PateGAIL++: Utility Optimized Private Trajectory Generation with Imitation Learning
Authors: Yingjie Ma
Bijal Bharadva
Xin Zhang
Joann Qiongna Chen
Venue: ICLR 2026 Oral (2026)
Keywords: Differential Privacy
Imitation Learning
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Human mobility trajectory data supports a wide range of applications, including urban planning, intelligent transportation systems, and public safety monitoring. However, large-scale, high-quality mobility datasets are difficult to obtain due to privacy concerns. Raw trajectory data may reveal sensitive user information, such as home addresses, routines, or social relationships, making it crucial to develop privacy-preserving alternatives.
Recent advances in deep generative modeling have enabled synthetic trajectory generation, but existing methods either lack formal privacy guarantees or suffer from reduced utility and scalability. Differential Privacy (DP) has emerged as a rigorous framework for data protection, and recent efforts such as PATE-GAN and \textsc{PateGail} integrate DP with generative adversarial learning. While promising, these methods struggle to generalize across diverse trajectory patterns and often incur significant utility degradation.
In this work, we propose a new framework that builds on \textsc{PateGail\texttt{++}} by introducing a \emph{sensitivity-aware noise injection module} that dynamically adjusts privacy noise based on sample-level sensitivity. This design significantly improves trajectory fidelity, downstream task performance, and scalability under strong privacy guarantees. We further adapt our framework to the local differential privacy (LDP) setting, allowing individual-level protection without reliance on a trusted server. We evaluate our method on a real-world mobility dataset and demonstrate its superiority over state-of-the-art baselines in terms of privacy-utility trade-off.

Published as a conference paper at ICLR 2026
PATEGAIL++: UTILITY OPTIMIZED PRIVATE TRAJEC- TORY GENERATION WITH IMITATION LEARNING
Yingjie Ma, Bijal Bharadva, Xin Zhang & Joann Qiongna Chen
Department of Computer Science San Diego State University San Diego, CA 92182, USA
{yma 6999, bbharadva1752, xzhang19, jchen27) sdsu. edu
ABSTRACT
Human mobility trajectory data supports wide range of applications, including urban planning, intelligent transportation systems, and public safety monitoring. However, large-scale, high-quality mobility datasets are difficult to obtain due to privacy concerns. Raw trajectory data may reveal sensitive user information, such as home addresses, routines, social relationships, making it crucial de- alternatives. Recent advances in deep generative model-
velop srivacy-preservve ing have enabled synthetic trajectory generation, but existing methods either lack formal privacy guarantees or suffer from reduced utility and scalability. Differ- ential Privacy (DP) has emerged as a rigorous framework for data protection, and recent efforts such as PATE-GAN and PATEGAIL integrate DP with generative ad- versarial learning. While promising, these methods struggle generalize across diverse trajectory patterns and often incur significant utility degradation. In this work, we propose a new framework that builds on PATEGAIL++ by introducing a sensitivity-awwre noise injection module that dynamically adjusts privacy noise based on sample-level sensitivity. This design significantly improves trajectory fidelity, downstream task performance, and scalability under strong privacy guar- antees. We further adapt our framework to the local differential privacy (LDP) setting, allowing individual-level protection without reliance We evaluate our method on a real-world mobility dataset and demonstrate its su- periority over state-of -ott---rr-tttt baselines in terms of privacy-utility trade-off.
trusted server.
INTRODUCTION
Human mobility data supports wide range of critical ap- plications, including urban planning (Ruan al. (2020). intelligent transportation systems (Ma et al. (2013). hu-
mobility analysis (Liang et al.] 2021 Wang al. 2021]. and public safety monitoring (Gao et al. 2017).
However, obtaining high-quality, large-scale mobility datasets remains challenging due to serious privacy con- cerns. Raw trajectory records can expose sensitive per- sonal information, such as home addresses. daily rou- tines, or social relationships, that may be exploited for malicious purposes if not properly protected.
User trajectories Other user trajectories Sensitive segments
Trajectory segments that strongly reflect user-specific behaviors pose higher privacy risks than those that resemble common or overlapping ones.
Figure 1:
Recent advances (Wang et al.) 2023b a Roman Zhhng et al.) 2025; Ma et al.; 2024 Fan et al.
2025
2024 Bouabba et al. 2024 Netzler Lienkamp 2024 Narayanan et al. 2024) in deep generative modeling have
motivated the use of synthetic trajectory generation as a prevecypressrving alternative. While promising. many existing methods either lack formal privacy guarantees (Kim & Jang 2022 Rao et al.) 2020) or incur significant utility degradation and computational overhead (Du et al. 2023
Rao al. 2020), limiting their practical applicability.

---

Published as a conference paper at ICLR 2026
Differential Privacy (DP) has emerged as the gold standard for provable privacy protection (Dwork et al. 2006), and has been increasingly applied in data publishing (Asghar et al. 2020) and syn- thetic data generation (Jordon et al. 2018). One notable effort is PATE-GAN (Jordon et al. 2018), which combines generative adversarial networks with the Private Aggregation of Teacher Ensem- bles (PATE) (Papernot et al. al.] (017) framework to generate differentially private synthetic data. While promising, its utility remains limited, especially in complex spatial-temporal domains like mobil- ity trajectories. On the other hand, PATEGAIL (Wang al.. 2023b) adapts DP mechanisms the imitation learning setting, leveraging Generative Adversarial Imitation Learning (GAIL) (Ho & Er- mon 2016) while incorporating differential privacy into policy training. While PATEGAIL provides promising direction for behavior modeling under DP, it suffers from reduced performance and challenges in generalizing to diverse trajectory patterns real-world settings.
Limitation of State-of-the-Art. A critical limitation of current DP-based trajectory generation methods lies in their uniform treatment of all data points when applying privacy noise. These ap- proaches typically inject the same amount of noise across all samples, regardless of their semantic or statistical sensitivity. However, not all trajectories pose the same privacy risk-some may contain highly identifying patterns, while others are inherently less sensitive. As shown in Fig. trajectory segments that are behaviorally unique are more sensitive than those that overlap with many users' trajectories. Applying identical noise levels can therefore lead to unnecessary utility loss for low- risk samples and insufficient protection for highly sensitive ones. This rigid noise assignment limits scalability and weakens the overall privacy-utility trade-off.
Our Approach. We propose PATEGAIL++, a new differentially private imitation learning frame- work for trajectory generation. Our design introduces sensitivity-aware noise injection module that dynamically adjusts noise levels according to the sensitivity of trajectory samples, offering stronger protection for high-risk segments while reducing unnecessary distortion in low-risk cases. We further extend this framework to the local differential privacy (LDP) setting, ensuring user-level protection without reliance on a trusted server. To stabilize training under adaptive noise, PATE- +aloo incorporates Wasserstein GAN with Gradient Penalty (WGAN-GP) (Gulrajani et al.) 2017a), which mitigates instability in discrete trajectory learning and accelerates policy conver- gence. Our key contributions are as follows:
We design a differentially private generative model tailored for mobility trajectory data that better balances privacy and utility.
We introduce novel framework PATEGAIL +with a customizable sensitivity module that en- hances trajectory realism while maintaining strict privacy guarantee.
We extend our framework to the local differential privacy setting, allowing individual privacy protection without reliance trusted server.
We conduct extensive experiments on a real-world dataset, demonstrating superior performance over existing baselines in privacy and utility trade-off.
2
PRELIMINARIES
2.1 HUMAN MOBILITY DECISION-MAKING
We consider a scenario with multiple users, each equipped with personal mobile device that locally stores their historical mobility trajectories. These trajectories consist of sequential eeciiionnmmainng records that capture human movement behaviors, such as daily commuting or shopping. Formally, for each user u E U, the trajectory is represented as Tи {(1,44) 41), ....... (IN. (x }} where I; and 4; denote the location and timestamp at step i, respectively. These sequences are the result of the user's latent makiing strategy (i.e., policy) under spatial-temporal constraints.
Each trajectory describes a user's traversal through a sequence of spatial-temporal states, guided by corresponding sequence of decisions (i.e., actions). We define the state 8, user's mobility history up to time f, i.e., 8; = {(T,, t-)rrs,, and the action an action space is defined based on the widely-adopted exploration and preferential return (EPR) model (Song et al. 2010 Jiang al.) 2016). Core to this modeling framework are two functions, i.e., policy and reward, that govern decision-making and need to be learned from trajectory data:
2

