Method and device for generating synthetic location data

Abstract

Method and device for anonymizing longitudinal location data relating to a plurality of individuals. The anonymization method comprises: a step (E20) of classifying longitudinal location data into a plurality of clusters of a given minimum size using an unsupervised partitioning algorithm; a step (E30) of training a generative model conditioned by said plurality of clusters from the longitudinal location data; and a step (E40) of generating synthetic data within each cluster using said generative model and taking into account a cluster distribution of the original longitudinal location data. Figure for the abstract: Fig. 4.

Description

Title of the invention: Method and device for generating synthetic location data. Prior art.

[0001] The invention belongs to the general field of communications.

[0002] It relates more particularly to the anonymization of data relating to individuals collected over a given period of time, also called "longitudinal data". The invention thus applies primarily, but not exclusively, to longitudinal location data such as mobility traces collected from users of mobile devices.

[0003] Among all human activities, mobility gives rise to a multitude of political and environmental problems for societies, but also for many industries. A good understanding of this mobility helps to inform decisions in very diverse fields, such as the optimization of transport networks, the reduction of greenhouse gas emissions or energy consumption, the deployment of telecommunications networks, etc.

[0004] In recent years, new sources of location data have emerged. These include applications embedded in smartphones equipped with GPS chips, radio chips embedded in vehicles, mobile phones generating signal traces from their connection to the mobile network, etc. These various sources offer the possibility of collecting, over a given period, mobility traces or, more generally, location data relating to a large number of individuals or users. The processing and analysis of the longitudinal data thus collected makes it possible to address the issues mentioned above.

[0005] However, the privacy of individuals whose longitudinal location data is collected may be threatened if this data is used in a way that allows for the direct or indirect re-identification of those individuals. In Europe, the processing of personal data, including longitudinal location data, is subject to strict privacy regulations, such as the European General Data Protection Regulation (GDPR), or, more specifically for mobile network operators, Directive 2002 / 58 / EC of 12 July 2002 (also known as the "ePrivacy Directive"), as updated by Directive 2009 / 136 / EC on cookies. These regulations aim to ensure the effective and secure processing of personal data.

[0006] There are various techniques for anonymizing longitudinal data, and incidentally traces of mobility.

[0007] A first category of commonly used anonymization techniques consists of producing statistical aggregates from the collected data. The nature of the statistical aggregates to be created and the samples of individuals from which to collect the data are chosen before collection, based on the specific problem that the collected data seek to address. The statistical aggregates thus generated are produced while respecting the confidentiality of the original data (which are "merged" into the aggregates) and are themselves anonymous.

[0008] Statistical aggregates can be calculated incrementally as data is collected, without creating individual histories (which are considered personal data) and by deleting raw events within a very short timeframe. This delay is necessary for statistical processing and allows for the calculation, where appropriate, of additional enrichment variables. For example, a study of the usage of a given area can be based on counting the mobile devices that have connected to cells of a mobile network deployed in that area, relative to a representative sample of the targeted activity (selected, for example, based on socio-demographic or behavioral characteristics, known or deduced from the spatiotemporal properties of the mobile devices). The statistics obtained can be further enriched by estimating the speeds and directions of movement of the mobile devices, etc.Operationally, a maximum retention period of 15 minutes for events (“pseudonymized”) is considered an acceptable compromise to ensure data usability while guaranteeing anonymization.

[0009] Techniques based on the incremental production of statistical aggregates place the anonymization / utility trade-off on the side of minimal information retention and essentially raise the problem of reusing the produced statistical aggregates for new purposes. Regardless of the performance of the processes and algorithms implemented, these statistics are designed to address a specific problem, identified prior to data collection. Thus, a given set of statistics is not always usable for new purposes. For example, it is obviously impossible to retrospectively examine the age pyramid of a studied population if the appropriate variable was not included in the aggregates during the design phase. Similarly, the time steps and the choice of study areas heavily influence the semantics of the indicators, and it is generally impossible to explore all the useful combinations.Thus, it is very difficult to imagine and predict all the potentially useful statistical combinations in the future; moreover, this. raises significant practical problems, particularly with regard to the computing and storage costs required.

[0010] To overcome this drawback, a second category of anonymization techniques relies on the generation of synthetic data that preserves the form and certain statistical and structural properties of real data collected from individuals. By definition, synthetic data is data that does not originate from a real observation (measurement) but is created artificially through numerical simulations and / or by artificial intelligence (AI). These techniques advantageously offer the possibility of conducting ex post analyses on the generated synthetic data, and of compensating for the fact that the original data are no longer available.

