Method and device for generating synthetic location data

Abstract

The invention relates to a method and device for anonymising longitudinal location data relating to a plurality of persons. The anonymising method comprises: - a step (E20) of classifying, by means of an unsupervised partitioning algorithm, longitudinal location data into a plurality of clusters having a given minimum size; - a step (E30) of learning, from the longitudinal location data, a generative model conditioned by the plurality of clusters; and - a step (E40) of generating synthetic data within each cluster using the generative model and taking into account a distribution per cluster of the original longitudinal location data.

Description

Description Title of the invention: Method and device for generating synthetic location data Previous technique

[0001] The invention falls within the general field of communications.

[0002] It relates more specifically to the anonymization of data concerning individuals collected over a given period of time, also known as "longitudinal data". The invention thus applies primarily, but not exclusively, to longitudinal location data such as mobility traces collected from users of mobile devices.

[0003] Among all human activities, mobility gives rise to a multitude of political and environmental issues for societies, as well as for many industries. A thorough understanding of this mobility helps inform decisions in a wide range of fields, such as optimizing transport networks, reducing greenhouse gas emissions or energy consumption, deploying telecommunications networks, and so on.

[0004] In recent years, new sources of location data have emerged. These include applications embedded in smartphones equipped with GPS chips, radio chips embedded in vehicles, mobile phones generating signal traces from their connection to the mobile network, and so on. These various sources offer the possibility of collecting, over a specific period, mobility traces or, more generally, location data relating to a large number of individuals or users. The processing and analysis of the longitudinal data thus collected makes it possible to address the issues mentioned above.

[0005] However, the privacy of individuals whose longitudinal location data is collected can be threatened if this data is used in a way that allows for the direct or indirect re-identification of those individuals. In Europe, the processing of personal data, including longitudinal location data, is subject to strict privacy regulations, such as the General Data Protection Regulation (GDPR), or, more specifically for mobile network operators, Directive 2002 / 58 / EC of 12 July 2002 (also known as the "ePrivacy Directive"), as updated by Directive 2009 / 136 / EC on cookies. These regulations aim to ensure the effective and secure processing of personal data.

[0006] There are various techniques that allow for the anonymization of longitudinal data, and incidentally, traces of mobility.

[0007] A first category of commonly used anonymization techniques involves generating statistical aggregates from the collected data. The nature of the statistical aggregates to be created and the samples of individuals from which to collect the data are chosen before collection, based on the specific problem that the collected data aims to address. The statistical aggregates thus generated are produced while respecting the confidentiality of the original data (which are "merged" into the aggregates) and are themselves anonymous.

[0008] Statistical aggregates can be calculated incrementally as data is collected, without creating individual histories (which are considered personal data) and by deleting raw events within a very short timeframe. This delay is necessary for statistical processing and allows for the calculation, if needed, of additional enrichment variables. For example, a study of the usage of a given area can be based on counting the mobile devices that have connected to cells of a mobile network deployed in that area, relative to a representative sample of the targeted activity (selected, for example, based on socio-demographic or behavioral characteristics, known or inferred from the spatiotemporal properties of the mobile devices). The statistics obtained can then be enriched by estimating the speeds and directions of movement of the mobile devices, etc.Operationally, a maximum retention period of 15 minutes for events (“pseudonymized”) is considered an acceptable compromise to ensure data usability while guaranteeing anonymization.

[0009] Techniques based on the incremental production of statistical aggregates place the anonymization / utility trade-off on the side of minimal information retention and essentially raise the problem of reusing the produced statistical aggregates for new purposes. Regardless of the performance of the processes and algorithms implemented, these statistics are designed to address a specific problem, identified prior to data collection. Thus, a given set of statistics is not always usable for new purposes. For example, it is obviously impossible to retrospectively examine the age pyramid of a studied population if the appropriate variable was not included in the aggregates during the design phase. Similarly, the time steps and the choice of study areas heavily influence the semantics of the indicators, and it is generally impossible to explore all the useful combinations.Thus, it is very difficult to imagine and predict all the potentially useful statistical combinations in the future; moreover, this raises important practical problems, particularly with regard to the necessary computing and storage costs.

[0010] To overcome this drawback, a second category of anonymization techniques relies on the generation of synthetic data that preserves the form and certain statistical and structural properties of real data collected from individuals. By definition, synthetic data is data that does not originate from a real observation (measurement) but is created artificially through numerical simulations and / or by artificial intelligence (AI). These techniques offer the advantage of being able to conduct post-hoc analyses on the generated synthetic data, thus compensating for the fact that the original data is no longer available.

