed from the historical trajectory database, and by cutting long trajectories to generate fixed-length feasible sub-paths as a candidate set. Each candidate trajectory segment calculates its discrete Frechet distance with all landmark trajectories to form a multi-dimensional distance vector. These vectors are stored in the system for subsequent similarity matching with the estimated distance vector of the target trajectory, so as to screen out the most similar segments for splicing into a rough estimation trajectory.

[0164] In this embodiment, a set of candidate trajectory segments is considered Each segment is represented in the embedding space as The distance vector of each segment relative to the landmark set is calculated:

[0165] .

[0166] According to the evaluation target vector and the matching degree of the candidate vector :

[0167] .

[0168] The top segments are taken in descending order , and they are spliced into a rough estimation trajectory according to the map connectivity. The matching trajectory of the target trajectory will be sent to the next step for error comparison and risk assessment together.

[0169] S10: determining a non-noisy comprehensive risk score according to the non-noisy matching trajectory of the target trajectory, the non-noisy rough estimation trajectory of the target trajectory, and the target trajectory node sequence, using a comprehensive risk scoring function.

[0170] S11: determining a noisy comprehensive risk score according to the noisy matching trajectory of the target trajectory, the noisy rough estimation trajectory of the target trajectory, and the target trajectory node sequence, using a comprehensive risk scoring function.

[0171] S12: evaluating the privacy leakage risk of the trajectory embedding model to be evaluated according to the non-noisy comprehensive risk score and the noisy comprehensive risk score.

[0172] In this embodiment, the privacy risk assessment is finally performed: based on the matching trajectory and the coarse estimation trajectory of the target trajectory, the privacy risk of the trajectory embedding system is evaluated, in particular:

[0173] The system compares the distance distribution of the coarse estimation trajectory and the original embedding, including the Hausdorff distance and the discrete Frechet distance, and calculates the restoration error index.

[0174] Calculate the accurate restoration path (matching trajectory of the target trajectory) The Hausdorff distance between the node sequence of the target trajectory

[0175] .

[0176] Wherein, represents the Euclidean distance between two points p and q.

[0177] And the discrete Frechet distance defined in the above. If , it is determined that the trajectory is successfully restored at the accurate restoration level, and the high-precision restoration privacy risk is high.

[0178] Wherein, is the acceptable accurate estimation error threshold, which can be set to 1000 meters in practice.

[0179] For the coarse estimation error of the limited query, the coarse estimation trajectory The Hausdorff distance and the discrete Frechet distance are also calculated between the node sequence of the target trajectory

[0180] .

[0181] If , it is considered that even under the condition of limited query, the target trajectory can still be restored within a high accuracy range, and the privacy risk still exists.

[0182] Wherein, is the acceptable coarse estimation error threshold, , which can be set to 2000 meters in practice.

[0183] The system additionally adds the recovery point coverage rate:

[0184] .

[0185] The privacy attack effect is measured from the map classification index.

[0186] The comprehensive risk score function is defined:

[0187] ​​ .

[0188] wherein, is a comprehensive risk score; is a weight constant, ; is an indicator function; is a Hausdorff distance between a matching trajectory of the target trajectory and a target trajectory node sequence; is a discrete Frechet distance between a matching trajectory of the target trajectory and a target trajectory node sequence; is a precise estimation error threshold; is a Hausdorff distance between a coarse estimation trajectory of the target trajectory and a target trajectory node sequence; is a discrete Frechet distance between a coarse estimation trajectory of the target trajectory and a target trajectory node sequence; is a coarse estimation error threshold; is a recovery point coverage.

[0189] In an embodiment, S12 specifically comprises:

[0190] determining whether the difference between the noise-added comprehensive risk score and the non-noise-added comprehensive risk score is less than a preset risk threshold.

[0191] If yes, it is determined that the trajectory embedding model to be evaluated has a privacy leakage risk.

[0192] If no, it is determined that the trajectory embedding model to be evaluated does not have a privacy leakage risk.

[0193] The comprehensive risk score functions of the noise-added and non-noise-added embeddings are calculated respectively, and if wherein, is a preset risk threshold, the system determines that the privacy protection is insufficient, otherwise it is considered that the differential privacy noise has a good effect on the location privacy of the trajectory.

[0194] The trajectory embedding model privacy leakage risk evaluation method of the present application has the following advantages:

[0195] 1. High-precision trajectory restoration capability: Through the trajectory embedding reverse recovery attack method, the system directly generates an embedding vector using a black-box embedding model, restores a trajectory node sequence with the help of a structure decoding network, and restores a feasible road path through map matching, so that the restored trajectory is highly consistent in the starting and ending point positions, path direction, and road segment connectivity. The technical effect mainly comes from the structure mapping mechanism based on the sequence generation network and the road map matching strategy used in S3, which jointly ensures the compliance and integrity of the trajectory structure.