[0011] Many synthetic data generation techniques rely on generative models, which allow the generation of "new" samples from a known distribution of the collected longitudinal data. The samples thus generated are partially statistically representative of the initial distribution of the actual data; however, they are "new" in the sense that there is no exact match between a generated sample and the actual data collected from individuals. Examples of these techniques based on generative models include variational autoencoders (VAEs), generative adversarial networks (GANs), diffusion models, etc.

[0012] However, these techniques encounter difficulties, particularly concerning the representativeness of the distribution obtained, as well as the quality and guarantee of the "new" character of the generated samples.

[0013] By way of illustration, in the case of highly multimodal longitudinal location data (i.e., data representative of very different behaviors), some techniques such as VAEs (Variable Acceleration Analysis) can estimate the distribution of the original data quite well but struggle to produce synthetic samples that accurately reflect their fine characteristics. Such fine characteristics include, for example, precise positions along the trajectory of a transport infrastructure, consistent acceleration / deceleration behavior, the presence of service areas on a highway, etc. Other techniques, such as GANs (Generative Analysis Networks) or generative models based on diffusion, are, on the contrary, able to produce synthetic samples with fine characteristics, but fall short in terms of the representativeness of the generated samples.

[0014] There is therefore a need for a technique enabling the anonymization of longitudinal data such as location data relating to individuals, allowing for a compromise between the strength of the anonymization applied (typically its irreversibility in the face of various attack scenarios) and the preservation of useful information contained in the original data in order to be able to exploit it for purposes not necessarily envisaged when it was collected. Description of the invention

[0015] The invention addresses this need in particular by proposing a method for anonymizing longitudinal location data, known as origin data, relating to a plurality of individuals, this method comprising: - a classification step, using an unsupervised partitioning algorithm, of said original longitudinal location data into a plurality of clusters all having a size greater than or equal to a given threshold; - a learning step, based on said original longitudinal location data, of a generative model conditioned by said plurality of clusters; and - a synthetic data generation step within each cluster, using said generative model and taking into account a cluster distribution of the original longitudinal location data used during the generative model training step.

[0016] Correspondingly, the invention also relates to a device for anonymizing longitudinal location data, known as origin data, relating to a plurality of individuals, said device comprising: - a classification module, configured to classify, using an unsupervised partitioning algorithm, the said original longitudinal location data into a plurality of clusters, all having a size greater than or equal to a given threshold; - a learning module, configured to learn from said original longitudinal location data a generative model conditioned by said plurality of clusters; and - a generation module, configured to generate synthetic data within each cluster using said generative model and taking into account a cluster distribution of the original longitudinal location data used to train the generative model.

[0017] No limitations are attached to the generative model that may be used in the context of the invention. It may be, for example, a diffusion-based model (more commonly called a "diffusion model"), a generative adversarial network (GAN), etc.

[0018] Thus, the invention makes it possible to obtain an anonymized synthetic dataset by applying several models learned on original longitudinal location data (i.e., real data). More particularly, the invention relies on a two-step sequence to create an anonymized synthetic dataset combining the concepts of unsupervised partitioning (also more commonly called "clustering" in English) of the original data and a generative model learned on the original data and conditioned by the clusters obtained.Through these two steps, the resulting synthetic dataset is anonymized, notably through the use of the generative model and partitioning into a maximum number of sufficiently large clusters (greater than or equal to a given threshold), while preserving the statistical properties of the original longitudinal location data. This is achieved through conditional learning of the generative model on the clusters resulting from the partitioning of the original location data and by taking into account the distribution of this original location data during the generation of the synthetic data. For example, during the generation of the synthetic data, the number of synthetic data points generated within a cluster using the generative model is proportional to the number of original longitudinal location data points classified during the classification step within that cluster (assuming the same proportionality coefficient for the different clusters).This allows us to approximate the distribution of the original longitudinal location data through a single inference of the generative model.

[0019] The invention thus ensures good representativeness of the original location data by the generated synthetic data. The usefulness of the generated synthetic data is therefore greatly improved, making it possible to conduct ex post analyses using the synthetic data (i.e., data not necessarily anticipated during collection) and broadening the range of applications for this synthetic data. Indeed, thanks to the invention, it is ensured that the synthetic data has a distribution close to that of the original data in clusters identified from this original data. It is thus possible to retain the important useful information present in the original location data collected from several individuals without having to retain the original location data.It is therefore permissible to comply with the various legal obligations relating to personal data without losing the useful information contained in the original location data. Only anonymized synthetic data needs to be stored to create a history, and can be used later to regenerate the useful information contained in the original data, and where appropriate to calculate other statistics on this original data than those considered at the time of its collection.