[0011] Many synthetic data generation techniques rely on generative models, which allow for the generation of "new" samples from a known distribution of collected longitudinal data. The samples thus generated are partially statistically representative of the initial distribution of the real data; however, they are "new" in the sense that there is no exact match between a generated sample and the actual data collected from individuals. Examples of these techniques based on generative models include variational autoencoders (VAEs), generative adversarial networks (GANs), diffusion models, and others.

[0012] However, these techniques encounter difficulties, particularly regarding the representativeness of the distribution obtained, as well as the quality and guarantee of the "new" nature of the generated samples.

[0013] For example, in the case of highly multimodal longitudinal location data (i.e., data representing very different behaviors), some techniques, such as VAE (Vehicle Analysis and Evaluation), can estimate the distribution of the original data quite well but struggle to produce synthetic samples that accurately reflect their fine characteristics. Such fine characteristics include, for instance, the precise positions of a transport infrastructure's trajectory, consistent acceleration / deceleration patterns, the presence of service areas on a highway, and so on. Other techniques, such as GANs (Generative Analysis Networks) or diffusion-based generative models, can produce synthetic samples with fine characteristics but fall short in terms of the representativeness of the generated samples.

[0014] There is therefore a need for a technique to anonymize longitudinal data such as location data relating to individuals, making a compromise between the power of the anonymization applied (typically its irreversibility in the face of various attack scenarios) and the preservation of useful information contained in the original data in order to be able to exploit it for purposes not necessarily envisaged when it was collected. Description of the invention

[0015] The invention addresses this need in particular by proposing a method for anonymizing longitudinal location data, referred to as original data, relating to a plurality of individuals, this method comprising: a step of classifying, by means of an unsupervised partitioning algorithm, said longitudinal location data, the original data, into a plurality of clusters, all having a size greater than or equal to a given threshold; a step of training, from said longitudinal location data, a generative model conditioned by said plurality of clusters; and a step of generating synthetic data within each cluster, using said generative model and taking into account a cluster distribution of the longitudinal location data, the original data used during the training step of the generative model.

[0016] Correspondingly, the invention also relates to a device for anonymizing longitudinal location data, referred to as "origin" data, pertaining to a plurality of individuals. This device comprises: a classification module, configured to classify said longitudinal location data into a plurality of clusters, each having a size greater than or equal to a given threshold, using an unsupervised partitioning algorithm; a learning module, configured to learn a generative model conditioned by said plurality of clusters from said longitudinal location data; and a generation module, configured to generate synthetic data within each cluster using said generative model and taking into account a cluster distribution of original longitudinal location data used to learn the generative model.

[0017] No limitations are attached to the generative model that may be used in the context of the invention. 11 It may be, for example, a diffusion-based model (more commonly called a "diffusion model"), a generative adversarial network (GAN), etc.

[0018] Thus, the invention makes it possible to obtain an anonymized synthetic dataset by applying several models learned on original longitudinal location data (i.e., real data). More specifically, the invention relies on a two-step process to create an anonymized synthetic dataset that combines the concepts of unsupervised partitioning (also more commonly called "clustering") of the original data and a generative model learned on the original data and conditioned by the resulting clusters.Through these two steps, the resulting synthetic dataset is anonymized, notably through the use of the generative model and partitioning into a maximum number of sufficiently large clusters (greater than or equal to a given threshold), while preserving the statistical properties of the original longitudinal location data. This is achieved through conditional learning of the generative model on the clusters resulting from the partitioning of the original location data and by taking into account the distribution of this original location data during the generation of the synthetic data. For example, during the generation of synthetic data, the number of synthetic data points generated within a cluster using the generative model is proportional to the number of original longitudinal location data points classified during the classification step within that cluster (assuming the same proportionality coefficient for the different clusters).This allows us to approach the distribution of the original longitudinal location data via a single inference of the generative model.

[0019] The invention thus ensures that the generated synthetic data accurately represents the original location data. Consequently, the usefulness of the generated synthetic data is greatly improved, making it possible to conduct post-hoc analyses using the synthetic data (i.e., data not necessarily anticipated during collection) and broadening its range of applications. Indeed, thanks to the invention, the synthetic data is guaranteed to have a distribution close to that of the original data within clusters identified from the original data. It is therefore possible to retain important, useful information from the original location data collected from multiple individuals without having to store the original location data.It is therefore permissible to comply with the various legal obligations relating to personal data without losing the useful information contained in the original location data. Only anonymized synthetic data needs to be stored to create a history and can be used later to regenerate the useful information contained in the original data and, where applicable, calculate other statistics on this original data than those considered at the time of collection.

