Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy

• URL: http://arxiv.org/abs/2606.03711v1
• Date: Tue, 02 Jun 2026 14:31:14 GMT
• Title: Ghost: Plausible Yet Unlearnable Trajectories via On-Manifold Substitution for Next-POI Privacy
• Abstract summary: A publisher who releases check-in trajectories inadvertently publishes a strong predictor of every user's future locations.<n>We address this risk by generating unlearnable trajectories, perturbed sequences that yield victim models with degraded next-Point-of-Interest (next-POI) accuracy on clean test inputs.<n>We propose Ghost, a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind.
• Score: 34.07056031726073
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A publisher who releases check-in trajectories inadvertently publishes a strong predictor of every user's future locations. We address this risk by generating unlearnable trajectories, perturbed sequences that yield victim models with degraded next-Point-of-Interest (next-POI) accuracy on clean test inputs. Direct ports of image-domain unlearnable examples fail on two counts. The published data must remain geographically and semantically plausible, and the perturbation must resist purification adversaries that exploit the structure of randomized defences. We propose Ghost, a manifold-aligned framework whose perturbations look like plausible human check-in sequences yet leave no learnable signal behind. Ghost steers each substitution onto the real-trajectory manifold through a frozen trajectory language model, so a denoising-bridge adversary has nothing to invert and a context-free frequency-table adversary recovers a near-uniform distribution. Across two standard benchmarks, and four attacker postures, Ghost achieves protection-gap competitive with the strongest deterministic baseline (PGD) while attaining the lowest restored accuracy under the bigram adaptive purification adversary on both datasets, and lies within one per-cell standard deviation of PGD on the protection-versus-purification-resistance plane. Ablations confirm the manifold prior subsumes the entropy-floor knob of prior randomized defences, with the frequency-table adversary's survival gap remaining within 0.04 even when twenty percent of the pairs are leaked.

Related papers

• The Knowing-Saying Gap: When Probes See Errors that Confidence Misses [20.46211358172975]
  Linear probes detect corrupted context in language models with near-perfect accuracy, yet this does not translate into reliable failure prediction.<n>Across multi-hop arithmetic chains, probes that detect corruption turn out to be uninformative about final answer correctness.<n>As a real-time monitor, probe-based interventions are sharply model and error-type dependent.
  arXiv  Detail & Related papers  (2026-07-21T12:13:10Z)
• A Step Towards Robust Unsupervised Domain Adaptation via Fine-Tuning and Reinforcement Learning [2.436631469537453]
  We propose textbfSFT+RL, a two-stage robust UDA framework that integratesSupervised Fine Tuning and Reinforcement Learning.<n>textbfSFT+RL achieves average improvements of textbf10.2% in clean accuracy and textbf15.8% in adversarial robustness across three datasets.
  arXiv  Detail & Related papers  (2026-07-03T20:56:12Z)
• FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement [3.3664896840786525]
  Federated Learning remains highly susceptible to backdoor attacks.<n>Existing defenses suffer from substantial false-positive rates under realistic non-independent and identically distributed (non-IID) data.<n>We present FedSurrogate, a novel backdoor defense that addresses this limitation by combining bidirectional gradient filtering with layer-adaptive anomaly detection.
  arXiv  Detail & Related papers  (2026-05-11T18:30:32Z)
• Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions [27.15028670439718]
  We present Sparse Backdoor, a supply-chain attack that plants a emphprovably undetectable backdoor in pre-trained image classifiers.<n>The attack injects a structured perturbation along a randomly chosen direction into a small subset of columns at each fully connected layer.<n>It propagates a trigger signal to an adversary-chosen target class, and masks the perturbation with an independent isotropic dither.
  arXiv  Detail & Related papers  (2026-05-05T18:48:09Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning [5.725082598014574]
  Retrieval-Augmented Generation (RAG) improves reliability of large language model applications by grounding generation in retrieved evidence.<n>An adversary injects or edits passages so that they are ranked into the Top-$K$ results for target queries and then affect downstream generation.<n>We propose ProGRank, a post hoc, training-free retriever-side defence for dense-retriever RAG.
  arXiv  Detail & Related papers  (2026-03-24T08:29:15Z)
• Benchmarking Corruption Robustness of LVLMs: A Discriminative Benchmark and Robustness Alignment Metric [49.393713730706445]
  We introduce Bench-C, a benchmark emphasizing discriminative samples for assessing corruption robustness.<n>We propose the Robustness Alignment Score (RAS), a unified metric that measures degradation in logit-level prediction structure.
  arXiv  Detail & Related papers  (2025-11-24T12:07:56Z)
• BURN: Backdoor Unlearning via Adversarial Boundary Analysis [73.14147934175604]
  Backdoor unlearning aims to remove backdoor-related information while preserving the model's original functionality.<n>We propose Backdoor Unlearning via adversaRial bouNdary analysis (BURN), a novel defense framework that integrates false correlation decoupling, progressive data refinement, and model purification.
  arXiv  Detail & Related papers  (2025-07-14T17:13:06Z)
• BadHMP: Backdoor Attack against Human Motion Prediction [11.271295378687887]
  We propose BadHMP, a novel backdoor attack that targets specifically human motion prediction tasks.<n>Our approach involves generating poisoned training samples by embedding a localized backdoor trigger in one limb of the skeleton.<n>Future sequences are globally modified that all the joints move following the target trajectories.
  arXiv  Detail & Related papers  (2024-09-29T09:55:31Z)
• Improving Adversarial Robustness to Sensitivity and Invariance Attacks with Deep Metric Learning [80.21709045433096]
  A standard method in adversarial robustness assumes a framework to defend against samples crafted by minimally perturbing a sample. We use metric learning to frame adversarial regularization as an optimal transport problem. Our preliminary results indicate that regularizing over invariant perturbations in our framework improves both invariant and sensitivity defense.
  arXiv  Detail & Related papers  (2022-11-04T13:54:02Z)
• Unsupervised Robust Domain Adaptation without Source Data [75.85602424699447]
  We study the problem of robust domain adaptation in the context of unavailable target labels and source data. We show a consistent performance improvement of over $10%$ in accuracy against the tested baselines on four benchmark datasets.
  arXiv  Detail & Related papers  (2021-03-26T16:42:28Z)
• Class-Conditional Defense GAN Against End-to-End Speech Attacks [82.21746840893658]
  We propose a novel approach against end-to-end adversarial attacks developed to fool advanced speech-to-text systems such as DeepSpeech and Lingvo. Unlike conventional defense approaches, the proposed approach does not directly employ low-level transformations such as autoencoding a given input signal. Our defense-GAN considerably outperforms conventional defense algorithms in terms of word error rate and sentence level recognition accuracy.
  arXiv  Detail & Related papers  (2020-10-22T00:02:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.