<figure><img src="image_1.png" /></figure>

HAL
open science

# Investigating different perspectives on exposure in mobility datasets

Lucas Félix, Anne Josiane Kouam, Aline Carneiro Viana, Nadjib Achir, Jussara M Almeida

► To cite this version:

Lucas Félix, Anne Josiane Kouam, Aline Carneiro Viana, Nadjib Achir, Jussara M Almeida. Investigating different perspectives on exposure in mobility datasets. 2025. hal-05288503

HAL Id: hal-05288503

https://inria.hal.science/hal-05288503v1

Submitted on 29 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Investigating different perspectives on exposure in mobility datasets

Lucas Félix*† Anne Josiane Kouam* Aline Carneiro Viana*, Nadjib Achir* Jussara M. Almeida†

*Inria, France † Universidade Federal de Minas Gerais, Brazil

***Abstract***—Mobility is a fundamental aspect of human life, and mobility data offers valuable insights into user behavior. Yet, this data also exposes users to privacy risks given the unicity in their trajectories. Techniques to quantify users’ vulnerability have been proposed to address these concerns. However, these techniques often focus on the users’ spatial-temporal vulnerability and leave aside the behavioral vulnerability of the users. Thus, in this PhD, we address the problem of quantifying the user vulnerability. In this scenario, we introduce two techniques, namely, MoBES and the Hypercube. Both these techniques leverage features extracted from trajectories, modeling user behavior in a multidimensional space, to provide a comprehensive and intuitive assessment. Results show that the techniques effectively capture vulnerability within the behavioral space, identifying the uniqueness in such behavior.

***Index Terms***—mobility, privacy, vulnerability, exposure

## I. INTRODUCTION

Mobility is a fundamental aspect of human life, shaping both individual and societal well-being. Mobility also serves as a human behavioral signature, and such a signature can be modeled with related data from cell phones, GPS, and social media. By analyzing mobility patterns, we gain insights into individuals’ daily routines or preferences, such as places they visit and home/work locations. However, mobility data sharing can be both a blessing and a curse, given that it can expose individuals’ sensitive personal information (e.g., home, workplace, hospitals) or reveal personal affiliations, including political or religious beliefs. The disclosure of sensitive information poses significant privacy concerns, representing a major barrier to using and sharing mobility datasets. Previous works have shown that knowing just a few locations can uniquely reveal a user’s trajectory. For instance, [1] showed that 4 points temporally ordered are enough to identify 95% of 1.5 million users, while [2] showed that the identification risk remains high (up to 93%), even in a country-scale dataset (60 million users).

Measuring user exposure, however, is complex, as mobility patterns can be analyzed from multiple perspectives, each with the potential of revealing singular aspects that may expose users, potentially risking their privacy. A widely used exposure measuring approach is uniqueness [1], which quantifies

how distinctive a user’s mobility is based on time-ordered sequences of visited locations. While effective, uniqueness has key limitations: (i) it is computationally expensive due to the need to analyze all temporal combinations of locations in users trajectories, and (ii) it provides a narrow view of user vulnerability, focusing solely on sequential visiting patterns. Furthermore, despite being a continuous measure, uniqueness is often applied as a binary classification (vulnerable vs. non-vulnerable), limiting its ability to assess multiple levels of exposure.

Human mobility – as an expression of human behavior – is inherently multifaceted, requiring a multiple perspectives analytical approach. Prior studies have characterized mobility using diverse metrics such as radius of gyration, diversity, regularity, stationarity, and entropy [3], [4]. These metrics capture distinct aspects of mobility, revealing unique behavioral patterns beyond what uniqueness alone can detect [5]. While uniqueness extracts raw subsequences of visited locations, mobility metrics encapsulate processed insights about how individuals occupy space over time, i.e., a cheaper, yet rich in information, view of the visited locations. For example, the radius of gyration measures how confined a user’s movements are, while diversity assesses how distinct the subsequences of visited locations are. Combining multiple metrics allows for a multi-dimensional behavioral space, uncovering new forms of user exposure in mobility patterns.

