PWS Cup 2019 Contest Rule Ver1.4
PWS Cup Organizing Committee
September 20, 2019

1 Introduction
The notations used in this rule, the detailed information of the algorithms, and the data set are givenin the following documents.
• PWS Cup 2019 rule paper submitted to CSS2019 [1].
• PWS Cup2019 artificial data [3] that is newly-generated on the basis of the SNS-based people flow
data [2].

2 Contest rule
2.1 Overview
1. Each team is to submits designated data (anonymized trace sets in the data anonymizing phase,
inferred ID tables and inferred original trace sets in the ID disclosure & trace inference phase)
following the contest flow described in Section 2.2 of the PWS Cup 2019 rule paper [1].
2. Each team is to follow the data format and file name rules described in Section 2.4 and 2.5 in thispaper when submitting their data.
3. Each team is not to perform the prohibited actions described in Section 2.6 in this paper.

2.2 Contest flow
Refer Section 2.2 of the PWS Cup 2019 rule paper [1].

2.3 Awards
The following awards will be given in the contest. The award-winning teams will be selected after
adding corresponding scores (privacy score against ID disclosure and/or trace inference attacks) fromthe preliminary and final rounds at a ratio of 1:9.
1. Overall winner, 2nd place, and 3rd place

1

These prizes will be given to teams that protect their data well against ID disclosure and trace
inference attacks.
More specifically, the prizes will be given to the top-3 teams whose public anonymized trace setsmark the highest sI,min + sT,min , where sI,min is A′(i,1) ’s privacy score against ID disclosure
(i,1)

(i,2)

(i,1)

attack and sT,min is A′(i,2) ’s privacy score against trace inference attack. Note that invalid or(i,2)

unsubmitted public anonymized trace set will get the privacy score of 0.
2. Best data anonymizer (ID disclosure)
The prize will be given to a team whose public anonymized trace set for ID disclosure challenge(A′(i,1) ) marks the highest privacy score against ID disclosure attack (sI,min ).
(i,1)

3. Best data anonymizer (trace inference)
The prize will be given to a team whose public anonymized trace set for trace inference challenge(A′(i,2) ) marks the highest privacy score against trace inference attack (sT,min ).
(i,2)

4. Best risk assessor (ID disclosure)
The prize will be given to a team who contributes the most in lowering the privacy score against
ID disclosure attack. We will select this prize from all teams except the overall winner and thebest data anonymizer (ID disclosure).
More specifically, the prize will be given to the team who marks the lowest s∗I +where s∗I and sI

(i,j)

∑z
i=1

∑2

(i,j)
,
j=1 sIare the privacy score against ID disclosure of the pseudonymized trace set

presented by the committee (refer Section 2.3.6) and of the public anonymized trace sets submitted
by other teams (A′(i,j) ), respectively. Note that public anonymized trace sets for trace inference(i,j)

challenge are also included in the summation of sI. The privacy score is counted as 0 for all

invalid anonymized trace sets and one’s own anonymized trace sets. Thus, ID disclosure against
one’s own team is not evaluated. The privacy score is counted as 1 for all of the other teams’ valid
public anonymized trace sets that were not attacked.
[Implication] The team who attempts many ID disclosure attacks against other teams’ publicanonymized trace sets (both for ID disclosure and trace inference challenges) will have high possibility of winning this prize.
5. Best risk assessor (trace inference)
The prize will be given to a team who contributes the most in lowering the privacy score against
trace inference attack. We will select this prize from all teams except the overall winner and thebest data anonymizer (trace inference).
More specifically, the prize will be given to the team who marks the lowest s∗T +where s∗T and sT

(i,j)