---

Published as a conference paper at ICLR 2026
Definition 1: Policy function [a]ss defines the probability of choosing action given the current state S. This function governs how user makes decisions at different situations.
Definition 2: Reward function R(s, a) quantifies the implicit benefit desirability of taking action a at state s. This function explains the preferences that guide the user's behavior.
Human users adapting policies for higher total reward in decision maaiii.nnmmaing...... Both the policy and reward functions are unobserved and need to be inferred from the user trajectories.
2.2 HUMAN STRATEGY LEARNING VIA IMITATION LEARNING
Generative Adversarial Imitation Learning (GAIL) (Ho & Ermon 2016) an imitation learning method that jointly learns the reward function and policy from expert demonstrations. It frames imitation as a minimax optimization problem, i.e.,
min max ((,,a)=a (log Dø(s, a)] + E( [I D)(s,a))), x9
D3
where TE denotes the expert (real) policy, and (o a) is a discriminator trained to distinguish expert from generated behavior. The learned policy πа is trained using reinforcement learning to maximize expected rewards derived from the discriminator's output. The learned policy my is opti- mized to fool the discriminator, effectively mimicking expert trajectories.
2.3 DIFFERENTIAL PRIVACY IN DECISION- MAKKIN
Differential Privacy (DP) (Dwork et al. 2006) is a formal framework for quantifying privacy guar- antees. Let D and D' two neighboring datasets that differ in a single record. A randomized algorithm M satisfies (s, diffferrent privacy if, for all such neighboring datasets D, D' and for all measurable subsets E of the output space,
PDM(D) E) S e P(M(D') E] +
To ensure DP, noise is typically added using the Laplace mechanism:
2A cxp (-1x) | (Lx))
1
Lap(> A)
(3)
where À is calibrated based on the global sensitivity and the privacy budget e. The privacy budget controls how much information about a user's data can leak; smaller & means stronger privacy. Beyond noise addition, several fundamental properties of DP are critical when applying it to learning algorithms. Specifically:
Sequential Composition. The sequential composition states that combining multiple subroutines that satisfy DP for (11, (E2, 82), results in mechanism that satisfies (e, 0DP for Σe; and 8..
Post post-processing. Given (s, dDD algorithm M, releasing g(M(D)) for any g still satisfies (s, dD. That is, post-processing an output of differentially private algorithm does not incur any additional loss of privacy.
Zero-Concentratedd Differential Privacy. While (c, DDP is the standard definition, Zero- Concentrated Differential Privacy (p-zCDP) (Dwork & Rothblum 2016 Azize & Basu 2024 pro- vides a more refined privacy accounting framework. Its tighter composition guarantees make particularly well-suited for iterative algorithms.
2.4 PROBLEM DEFINITION
Differentially Private Trajectory Generation Problem. Given set of users 2/ with private mobility trajectories [Twhe the goal is to learn global trajectory generation policy =(ass) such that: 1). The generated synthetic trajectories are urility-preserving. i.e., they statistically resemble the real trajectories and support downstream applications such as prediction and recommendation. 2). The learning algorithm satisfies (e. -)ddifferential privacy, meaning the presence or absence any individual user's trajectory does significantly affect the output.
3

---

Published as a conference paper at ICLR 2026
Query Traj, i.c. (s,
Server
Trnjeh
User D
Discriminator
Response (s,
Systhetic Trajehs
1 R(s.a) ( (s.
45
Pric Trsje'
Lap (s,a)
User
Discriminator
Response (i a)
Syrthetic Tnyet
R(s,a) = R(s,)) - ())
Pdy Trijht
User N
Discriminator N
Response (s,
Synthetic Tr
R a)
Synthetic Trajs
Global policy
Figure 2: PATEGAIL+ framework.
Challenges. The proposed differentially private trajectory generation problem presents three key challenges: (C1) How can privacy budgets be allocated to reflect varying data sensitivity and ensure good model utility? (C2) How can we provide formal privacy guarantees under non-uniform noise, given that adaptive noise scaling complicates standard DP analysis? (C3) How can policy learning remain stable under adaptive noise injection in the federated learning setting?
Federated Learning Setting. In this work we adopt a federated data-access model following Wang al. (2023b). Human mobility trajectories are sensitive, e.g. GPS traces can reveal home and work locations, daily routines, and social patterns, and are often subject to legal or institutional restrictions that prohibit centralizing raw data. Federated learning thus provides an appropriate deployment framework: each user retains their trajectory data locally. and only differentially private reward signals are shared with the server. Our work focuses on improving utility-privacy trade- off within this practically constrained federated setting.
3 METHOD
In this section, we address the differentially private trajectory generation problem by introducing the PATEGAIL++ framework shown in Fig- 2 In this framework, each user device locally trains discriminator on its private mobility data to evaluate the plausibility of synthetic trajectories, while the global policy is trained the server using aggregated, differentially private reward signals derived from local discriminator outputs.
Three important components are proposed in PATEGAIL++: First, we introduce a sensitivity-aware module that identifies the privacy sensitivity levels of user trajectories in the training data, thereby addressing Challenge C1 (see 3.1 Second, we provide a formal theoretical guarantee for (c, 5)- differential privacy, thereby addressing Challenge C2 (see Sec(322). Finally, to tackle Challenge C3, we design a reward function ensemble strategy that stabilizes policy learning under adaptively injected noise (see Sec 3.3
3.1 SENSITIVITY- DRIVEN PRIVACY BUDGET ASSIGNMENT
In this framework, each user u E maintains a local discriminator De,, trained to distinguish real from generated trajectories on-device. For each state-action pair (s, a), the local reward estimate is R(")(s, a) = D&. (s, a), and the server aggregates these signals via Laplace mechanism,
R(s a)
Σ Do. (s, a) Lap(O,
(4)
NEll
Here, the server all sample-wise rewards, and the Lap(0, A) ensures differential privacy for global policy updates.
To account for reward variability across users, PATEGAIL introduces reward dynamics compensa- tion term based on the variance of local rewards.
i((s, a) R(s, a) - 3 [(s, a), where E(s,a) / Var(D (s, a)) + Lap(O, Ae).
(5)
This adjustment allows the global policy {(a)s) to maximize a users' expected cumulative rewards, while satisfying (e, dddfffernnnt privacy.
high- probbbbbbbbbytyy lower bound of the