[0020] In one particular embodiment, the anonymization process further comprises at least one iteration including: a step of applying to synthetic data the partitioning algorithm used during the classification step; and if a distribution of synthetic data over the plurality of clusters does not meet a fidelity criterion determined with respect to the distribution of the original longitudinal location data, an adjustment step for at least one cluster of a number of synthetic data generated using the generative model within that cluster.

[0021] This embodiment ensures that the distribution of synthetic data conforms to the distribution of the original location data. Indeed, the inventors observed that in certain exceptional cases, as with any generative model used in artificial intelligence, and despite the steps implemented according to the invention to train the generative model and ensure that the distribution of the original location data in the clusters is respected, the generated synthetic data may not strictly conform to the distribution of the original longitudinal location data in some clusters. This can occur, for example, in clusters located at the edge of the distribution, typically in clusters where the original longitudinal data is most dispersed.This embodiment allows for the correction of the generated synthetic data in order to further improve its representativeness of the original longitudinal location data and, consequently, its usefulness. This embodiment aims to further strengthen the similarity between the distribution of the original location data and that of the generated synthetic data.

[0022] In a particular embodiment, each cluster identified during the first classification step further verifies a criterion of non-discernibility of the original longitudinal location data classified in that cluster.

[0023] Taking such a criterion into account strengthens the anonymity of the generated synthetic data. This criterion could, for example, take the form of a comparison against a threshold for a measure of cluster spread, thereby eliminating clusters where the original longitudinal location data are too dispersed. This ensures continuity between the clusters learned from the original longitudinal location data.

[0024] In a particular embodiment, the partitioning algorithm used during the classification step includes the application of a variational autoencoder combined with a tiling of a latent space of the variational autoencoder, a cluster corresponding to a said tile.

[0025] An autoencoder, as is well known, is a specific type of neural network, divided into two parts: an encoder and a decoder, which are applied sequentially. The encoder compresses the input information vector x by reducing its dimensionality (i.e., it "encodes" the useful information contained in the vector x with fewer variables than the vector x itself). The space of reduced codes is called the "latent space." This latent space describes the structure of the data. The decoder is a generative model that reconstructs an observation of x from the latent space. Since the autoencoder performs a reconstruction task, it is trained to minimize reconstruction error.

[0026] A variational autoencoder, or VAE, is an autoencoder that allows learning a function associating a multivariate latent distribution, typically a Gaussian distribution, with an input vector. This latent distribution is not directly observed but deduced. based on a mathematical model. This is a kind of "regularized" autoencoder in which the distribution of codes in the latent space is constrained to a given distribution, generally Gaussian, whose parameters (mean and standard deviation) are predicted by the encoder. Using a variational autoencoder facilitates obtaining certain properties useful for the latent space, such as continuity and a density that approximates a known distribution. It advantageously allows for a less sparse latent space than a classical autoencoder, and therefore better continuity. This makes it easier to group longitudinal location data by similarity thanks to the imposed continuity in the latent space, while retaining the possibility of reconstructing the longitudinal location data using the variational autoencoder's decoder.

[0027] The combined use of a virtual array and tile segmentation with a minimum tile size ensures that, after reconstruction, the generated synthetic data are closely related. By making the latent space continuous, the possibility of re-identifying an individual during the generation of synthetic data is limited. This strengthens the anonymity of the generated synthetic data and, consequently, contributes to respecting individual privacy.

[0028] Of course, this is only a non-limiting illustrative example of the invention, and other algorithms can be considered as alternatives.

[0029] Furthermore, following the tiling of the latent space, it is possible to consider that tiles with an area greater than or equal to a given threshold are invalidated and the original longitudinal mobility data classified in these tiles are deleted before the learning stage.

[0030] This process aims to filter out the largest tiles, in which mobility traces are likely to be spaced further apart and therefore more easily discernible. This implementation is an example of applying a non-discernibility criterion during the classification step.

[0031] In one particular embodiment, the anonymization process further includes a step of assigning a confidence index to the synthetic data.

[0032] This confidence index measures the accuracy of the generated synthetic data compared to the original longitudinal location data, particularly in terms of statistical properties (e.g., distribution). It can also account for clusters that cannot be represented by the synthetic data.