∑z
i=1

∑2

(i,j)
,
j=1 sTare the privacy score against trace inference of the pseudonymized trace set

presented by the committee (refer Section 2.3.6) and of the public anonymized trace sets submitted
by other teams (A′(i,j) ), respectively. Note that public anonymized trace sets for ID disclosure(i,j)

challenge are also included in the summation of sT. The privacy score is counted as 0 for all

invalid anonymized trace sets and one’s own anonymized trace sets. Thus, trace inference against
one’s own team is not evaluated. The privacy score is counted as 1 for all of the other teams’ valid
public anonymized trace sets that were not attacked.
[Implication] The team who attempts many trace inference attacks against other teams’ pub2

lic anonymized trace sets (both for ID disclosure and trace inference challenges) will have highpossibility of winning this prize.
6. Pseudonymized trace set presented by the committee
The pseudonymized trace set is generated by the PWS Cup 2019 committee. The set is generated
from an original trace set having a user set that is diﬀerent from the ones contained in the original
trace sets distributed to participating teams. The pseudonymized trace set is generated with nolocation data processing; the committee just pseudonymizes the original trace set.
The committee will distribute this pseduonymized trace set and the corresponding reference trace
set to all teams in the ID disclosure & trace inference phase. Each team is expected to attempt ID
disclosure and trace inference attacks against the pseudonymized trace set. As already describedin the previous sections, the best risk assessor (ID disclosure/trace inference) will be selected withthe consideration of the privacy score of the pseudonymized trace sets against ID disclosure (s∗I )and trace inference (s∗T ). Note that s∗I and s∗T will be counted as 1 if no ID disclosure or trace
inference attack is made to the pseudonymized trace set.
7. Best presenter
Each team will give an oral presentation in CSS2019 venue to explain the algorithms used foranonymizing their data and for performing ID disclosure and trace inference attacks. Each teamis also expected to make a poster that summarizes the details of their algorithms.
Multiple examiners selected by the judge Q will vote for the best presenter, and the team who
receives the most votes will receive the best presenter prize.
The judge Q will later collect oral and poster presentation materials. Consult the organizing committee if your team cannot make a presentation in the venue or cannot submit their presentationmaterials for some reasons.

2.4 Data format• User ID: In this contest, we use reference trace set R(i,j) and original trace set O(i,j) covering a
set of 2000 users. A user set is diﬀerent for each team i (1 ≤ i ≤ z) and for data set j (1 ≤ j ≤ 2).
A user ID, a natural number from 1 to 2000, is assign to each user in the original trace set O(i,j) .
• Pseudo ID: A natural number from 2001 to 4000 assigned to a public anonymized trace set
A′(i,j) .
• Region ID: Tokyo metropolitan area (latitude from 35.65 to 35.75 and longitude from 139.68
to 139.8) is equally divided into 32 × 32 = 1024 regions. Region ID is assigned to each region
sequentially from lower-left to upper-right; Region ID is thus a natural number from 1 to 1024.
• Time: The time is discretized by dividing the time from 8:00 to 17:59 in 30-minute interval. In
the preliminary round, traces from the 1st and 2nd days are used for a reference trace. Traces fromthe 3rd and 4th days are used for an original trace. The length of each trace is thus t = 40 (time1 representing 8:00 of the 1st day, time 40 representing 17:30 of the 2nd day, time 41 representing

38:00 of the 3rd day, and time 80 representing 17:30 of the 2nd day). Note that we might change
the length of the reference and original traces from 2-day long in the final round.
• Reference trace set R(i,j) and original trace set O(i,j) : A csv file with user ID, time, andregion ID. The first line has a header “user id,time id,reg id.” The second line and after cover alist of user ID, time, and region ID in ascending order of (user ID, time).
For example, the original trace set in Fig. 1 is represented as follows:
user_id,time_id,reg_id
1,5,1
1,6,3
1,7,2
1,8,1
...
3,8,4
• Anonymized trace set A(i,j) : A csv file with processed region ID listed in ascending order of(user ID, time). Note that user ID and time themselves are not stored in the file. The first line
has a header “reg id.” The second line and after cover processed region ID in ascending order of(user ID, time).
The possible data processing methods are adding noise, generalizing, and deletion. The generalized
and deleted data are to be represented as a list of region IDs (space separated) and an asterisk(*), respectively.
For example, the anonymized trace set in Fig. 1 is represented as follows:
reg_id
2
3
2 4 5
*
...
1 2 3
We can see that a noise is added to user ID 1’s trace at time 5 to shift the region as x1 → x2 . The
same user’s trace is generalized at time 7 to make the region vague as x2 → {x2 , x4 , x5 }. Finally,
the same user’s trace is deleted at time 8 to hide the region x1 .
• Public anonymized trace set A′(i,j) : A csv file with pseudo ID, time, and processed region ID.
The first line has a header “pse id,time id,reg id.” The second line and after cover a list of pseudoID, time, and processed region ID in ascending order of (pseudo ID, time).
For example, the public anonymized trace set in Fig. 1 is represented as follows:
pse_id,time_id,reg_id
2001,5,*