[0020] In a particular embodiment, the anonymization process further comprises at least one iteration including: - a step applying the partitioning algorithm used in the classification step to synthetic data; and - if a distribution of synthetic data over the plurality of clusters does not respect a fidelity criterion determined with respect to the distribution of the original longitudinal location data, an adjustment step for at least one cluster of a number of synthetic data generated using the generative model within that cluster.

[0021] This embodiment ensures that the distribution of synthetic data conforms to the distribution of the original location data. Indeed, the inventors have observed that in certain exceptional cases, as with any generative model used in artificial intelligence, and despite the steps implemented according to the invention to train the generative model and ensure compliance with the distribution of the original location data in the clusters, the generated synthetic data may not strictly conform to the distribution of the original longitudinal location data in some clusters. This can occur, for example, in clusters located at the edge of the distribution, typically in clusters where the original longitudinal data is most dispersed.This embodiment allows for the correction of the generated synthetic data in order to further improve its representativeness of the original longitudinal location data and, consequently, its usefulness. This embodiment aims to further strengthen the similarity between the distribution of the original location data and that of the generated synthetic data.

[0022] In a particular embodiment, each cluster identified during the first classification step further verifies a non-discemability criterion for the original longitudinal location data classified in that cluster.

[0023] Taking such a criterion into account strengthens the anonymity of the generated synthetic data. Such a criterion can be expressed, for example, as a comparison against a threshold of a measure of the cluster's spread, so as to eliminate clusters within which the original longitudinal location data are too dispersed relative to each other. This ensures continuity of the clusters learned from the original longitudinal location data.

[0024] In a particular embodiment, the partitioning algorithm used during the classification step includes the application of a variational autoencoder combined with a tiling of a latent space of the variational autoencoder, a cluster corresponding to a said tile.

[0025] As is known per se, an autoencoder is a particular type of neural network, divided into two parts, namely an encoder and a decoder, which are applied successively. The encoder compresses the input information vector x by reducing its dimensionality (i.e., it "encodes" the useful information contained in the vector x with fewer variables than the vector x itself). The space of reduced codes is called the "latent space." This latent space describes the structure of the data. The decoder is a generative model that allows the reconstruction of an observation of x from the latent space. Since the autoencoder performs a reconstruction task, it is trained to minimize the reconstruction error.

[0026] A variational autoencoder, or VAE, is an autoencoder that allows learning a function associating a multivariate latent distribution, typically a Gaussian distribution, with an input vector. This latent distribution is not directly observed but deduced from a mathematical model. It is a kind of "regularized" autoencoder in which the distribution of codes in the latent space is constrained to a given distribution, generally Gaussian, whose parameters (mean and standard deviation) are predicted by the encoder. Using a variational autoencoder facilitates obtaining certain properties useful for the latent space, such as continuity and a density that approximates a known distribution. It advantageously allows obtaining a less sparse latent space than a classical autoencoder, and therefore better continuity.This makes it easier to group longitudinal location data by similarity thanks to the continuity imposed in the latent space, while retaining the possibility of reconstructing longitudinal location data via the variational autoencoder decoder.

[0027] The combined use of a VAE (Virtual Autonomous Evoked Response) and a tile-based partitioning system respecting a minimum size ensures that, after reconstruction, the generated synthetic data are closely related. By making the latent space continuous, the possibilities of re-identifying an individual during the generation of synthetic data are limited. This strengthens the anonymity of the generated synthetic data and, incidentally, contributes to respecting the privacy of individuals.

[0028] Of course, this is only a non-limiting illustrative example of the invention, and other algorithms can be considered as alternatives.

[0029] Furthermore, following the tiling of the latent space, it is possible to consider that tiles with an area greater than or equal to a given threshold are invalidated and the original longitudinal mobility data classified in these tiles are deleted before the learning step.

[0030] This process aims to filter the largest tiles in which the mobility traces are likely to be spaced further apart and therefore more easily distinguishable. This embodiment is an example of applying a non-discernibility criterion during the classification step.

[0031] In a particular embodiment, the anonymization process further includes a step of assigning a confidence index to the synthetic data.

[0032] This confidence index makes it possible to measure the reliability of the generated synthetic data with respect to the original longitudinal location data, particularly in terms of statistical properties (e.g., distribution). It can also take into account clusters that cannot be represented by the synthetic data.