---

Published as a conference paper at ICLR 2026
Despite these contributions, PATEGAIL has important limitations. First, it applies uniform privacy budget across all iterations, regardless of individual as well as iteration- -wie sensitivity. This neglects sppeciffr--spcciiicc privacy risks, potentially overprotecting benign data while underprotect- ing highly sensitive samples. Second, the added noise not calibrated to local context or trajectory variability. As result, the policy may suffer from degraded utility or lack robustness across hetero- geneous mobility behaviors. These limitations motivate the need for a more fine- aieeggrined approach that is able identify trajectory-level data sensitivity and adjust privacy budget accordingly.
Trajectory Sensitivity Module. To improve the privacy-utility trade-off in federated imitation learning we introduce a trajectory sensitivity module that dynamically calibrates the amount of noise injected into the reward aggregation process based on the privacy sensitivity of samples each iteration. This mechanism to enable fine-grained differential privacy guarantees. We also extend this to individual-level differential privacy guarantees later.
We estimate the privacy sensitivity of each state-action pair (s, based on the output of lo- cal discriminators De... Intuitively, Da. (8, a) x 1, it indicates that the generated sample is highly indistinguishable from real user tra- jectories. Such samples are more likely to resemble unique or rare behaviors, making them more vulnerable to inference attacks. Therefore, they considered more privacy-sensitive and require stronger protection.
discriminator De., assigns a high reward (s, a)
To reflect this, we define the privacy sensitivity of sample inversely with respect to its confidence margin from 1, i.e.,
Sensitivity(s. a) &
1 R[ss a) 8
where 8' > 0 is small constant to avoid division by zero. Based on this sensitivity score, we allocate a per-sample privacy budget e(s, a) such that:
E E. w(s
s(8, a) = Eegaaee vo(6"aa)) where w(s,a) = - Rp(s,
To avoid potential information leakage when adaptively allocating privacy budgets, the (s, a) above is differentially private pilot estimate of R(ss, a). This ensures that samples with higher discriminator confidence (i.e., more sensitive) receive a smaller share of the privacy budget, leading stronger noise injection. The total privacy expenditure constrained by:
Σ (S
E(s, =E,
where 'D is the set of all state-action pairs queried during training.
This sensitivity-awarr allocation enables stronger protection for high-risk samples while reducing unnecessary noise for low-risk ones, improving both privacy and utility under fixed global budget.
Interprefation of Sensitivity. Our sensitivity module reflects how closely generated state-action resembles behavioral patterns that are distinctive to individual user. When user's local discrim- inator D&., assigns a high score, indicates that the generated sample highly similar to that user's real behavior. We therefore treat such samples high-sensitivity and add stronger noise, preventing the server from learning or exploiting user-specific behavioral signatures. This design also preserves DP guarantees: incorporating external semantic cues (e.g., location types home-work labels) into the sensitivity calculation would depend on non- con-private information and violate the DP account- ing assumption. By basing sensitivity solely on internal model signals, formulation maintains end-to-end DP protection.
3.2 SENSITIVITY-WAARR REWARD AGGREGATION
For each state-action pair (s, a), each user u computes local reward (())s,))) Do. The server aggregates these using sensitivity-aware Laplace mechanism:
1 N Σ R R a) + Lap
AF
R(s
(6)
E(S.a)
5

---

Published as a conference paper at ICLR 2026
where Af equals À in Eq. (4 if the total privacy distributed evenly per sample (s.a). =(s.a]
To account for reward variability across users, adopt the dynamics compensation mechanism introduced in PATEGAIL.
R(s,a) = R(s, -.(
Af
where {(s,a) - (s) Lap (, e(s, a)
Policy Optimization. The final perturbed reward R(s, a) used to update the global policy xa using any standard policy optimization method, such as Proximal Policy Optimization (PPO). The process repeats over multiple rounds of federated communication until convergence.
Extending to LDP. While our current framework enables fine-grained privacy control at the sample level with strong theoretical guarantees, it assumes a trustworthy server that can access raw rewards. To relax this assumption, we extend framework to the local differential privacy (LDP) setting, where each user perturbs their own rewards before transmitting them to the server. In this way, the server never observes raw rewards from users (i.e., the outputs of individual discriminators). We further introduce per-user privacy budget e(*) (s, a), such that these budgets across users aggregate to the per-sample budget e(8, a). The aggregated reward is then computed as:
Af
R(s, a) NN- ==1
Σ
(s, + Lap
(s,)( a)
To allocate per-user budgets, we define:
(8, ( = E(s.a) w(l) (s. where (s, = =1- (x)
E w(() (s,
Note that the weights be calculated and shared using homomorphic encryption among users to protect individual privacy.
Das 2018
This design enables fine-grained privacy control at both the sample and individual-user levels, while preserving strong theoretical guarantees. As a result, our method improves utility in generated trajectories and downstream tasks, and broadens the applicability of the framework under more practical privacy assumptions.
3.3 WGAN-GP FOR STABLE POLICY LEARNING
The original PATEGAIL employs a cross-entropy-basee discriminator, which often produces van- ishing gradients and unstable updates when applied to discrete trajectory data. These issues are further amplified under DP-induced perturbations. To stabilize training, PATEGAIL++ adopts a Wasserstein GAN with Gradient Penalty (Gulrajani al. 20176), which minimizes the Wasserstein- distance between expert and generated distributions:
min max ((,,)~=T [Da(s, a)] B(,,))= [Do(s, AGP E, (()2 1) "6 Do
(9)
where & denotes samples interpolated between expert and generated state-action pairs, and Agr
controls the penalty strength.
Following the central reward design in Sec. 3.2 the critic output of each local discriminator is di- rectly treated the per-user reward, i.e., ((") a) (au) as) These local rewards are then ag-
gregated into A(s, a) through the sensitivity-awarc Laplace mechanism. Compared to the log- log-based reward GAIL, the Wasserstein critic provides smoother gradients and avoids reward saturation, leading to more stable aggregation and policy updates under adaptive noise injection.
We further apply spectral normalization as an optional regularizer to enforce Lipschitz continuity alongside the gradient penalty. This combination enhances the robustness of local discriminators, improves the fidelity of aggregated rewards, and ultimately accelerates policy convergence in PATE- GAIL++.

---

Published as a conference paper at ICLR 2026
3.4 PRIVACY RISKS ANALYSIS
Following PATEGAIL (Wang et al. 2023b), we measure the privacy risks in PATEGAIL++ using white-box membership inference attack (MIA), where the attack has full access to the target model. Specifically, let Ta denote the set of trajectories selected as attack targets. For each T, Ta, the adversary extracts the reward corresponding to every state-action pair (8, a) and constructs a feature vector By from these values. This feature vector vy serves input to Random Forest classifier, whose objective is to determine whether To originates from the training set of the trajectory gener- ation model. To train the classifier, an 70% of trajectories are drawn from the training set and 30% from outside the training set are used as positive and negative instances, respectively.
4 EVALUATION
Dataset. We evaluate PATEGAIL++ on two datasets: the processed Geolife dataset (Wang et al. 2023b) and the Telecom Shanghai dataset (Li et al. [022 Guo et al. 2020 Wang et al. 2019)) The Geolife dataset was previously used in PATEGAIL, and contains mobility trajectories of 83 users collected between April 2007 and October 2011. The Telecom Shanghai dataset contains more than 7.2 million records of accessing the Interent through 3,233 base stations from 9,481 mobile phones for six months. For both datasets, each record is obtained from GPS logs on users' mobile phones and includes latitude, longitude, and timestamp information.
Implementation We implemented PATEGAIL+ + in Python 3.10 using PyTorch 2.1 with CUDA support, and conducted all experiments on an NVIDIA A100 GPU with 256 GB RAM. Training is based on Proximal Policy Optimization (PPO) (Schulman et al. (017)) with entropy regularization and gradient clipping for stability. Our system fully configurable via YAML and supports automated logging, evaluation, and model checkpointing.
Metrics. To evaluate the quality of generated mobility trajectories, we adopt five statistical metrics at both trajectory and record levels, following (Wang et al. (0236)) At the trajectory level, Ra- dius (of gyration) quantifies the dispersion of a trajectory around its center of mass, while DailyLoc measures the number of distinct locations visited. At the record level, Distance captures travel be- tween consecutive trajectory points, G-rank reflects the normalized frequency of visits to globally popular locations across users, and I-rank measures user-specific visit frequencies to top locations averaged across individuals. Each metric is represented as a probability distribution over trajecto- ries records, and we employ the Jensen- Divergence (ISD) to quantify the discrepancy between real and synthetic distributions.
4.1 COMPARISON RESULTS WITH BASELINES
In this section, we evaluate PATEGAIL ++'s utility performance using five key metrics: Radius, Dai- lyLoc, Distance, G-rank, and I-rank. We assess robustness under varying noise levels. For clarity, all reported noise levels correspond to the uniform noise setting used in PATEGAIL; in contrast, PATE- GAIL++ employs dynamic noise allocation, but ensure that the total privacy budget is matched across methods. In addition to the privacy budget e, we further evaluate privacy leakage through Membership Inference Attacks (MIA).
Baselines vs. Federated/DP Setting. The baselines (GAN GGoodfllow et al. 2020), SeqGAN Yu al. 2017), Time-Geo (Jiang al. (016)) MoveSim (Feng al. 2020). Trjj (Zhu et al.) 2023) are trained and evaluated in a centralized, non-federated, non-DP setting, whereas PATEGAIL and PATEGAIL++ operate in a federated setup with DP-style perturbations during reward aggregation. Therefore, the baseline numbers in Tab. are reported to demonstrate comparibility of our method under stronger constraints, rather than to claim strict apples-to-apples SOTA victory. See detailed description of the baseline methods in Appendix Despite these constraints, PATEGAIL attains competitive utility across metrics and strong semantic fidelity: for example, PATEGAIL + achieves G-Rank = 0.0256 (better than MoveSim's 's 0.0387), with I-Rank comparable to MoveSim (0.0176 vs. 0.0173). In contrast, standard GAN suffers large errors (e.g.. DailyLoc = 0.5795, G-Rank 1.0000). While SeqGAN and MoveSim yield smaller values on geometry-orientee metrics such as Radius/Distance. they do not consistently preserve ranking- based semantics; PATEGAIL+ better maintains high-level trajectory realism under federated/DP constraints.
7