[0033] Alternatively, we can consider evaluating other exogenous criteria to qualify the representativeness of the synthetic data generated in relation to an original longitudinal location dataset, and / or their representation in latent space.

[0034] Determining and incorporating such criteria advantageously addresses two key challenges. Firstly, they guide the learning of the partitioning algorithm and / or the generative model to achieve a distribution of the generated synthetic data that closely matches the actual distribution of the original longitudinal location data, viewed through the lens of predetermined criteria. Secondly, they enable statistical adjustment of the generated synthetic data with respect to these same criteria, for example, by implementing a cluster adjustment step for the generated synthetic data, similar to what was described earlier for a specific embodiment, or by using classification supervised by predetermined statistics, and so on.

[0035] In one particular embodiment, the anonymization process is implemented by a computer.

[0036] The invention also relates to a computer program on a recording medium, this program being capable of being implemented in a computer or more generally in an anonymization device conforming to the invention and comprising instructions adapted to the implementation of an anonymization process as described above.

[0037] This program can use any programming language, and be in the form of source code, object code, or code somewhere between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0038] The invention also relates to an information carrier or a recording medium readable by a computer, and comprising instructions for a computer program as mentioned above.

[0039] The information or recording medium can be any entity or device capable of storing programs. For example, the medium may include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard drive, or a flash memory.

[0040] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be carried via an electrical or optical cable, by radio link, by wireless optical link or by other means.

[0041] The program according to the invention can in particular be downloaded onto an Internet-type network.

[0042] Alternatively, the information or recording medium may be an integrated circuit in which a program is incorporated, the circuit being adapted to execute or to be used in the execution of the anonymization process according to the invention.

[0043] It is also possible to consider, in other embodiments, that the anonymization process and device according to the invention may have in combination all or part of the aforementioned characteristics. Brief description of the drawings

[0044] Other features and advantages of the present invention will become apparent from the description below, with reference to the accompanying drawings, which illustrate an example of an embodiment without being limiting in any way. In the figures: [Fig. 1] Figure 1 represents, in its environment, a longitudinal location data anonymization device according to the invention, in one embodiment; [Fig. 2] Figure 2 schematically represents longitudinal location data collected from mobile terminal users; [Fig. 3] Figure 3 represents the material architecture of the anonymization device of Figure 1 in a particular embodiment; [Fig. 4] Figure 4 represents the main steps of a longitudinal location data anonymization process according to the invention in a particular embodiment in which it is implemented by the device of Figure 1; [Fig. 5] Figure 5 illustrates an example of synthetic data generated by the invention from the longitudinal location data of Figure 2. Description of the invention

[0045] Figure 1 represents, in its environment, a device 1 for anonymizing longitudinal location data, in a particular embodiment.

[0046] As mentioned previously, such longitudinal location data are location data collected over a given time period from a plurality of distinct individuals.

[0047] In the example considered here, we focus specifically on longitudinal location data (DATA-MOB), consisting of mobility traces collected from mobile device users. As is well known, mobile devices generate signaling traces when they connect to the mobile network, providing visibility into the location of their users and, consequently, their mobility over a given period. Access to such traces (also called mobility traces) allows for a number of analyses to be conducted, for example, to address various industrial, societal, and / or environmental issues, as discussed previously.

[0048] Of course, this is only an illustrative example and not a limiting one in itself. The invention applies in other contexts and in particular to other types of longitudinal location data, such as data from GPS chips or IoT radio chips embedded in vehicles, etc. No limitations are attached to the way in which this longitudinal location data is obtained.

[0049] Longitudinal location data (DATA-MOB) typically takes the form of a plurality of sequences (N, where N is an integer greater than 1) of locations (a sequence constituting a longitudinal data point associated with an individual or trace) considered at various times within a global time interval common to all sequences. For example, each location is identified by a point P(x,y). t. defined at a time ti by its coordinates x and y in a two-dimensional orthonormal coordinate system, a sequence being represented by a vector of L points P(x,y) ti L denotes an integer greater than 1 representing the number of instants ti considered within the overall time interval. Figure 2 illustrates a set of mobility traces collected on a French mobile network over a given overall time interval for N = 10,000 people. More precisely, in this figure, each trace reflects, for a given person, the successive positions occupied by that person between 6:00 AM and 6:00 PM during the month of March 2023.