[0033] Alternatively, it is possible to consider evaluating other exogenous criteria allowing the representativeness of the synthetic data generated in relation to an original longitudinal location dataset, and / or their representation in latent space.

[0034] Determining and taking into account such criteria advantageously addresses two key challenges. On the one hand, they allow for guiding the learning of the partitioning algorithm and / or the generative model to achieve a distribution of the generated synthetic data close to the actual distribution of the original longitudinal location data, viewed through the lens of predetermined criteria. On the other hand, they allow for statistical adjustment of the generated synthetic data with respect to these same criteria, for example, by implementing a step to adjust the generated synthetic data by cluster, similar to what was described previously for a particular embodiment, or by using a classification supervised by predetermined statistics, etc.

[0035] In a particular embodiment, the anonymization process is implemented by a computer.

[0036] The invention also relates to a computer program on a recording medium, this program being capable of being implemented in a computer or more generally in an anonymization device according to the invention and comprising instructions adapted to the implementation of an anonymization process as described above.

[0037] This program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0038] The invention also relates to an information medium or a recording medium readable by a computer, and comprising instructions for a computer program as mentioned above.

[0039] The information or recording medium can be any entity or device capable of storing programs. For example, the medium may include a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a hard disk, or a flash memory.

[0040] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio link, by wireless optical link or by other means.

[0041] The program according to the invention can in particular be downloaded onto an Internet-type network.

[0042] Alternatively, the information or recording medium may be an integrated circuit in which a program is incorporated, the circuit being adapted to execute or to be used in the execution of the anonymization process according to the invention.

[0043] It is also possible to consider, in other embodiments, that the anonymization process and device according to the invention may have in combination all or part of the aforementioned characteristics. Brief description of the drawings

[0044] Other features and advantages of the present invention will become apparent from the description below, with reference to the accompanying drawings which illustrate an example of an embodiment without being limiting in any way. In the figures:

[0045] [Fig-1] [Fig.1] represents, in its environment, an anonymization device of longitudinal location data according to the invention, in an embodiment;

[0046] [Fig.2] [Fig.2] schematically represents location data longitudinal data collected from mobile device users;

[0047] [Fig.3] [Fig.3] represents the physical architecture of the anonymization device the [Fig.1] in a particular embodiment;

[0048] [Fig.4] [Fig.4] represents the main steps of an anonymization process of longitudinal location data according to the invention in a particular embodiment in which it is implemented by the device of [Fig.1];

[0049] [Fig. 5] [Fig. 5] illustrates an example of synthetic data generated using the invention based on longitudinal location data from [Fig.2]. Description of the invention

[0050] Fig. 1 represents, in its environment, a device 1 for anonymizing longitudinal location data, in a particular embodiment.

[0051] As mentioned previously, such longitudinal location data are location data collected over a given time period from a plurality of distinct individuals.

[0052] In the example considered here, we focus more specifically on longitudinal location data (DATA-MOB), consisting of mobility traces collected from mobile device users. As is well known, mobile devices generate signaling traces when they connect to the mobile network, which provides visibility into the location of their users and, consequently, their mobility over a given period. Access to such traces (also called mobility traces) allows for a number of analyses to be carried out, for example, to address various industrial, societal, and / or environmental issues as discussed previously.

[0053] Of course, this is only an illustrative example and not a limiting one in itself. The invention applies in other contexts and in particular to other types of longitudinal location data, such as, for example, data from GPS chips, or IoT radio chips embedded in vehicles, etc. No limitations are attached to the way in which this longitudinal location data is obtained.

[0054] Longitudinal location data (DATA-MOB) typically takes the form of a plurality of sequences (N, where N is an integer greater than 1) of locations (a sequence constituting a longitudinal data point associated with an individual or trace) considered at various times within a global time interval common to all sequences. For example, each location is identified by a point y^ defined at time h by its coordinates x and y in a two-dimensional orthonormal coordinate system, a sequence being represented by a vector of L points p(x, y^, L), where L denotes an integer greater than 1 representing the number of times h considered within the global time interval. Figure 2 illustrates a set of mobility traces collected on a French mobile network over a given global time interval for N = 10,000 people.More specifically, in this figure, each trace reflects, for a given person, the successive positions occupied by that person between 6am and 6pm during the month of March 2023.