---

Published as a conference paper at ICLR 2026
Table 1: Comparison results with baselines. Approaches were implemented without noise on the training data, and the results of PATEGAIL and PATEGAIL++ are identical when the noise level is O.
Method
Radius
DailyLoc
Distance
G-rank
I-rank
PATEGAIL(++)
0.0699
0. 0.1046
0.0130
0.0256
0.0176
GAN
0.6931
0.5795
0.3191
1.0000
1.0000
SeqGAN
0.0757
0.0881
0,0115
0,0752
0.0329
Time-Geo
0.0544
0.4955
0.4116
0.1515
0.1461
MoveSim
0.0311
0.0293
0.0058
0.0387
0.0173
DiffTraj 0.0105
0.3792
0.0087
0.0501
0.0576
Robustness Under Noise (matched protocol). Tab. and demonstrate the robustness of PATE- GAIL++ under various noises. Under the federated training protocol, PATEGAIL++ demonstrates comparable performance to PATEGAIL at small noise levels (e.g.. Noise 0.01), where the two methods achieve nearly identical utility across all metrics. At moderate noise (= 0.10), PATE- GAIL++ already shows advantages higher-level semantics, reducing DailyLoce by 29% (0.4914 vs. 0.6915) and lowering ranking errors (G-Rank 0.0278 vs. 0.0512, I-Rank 0.0607 vs. 0.2698), while maintaining similar Radius/Distance. At large noise (= 1.00), PATEGAIL clearly outper- forms PATEGAIL, with lower DailyLoc and consistently better ranking fidelity. These results indi- cate that PATEGAIL+ + least compatible with PATEGAIL at low-noise regimes and substantially more robust under stronger privacy perturbations.
Table 2: Comparison of PATEGAIL PATEGAIL+++ various noise levels under Geolife dataset.
PATEGAIL++ consistently outperforms PATEGAU. in DailyLoc, G-Rank and I-Rank.
Noise 0.01
Noise = 0.10
Noise 1.00
Metric
PATEGAIL
PATEGAIL++
PATEGAIL
PATEGAIL+*
PATEGAIL
PATEGAIL++
Radius 0.0260
0.0409
0.0263
0.0392
0.0409
0.0409
DailyLoc
0.6837
0.6818
0.6915
0.4914
0.6070
0.5608
Distance
0.0045
0,0059
0.0049
0.0057
0,0059
0.0058
G-Rank 0.0512
0.0216
0.0512
0.0278
0.0216
0.0216
I-Rank
0.2358
0.1433
0.2698
0.0607
0.1158
0.1145
Table 3: Comparison of PATEGAIL and PATEGAIL* at various noise levels under the Telecom
Shanghai dataset.
Noise 0.01
Noise
0.10
Noise 1.00
Metric
PATEGAIL
PATEGATL++
PATEGATL
PATEGAIL++
PATEGAIL
PATEGAIL+
Radius
0.3384
0.0071
0.3951
0.2752
0.4853
0,4978
DailyLoc
0.3412
0.4852
0.3402
0.3018
0.5554
0.6252
Distance
0.1251
0.0052
0.1789
0.0918
0.1520
0.2785
G-Rank
0.0668
0.0004
0.0668
0.0668
0.0668
0.0668
I-Rank 0.0199
0.2156
0.0325
0.0184
0.1163
0.1488
Privacy Leakage. We evaluate the vulnerability of PATEGAIL and PATEGAIL++ against both white-box and black-box membership inference attacks. For the white-box setting, we follow PATE- GaIl's setting and train random forest classifier distinguish members from non-members. For the black-box setting, we adopt LiRA (Carlini et al. 2022), which fits Gaussian loss distributions for each example and performs likelihood-ratio test infer membership. The white-box results for Geolife are presented in Tab. 4 and the corresponding LiRA results are shown in Tab. 5] Additional evaluations on the Telecom Shanghai dataset are provided in Appendix [A.3.] White-box MIA re- sults show that PITEGAIL exhibits substantial privacy leakage at low noise (Accuracy = 0.6645, AUC 0. 0.7208 at Noise = 0.01), indicating that an adversary can reliably infer training mem- bership. In contrast, PATEGAIL++ achieves near-random performance (Accuracy se 0.51, AUC 0.49), effectively mitigating this risk. Importantly, this trend persists across different noise lev- els: while the attack PATEGAIL. remains above random until noise is very high, PATEGAIL++
8