4

2ULJLQDOWUDFHVHW , $QRQ\PL]HGWUDFH VHW ,
8VHU,' 7LPH

5HJLRQ,'

8VHU,' 7LPH

5HJLRQ,'

3XEOLFDQRQ\PL]HGWUDFH VHW ′,,'WDEOH ,

3VHXGR
5HJLRQ
7LPH,','

3VHXGR
8VHU ,'
,'

















































































































































































































Figure1 An example of data anonymizing. The generalization and deletion are shown as a listof region ID (space separated) and an asterisk (*), respectively. For example, “2 4 5” means{x2 , x4 , x5 },QIHUUHG෡ ,
RULJLQDOWUDFHVHW ࡻ,QIHUUHG ,'WDEOH ࢌ෠,
3VHXGR
8VHU,','

8VHU,' 7LPH

5HJLRQ
,'





















































































Figure2 An example of ID disclosure and trace inference results on the public anonymized trace
set A′(i,1) in Fig. 1. User and region ID in blue match exactly with the original data.

2001,6,*
2001,7,5
2001,8,5...
2003,8,*• ID table f (i,j) : A csv file with pseudo ID and user ID. The first line has a header “pse id,user id.”
The second line and after cover a list of pseudo ID and user ID in ascending order of pseudo ID.
For example, the ID table in Fig. 1 as represented as follows:5pse_id,user_id
2001,2
2002,3
2003,1• Inferred ID table fˆ(i,j) : A csv file with inferred user ID listed in ascending order of pseudo ID.
Note that pseudo ID itself is not stored in the file. The first line has a header “user id.” Thesecond line and after cover a list of inferred user ID in ascending order of pseudo ID.
For example, the inferred ID table in Fig. 1 is represented as follows:
user_id2
2
1• Inferred original trace set Ô(i,j) : A csv file with inferred region ID listed in ascending orderof (user ID, time). Note that user ID and time themselves are not stored in the file. The first line
has a header “reg id.” The second line and after cover inferred region ID in ascending order of(user ID, time).
For example, the inferred original trace set in Fig. 1 is represented as follows:
reg_id
1
1
2
4
...
1

2.5 File name
1. For all files:• A 3-digit number XXX represents a team number i (1 ≤ i ≤ z) of the team who anonymizes
the data.
• A 2-digit number YY represents a data set number j (1 ≤ j ≤ 2) which is either 01 or 02.
• A 3-digit number WWW represents a team number i′ (i′ ̸= i) who attacks the data (either
ID disclosure attack or trace inference attack).
• A flag ZZZ indicates if the data is anonymized for ID disclosure or trace inference challenge.
The flag is to be added in front of an extension (.csv). If the data set number is j = 1, add
the flag ZZZ=IDP (IDP is an abbreviation for “ID Protection”). If the data set number is
j = 2, add the flag ZZZ=TRP (TRP is an abbreviation for “Trace Protection”).