[0055] According to the invention, the anonymization device 1 is configured to anonymize real longitudinal location data supplied to it as input (referred to as "original data"). More specifically, it is configured to generate, from such real original data, anonymized synthetic data from which it is difficult or even impossible to identify the individuals from whom this real original data was collected. The synthetic data thus generated is not real data, but thanks to the invention, it is similar to and representative of such real data.

[0056] In the embodiment described here, the anonymization device 1 has the hardware architecture of a computer as shown in [Fig. 3]. It includes, in particular A processor (PROC), random access memory (MEM), read-only memory (ROM), non-volatile memory (NVM), and communication means (COM) including input / output means for providing longitudinal location data, such as DATA-MOB mobility traces, as input for anonymization, and for obtaining anonymized synthetic data as output for transmission to a storage unit and / or a processing unit (not shown in [Fig. 2]). Such means are known per se and are not described further here.

[0057] The non-volatile NVM memory constitutes a recording medium according to the invention, readable by the PROC processor and on which a computer program PROG according to the invention is stored. This PROG program comprises instructions defining the main steps of an anonymization process according to the invention. More specifically, it defines functional modules of the anonymization device 1 (shown in [Fig. 2]), which rely on and / or control all or part of the PROC, MEM, ROM, NVM, and COM elements mentioned above.

[0058] These functional modules include, in particular:

[0059] - a sorting module 2, configured to sort using an algorithm of partitioning the original longitudinal location data into a plurality of clusters all having a size greater than or equal to a given threshold denoted Kmin;

[0060] - a learning module 3, configured to learn from said data longitudinal localization of origin a generative model conditioned by the plurality of clusters resulting from the classification performed by the classification module 2. In the embodiment described here, we consider a generative model based on diffusion, called the diffusion model hereafter; and

[0061] - a generation module 4, configured to generate synthetic data at within each cluster using said diffusion model and taking into account the cluster distribution of the original longitudinal location data used to learn the diffusion model.

[0062] In the embodiment described here, the computer program PROG further defines an adjustment module 5 for the synthetic data generated, activated in a particular context as described in more detail later.

[0063] The functions implemented by the classification 2, learning 3, generation 4 and adjustment 5 modules are now detailed with reference to [Fig.4] which represents the main steps of an anonymization process according to the invention as implemented by the anonymization device 1 in a particular embodiment.

[0064] It is assumed here that the original longitudinal location dataset DATA-MOB is provided to the anonymization device 1 (step E10). We denote by N the dimension of the DATA-MOB dataset (i.e. N longitudinal location data, i.e. here N mobility traces relating to N distinct users).

[0065] According to the invention, the anonymization device 1 classifies the DATA-MOB data into a plurality of clusters, ensuring that all clusters have a size greater than or equal to Kmin (step E20). KQ denotes the size of a cluster Q with KQ > Kmin for any index j.

[0066] To this end, the classification module 2 of the anonymization device 1 uses an unsupervised partitioning algorithm. In the embodiment described here, the classification module 2 more specifically uses a variational autoencoder (VAE) combined with a tile partitioning applied to the latent space of the VAE, each tile corresponding to a cluster constrained by a minimum size equal to Kmin.

[0067] More precisely, the VAE is trained by the classification module 2 on the original longitudinal location data DATA-MOB in a manner known to those skilled in the art, leading to a latent space of dimension d, where d is an integer strictly less than L (step E21). The latent space allows the DATA-MOB data to be represented in a space of dimension d much smaller than L. Typically, in the example considered in [Fig. 2], a dimension d less than 10 can be obtained using a VAE. The representation in the latent space of the original longitudinal location dataset DATA-MOB is denoted DATA-MOB-RED: each original longitudinal data point of dimension L in the DATA-MOB dataset corresponds to a reduced longitudinal data point of dimension d in the DATA-MOB-RED dataset.

[0068] Then, the latent space obtained in step E21 is tiled by the classification module 2, using a kd tree (k-dimensional tree), also called a "kd-Tree," ensuring that the resulting tiles contain at least Kmin of mobility traces (i.e., at least Kmin of reduced data) associated with Kmin of different individuals (step E22). The kd-Tree method is well-known: it is a structure for optimally organizing data in a k-dimensional space according to their spatial distribution. A detailed description of the kd-Tree method is given in C. Fleury's document entitled "The kd-Tree: A Spatial Subdivision Method," December 19, 2007.

[0069] Each tile resulting from the partitioning of the latent space into E22 tiles constitutes a cluster Q of size KCj, given by the number of traces (i.e., reduced longitudinal location data) that the tile contains. It is associated with a representative which, in the embodiment described here, is the center of gravity of the reduced longitudinal location data classified in that tile (or cluster). The center of gravity is only an illustrative example, and other representatives can be considered as long as they allow for the unique identification of each cluster.