[0050] According to the invention, the anonymization device 1 is configured to anonymize real longitudinal location data supplied to it as input (referred to as "original data"). More specifically, it is configured to generate, from such real original data, anonymized synthetic data from which it is difficult or even impossible to identify the individuals from whom this real original data was collected. The synthetic data thus generated is not real data, but thanks to the invention, it is similar to and representative of such real data.

[0051] In the embodiment described here, the anonymization device 1 has the hardware architecture of a computer as shown in Figure 3. It includes, in particular, a processor (PROC), a random access memory (MEM), a read-only memory (ROM), and a Non-volatile memory (NVM), communication means including input / output means for providing it with longitudinal location data, such as DATA-MOB mobility traces, for anonymization, and for obtaining anonymized synthetic data as output for transmission to a storage and / or processing unit (not shown in Figure 2). Such means are known per se and are not described further here.

[0052] The non-volatile memory NVM constitutes a recording medium according to the invention, readable by the processor PROC, and on which a computer program PROG according to the invention is stored. This program PROG comprises instructions defining the main steps of an anonymization process according to the invention. More specifically, it defines functional modules of the anonymization device 1 (shown in Figure 2), which rely on and / or control all or part of the elements PROC, MEM, ROM, NVM, and COM mentioned above.

[0053] These functional modules include, in particular: - a classification module 2, configured to classify the original longitudinal location data into a plurality of clusters, all having a size greater than or equal to a given threshold denoted Kmin, using a partitioning algorithm; - a learning module 3, configured to learn from said original longitudinal location data a generative model conditioned by the plurality of clusters resulting from the classification performed by the classification module 2. In the embodiment described here, a diffusion-based generative model, referred to hereafter as the diffusion model, is considered; and - a generation module 4, configured to generate synthetic data within each cluster using said diffusion model and taking into account the cluster distribution of the original longitudinal location data used to learn the diffusion model.

[0054] In the embodiment described here, the computer program PROG further defines an adjustment module 5 for the generated synthetic data activated in a particular context as described in more detail later.

[0055] The functions implemented by the classification module 2, learning module 3, generation module 4 and adjustment module 5 are now detailed with reference to Figure 4, which represents the main steps of an anonymization process according to the invention as implemented by the anonymization device 1 in a particular embodiment.

[0056] We assume here that the original longitudinal location dataset DATA-MOB is provided to the anonymization device 1 (step E10). We denote by N the dimension of the DATA-MOB dataset (i.e. N longitudinal location data, that is to say here N mobility traces relating to N distinct users).

[0057] According to the invention, the anonymization device 1 classifies the DATA-MOB data into a plurality of clusters, ensuring that all clusters have a size greater than or equal to Kmin (step E20). KQ denotes the size of a cluster Q with KQ > Kmin for any index j.

[0058] To this end, the classification module 2 of the anonymization device 1 uses an unsupervised partitioning algorithm. In the embodiment described here, the classification module 2 uses more specifically a variational autoencoder (VAE) combined with a tile partitioning applied to the latent space of the VAE, each tile corresponding to a cluster constrained by a minimum size equal to Kmin.

[0059] More precisely, the VAE is trained by the classification module 2 on the original longitudinal location data DATA-MOB in a manner known to those skilled in the art, leading to a latent space of dimension d, where d is an integer strictly less than L (step E21). The latent space allows the DATA-MOB data to be represented in a space of dimension d much smaller than L. Typically, in the example shown in Figure 2, a dimension d less than 10 can be obtained using a VAE. The representation in the latent space of the original longitudinal location dataset DATA-MOB is denoted DATA-MOB-RED: each original longitudinal data point of dimension L in the DATA-MOB dataset corresponds to a reduced longitudinal data point of dimension d in the DATA-MOB-RED dataset.

[0060] Then, the latent space obtained in step E21 is tiled by the classification module 2, using a kd tree (k-dimensional tree), also called a "kd-tree," ensuring that the resulting tiles contain at least Kmin of mobility traces (i.e., at least Kmin of reduced data) associated with Kmin of different individuals (step E22). The kd-tree method is well-known: it is a structure for optimally organizing data in a k-dimensional space according to its spatial distribution. A detailed description of the kd-tree method is given in C. Heury's document entitled "The kd-tree: a spatial subdivision method," December 19, 2007.

[0061] Each tile resulting from the E22 tile partitioning of the latent space constitutes a cluster Q of size KQ, given by the number of traces (i.e., reduced longitudinal location data) that the tile contains. It is associated with a representative which, in the embodiment described here, is the center of gravity of the reduced longitudinal location data classified in that tile (or cluster). The center of gravity is only an illustrative example, and other representatives can be considered as long as they allow for the unique identification of each cluster.