Beyond uniqueness, prior work has explored mobility metrics to assess exposure. In [5], the authors use entropy [3] to quantify exposure, linking predictability to mobility. More visited places mean higher exposure. However, it focuses solely on entropy, while a multi-dimensional approach provides broader insights. [6], [7] brought a new perspective to the problem, framing it as a classification task (vulnerable vs. non-vulnerable) using supervised learning. However, to obtain the required training data (i.e., labeled users), they tie their methods to specific simulated adversarial models (that may not reflect real-world threats) and define vulnerability as the probability of re-identifying a user in a dataset [6], [7]. This simulated attack dependency limits the applicability scope of such exposure works, as they do not account for unforeseen attack methods and may not capture actual adversarial strategies and capabilities. As a result, uniqueness remains widely used despite its limitations, as it provides a more straightforward measure of exposure.

*Thus, in this PhD research, we tackle the challenge of*

<footnote>This work is part of the Mob Sci-Dat Factory project (ANR-23-PEMO-0004) under the France 2030 program. It was supported by Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq), by Fundação de Amostra à Pesquisa do Estado de Minas Gerais (FAPEMIG), by Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES), and by the CAPES-STIC-AMSUD 22-STIC-07 LINT project.</footnote>
assessing human mobility exposure by exploring the uniqueness of multi-perspective behavioral patterns, offering a more comprehensive understanding and nuanced reflection of user exposure in mobility data. We map some of the gaps left in the literature into Research Questions that guide our work:

* **RQ1:** How to quantify the exposure individual human behavior capturing the fundamental aspects that make the user exposed?

* **RQ2:** Which are the characteristics that describe the behavior of an exposed user?

* **RQ3:** How do defense techniques impact the behavior of users with different characteristics?

To address the gaps left in the literature and answer the research questions, we propose two novel, simple, dynamic, and scalable methodologies that leverage standard human mobility metrics that capture the users' circadian mobility behaviors. We name these techniques MoBES (Mobility Behavior-based user Exposure Score) and the Hypercube. Both these techniques explore a generic $|M|$-dimensional space of metrics, defined from a set of $M$ urban mobility metrics. In this space, the hypothesis of both techniques is if a user is isolated from its peers, it has a more unique (singular) behavior, hence is more vulnerable. Thus, the goal of both techniques is to quantify how isolated each of the users is. The difference between these techniques is given by how they will find these isolated users: MoBES: Identify the exposed users by measuring the distance to the k-nearest neighbors. The larger the distance, the more isolated the user. Hypercube: Identify the exposed users by counting the number of neighbors that are at most within a variation $v$ from the user behavior. The bigger the count, the more protected the user is.

Both these techniques are able to quantify the exposure (addressing **RQ1**), have a high interpretability, which allows to identify which metrics most contributed to a user being far from their neighbors (i.e., more exposed) (addressing **RQ2**). Besides that, when compared to the literature, our proposal presents a low computational cost, given that it does not explore combinations of spatial-temporal patterns (as uniqueness), but a representation of the user's trajectories given by mobility metrics. The techniques also are not dependent on labeled data, and are not tied to any specific type of threat models (as [6], [7]). We were able to publish the results of MoBES in:

* Assessing Shadows in Mobility: Beyond Spatiotemporal Patterns. Lucas Félix, Anne Josiane Kouam, Aline Carneiro Viana, Nadjib Achir, Jussara Almeida. NetMob 2024, World Bank, Oct 2024, Washington (DC), US.

* The Silent Signature: Behavior-based User Exposure in Mobility Data. Lucas Félix, Anne Josiane Kouam, Aline Carneiro Viana, Nadjib Achir, Jussara Almeida. IEEE-MDM 2025, June 2025, Irvine (CA), US.

This PhD is advised by Jussara Almeida Marques (UFMG-Brazil), Aline Carneiro Viana (INRIA-France), Anne Josiane Kouam (TU-Berlin), and Nadjib Achir (INRIA-France).

## II. EXPOSURE MEASURING TECHNIQUES

In this section, we present both of the techniques we propose in detail. Both of them share some of the same principles for the construction of the behavioral space, but fundamentally, they distinguish themselves in how they capture exposed users.

### A. Definition

Let's consider a human mobility dataset consisting of a set of users $U = \{1, 2, \dots, i, \dots, n\}$, where each user $i$ is associated with a trajectory $Tr_i$. A trajectory $Tr_i$ is represented as a sequence of spatial-temporal points $(t, l)$, where $t$ is the timestamp of an observation and $l$ denotes user $i$'s location, expressed as a longitude-latitude pair, at time $t$. Let's also consider a set $M$ of $m$ metrics that can be computed given an input user trajectory. Specifically, given $Tr_i$, we can compute $M = \{m_1^i, m_2^i, \dots, m_r^i, \dots, m_m^i\} \in \mathbb{R}^+$ where each component $m_i^i$ represents the value of metric $m_i$ for user $i$. Thus, the multidimensional space defined by set $M$ encapsulates a model of user mobility behavior as captured by the selected $m$ metrics. Specifically, the mobility signature of a user $i$ is determined by computing the set $M$ from $i$'s trajectory, which effectively positions $i$ in the defined $m$-dimensional space. In this scenario, our hypothesis is that users with distinct behavior will be isolated in the defined metric space, making them more easily distinguishable from other users in $U$ and, consequently, more vulnerable to exposure.