[0070] Steps E21 and E22 advantageously allow for the identification of a maximum number of clusters (i.e. tiles) satisfying a minimum size criterion.

[0071] In the embodiment described here, the classification module 2 checks that each cluster Q identified during step E22 complies with a given criterion of non-discemability of the data classified in that cluster (test step E23).

[0072] If, for at least one cluster Cj0, the non-discernibility criterion is not met (no response in step E23), the cluster Cj0 is invalidated (step E24). The classification module 2 then removes from the DATA-MOB set the original longitudinal location data corresponding to the reduced longitudinal data classified in this cluster (step E24).

[0073] Otherwise (yes answer in step E23), all clusters are validated and all original longitudinal location data are retained in the DATA-MOB set (step E25).

[0074] It should be noted, however, that the E23 test step (and the E24 invalidation step where applicable) is optional and leads to strengthening the anonymity of the longitudinal location data considered to generate a synthetic dataset.

[0075] In the embodiment described here, during step E23, the classification module 2 considers the surface area of ​​the tiles obtained at the end of step E22 and determines that the non-discemability criterion is not met when this surface area exceeds a predetermined threshold. This involves removing tiles that are too large in space because their spread prevents the longitudinal data classified within them from being sufficiently close together to maximize the anonymity of the individuals to whom this data corresponds. For example, the classification module 2 sorts the tiles in descending order of surface area and removes the first x tiles thus obtained that have a surface area exceeding the set threshold. Such a threshold can be absolute or relative, such as, for example, a relative threshold corresponding to the surface area of ​​the 95th percentile of the tile areas.According to another example, the ranking module 2 can consider the dispersion of reduced longitudinal location data in the latent space and remove tiles with a dispersion greater than a given threshold (absolute or relative).

[0076] These examples are given only as examples, and other criteria for non-discernibility may be considered as alternatives.

[0077] This deletion makes it possible to remove the original longitudinal data that is too discriminating from the DATA-MOB set.

[0078] Thus, in the embodiment described here, the original longitudinal location data are classified by identifying the clusters in the latent space from the reduced longitudinal data corresponding to the original longitudinal data. Classifying the reduced longitudinal location data in the latent space as proposed in steps E21 and E22 is therefore equivalent to classifying the original longitudinal location data: the Q clusters identified in step E22 from the reduced longitudinal data also apply to the corresponding original longitudinal location data.

[0079] Of course, other unsupervised partitioning algorithms besides a VAE combined with a kd tree can be considered as alternatives, such as combining spatiotemporal subsampling (leading to a reduction in the dimensionality of the traces) followed by the application of a k-means (or k-means) algorithm to the resulting subsampled longitudinal location data. A supervised partitioning algorithm can also be used.

[0080] The classification module 2 associates each original longitudinal location data point in the DATA-MOB dataset with the representative of the cluster in which the corresponding reduced longitudinal location data point is classified (step E26). This association is stored by the classification module 2, for example, in the non-volatile NVM memory of the anonymization device 1. Thus, in the original longitudinal dataset DATA-MOB, each data point is associated with the same cluster as at least Kmin-1 other data points.

[0081] Then, the learning module 3 of the anonymization device 1 learns, from the original longitudinal location data of the DATA-MOB set, a generative DIFF diffusion model conditioned by the Cj clusters identified during step E22 (step E30). For example, during step E30, the learning module 3 uses as a DIFF model, a Traj-UNET diffusion model as described in the paper by Y. Zhu et al. entitled “DiffTraj: Generating GPS Trajectory with Diffusion Probabilistic Model”, 37th Conference on Neural Information Processing Systems, NeurIPS 2023, adapted to take into account as conditioning variables during training, the representatives (centers of gravity here) of the Cj clusters identified during step E22 (and which were not invalidated during step E24) and associated during step E26 with the original longitudinal location data.

[0082] The conditioning of a generative model by the clusters presents no difficulty in itself for a person skilled in the art and is not described in more detail here. It should also be noted that the invention can also be applied to a generative model other than a diffusion model, such as a GAN, provided that the latter is conditioned by the clusters Cj.