---

Published as a conference paper at ICLR 2026
consistently yields AUC values close to 0.5, demonstrating strong resistance to inference attacks without sacrificing utility. LiRA reveals the same trend. As shown in Tab. 5 PATEGAIL++ con- sistently achieves lower attack accuracy (roughly 10% reduction compared to PATEGAIL) while maintaining comparable AUC. This demonstrates that PATEGAIL++ offers stronger protection even under the state-of-the-ar black-box threat model.
Table 4:
Comparison of white-box MIA performance against PATEGAIL and PATEGAIL++ under different noise levels (70% members, 30% non-members) using Geolife dataset.
PATEGAIL
PATEGAIL++
Noise
Accuracy
AUC
Accuracy
AUC
0.01
0.6645 + 0.0104
0.7208 + 0.0127
0.5115 0.0098
0.4962
0.0175
0.10
0.6650 1 0.0239
0.7273 1 0.0280
0.4880 1 0.0168
0.4846 1 0.0171
1.00
0.5000 + 0.0175
0.4972 + 0.0277
0.4890 + 0.0103
0.4921 = 0.0190
Comparison of LiRA performance against PATEGAIL. and PATEGAIL++ under different Table 5:
noise levels using Geolife dataset.
PATEGAIL
PATEGAIL+
Noise
Accuracy
AUC
Accuracy
AUC
0.01
0.7000 + 0.1216
0.6365 0.1722
0.6088 + 0.1337
0.6487 = 0.1788
0.10
0.7000 0.1217
0.5218 + 0.1800
0.7000 0.1216
0.5135 + 0.1598
1.00
0.7000 0.1148
0.6049 0.1786
0.6088 = 0.1337
0.6487 = 0.1788
4.2 STUDY OTHER KEY HYPERPARAMETERS
We conduct ablation study to evaluate the sensitivity of PATEGAIL++ to key hyperparameters and design choices. Specifically, we focus on the following gradient penalty coefficient introduced in See 3.3 and user subset ratio.
Gradient Penalty Coefficient (AGr). To evaluate the effect of WGAN-GP regularization, we vary
the gradient penalty coefficient across five settings: AGe {1, 5, 10, 15, 20}. As shown in Tab, 6
incorporating WGAN-GP consistently improves performance, with PATEGAIL.+ outperforming
PATeGAIL on nearly all metrics. For each noise level and metric, also selected the best PATE-
GAIL++ configuration over ÀGP E (1,5, 10, 15, 20} and compared it to PATEGAIL (See Fig 3 in
Appendix A.3.2
Table 6: Ablation study of different AGp levels across noise levels.
PATEGAIL++
Noise
Metric
PATEGAIL
w/o
Aap
Àge 10
Àce 15
Àgp 20
Radius
0,0260
0.0409
0,0409
0.0271
0.0409
0.0253
DailyLoc
0.6837
0.6818
0.6018
0.6912
0.6789
0.6917
0.01
Distance
0.0045
0.0059
0.0058
0.0049
0.0058
0.0048
G-Rank
0.0512
0.0216
0.0216
0.0512
0.0216
0.0512
I-Rank
0.2358
0.1433
0.1157
0.2694
0.1424
0.2700
Radius
0.0263
0.0392
0.0259
0.0268
0.0409
0.0264
DailyLoc
0.6915
0.4914
0.6913
0.6917
0.6084
0.6912
0.10
Distance
0.0049
0.0057
0.0048
0.0049
0.0059
0.0048
G-Rank
0.0512
0.0278
0.0512
0.0512
0.0216
0.0512
I-Rank
0.2698
0.0607
0.2704
0.2696
0.1158
0.2704
Radius
0.0409
0.0409
0.0271
0.0409
0.0258
0.0252
DailyLoc
0.6070
0.5608
0.6652
0.6084
0.6916
0.6912
1.00
Distance
0.0059
0.0058
0.0046
0.0059
0,0048
0.0048
G-Rank
0.0216
0.0216
0.0512
0.0216
0.0512
0.0512
I-Rank
0.1158
0.1145
0.2258
0.1158
0.2689
0.2686

---

Published as a conference paper at ICLR 2026
User Subset Ratio. Since approach trains one discriminator per user, analyze the effect of varying the number of users involved during training. Specifically, we fix AGP = 20 and compare performance when using all, 80% and 40% of the available users. Due space limit, we defer the results of user sebset ration Appendix A.4
4.3 EXTENDING TO LOCAL DIFFERENTIAL PRIVACY
In this section, we extend framework to the local differential privacy (LDP) setting and eval- uate its performance with and without sensitivity- aggregation at the individual level. We report results across the same five key metrics: Radius, DailyLoc, Distance, G-rank, and I-rank, as shown in Tab. 7 We denote the LDP variant of PATEGAIL with sensitivity aggregation as PATEGAIL++* and the variant without sensitivity aggregation as PATEGAIL++ Overall, Table 7: Performance comparison between PATEGAIL++ and PATEGAIL under local differ- ential privacy. Lower values indicate better performance.
LDP
Central
Noise
Metric
PATEGAIL++
PATEGAIL++
PATEGAIL
PATEGAIL++
Radius
0.0409
0.0409
0,0260
0.0253
DailyLoc
0.6789
0.6084
0.6837
0.6917
0.01
Distance
0.0059
0.0059
0.0045
0.0048
G-Rank
0.0216
0.0216
0,0512
0.0512
I-Rank
0.1419
0.1158
0.2358
0.2700
Radius
0.0324
0.0262
0.0263
0.0264
DoilyLoc
0.6003
0.6916
0,6915
0.6912
0.10
Distance
0.0045
0.0049
0.0049
0.0048
G-Rank
0.0224
0.0512
0.0512
0.0512
I-Rank
0.1241
0.2695
0,2698
0,2704
Radius
0.0409
0.0333
0.0409
0.0252
DoilyLoc
0.6084
0.3758
0.6070
0.6912
1.00
Distance 0.0059
0.0046
0,0059
0.0048
G-Rank 0.0216
0.0324
0.0216
0.0512
I-Rank 0.1
0.0726
0.1158
0.2686
PATEGAIL+ achieves comparable or superior performance PATEGAIL++ across set- tings. Moreover, PATEGAIL++ consistently pushes the privacy-utility frontier beyond PATEGAIL. in both central and local settings.
CONCLUSION
In this work, presented PATEGAIL++, differentially private trajectory generation framework that adapts privacy budgets to trajectory sensitivity. By introducing sensitivity-aware allocation, improve the privacy-utility trade-off over prior uniform-noke approaches. We further enhance training stability via WGAN-GP and extend the framework to the local differential privacy setting, enabling individual-level protection without assuming trusted server. Experiments real-world mobility data show that PATEGAIL++ consistently outperforms state-of-the-art baselines in both trajectory fidelity and robustness membership inference attacks.
While PATEGAIL+* advances mrivacy-preserving trajectory generation, its sensitivity measure relies on discriminator confidence the state-action action level and may not fully capture semantic privacy risks, such repeated visits to sensitive locations or long-horizon sequence patterns. Developing more nuanced sensitivity models, e.g., incorporating location-specific and long-term risk signals that treat places like hospitals as higher risk, is promising direction for future work.
6 ACKNOWLEDGMENT
We thank the reviewers for the valuable suggestions. This project is supported by NSF IIS 24499444
and CNS-2451661
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Hassan Jameel Asghar, Ming Ding, Thierry Rakotoarivelo, Sirine Mrabet, and Dali Kaafar. Differ- entially private release of datasets using gaussian copula. Journal of Privacy and Confidentiality, 10(2), 2020,
Achraf Azize and Debabrota Basu. Concentrated differential privacy for bandits. In 2024 IEEE Conference Secure and Trustworthy Machine Learning (SaTML), pp. 78-109. IEEE, 2024.
Saloua Bouabba, Karine Zeitouni, Bassem Haidar, Nazim Agoulmine, and Zaineb Chelly Dagdia. Federated timegan for privacy preserving synthetic trajectory generation. In 2024 25th IEEE International Conference on Mobile Data Management (MDM), pp. 301-306, 2024. doi: 10.
1109/MDM61037.0 000.DDMMM66077222400000066 202..0062...
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Mem- bership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pp. 1897-1914 14. IEEE, 2022.
Debasis Das. Secure cloud computing algorithm using homomorphic encryption and multi-party computation. In 2018 international conference on information networking (ICOIN), pp. 391- 396. IEEE, 2018.
Yuntao Du Yujia Hu. Zhikun Zhang, Ziquan Fang, Lu Chen, Baihua Zheng, and Yunjun Gao. Ldptrace: Locally differentially private trajectory synthesis. Proceedings of the VLDB Endow- ment, 16(8);1897-1909 April 2023. ISSN 21 2090-8097. doi: 10. 10.1478/:594512.3555530 URL
http::/áx doi. org/10 /00 14778/3594512, 3594520
Cynthia Dwork and Guy N Rothblum. arXiv:1603.01887, 2016.
Concentrated differential privacy. arXiv preprint
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265-284. Springer, 2006.
Na Fan, Jia Liu, Shudi Zhao, Yifan Dai, and Wenjun Fan. Tlpp: Deep-learning based two-layer privacy preserving mechanism for protecting vehicle trajectory data. IEEE Internet of Things Journal, 1 11(22):36084 36098, 2024. doi: 10.1 10.10//00T.2222.339999999
Jie Feng, Zeyu Yang, Fengli Xu, Haisu Yu, Mudan Wang, and Yong Li. Learning to simulate hu- mobility. In Proceedings the 26th ACM SIGKDD international conference knowledge discovery & data mining, pp. 3426-3433, 2020.
Qiang Gao, Fan Zhou, Kunpeng Zhang, Goce Trajcevski, Xucheng Luo, and Fengli Zhang. Identi- fying human mobility via trajectory embeddings. In IJCAI, volume 17, pp. 1689-1695, 2017.
Ian Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139-14) 144, 2020.
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron Courville. Im- proved training of wasserstein gans, 2017a. URL htttps://arxiy http://axxxv..oorab///1111
org abgg/bbb/177
00028
Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron Courville. Im- proved training of wasserstein gans. Advances in neural information processing systems, 30. 2017b.
Yan Guo, Shangguang Wang, Ao Zhou, Jinliang Xu. Jie Yuan, and Ching-Hsien Hsu. allocation- aware edge cloud placement in mobile edge computing. Software: Practice and Expe- rience, 50(5):489-55 502. 2020.
User
Jonathan Ho and Stefano Ermon. Generative adversarial imitation learning. Advances in neural information processing systems, 29, 2016.