### B. MoBES Computation

MoBES quantifies the users' exposure by measuring the relative difference between each user in each dimension to its $k$-nearest neighbors. Specifically, the distance from user $i$ (target) to user $j$ (a neighbor) in the $m$-dimensional space defined by set $M$ of mobility metrics is calculated as:

$$D_{i,j} = \text{distance}(i, j) = \sum_{r=1}^{m} \left| \frac{m_r^i - m_r^j}{m_r^i} \right|, \quad (1)$$

where $m_r^i$ and $m_r^j$ are the values of the $r^{th}$ metric for users $i$ and $j$, respectively $(i, j \in U)$. In broad terms, this distance captures how much user $i$ would need to adjust her behavior (the average across all metrics) to "blend" with $j$. The idea is that if a user's behavior (as captured by the metrics) is very distinguishable (thus more exposed), she should make a larger adjustment to align with a nearby user. The values of $D$ are relative to the target user, being thus asymmetric.

Based on the definition of $D_{i,j}$, we establish that MoBES is the average distance captured in $D$, i.e., the average distance from user $i$ to her $k$-nearest neighbors in the $m$-dimensional space of metrics. We let $k$ be an input parameter to accommodate various notions of exposure, from stricter (smaller values of $k$) to more relaxed ones (larger values of $k$). In other words, let $NN_i^k$ be the set of the $k$ nearest neighbors of $i$, identified by using Equation 1 to compute the distances from $i$ and every other user in the dataset. $MoBES_i$ is then defined as:

$$MoBES_i = \frac{\sum_{j \in NN_i^k} D_{i,j}}{k \times |M|} \quad (2)$$
Lastly, we define the threshold $\tau$ as a lower bound on the MoBES score for a user to be considered exposed. Any user $i$ with $MoBES_i \ge \tau$ is considered exposed. We also define the set of exposed users, denoted by $MoBES^*$, as all users that meet this exposure criterion i.e., $MoBES^* = \{i, \forall i \in U$ such that $MoBES_i \ge \tau\}$. The selection of $\tau$ is context dependent: higher values imply stricter notions of exposures, as set $MoBES^*$ would include users that are more strikingly distant from their closest neighbors in the metric space.

**MoBES Interpretability:** The interpretability is done by examining the contribution of each individual metric to the overall distance of a user to her k-nearest neighbors. Specifically, for a user $i$ and a metric $m_r$, the distance between $i$ and another neighbor $j$ can be calculated solely in dimension $r$, similarly to Eq. 1. Using this, we compute $I_{i,r}$, the contribution of metric value $m_r$ to the value of $MoBES_i$ as:

$$I_{i,r} = \frac{\sum_{j \in NN_i^k} \left| \frac{m_r^i - m_r^j}{m_r^i} \right|}{\sum_{j \in NN_i^k} D_{i,j}} \quad (3)$$

This fraction quantifies the percentage contribution of the metric $m_r$ to the user's exposure score $MoBES_i$, obtaining a percentage-based interpretation of each metric's importance.

### C. Hypercube computation

The hypercube estimates the vulnerability of a target user $i$ by counting the amount of neighbors $N_i \in \mathbb{Z}_+$ inside a similarity region in this space defined by a parameter $v \in \mathbb{R}_+$. The users that are inside the similarity region exhibit very similar behavior (controlled by a maximum relative difference $v$) to $i$ with respect to the metrics in $M$. Thus, the smaller $N_i$, the more vulnerable user $i$ is. Different from MoBES, where the user is independent of the distance, the user will have $k$ neighbors; here, the user will only have neighbors if and only if the neighbors are inside the similarity region.

The similarity region of $i$ is defined as a hypercube centered at the point $(m_1^i, m_2^i, \dots, m_{|M|}^i)$ (i.e., the location of $i$ in the metric space), where the side length in dimension $r$ is given by $m_r^i \pm v \times m_r^i$. In other words, $v$ can be interpreted as a threshold for variations in user behavior (captured by each metric in $M$) and represents the maximum relative difference allowed for another user $j$ to be considered similar to $i$ concerning any given metric.