62. File name of a reference trace set R(i,j) : reftraces teamXXX dataYY ZZZ.csv
For example, the file name should be:• reftraces team012 data01 IDP.csv for the team number i = 12 and the data set number j = 1.
• reftraces team012 data02 TRP.csv for the team number i = 12 and the data set number j = 2.
3. File name of an original trace set O(i,j) : orgtraces teamXXX dataYY ZZZ.csv
For example, the file name should be:• orgtraces team012 data01 IDP.csv for the team number i = 12 and the data set number j = 1.
• orgtraces team012 data02 TRP.csv for the team number i = 12 and the data set number
j = 2.
4. File name of an anonymized trace set A(i,j) : anotraces teamXXX dataYY ZZZ.csv
For example, the file name should be:• anotraces team012 data01 IDP.csv for the team number i = 12 and the data set number j = 1.
• anotraces team012 data02 TRP.csv for the team number i = 12 and the data set number
j = 2.
5. File name of a public anonymized trace set A′(i,j) : pubtraces teamXXX dataYY ZZZ.csv
For example, the file name should be:• pubtraces team012 data01 IDP.csv for the team number i = 12 and the data set number
j = 1.
• pubtraces team012 data02 TRP.csv for the team number i = 12 and the data set number
j = 2.
6. File name of an ID table f (i,j) : ptable teamXXX dataYY ZZZ.csv
For example, the file name should be:• ptable team012 data01 IDP.csv for the team number i = 12 and the data set number j = 1.
• ptable team012 data02 TRP.csv for the team number i = 12 and the data set number j = 2.
Note that only the judge Q can view the ID table file.
7. File name of an inferred ID table fˆ(i,j) : etable teamWWW-XXX dataYY ZZZ.csv
Concatenate the team number i′ (the team who attacks the data) and the team number i (theteam whose data is being attacked) with a hyphen. For example, the file name should be:• etable team020-012 data01 IDP.csv if the team number i′ = 20 performs ID disclosure attack
against the team number i = 12’s public anonymized trace set (data set number j = 1).
• etable team020-012 data02 TRP.csv if the team number i′ = 20 performs ID disclosure attack
against the team number i = 12’s public anonymized trace set (data set number j = 2).
8. File name of an inferred original trace set Ô(i,j) : etraces teamWWW-XXX dataYY ZZZ.csv
Concatenate the team number i′ (the team who attacks the data) and the team number i (theteam whose data is being attacked) with a hyphen. For example, the file name should be:• etraces team020-012 data01 IDP.csv if the team number i′ = 20 performs trace inference
attack against the team number i = 12’s public anonymized trace set (data set number j = 1).
• etraces team020-012 data02 TRP.csv if the team number i′ = 20 performs trace inference
attack against the team number i = 12’s public anonymized trace set (data set number j = 2).

7

2.6 Prohibited actions
2.6.1 Prohibited actions in data anonymizing phase
A team could be disqualified if they violate the following prohibitions.
1. A team submits more data than the specified limit number.
2. A team submits data that do not follow the specified format.
3. A team colludes with other teams. Note that sharing programs, modules and algorithms among
teams are allows as long as the information disclosed only to the team is not inferred by otherteams.

2.6.2 Prohibited actions in ID disclosure and trace inference phase
A team could be disqualified if they violate the following prohibitions.
1. A team submits data that do not follow the specified format.
2. A team colludes with other teams. Note that sharing programs, modules and algorithms among
teams are allows as long as the information disclosed only to the team is not inferred by otherteams.
3. A team submits more than two inferred ID tables for a public anonymized trace set (i.e., attempting
more than two ID disclosure attacks on the same public anonymized trace set).
4. A team submits more than two inferred original trace sets for a public anonymized trace set (i.e.,
attempting more than two trace inference attacks on the same public anonymized trace set).

2.6.3 Prohibited actions for organizing committee members
1. A committee member colludes with teams (i.e., leaking information that is obtained using theprivilege of the organizing committee).
2. A committee member hides any information while knowing that the information will be advantageous to teams.
3. A committee member leverages their privilege during the data submission period when he participates the contest as one of competitors (e.g., using the knowledge obtained using the organizing
committee privileges when anonymizing data and when executing ID disclosure and trace inference
attacks).

2.7 Open information
The judge makes the following information available to all teams.

82.7.1 Sample programs
Sample programs for anonymizing data, executing ID disclosure attack, and executing trace inference
attack are available. Refer the documentation [4] for the details.
2.7.2 Utility assessment programThis program takes an original trace set O(i,j) and an anonymized trace set A(i,j) as an input. The(i,j)

program gives the utility score sU

as an output.

2.7.3 Privacy score (against ID disclosure attack) assessment programThis program takes an ID table f (i,j) and an inferred ID table fˆ(i,j) as an input. The program gives(i,j)

the privacy score against ID disclosure attack sI

as an output.

2.7.4 Privacy score (against trace inference attack) assessment programThis program takes an original trace set O(i,j) and an inferred original trace set Ô(i,j) as an input.
(i,j)

The program gives the privacy score against trace inference attack sT

as an output.