[0196] 2. Available recovery under limited calling conditions: The limited query structure optimization method only needs to call a small number of auxiliary trajectories for embedding, which can estimate the embedding similarity of any target trajectory and complete the rough reconstruction of the trajectory. Compared with the traditional trajectory recovery attack which relies on a large number of queries, the interface cost is greatly reduced and the adaptability is stronger. This advantage is due to the neural network model training mechanism and the multidimensional distance matching algorithm, which can effectively establish the similarity mapping between the target trajectory and the auxiliary trajectory.

[0197] 3. Consideration of efficiency and scalability: The method of the present application adopts modular design, and the privacy evaluation attack method is suitable for the case of open calling resource rich, and supports the limited query structure optimization method for the optimization of the calling frequency limited scene, and the system can flexibly switch the attack strategy according to the resource constraints, and has good scalability. The advantage comes from the optimization design of the calling strategy of the trajectory embedding model in the whole system architecture, and the structural reuse of the embedding representation.

[0198] 4. With privacy explainability and process transparency: Compared with the method of only giving the binary results of "privacy leakage" and "no privacy leakage", the method can intuitively reflect the privacy exposure degree of the target trajectory through the path offset, distance error and other indicators of the reconstructed trajectory, and provide the contribution ranking of the auxiliary trajectory, which is convenient for auditing and analysis. This technical effect benefits from the error evaluation and index output mechanism, which supports the fine-grained quantification and explanation of the attack process.

[0199] 5. Adapt to black box model, with algorithm universality: The proposed method has no dependence on the structure of the trajectory embedding model, and supports any form of trajectory encoding interface, including closed API services based on deep learning. This feature significantly enhances the adaptability of the attack model in actual systems. This advantage comes from the design of relying only on embedding vectors rather than embedding processes themselves, ensuring compatibility with mainstream trajectory service systems such as privacy-sensitive location recommendation, path prediction API, etc.

[0200] In an exemplary embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the trajectory embedding model privacy leakage risk evaluation method described above when executing the computer program.

[0201] In an exemplary embodiment, a computer readable storage medium is provided, storing a computer program, which is executed by a processor to implement the trajectory embedding model privacy leakage risk evaluation method described above.

[0202] In an exemplary embodiment, a computer program product is provided, comprising a computer program, which is executed by a processor to implement the trajectory embedding model privacy leakage risk evaluation method described above.

[0203] In an exemplary embodiment, a computer device, which can be a server or a terminal, has an internal structure diagram as shown in Figure 3 The computer device includes a processor, a memory, an input / output interface, and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a trajectory embedding model privacy leakage risk assessment method.

[0204] Those skilled in the art can understand that Figure 3 The structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0205] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use, and processing of the relevant data need to comply with relevant regulations.

[0206] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, databases or other media used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0207] The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a blockchain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0208] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0209] The principles and implementation modes of the present application are described by using specific examples in the present application. The above embodiments are only used to help understand the method and its core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed. In conclusion, the content of the present application should not be understood as a limitation.

Claims

1. A trajectory embedding model privacy leakage risk assessment method, characterized in that, The method comprises the following steps: acquiring a target trajectory; the target trajectory is composed of spatial coordinates and corresponding time stamps of a plurality of sampling points; according to the target trajectory, a trajectory embedding data set is obtained by using a trajectory embedding model to be evaluated; the trajectory embedding data set includes a target trajectory non-noisy embedding vector and a target trajectory noisy embedding vector; the target trajectory non-noisy embedding vector and the target trajectory noisy embedding vector are respectively input into a sequence generation network to generate a non-noisy candidate node sequence and a noisy candidate node sequence; the sequence generation network is obtained by training an initial sequence generation network using an auxiliary trajectory set and real node sequences of the auxiliary trajectory set on a space-time graph; the space-time graph is a weighted directed graph; the weighted directed graph is constructed according to a historical trajectory database; according to the non-noisy candidate node sequence, a non-noisy matching trajectory of the target trajectory is determined; according to the noisy candidate node sequence, a noisy matching trajectory of the target trajectory is determined; according to the target trajectory non-noisy embedding vector and a landmark trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory non-noisy embedding vector and the landmark trajectory embedding vector, and a target trajectory non-noisy estimated distance vector is constructed; the neural network model is obtained by training an initial neural network model using a training trajectory embedding vector, a landmark trajectory embedding vector, and the distance between the training trajectory embedding vector and the landmark trajectory embedding vector; the landmark trajectory embedding vector is determined according to a landmark trajectory; the landmark trajectory is obtained by clustering the auxiliary trajectory set; according to the target trajectory noisy embedding vector and the landmark trajectory embedding vector, a neural network model is used to estimate the distance between the target trajectory noisy embedding vector and the landmark trajectory embedding vector, and a target trajectory noisy estimated distance vector is constructed; according to the target trajectory non-noisy estimated distance vector and a candidate trajectory estimated distance vector, a non-noisy rough estimated trajectory of the target trajectory is determined; the candidate trajectory estimated distance vector is a distance vector between a candidate trajectory and a landmark trajectory embedding vector; the candidate trajectory is a historical trajectory fragment extracted based on the weighted directed graph; according to the target trajectory noisy estimated distance vector and the candidate trajectory estimated distance vector, a noisy rough estimated trajectory of the target trajectory is determined; according to the non-noisy matching trajectory of the target trajectory, the non-noisy rough estimated trajectory of the target trajectory, and a target trajectory node sequence, a non-noisy comprehensive risk score is determined by using a comprehensive risk score function; according to the noisy matching trajectory of the target trajectory, the noisy rough estimated trajectory of the target trajectory, and a target trajectory node sequence, a noisy comprehensive risk score is determined by using a comprehensive risk score function; according to the non-noisy comprehensive risk score and the noisy comprehensive risk score, the privacy leakage risk of the trajectory embedding model to be evaluated is evaluated.

2. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, According to the target trajectory, a trajectory embedding data set is obtained by using a trajectory embedding model to be evaluated, specifically comprising: The target trajectory is encrypted by using a homomorphic hash encryption protocol to obtain an encrypted target trajectory. According to the encrypted target trajectory, a to-be-evaluated trajectory embedding model is used to obtain an un-noised embedding vector of the target trajectory. According to the encrypted target trajectory and a noise vector, the to-be-evaluated trajectory embedding model is used to obtain a noised embedding vector of the target trajectory. The noise vector is sampled from a Laplace distribution.

3. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, The construction process of the weighted directed graph specifically includes: Obtain a historical trajectory database; Based on the historical trajectory database, map matching is performed to map each historical trajectory into a discretized node sequence; According to the discretized node sequence, a node set and an edge set are determined; Determine the transition probability and time type label between adjacent nodes; Based on the node set, the edge set, the transition probability between adjacent nodes, and the time type label, a weighted directed graph is constructed.

4. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, The initial sequence generation network is trained by using an auxiliary trajectory set and a real node sequence of the auxiliary trajectory set on a spatio-temporal graph, specifically including: The auxiliary trajectory is encrypted by using a homomorphic hash encryption protocol to obtain an encrypted auxiliary trajectory; According to the encrypted auxiliary trajectory, a to-be-evaluated trajectory embedding model is used to obtain an un-noised embedding vector of the auxiliary trajectory; According to the encrypted auxiliary trajectory and a noise vector, the to-be-evaluated trajectory embedding model is used to obtain a noised embedding vector of the auxiliary trajectory. The noise vector is sampled from a Laplace distribution; Obtain a real node sequence of the auxiliary trajectory on a spatio-temporal graph; The initial sequence generation network is trained by using the un-noised embedding vector of the auxiliary trajectory and the noised embedding vector of the auxiliary trajectory as input, and using the real node sequence of the auxiliary trajectory on the spatio-temporal graph as output, to obtain a sequence generation network.

5. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, According to the un-noised candidate node sequence, an un-noised matching trajectory of the target trajectory is determined, specifically including: Determine whether the transition probability of an adjacent node pair in the un-noised candidate node sequence is greater than 0; If yes, the un-noised candidate node sequence is taken as the un-noised matching trajectory of the target trajectory; If no, a Dijkstra algorithm is used to find a shortest path on the spatio-temporal graph, and the shortest path is inserted into the un-noised candidate node sequence to obtain the un-noised matching trajectory of the target trajectory.

6. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, The comprehensive risk score function is: ； wherein, is a comprehensive risk score; is a weight constant, ; is an indicator function; is a Hausdorff distance of a matching trajectory and a target trajectory node sequence of the target trajectory; is a discrete Frechet distance of a matching trajectory and a target trajectory node sequence of the target trajectory; is a precision estimation error threshold; is a Hausdorff distance of a coarse estimation trajectory and a target trajectory node sequence of the target trajectory; is a discrete Frechet distance of a coarse estimation trajectory and a target trajectory node sequence of the target trajectory; is a coarse estimation error threshold; is a recovery point coverage.

7. The trajectory embedding model privacy leakage risk assessment method according to claim 1, characterized in that, According to the un-noised comprehensive risk score and the noised comprehensive risk score, the privacy leakage risk of the to-be-evaluated trajectory embedding model is evaluated, specifically including: Determine whether the difference between the noised comprehensive risk score and the un-noised comprehensive risk score is less than a preset risk threshold; If yes, it is determined that the to-be-evaluated trajectory embedding model has a privacy leakage risk; If no, it is determined that the to-be-evaluated trajectory embedding model does not have a privacy leakage risk.

8. A computer device comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the trajectory embedding model privacy leakage risk evaluation method of any one of claims 1-7.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the trajectory embedding model privacy leakage risk assessment method in any one of claims 1-7.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the trajectory embedding model privacy leakage risk assessment method in any one of claims 1-7.

Images