To find $N_i$, we first identify the neighbors of $i$ by considering each dimension separately. Thus, for each metric $m^r$ and each other user $j \in U$, we define the binary variable $X_{i,j}^r$ to indicate whether $j$ has a behavior very similar to $i$ with respect to metric $m^r$, that is:

$$X_{i,j}^r = \begin{cases} 1, & \text{if } m_i^r - v \times m_i^r \le m_j^r \le m_i^r + v \times m_i^r \quad \forall j \in U \\ 0, & \text{otherwise} \end{cases} \quad (4)$$

Next, we identify the users who are neighbors of $i$ considering all dimensions together, defining the variable $A_{i,j}$ as:

$$A_{i,j} = \begin{cases} 1, & \text{if } \sum_{r=0}^{|M|} X_{i,j}^r = |M| \quad \forall j \in U \\ 0, & \text{otherwise} \end{cases} \quad (5)$$

The number of neighbors of $i$, $N_i$, is defined as $N_i = \sum_{j=0}^{|U|} A_{i,j} - 1$. We subtract 1 from the sum to exclude $i$ itself from the count.

**Hypercube interpretability:** As in MoBES, in the hypercube, it is possible to identify which metric most contributed to the user exposure. In this scenario, we measure the largest distance to the closest neighbor, i.e., the maximum amount of effort, in order to have the same behavior as the nearest neighbor.

## III. PARTIAL RESULTS AND CONCLUSIONS

This section presents how the behavioral space was constructed, partial results, conclusions, and future work.

**Behavioral Metrics** We select 13 metrics widely used in the literature for characterizing mobility behavior. We group these metrics into 3 categories, namely, Spatial, Temporal and Structural. (i) Spatial metrics rely on geo-location: radius of gyration, 2 radius of gyration, maximum distance, average and std. deviation of jump lengths, number of visits, and number of distinct visits. (ii) Temporal are derived from visiting times: average and std. deviation of waiting times (time between records), and (iii) Structural: depend on time-ordered visits, relying on both spatial and temporal information: diversity, regularity, stationarity, and entropy.

**Partial Results** We evaluate both of the proposed techniques with the Shezhen CDR dataset, and our results shows that: Both techniques cannot only capture similar patterns as uniqueness [1], but the techniques can capture different patterns of exposure; MoBES and the Hypercube can capture almost 22% of users not captured by the uniqueness, i.e., users that are only vulnerable in the behavior.

**Conclusions and Future Work:** Our techniques were not proposed to replace uniqueness, but to be a complementary view of user exposure. As future work, we plan to evaluate the techniques with more datasets and evaluate the effect of defense mechanisms on the behavior captured (RQ3).

## REFERENCES

[1] Y.-A. De Montjoye, C. A. Hidalgo, M. Verleysen, and V. D. Blondel, “Unique in the crowd: The privacy bounds of human mobility,” *Scientific Reports*, vol. 3, no. 1, pp. 1–5, 2013.

[2] A. Farzanehfar, F. Houssiau, and Y.-A. de Montjoye, “The risk of re-identification remains high even in country-scale location datasets,” *Patterns*, vol. 2, no. 3, 2021.

[3] C. Song, Z. Qu, N. Blumm, and A.-L. Barabási, “Limits of predictability in human mobility,” *Science*, vol. 327, no. 5968, 2010.

[4] M. Gonzalez, C. Hidalgo, and A.-L. Barabási, “Understanding individual human mobility patterns,” *Nature*, vol. 453, no. 7196, 2008.

[5] A. Rodriguez-Carrion, D. Rebollo-Monedero, J. Forné, C. Campo, C. Garcia-Rubio, J. Parra-Arnau, and S. K. Das, “Entropy-based privacy against profiling of user mobility,” *Entropy*, vol. 17, no. 6, 2015.

[6] R. Pellungrini, L. Pappalardo, F. Pratesi, and A. Monreale, “A data mining approach to assess privacy risk in human mobility data,” *ACM Transactions on Intelligent Systems and Technology*, vol. 9, no. 3, 2017.

[7] F. Naretto, R. Pellungrini, A. Monreale, F. M. Nardini, and M. Musolesi, “Predicting and explaining privacy risk exposure in mobility data,” in *Proc. International Conference on Discovery Science*, 2020.