2.7.5 Region assignment file
This file describes the information on each region (region ID, ID in a y-axis (latitude), ID in a x-axis(longitude), a latitude of the center of the region, a longitude of the center of the region, if the region isa hospital region (1: yes, 0: no)).
The content of the file is as follows (the first line is a header):reg_id,y_id,x_id,y(center),x(center),hospital
1,1,1,34.6415625,135.441875,02,1,2,34.6415625,135.445625,1
3,1,3,34.6415625,135.449375,0
4,1,4,34.6415625,135.453125,0...
1024,32,32,34.7384375,135.558125,0

2.7.6 Time assignment file
This file describes the information on each time (if the time belongs to a reference trace set (ref) or
an original trace set (org), time (a natural number), day, hour, minute).
The content of the file is as follows (the first line is a header):ref/org,time_id,day,hour,min
ref,1,1,8,0
ref,2,1,8,30
ref,3,1,9,0

9

ref,4,1,9,30...
org,80,4,17,30

2.7.7 PWSCup2019 artificial data (Osaka data set)This data is generated on the basis of the the SNS-based people flow data [2]. Just like the Tokyo
data set used in the contest, Osaka metropolitan area (latitude from 34.64 to 34.74 and longitude from
135.44 to 135.56) in the SNS-based people flow data is divide equally into 32 × 32 regions and used aslearning data to formulate a Markov model-based trace generator. The trace generator is then used tocreate reference trace sets R(i,j) and original trace sets O(i,j) for two teams (i.e., 1 ≤ i ≤ 2, 1 ≤ j ≤ 2).
These trace sets are made open to all teams so that team members can understand how the reference
and original trace sets look like.
We also conduct several experiments using this data set with sample programs. Refer the documentation [4] for more details.
2.7.8 PWSCup2019 artificial data (Tokyo data set)
Reference and original trace sets for two “imaginary” teams are made open to all teams during thedata anonymizing phase so that a team can compare their trace sets with the sets distributed to otherteams. User sets in these trace sets are diﬀerent from the ones contained in the data sets distributed toparticipating teams.
In other words, we will create and publish reference trace sets R(i,j) and original trace sets O(i,j) forteam z + 1 and z + 2 (i.e., z + 1 ≤ i ≤ z + 2, 1 ≤ j ≤ 2) where z is the number of teams participating in
the contest.

2.8 Preliminary round
The following rules apply to the preliminary round.
1. The requirement value for the utility score is set as follows: sreq = 0.7.
2. After the preliminary round, we will fully disclose original trace sets, anonymized trace sets, ID
tables, and all inferred ID tables submitted by all teams.

2.9 Additional rules in the final round
The following rules might be added in the final round of the contest, after the preliminary round isfinished. If we decide to add them, we will make an announcement to all teams before we start the final
round.
1. The requirement value sreq of the utility score could be changed from the one of the preliminary
round.

10

2. The length of reference and original trace sets could be changed from the ones of the preliminary
round (i.e., 2-day long for each trace sets).
[Decision]: We decided the additional rules in the final round as follows:
1. The requirement value is: sreq = 0.7.
2. The length of reference and original trace sets is: 20-day long for each trace set.
Note that these reference and original trace sets are not composed of the traces taken in consecutive days
(e.g., five weekdays followed by Saturday and Sunday). Instead, the trace sets are sampled sporadically.

References[1] Takao Murakami, Hiromi Arai, Makoto Iguchi, Hidenobu Oguri, Hiroaki Kikuchi, Atsushi Kuromasa,
Hiroshi Nakagawa, Yuichi Nakamura, Kenshiro Nishiyama, Ryo Nojima, Takuma Hatano, Koki
Hamada, Yuji Yamaoka, Takayasu Yamaguchi, Akira Yamada, Chiemi Watanabe, “PWS Cup 2019:
Location Data Anonymization Competition,” CSS2019.
[2] Nightley and Center for Spatial Information Science (CSIS), SNS-based People Flow Data, [online]
Available: http://nightley.jp/archives/1954.
[3] PWS Cup 2019 Data Set: https://www.iwsec.org/pws/2019/cup19-dataset-e.pdf[4] PWS Cup 2019 Sample Program: https://www.iwsec.org/pws/2019/cup19-sample-e.pdf

11