---

Published as a conference paper at ICLR 2026
Shan Jiang, Yingxiang Yang, Siddharth Gupta, Daniele Veneziano, Shounak Athavale, and Marta C González. The timegeo modeling framework for urban mobility without travel surveys. Proceed- ings of the National Academy of Sciences, (3333))E5370-B53333 2016.
James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International conference on learning representations, 2018.
Jong Wook Kim and Beakcheol Jang. Deep learning- based
framework for
synthetic trajectory generation. Journal of Nenwork and Computer Applications, 206: 206:103459, 2022. ISSN 1084-8045. doi: httpc////......e...a..aaaaaaa/aa
103459. URL https:
/wwww sci sciencedi rect. com http://cc//cccccc/c/eaaeeaaa
Yuanzhe Li, Ao Zhou, Xiao Ma, and Shangguang Wang. Profit-aware edge server placement. IEEE Internet of Things Journal, 911):55-67, 2021.
Yuxuan Liang, Kun Ouyang, Hanshu Yan, Yiwei Wang, Zekun Tong, and Roger Zimmermann. Modeling trajectories with neural ordinary differential equations. In IJCAI, pp. 1498-15504 2021.
Shuo Ma, Yu Zheng, and Ouri Wolfson. T-share: A large-scale dynamic taxi ridesharing service. In 2013 IEEE 29th International Conference Data Engineering (ICDE), pp. 410-421. IEEE, 2013.
Xuebin Ma. Zinan Ding, and Xiaoyan Zhang. St-trajgam: A synthetic trajectory generation al- gorithm for privacy preservation. Future Generation Computer Systems, 161:226-238, 2024. ISSN 0167-739X. doi: http:://oii.rr//0..10010 00t.:000....uuue2000000000000010 URL httpp: ://::///wwww sciencedirect htt.a//c.......ceeeeeeaaaaaa/a/a
Srikanth Narayanan, Chaoquan Cai, and Dan Lin. Geogrenn: Synthetic trajectory generation for location privacy protection. In 2024 IEEE 48th Anmual Computers, Software, and Applications Conference (COMPSAC), pp. 1 1138-1147, 2024. doi: N0.1109/C0M 105.20..000002
Fabian Netzler and Markus Lienkamp. Privacy preserving human mobility generation using grid based data and graph autoencoders. 2024.
Nicolas Papernot, Martín Abadi, Úlfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from private training data, 2017. URL https: //aaxii..rr//aa///155. 05755
Jinmeng Rao, Song Gao, Yuhao Kang, and Qunying Huang. Lsamatrajgan: A deep learning approach to trajectory privacy protection, 2020. https:::: /awxiv
10521
Adrian-Silviu Roman, Roland Bolboacä, Teri Lenard, and Piroska Haller. Apu-trajgen+: Gru-based adaptive privacy and utility preserving trajectory generation. IEEE Access, 13:160081-160102, 2025. doi: 10.1109/ACCESS.2200 201ESS..2025.555 2000000....00....
Sijie Ruan, Cheng Long, Jie Bao, Chunyang Li, Zisheng Yu, Ruiyuan Li, Yuxuan Liang, Tianfu He, and Yu Zheng. Learning to generate maps from trajectories. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 890-897, 2020.
John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms, 2017. URL https: / www.aaivvoooo..... www.iiioorrreeeee
haarg//bbb.... abs/ /
Chaoming Song, Zehui Qu, Nicholas Blumm, and Albert-Lászla Barabási. Limits of predictability in human mobility. Science, 1018 1021, 2010.
Haiming Wang, Zhikun Zhang, Tianhao Wang, Shibo He, Michael Backes, Jiming Chen, and Yang Zhang. Privtrace: Differentially private trajectory synthesis by adaptive markov model. In USENIX Security Symposium 2023, 2023a.
Huandong Wang, Changzheng Gao, Yuchen Wu, Depeng Jin, Lina Yao, and Yong Li. Pategail: A privacy-prese preccc-pr mobility trajectory generator with imitation learning. Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 14539-14547, 2023b.
12

---

Published as a conference paper at ICLR 2026
Shangguang Wang. Yan Guo, Ning Zhang, Peng Yang, Ao Zhou, and Xuemin Shen. Delay-aware microservice coordination mobile edge computing: A reinforcement learning approach. IEEE Transactions Mobile Computing, 20(3):939 2019.
Zheng Wang, Cheng Long, and Gao Cong. Trajectory simplification with reinforcement learning. In 2021 IEEE 37th International Conference on Data Engineering (ICDE), pp. 684-695, IEEE, 2021.
Lantao Yu, Weinan Zhang, Jun Wang, and Yong Yu. Seqgan: Sequence generative adversarial nets with policy gradient. In Proceedings of the AAAI conference artificial intelligence, volume 31, 2017.
R. Zhang, W. Ni, N. Fu, L. Hou, D. Zhang, and Y. Zhang. Dp-ltgan: Differentially pri- vate trajectory publishing via locally-awand transfrmer-basel gan. Future Generation Com- puter Systems, 166: 107686, 2025. ISSN 0167-739X. doi: http::/doo.org//00.000//// 2024.107686. URL
wwt /ttpttt.ccoocccceeeeeeeraaacaala
S0167733X24006502
Yuanshao Zhu, Yongchao Ye, Shiyao Zhang, Xiangyu Zhao, and James Yu. Difftraj: Generating gps trajectory with diffusion probabilistic model. Advances in Neural Information Processing Systems, 36:651 18665168-440 (8-661886 2023.
13