[0083] Then, the generation module 4 of the anonymization device 1 generates, in each cluster Q identified during step E22 and which, in the embodiment described here, was not invalidated during step E24, a number NCj of synthetic data using the generative diffusion model learned during the training step E30 (step E40). The NCj numbers are chosen so as to take into account the cluster distribution of the original longitudinal location data of the DATA-MOB set in the clusters Cj considered during the training step E30.More precisely, in the embodiment described here, if we denote by DAT AS the synthetic dataset generated by exploiting the DIFF generative diffusion model learned during step E30, the proportion of synthetic data DATA-S that the DIFF generative diffusion model is asked to generate in each cluster is chosen to be identical to the proportion of the original longitudinal data DATA-MOB classified in each cluster Q during step E20. For example, for each cluster Cj, a number NCj of synthetic data in that cluster is generated equal to [3=10] times the number KQ of original longitudinal data classified in that cluster. Of course, this proportionality factor [3=10] is given only as an illustration, and other values ​​of [3] can be considered, the same proportionality factor [3] being applied to each cluster to respect as closely as possible the distribution of the original longitudinal data.Respecting the distribution of the original data guarantees the statistical usefulness of the generated synthetic data.

[0084] In the embodiment described herein, the anonymization device 1 implements an additional (optional) step to verify the conformity (i.e., accuracy) of the distribution of the generated synthetic data with the distribution of the original data. This step includes adjusting the generated synthetic data, if necessary, using its adjustment module 5 to improve this conformity (step E50). These steps are implemented iteratively until a specified accuracy criterion is met or a maximum number of iterations has been reached.

[0085] More specifically, during at least one iteration, the adjustment module 5 applies the VAE encoder learned in step E21 to the generated synthetic data DATA-S and obtains a reduced representation in the latent space of the synthetic data DATA-S (step E51). The resulting reduced synthetic data is designated DATA-S-RED.

[0086] The adjustment module 5 then determines the distribution (in number) of the reduced synthetic data DATA-S-RED in the clusters Q that had been learned from the original longitudinal data (step E52). To this end, for example, it assigns each reduced synthetic data point to the cluster Cj whose representative is the furthest away close to the reduced synthetic data in question, and evaluates the number of reduced synthetic data assigned to each cluster Q.

[0087] Then it compares the distribution obtained with the distribution of the reduced longitudinal data DATA-MOB-RED in the Q clusters with respect to a determined reliability criterion (test step E53). This reliability criterion is, for example, the identity of the distributions in each cluster or for a given minimum number of clusters, or the identity of the distributions for each cluster or a given minimum number of clusters up to a tolerance threshold, etc.

[0088] If this criterion is not met (no response in test step E53), the adjustment module 5 adjusts, for at least one cluster Cj, the number of synthetic data points generated in step E40 for that cluster using the DIFF diffusion model (step E54). More specifically, the adjustment module 5 adjusts upwards or downwards the quantity NQ of synthetic data points generated for that cluster in step E40 based on the result of the comparison (for example, whether that cluster is over-represented or under-represented).

[0089] Typically, if, for a cluster Q, the adjustment module 5 determines in step E53 that the number of reduced synthetic data points (DATA-S-RED) classified in that cluster is less, up to a proportionality factor of 3, than the number of reduced original location data points classified in that cluster in step E20, it regenerates synthetic data points (DATA-S) in that cluster using the DIFF diffusion model so as to obtain an identical number (up to a proportionality factor of 3). With each generation of new synthetic data points, the adjustment module 5 repeats steps E51 to E54 until it obtains a distribution of synthetic data points (DATA-S) that conforms to the distribution of the original longitudinal data with respect to the considered fidelity criterion.

[0090] It is noted that if MQ denotes the number of missing synthetic data points in a cluster Cj, the adjustment module 5 can, during a single inference, use the DIFF diffusion model to generate a number M greater than MQ (for example, 10 or 20 times greater) of synthetic data points in the cluster Q, and then retain only the desired number MQ from among those which, after application of the VAE encoder, do indeed belong to the cluster Cj. This makes it possible to limit the number of inferences of the generative model.

[0091] If, on the contrary, for a cluster Q, the adjustment module 5 determines during step E53 that the number of reduced synthetic data DATA-S-RED classified in this cluster is greater, up to the proportionality factor [3, than the number of reduced original location data, it removes from the DATA-S set synthetic data generated by the generative model DIFF in this cluster Q.

[0092] Substeps E51 to E54 are repeated until the specified reliability criterion is met or a maximum number of iterations is reached (test step E55). Figure 5 illustrates a representation of the synthetic DATA-S data generated from the original longitudinal data in Figure 2.