[0062] Steps E21 and E22 advantageously allow us to identify a maximum number of clusters (i.e., tiles) that meet a minimum size criterion.

[0063] In the embodiment described here, the classification module 2 verifies that each cluster Q identified during step E22 meets a given criterion of non-discernibility of the data classified in that cluster (test step E23).

[0064] If at least one Qo cluster is found to be in the S range, the non-discernibility criterion is not met (no response in step E23), and the Qo cluster is invalidated (step E24). Classification module 2 then removes from the DATA-MOB dataset the original longitudinal location data corresponding to the reduced longitudinal data classified in that cluster (step E24).

[0065] Otherwise (yes answer in step E23), all clusters are validated and all original longitudinal location data are retained in the DATA-MOB set (step E25).

[0066] It should be noted, however, that the E23 test step (and the E24 invalidation step where applicable) is optional and leads to increased anonymity of the longitudinal location data considered to generate a synthetic dataset.

[0067] In the embodiment described here, during step E23, the classification module 2 considers the surface area of ​​the tiles obtained at the end of step E22 and determines that the non-discernibility criterion is not met when this surface area exceeds a predetermined threshold. This involves removing tiles that are too large in space, as this sprawl prevents ensuring that the longitudinal data classified within these tiles are sufficiently close to one another. to maximize the anonymity of the individuals to whom this data corresponds. For example, the ranking module 2 sorts the tiles in descending order of area and removes the first x tiles thus obtained corresponding to an area greater than the set threshold. Such a threshold can be an absolute or relative threshold, such as, for example, a relative threshold corresponding to the area of ​​95 ème percentile of tile areas. According to another example, the ranking module 2 can consider the dispersion of reduced longitudinal location data in the latent space and remove tiles with a dispersion greater than a given threshold (absolute or relative).

[0068] These examples are given for illustrative purposes only, and other criteria for non-discernibility may be considered as alternatives.

[0069] This removal allows the removal of overly discriminatory original longitudinal data from the DATA-MOB dataset.

[0070] Thus, in the embodiment described here, the original longitudinal location data is classified by identifying clusters in the latent space from the reduced longitudinal data corresponding to the original longitudinal data. Classifying the reduced longitudinal location data in the latent space as proposed in steps E21 and E22 is therefore equivalent to classifying the original longitudinal location data: the Q clusters identified in step E22 from the reduced longitudinal data also apply to the corresponding original longitudinal location data.

[0071] Of course, other unsupervised partitioning algorithms besides VAE combined with a kd tree can be considered as alternatives, such as combining spatiotemporal subsampling (leading to a reduction in trace dimensionality) followed by applying a k-means (or k-means) algorithm to the resulting subsampled longitudinal location data. A supervised partitioning algorithm can also be used.

[0072] The classification module 2 associates each original longitudinal location data point in the DATA-MOB dataset with the representative of the cluster into which the corresponding reduced longitudinal location data point is classified (step E26). This association is stored by the classification module 2, for example, in the non-volatile NVM memory of the anonymization device 1. Thus, in the original longitudinal DATA-MOB dataset, each data point is associated with the same cluster as at least Kmin-1 other data points.

[0073] Then, learning module 3 of the anonymization device 1 learns, from the original longitudinal location data of the DATA-MOB set, a generative DI FF diffusion model conditioned by the Q clusters identified during step E22 (step E30). For example, during step E30, learning module 3 uses as its DI FF model a Traj-UNET diffusion model as described in the document by Y Zhu et al. entitled "DiffTraj: Generating GPS Trajectory with Diffusion Probabilistic Model", 37 th Conference on Neural Information Processing Systems, Neurl PS 2023, adapted to take into account as conditioning variables during learning, the representatives (centers of gravity here) of the Q clusters identified during step E22 (and which were not invalidated during step E24) and associated during step E26 with the original longitudinal location data.

[0074] The conditioning of a generative model by Q clusters presents no difficulty in itself for a person skilled in the art and is not described in further detail here. It should also be noted that the invention can also be applied to a generative model other than a diffusion model such as a GAN as long as it is conditioned by the Q clusters.