---

Published as a conference paper at ICLR 2026
A APPENDIX
A.1
ETHICS AND REPRODUCIBILITY STATEMENTS
Ethics Statement This research adheres to the ICLR Code of Ethics. All experiments are con- ducted publicly available benchmark datasets and environments that do not involve human sub- jects or personally identifiable information. No new data collection was performed, and no sensitive private information included. The contributions of this work are methodological, aiming to advance machine learning. While reinforcement learning and related methods may be applied in safety-critical socially sensitive domains, this paper does directly address or deploy in such contexts. We have taken care to report results honestly, acknowledge limitations, and follow best practices for research integrity. No conflicts of interest or ethical concerns beyond standard research conduct arise from this work.
Reproducibility Statement We have made every effort to ensure the reproducibility of our re- sults. Detailed descriptions of the proposed algorithms, theoretical assumptions, and derivations are provided in the main text and appendices. Hyperparameter settings, model architectures, and training configurations are reported in full. Data preprocessing procedures and evaluation proto- cols are documented, and all datasets used are publicly available. Our source code and instruc- tions for reproducing experiments are available at PATEGAIL-PIun
Together, these resources ensure that independent researchers can reproduce and verify our findings.
A.2 BASELINE METHODS
We compare PATEGAIL++ against five baseline methods: GAN (Goodfellow al. 2020). Seq-
GAN Yuu et al. 2017). Time-Geo (Jiang et al.) 2016), MoveSim (Feng et al. 2020). and Diff-
Traj (Zuu al. 2023). We deseribe each baseline detail below.
GAN (Goodfello et al. 2020) directly generates full trajectories using a vanilla GAN architecture, training generator and discriminator adversarially without explicit temporal modeling.
SeqGAN (Yu et al. 2017) extends GANs to sequence generation by training the generator step-by-step via policy gradient, allowing it to produce trajectories transition at time.
TimeGeo @Jing et al. 2016) is rule-based probabilistic mobility model grounded in the classical Exploration and Preferential Return (EPR) framework. characterizes human movement using hand-crafted behavioral rules rather than learned representations.
MoveSim (Feng et al. 2020 GAN-based trajectory generator that incorporates domain knowledge of human mobility regularities to enhance realism and statistical fidelity.
diffusion-basel trajectory generation model that learns con- tinuous denoising dynamics spatial-temporal embeddings. It achieves high-quality trajectory synthesis under centralized, non-private training setting.
DiffTraj (/hu et al. 2023
A.3 MORE RESULTS
A.3.1 PRIVACY LEAKAGE
As a complement to the Geolife results discussed in the main text, we further evaluate privacy leakage on the Telecom Shanghai dataset to confirm that the same trends persist across a different mobility distribution. The following tables report both white-box MIA performance and LiRA-based black-box performance under varying noise levels.
The Telecom Shanghai results show similar overall pattern in Geolife. Under white-box MIAs, PATEGAIL continues to leak membership information at moderate noise levels, reflected by ele- vated AUCs between 0.60 and 0.73, while PATEGAIL++ remains more stable and private in terms of AUCs. Moreover, PATEGAIL's attack performance fluctuates substantially across noise levels, whereas PATEGAIL++ exhibits stable behavior with values consistently near chance. LiRA
14

---

Published as a conference paper at ICLR 2026
leads to similar conclusion: although both methods show variance due to the dataset's com- plexity, PATEGAIL maintains higher attack accuracy and greater fluctuation across noise settings, while PATEGAIL++ + remains reliably harder to exploit. Overall, the Telecom experiments reinforce that ANTEGAIL. provides stronger and more stable privacy protection than PATEGAIL. under both white-box and black-box threat models.
Table 8: Comparison of white-box MIA performance against PATEGAIL and PATEGAIL++ under different noise levels (70% members, 30% non-members) using Telecom Shanghai dataset.
PATEGAIL
PATEGAIL+
Noise
Accuracy
AUC
Accuracy
AUC
0.01
0.5454 = 0.0730
0.6263 = 0.0320
0.6162 + 0.0621
0.4881 + 0.0370
0.10
0.6625 + 0.0801
0.7299 = 0.0657
0.6044 + 0.1095
0.5380 1080
1.00
0.5669 = 0.0641
0.6022 + 0.0655
0.5912 + 0.1256
0.6149 + 0.1460
Table 9:
Comparison of LiRA performance against PATEGAIL and PATEGAIL++ under different noise levels using Telecom Shanghai dataset.
PATEGAIL
PATEGAIL++
Noise
Accuracy
AUC
Accuracy
AUC
0.01
0.5294 + 0.1020
0.6409 + 0.1660
0.4512 + 0.1220
0.6808 + 0.1684
0.10
0.5882 0.2210
0.6858 + 0.1395
0.6965 + 0.1320
0.5840 0..0200
1.00
0.7059 + 0.96
0.5452 = 0.2160
0.6965 + 0.1320
0.4962 + 0.2290
A.3.2 GRADIENT PENALTY COEFFICIENT
Radius
Dally
Distance
0.35
0.25
0.5
0.00
2000
0.55
0.000
0.35
0.15
6005
0.005
Figure 3: Comparison of PATEGAIL and the best-performing PATEGAIL ++ configuration over AGP 5, 5, 10, 15, 20), evaluated across various noise levels and metrics.
For each noise level and metric, select the best PATEGAIL+ configuration over five different gradient penalty coefficients AGe E (1,5, 5, 10, 15, 20} and compare it to PATEGAIL. Fig shows that PATEGAIL++ consistently outperforms PATEGAIL. across all noise regimes and evaluation met- rics. By adaptively allocating noise according to sample sensitivity and stabilizing training with WGAN-GP, PATEGAIL+ maintains high trajectory fidelity even under strong differential privacy constraints, whereas PATEGAIL deteriorates noticeably as noise increases. Across all metrics where lower better (Radius, DailyLoc, Distance, G-Rank, and I-Rank), PATEGAIL either matches or surpasses PATEGAIL. often by a substantial margin in the moderate-note setting where DP pressure highest. Overall, PATEGAIL+4 produces more stable, realistic, and consistent trajectories under differential privacy.
A.4 USER SUBSET RATIO
The results in Tab 10 show that both PATEGAIL++ and PATEGAIL remain robust when par- ticipation is reduced from 100% to 80%, showing only minor performance shifts. However, with user participation rate of 40%, PATEGAIL++ generally yields lower differences in metric val-
15

---

Published as a conference paper at ICLR 2026
Table 10: Performance comparison across different user percentages (40%, 80%, 100%) under vary-
ing noise levels.
40%
80%
100%
Noise
Metric
PG
PATRGATL:+
PG
PATEGAIL+
PG
PATEGAIL++
Radius
0.0349
0,0409
0.0263
0.0252
0.0260
0,0253
Doi
0.3778
0.6084
0.6917
0.6916
0.6837
0.6917
0.01
Distance
0.0046
0.0059
0.0049
0.0048
0.0045
0.0048
G-Rank
0.0452
0.0216
0.0512
0.0512
0.0512
0.0512
I-Rank
0.0589
0.1158
0.2703
0.2697
0.2358
0.2700
Radius
0.0409
0.0409
0.0265
0.0409
0.0263
0.0264
DailyLoc
0.6818
0.6806
0.6795
0.6818
0.6915
0.6912
0.10
Distance
0.0059
0.0059
0.0046
0.0059
0.0049
0.0048
G-Rank
0.0216
0.0216
0.0512
0.0216
0.0512
0.0512
I-Rank
0.1433
0.1431
0.2246
0.1433
0,2698
0.2704
Radius
0.0409
0.0281
0.0303
0.0392
0.0409
0.0252
DailyLoc
0.6818
0.6919
0.6114
0.5364
0.6070
0.6912
1.00
Distance
0.0059
0.0050
0.0046
0.0056
0.0059
0.0048
G-Rank
0.0216
0.0512
0.0224
0.0092
0.0216
0.0512
I-Rank
0.1433
0,2693
0.1384
0.0711
0.1158
0.2686
ues compared to PATEGAIL.. This highlights PATEGAIL++'S stronger resilience under limited user availability.
16