[0093] In the embodiment described here, at the end of the iterations, the adjustment module 5 assigns a confidence index to the generated synthetic data (step E60). This confidence index depends, for example, on compliance with the reliability criterion considered in step E50, and incidentally on any remaining difference between the distribution of the synthetic data DATA-S and the distribution of the original longitudinal location data DATA-MOB. Typically, the confidence index can be assigned based on a comparison, for each cluster, of the dispersion of the original longitudinal data with the dispersion of the synthetic longitudinal data in that cluster, and on the aggregation (for example, in the form of a histogram) of the results obtained for each cluster across all clusters. Such a confidence index makes it possible to verify the homogeneous coverage of each cluster.

[0094] Furthermore, the confidence index can take into account clusters not representable by synthetic data, i.e. those which the DIFF generative model has not been able to populate, if applicable, during the generation of synthetic longitudinal data.

[0095] The confidence index can also take into account the invalidated clusters during step E23. Other elements can also be taken into account when assigning the confidence index. At the end of the anonymization process, the synthetic data DATA-S are stored with their confidence index, for example in the non-volatile NVM memory of the anonymization device 1 and / or provided to a third party for storage and subsequent use (step E70).

[0096] It should be noted that other checks can be performed by the anonymization device 1 (or by a third party) on the synthetic DATA-S data in addition to, or instead of, those performed in step E50. For example, one or more exogenous criteria could be used to assess the representativeness of the synthetic DATA-S data compared to the original DATA-MOB longitudinal location data, rather than comparing their reduced forms as in step E50. For example, a criterion of indistinguishability of the synthetic DATA-S data from the original DATA-MOB longitudinal location data could be considered, assessed using a Fréchet distance or based on differential confidentiality. Of course, this is only a non-limiting illustrative example of the invention.

Claims

Demands

1. A method for anonymizing longitudinal location data referred to as original data relating to a plurality of individuals, said method comprising: - a step (E20) of classifying, by means of an unsupervised partitioning algorithm, said longitudinal location data of original data into a plurality of clusters, each cluster having a minimum size greater than or equal to a given threshold; - a step (E30) of training, from said longitudinal location data of original data, a generative model conditioned by said plurality of clusters; and - a step (E40) of generating synthetic data within each cluster, using said generative model and taking into account a distribution on each cluster of the longitudinal location data of original data used during the training step of the generative model.

2. An anonymization method according to claim 1 further comprising at least one iteration including: - a step (E51) of applying to the synthetic data the partitioning algorithm used during the classification step; and - if a distribution of the synthetic data over the plurality of clusters does not meet a fidelity criterion determined with respect to said distribution of the original longitudinal location data, an adjustment step (E54) for at least one cluster of a number of synthetic data generated by means of the generative model within that cluster.

3. An anonymization method according to claim 1 or 2 wherein, during the generation step, the number of synthetic data generated within a cluster using the generative model is proportional to the number of original longitudinal location data classified during the classification step in that cluster.

4. An anonymization method according to any one of claims 1 to 3, wherein each cluster identified during the step of The classification also verifies a criterion of non-discemability of the original longitudinal location data classified in this cluster.

5. An anonymization method according to any one of claims 1 to 4 wherein said partitioning algorithm comprises the application (E21) of a variational autoencoder combined with a tiling (E22) of a latent space of the variational autoencoder, a cluster corresponding to said tile.

6. An anonymization method according to claim 5 wherein following the tiling of the latent space, tiles having an area greater than a given threshold are invalidated and the original longitudinal mobility data classified in these tiles are deleted before the learning step (E24).

7. An anonymization method according to any one of claims 1 to 6 further comprising a step of assigning (E60) a confidence index to the synthetic data.

8. An anonymization method according to any one of claims 1 to 7 wherein said generative model is a diffusion-based model.

9. Computer program (PROG) comprising instructions for implementing an anonymization process according to any one of claims 1 to 8 when said program is executed by a computer.

10. Computer-readable recording medium on which a computer program according to claim 9 is recorded.

11. Device (1) for anonymizing longitudinal location data relating to a plurality of individuals, said device comprising: - a classification module (2), configured to classify, by means of an unsupervised partitioning algorithm, said longitudinal location data into a plurality of clusters, all clusters having a size greater than or equal to a given threshold; - a learning module (3), configured to learn from said longitudinal location data a generative model conditioned by said plurality of clusters; and a generation module (4), configured to generate synthetic data within each cluster using said generative model and taking into account a cluster distribution of the original longitudinal location data used to train the generative model.

Images