[0075] Then, the generation module 4 of the anonymization device 1 generates, in each cluster Q identified during step E22 and which, in the embodiment described here, was not invalidated during step E24, a number NQ of synthetic data using the generative diffusion model learned during the training step E30 (step E40). The numbers NQ are chosen to take into account the cluster distribution of the original longitudinal location data of the DATA-MOB set in the clusters Q considered during the training step E30.More precisely, in the embodiment described here, if we denote by DATA-S the synthetic dataset generated by exploiting the DI FF generative diffusion model learned in step E30, the proportion of synthetic data DATA-S that the DI FF generative diffusion model is asked to generate in each cluster is chosen to be identical to the proportion of the original longitudinal data DATA-MOB classified in each cluster Q in step E20. For example, for each cluster Q, a number NQ of synthetic data is generated in that cluster equal to 0=10 times the number KQ of original longitudinal data classified in that cluster. Of course, this proportionality factor 0=10 is given only as an illustration, and other values ​​of 0 can be considered, the same proportionality factor 0 being applied to each cluster to respect as closely as possible the distribution of the original longitudinal data.Respecting the distribution of the original data guarantees the statistical usefulness of the generated synthetic data.

[0076] In the embodiment described here, the anonymization device 1 implements an additional (optional) step to verify the conformity (i.e., accuracy) of the distribution of the generated synthetic data with the distribution of the original data. This step includes adjusting the generated synthetic data, if necessary, using its adjustment module 5 to improve this conformity (step E50). These steps are implemented iteratively until a predetermined accuracy criterion is met or a maximum number of iterations has been reached.

[0077] More specifically, during at least one iteration, the adjustment module 5 applies the VAE encoder learned during step E21 to the generated synthetic data DATA-S and obtains a reduced representation in the latent space of the synthetic data DATA-S (step E51). The reduced synthetic data obtained is designated as DATA-S-RED.

[0078] The adjustment module 5 then determines the distribution (by number) of the reduced synthetic data (DATA-S-RED) in the Q clusters that were trained on the original longitudinal data (step E52). For this purpose, for example, it assigns each reduced synthetic data point to the Q cluster whose representative is closest in distance to the reduced synthetic data point in question, and evaluates the number of reduced synthetic data points assigned to each Q cluster.

[0079] Then it compares the distribution obtained with the distribution of the reduced longitudinal data DATA-MOB-RED in the Q clusters with respect to a defined reliability criterion (test step E53). This reliability criterion is, for example, the identity of the distributions in each cluster or for a given minimum number of clusters, or the identity of the distributions for each cluster or a given minimum number of clusters up to a tolerance threshold, etc.

[0080] If this criterion is not met (no response in test step E53), the adjustment module 5 adjusts the number of synthetic data points generated for at least one cluster Q during of step E40 for this cluster using the DI FF diffusion model (step E54). More specifically, the adjustment module 5 adjusts up or down the quantity NQ of synthetic data generated for this cluster during step E40 based on the result of the comparison (for example, whether this cluster is over-represented or under-represented).

[0081] Typically, if, for a cluster Q, the adjustment module 5 determines in step E53 that the number of reduced synthetic data points (DATA-S-RED) classified in that cluster is less, up to a proportionality factor P, than the number of original reduced location data points classified in that cluster in step E20, it regenerates synthetic DATA-S data in that cluster using the DI FF diffusion model to obtain an identical number (up to the proportionality factor). With each generation of new synthetic data, the adjustment module 5 repeats steps E51 to E54 until it obtains a distribution of synthetic DATA-S data that conforms to the distribution of the original longitudinal data with respect to the considered reliability criterion.

[0082] Note that if MQ denotes the number of missing synthetic data in a cluster Q, the adjustment module 5 can, during a single inference, request the DI FF diffusion model to generate a number M greater than MQ (for example 10 times or 20 times greater) of synthetic data in the cluster Q, then keep only the desired number MQ from those which, after application of the VAE encoder, do indeed belong to the cluster Q. This makes it possible to limit the number of inferences of the generative model.

[0083] S on the contrary, for a cluster Q, the adjustment module 5 determines during step E53 that the number of reduced synthetic data DATA-S-RED classified in this cluster is greater, up to the proportionality factor P, than the number of original reduced location data, it removes from the DATA-S set of synthetic data generated by the generative model DI FF in this cluster Q.

[0084] Substeps E51 to E54 are repeated until the specified reliability criterion is met or a maximum number of iterations is reached (test step E55). Figure 5 illustrates a representation of the synthetic DATA-S data generated from the original longitudinal data in Figure 2.