Reviews:
[{"review_id": "3KWde4wpzR", "reviewer": "Reviewer_CLX6", "summary": "This paper proposes a novel approach for the privacy-preserving generation of synthetic trajectories, which extends a previous method called PATEGAIL by integrating a sensitive-aware noise injection module as well as a local differentially private extension. The experimental results obtained demonstrate that the proposed extension called PATEGAIL++ is able to achieve a better utility-privacy trade-off.", "questions": "Please see the main points raised in the weaknesses section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "-The paper is well-written and the authors have clearly reviewed the recent deep learning methods for the generation of synthetic trajectories. The main contributions of the paper are also clearly summarized. \n\n-One of the strength of the proposed approach is that it includes a sensitivity-aware noise injection module that adapts the level of the noise to the sensitivity of the trajectory sampled. This enables to add more noise to sensitive trajectories while saving on the privacy budget for non-sensitive ones. In addition, the paper considers the privacy model of local differential privacy, which enables the addition of noise at the level of the user thus limiting the trust assumptions that need to be done with respect to the central server responsible of the aggregation. \n\n-The proposed approach also relies on the use of the generative adversarial imitation learning to be able to generate trajectories that are realistic. \n\n-The approach is validated experimentally with the geolife dataset and compared against four different baselines using a wide range of utility measures. The results are promising and demonstrate the potential of the approach. In particular, PATEGAIL++ outperforms PATEGAIL for a wide range of metrics.  The privacy analysis performed using a membership inference attack in the white-box model also demonstrates that PATEGAIL++ achieves a higher privacy level.", "weaknesses": "-The novelty of the approach seems to be limited in the sense that the contribution provided by PATEGAIL++ appears to be only incremental compared to PATEGAIL.\n\n-The federated learning setting should be better justified. In particular, it only mentions at the end of page 3. Rather it seems that the proposed approach is not only limited to this setting but could also be applied in more centralized one, which is actually also an additional benefit of the framework. \n\n-Currently, there is no description of the four different baselines against which PATEGAIL++ is compared. Additionally, their choice should be justified. The evaluation of the approach also relies only on one dataset while actually assessing it on at least two other ones would help to evaluate its applicability. Finally, the use of a second MIA would also help to strengthen the privacy analysis. It is possible in particular that the attack designed originally against PATEGAIL is not adapted to PATEGAIL++ and that instead another one such as LIRA could be used instead.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QhALOQjdE8", "reviewer": "Reviewer_Qwbq", "summary": "This paper presents an interesting study that proposes a novel framework, PATEGAIL++, for the task of trajectory generation. It introduces a sensitivity-aware noise injection module, which aims to enhance the fidelity of the trajectories and the performance on downstream tasks. Furthermore, the framework is extended to the Local Differential Privacy (LDP) setting, achieving individual-level privacy protection without relying on a trusted server.", "questions": "Q1: Please explain on W1.\nQ2: Why are the evaluation results for PATEGAIL not listed in Table 1?\nQ3: Please explain on W3.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "S1: The overall logic of the paper is clear. Addressing the challenges of trajectory generation under differential privacy, it systematically describes the solutions corresponding to different challenges.\nS2: Existing approaches suffer from a significant limitation: they apply a uniform noise level to all samples. This practice causes unnecessary utility loss for low-risk samples and provides insufficient privacy for high-sensitivity ones. To address this, the paper introduces a sensitivity-aware module. This module is used to identify the privacy sensitivity level of user trajectories in the training data, allowing for the allocation of an appropriate privacy budget to data of different sensitivity levels.", "weaknesses": "W1: In Section 3.1, there is an apparent contradiction between the formula for privacy budget calculation and its textual description. According to the formula, samples with higher discriminator confidence (i.e., high sensitivity) are allocated a larger share of the privacy budget. However, the textual description states the opposite. The same issue exists in Section 3.2 regarding the privacy budget calculated for each user.\nW2: The baseline methods seem to be outdated, some stronger baseline methods are expected to be seen in this paper such as TrajDiff. Particularly, both PATEGAIL and PATEGAIL++ operate in a federated setup with Differential Privacy-style perturbations during reward aggregation, but there is no quantitative evaluation on PATEGAIL.\nW3: Table 4 indicates that PATEGAIL++ achieves the best average performance across all metrics when the gradient penalty is 5. This raises a question as to why different gradient penalties were chosen for subsequent experiments. For example, in conjunction with Table 4, it is noted that in the comparison against PATEGAIL (Table 2), PATEGAIL++ was evaluated with no gradient penalty.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nJbJ1ZVmcj", "reviewer": "Reviewer_3SYb", "summary": "The paper extends PATEGAIL by adding a \"sensitivity-aware\" noise injection (rather than uniform noise to achieve differential privacy they use the output of the individual discriminators as a proxy for the sensitivity of a sample for that user) and adding noise to the local reward before sending it to the server to improve the local differential privacy. They evaluate it on one dataset, Geolife.", "questions": "What is the state in your experiment?\n\nConsidering that the method only considers (s,a) pairs, this entails that you assume the Markov assumption holds, what are the consequences of this and how does this limit the applicability of the approach?\n\nHow do you evaluate whether using the discriminator to estimate the sensitivity of a sample is meaningful and reasonable? \n\nWhen the local discriminators have converged, will they correspond to the true sensitivity of each sample then?\n\nHow does the feedback loop of adding noise to the local reward as the local discriminator improves impact the method?\n\nThe abstract claims that existing methods fail to generalize across trajectory patterns, how does your approach improve on this?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "To improve the accuracy while maintain the privacy is important.\nThe idea of non-uniform noise over trajectories seems valid and useful.\nThe paper is well written and easy to follow.", "weaknesses": "Only looking at individual (s,a) pairs seems to entail significant limitations as the Markov assumption has to hold.\n\nThe method is only evaluated on a single dataset so no claims about generality can be made.\n\nIt is unclear whether using the discriminator to estimate the sensitivity of a sample is sufficient (it only checks individual (s,a) pairs not trajectories), see questions.\n\nThe abstract claims that existing methods fail to generalize across trajectory patterns, it is not clear how this approach improves on this.\n\nThere are no trends in Table 4 which makes it hard to interpret. It seems as \\lambda=5 and \\lambda=15 almost give the same results while \\lambda=10 and \\lambda=20 also give almost the same results. Shouldn't there be some trend?\n\nSome rows in Table 4 lack bold numbers.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LDOaiJepdn", "reviewer": "Reviewer_Gg8d", "summary": "This paper proposes PATEGAIL++, a framework for generating differentially private (DP) human mobility trajectories. It identifies a key limitation in prior work like PATEGAIL: the use of a uniform privacy noise level, which ignores the fact that not all trajectories are equally sensitive . The core contribution is a sensitivity-aware noise injection module. This module uses a heuristic to dynamically allocate the privacy budget, applying more noise to samples it deems more sensitive. To improve stability, the framework also integrates WGAN-GP . Experiments show that PATEGAIL++ achieves a better utility-privacy trade-off.", "questions": "Q1: Your heuristic equates high discriminator confidence with high sensitivity . But what about trajectories that are both common and sensitive (e.g., a \"home-to-work\" route)? Could the discriminator give these a low score (since they aren't rare), causing your method to mistakenly label them \"low sensitivity\" and thus under-protect them?\nQ2: The model's practical effectiveness relies on its heuristic, not just its mathematical $(\\epsilon, \\delta)$-DP guarantee. Is the single MIA attack in Table 3 (which the baseline failed) sufficient validation for this heuristic ? Or could other attacks exist that specifically exploit the heuristic's \"worst-case\" failure modes?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Clear Motivation: The paper is built on a clear and intuitive motivation: uniform noise is suboptimal for trajectory data, as privacy risks are not uniform (e.g., a home-work route vs. a public-hub route) .\n2. Excellent Practical Privacy Evaluation: A major strength is the practical evaluation using a Membership Inference Attack (MIA) in Table 3 . This experiment demonstrates a concrete privacy failure in the baseline PATEGAIL. \n3. Practical System Design: The paper presents a sound engineering solution to a known problem.", "weaknesses": "1.\tHeuristic-Based Sensitivity: The core contribution is based on a heuristic, not a theoretical guarantee of semantic privacy. It assumes that high discriminator confidence is a reliable proxy for high privacy sensitivity . This is a pragmatic but unproven assumption. The authors acknowledge this limitation in the conclusion.\n2.\tLimited Theoretical Novelty: The insight that different data has different sensitivity is intuitive and not, in itself, a deep theoretical breakthrough. The contribution is thus more of an effective application of this idea.\n3.\tSingle-Dataset Evaluation: The entire experimental validation is conducted on a single dataset (Geolife) . While this is the same dataset used by the baseline, the paper's claims would be significantly strengthened if the method's effectiveness was also demonstrated on a different mobility dataset.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)