[0085] In the embodiment described here, after the iterations, the adjustment module 5 assigns a confidence index to the generated synthetic data (step E60). This confidence index depends, for example, on compliance with the reliability criterion considered in step E50, and incidentally on any remaining difference between the distribution of the synthetic data (DATA-S) and the distribution of the original longitudinal location data (DATA-MOB). Typically, the confidence index can be assigned based on a comparison, for each cluster, of the dispersion of the original longitudinal data with the dispersion of the synthetic longitudinal data in that cluster, and the aggregation (for example, in the form of a histogram) of the results obtained for each cluster across all clusters. Such a confidence index allows verification of the homogeneous coverage of each cluster.

[0086] Furthermore, the confidence index can take into account clusters not represented by synthetic data, i.e. those which the DI FF generative model has not been able to populate, if applicable, during the generation of synthetic longitudinal data.

[0087] The confidence index can also take into account clusters invalidated during the step E23. Other elements may also be taken into account when assigning the confidence index. Following the anonymization process, the synthetic data DATA-S is stored with its confidence index, for example in the non-volatile memory NVM of the anonymization device 1 and / or provided to a third party for storage and subsequent use (step E70).

[0088] It should be noted that other checks can be performed by the anonymization device 1 (or by a third party) on the synthetic DATA-S data in addition to, or instead of, those performed in step E50. For example, one or more exogenous criteria could be used to assess the representativeness of the synthetic DATA-S data relative to the original DATA-MOB longitudinal location data, rather than comparing their reduced forms as in step E50. For example, a criterion of indistinguishability of the synthetic DATA-S data from the original DATA-MOB longitudinal location data could be considered, assessed using a Fréchet distance or based on differential confidentiality. Of course, this is only a non-limiting illustrative example of the invention.

Claims

Demands

1. A method for anonymizing original longitudinal location data relating to a plurality of individuals, said method comprising: a step (E20) of classifying, by means of an unsupervised partitioning algorithm, said original longitudinal location data into a plurality of clusters, each cluster having a minimum size greater than or equal to a given threshold; a step (E30) of training, from said original longitudinal location data, a generative model conditioned by said plurality of clusters; and a step (E40) of generating synthetic data within each cluster, using said generative model and taking into account a distribution on each cluster of the original longitudinal location data used during the training step of the generative model.

2. An anonymization method according to claim 1 further comprising at least one iteration including: a step (E51) of applying to the synthetic data the partitioning algorithm used during the classification step; and if a distribution of the synthetic data over the plurality of clusters does not meet a fidelity criterion determined with respect to said distribution of the original longitudinal location data, an adjustment step (E54) for at least one cluster of a number of synthetic data generated by means of the generative model within that cluster.

3. An anonymization method according to claim 1 or 2 wherein, during the generation step, the number of synthetic data generated within a cluster using the generative model is proportional to the number of original longitudinal location data classified during the classification step in that cluster.

4. An anonymization method according to any one of claims 1 to 3 wherein each cluster identified during the classification step further satisfies a criterion of non-distinguishability of the original longitudinal location data classified in that cluster.

5. An anonymization method according to any one of claims 1 to 4 wherein said partitioning algorithm comprises the application (E21) of a variational autoencoder combined with a tiling (E22) of a latent space of the variational autoencoder, a cluster corresponding to said tile.

6. An anonymization method according to claim 5, wherein, following the tiling of the latent space, tiles with an area greater than a given threshold are invalidated and the mobility data original longitudinals classified in these tiles are deleted before the learning step (E24).

7. An anonymization method according to any one of claims 1 to 6 further comprising a step of assigning (E60) a confidence index to the synthetic data.

8. An anonymization method according to any one of claims 1 to 7 wherein said generative model is a diffusion-based model.

9. Computer program (PROG) comprising instructions for implementing an anonymization process according to any one of claims 1 to 8 when said program is executed by a computer.

10. Computer-readable recording medium on which a computer program according to claim 9 is recorded.

11. Device (1) for anonymizing longitudinal location data referred to as origin data relating to a plurality of individuals, said device comprising: a classification module (2), configured to classify, by means of an unsupervised partitioning algorithm, said longitudinal location data referred to as origin data into a plurality of clusters, all clusters having a size greater than or equal to a given threshold; a learning module (3), configured to learn from said longitudinal location data a generative model conditioned by said plurality of clusters; and a generation module (4), configured to generate synthetic data within each cluster using said generative model and taking into account a cluster distribution of the longitudinal location data referred to as origin data used to learn the generative model.

Images