dataesr/scientific-paragraphs-categorization huggingface dataset:
(1) Data cleaning The presence of noise in the data is a consequence of the accuracy loss mentioned earlier in the data collection stage. Therefore, we apply a filtering process that deletes GPS points considered noise or outliers in the trajectory. For example, when two consecutive GPS points have much higher speeds than the globally defined speed limits in urban or non-urban areas, the second GPS point is considered an outlier and is subsequently removed from the dataset. A compression step further reduces the number of GPS points while preserving the trajectory properties. It works as follows. When the Euclidean radius distance is very small between consecutive points, it implies the points are in a very close neighbourhood of the same location. Subsequently, all these points are merged into a single point whose location is given by the median of all point coordinates, while the associated timestamp corresponds to the first point.
(2) Gravity GPS anonymisation After data filtering and compression, we obtain the clean GPS points. At the end of this second step, we release the first dataset (GPSTrackingData). Nevertheless, to guarantee privacy, we   The minimum gap time in a trajectory to split into trips is 30min min_length (100) The minimum length for trips is 100m need to anonymise the GPS locations. This is done as follows: Data is anonymised based on the gravity point calculated for each person's latitude and longitude data. The gravity point is set at the location 0-latitude and 0-longitude, and all GPS points are translated accordingly. This translation preserves the original shape position and distances between GPS points. While this first dataset is the core of AnLoCOV, we provide further datasets to ease the analysis at higher levels, which is at the level of trips and Activity Point Locations (APLs).
(5) Cluster APL anonymisation The latitude and longitude coordinates of each APL are anonymised. In this case, the reference point for anonymising the coordinates of each person is set as the most visited APL over time (cluster labelled as 0). In other words, we compute the mean latitude and longitude of the APLs clustered as 0 and translate all APLs accordingly. The most visited APL ends at the location 0latitude and 0-longitude. This translation preserves the original shape position and distances between each APL. Finally, we summarise trip measures such as the total number of GPS points, APLs, and clusters per trip. We do not consider the geodesic distances because it would provide some information about the exact geographical map and contradict our willingness to anonymise the data fully.
Acknowledgements We are grateful to all the people who agreed to provide their Google Location History file to build the AnLoCOV dataset. The authors also thank the  Académie de Recherche et d'Enseignement Supérieur (ARES) , the  Central University of Ecuador , and the  University of Liège  for their financial support and for hosting this research project. The research also was funded through the  Special Fund for Research "MIRS ", financed by the  Wallonia-Brussels Federation.
AnLoCOV provides relevant and validated data to support urban/human mobility research. Direct URL to survey: https://github. com/GmoncayoCodes/ActivityPointLocationGenerator/blob/ c014 8c7ca46964 8db722b6a2140a6d112b6b8856/demographic/Survey _ EN. pdf Value of the Data • AnLoCOV contributes to the scientific community in the domain of urban/human mobil- ity behaviour by making an anonymised longitudinal GPS dataset (N = 338) from Google Maps openly available. AnLoCOV includes Activity Point Locations over long PRE-and POST-COVID periods, allowing a deeper insight into the longitudinal effects of the COVID- 19 pandemic on the activity space/time dimensions. Additionally, GPS tracking, summary • City/Town/Region: Quito/Quito/Pichincha • Country: Ecuador Data accessibility Repository name: Mendeley Data Data identification number: https://doi.
Contains more than 16 million GPS point coordinates corresponding to the clean GPS tracking of each person. The anonymisation of this dataset is based on the gravity point of the whole GPS data. The data is ordered by Google Location History id and datetime. • DemographicData: Contains anonymous demographic data from 338 persons. The data is ordered by Google Location History id. • GPSTrackingData: • APLData: Contains more than 2 million Activity Point Location coordinates, including cluster information. The anonymisation of this dataset is based on the most visited Activity Point Location (cluster labelled as 0). The data is ordered by Google Location History id, week and trip.
Aggregating data is a widely used technique to protect privacy. Membership inference attacks on aggregated data aim to infer whether a specific target belongs to a given aggregate. We propose to study how aggregated time series data can be susceptible to simple membership inference privacy attacks in the presence of adversarial background knowledge. We design a linear programming attack that strongly benefits from the number of data points published in the series and show on multiple public datasets how vulnerable the published data can be if the size of the aggregated data is not carefully balanced with the published time series length. We perform an extensive experimental evaluation of the attack on multiple publicly available datasets. We show the vulnerability of aggregates made of thousands of time series when the aggregate length is not carefully balanced with the published length of the time series.
INTRODUCTION Private organizations and public bodies worldwide are nowadays engaged in ambitious open data programs that aim at favoring the sharing and re-use of data  (The World Wide Web Foundation, 2017). Opening data is rooted in century-old principles 1 and, with today's data collection capacities, is expected to yield important and various benefits  (Deloitte, 2017;  The World Wide Web Foundation, 2017; The European Data Portal, 2015; OECD, 2020) (e. g. , driving public policies, strengthening citizens trust into governments, fostering innovation, facilitating scientific studies). Personal data are part of the open data move-electrical power consumption with one measure every 30 minutes. Electrical consumption records are then published under a variety of aggregated time series 5. Today, the publication of such datasets is often encouraged by laws such as the EU directive 2019/1024 6 imposing to the states members to set up open data programs for various information, including energy consumption (Directive 2019/1024 Article 66).
Membership inference attacks form an important part of the privacy attacks. They aim to infer whether a specific target is present or absent from a dataset 5 See, e. g. , the open data portal of the French national electrical network manager (https://data. enedis. fr). 6 https://eur-lex. europa. eu/eli/dir/2019/1024/oj 7 https://www. legifrance. gouv. fr/codes/id/ LEGISCTA000034381202/2017-04-08 8 https://www. observeit. com/cost-of-insider-threats/ 9 https://www. verizon. com/business/resources/reports/ dbir/2021/data-breach-statistics-by-industry/ using various methods such as statistical tests  (Dwork et al. , 2017)  and machine learning  (Rigaki and Garcia, 2020). The presence of a target in a published aggregate is a valuable knowledge for an attacker when the aggregate is, or can be, publicly associated to other, possibly sensitive, attributes.
Contributions. In this paper, we introduce (Section 2) a new threat model where the attacker has access to the published aggregates (e. g. , averages, sums) that are, or can be, associated to additional attributes, and to the disclosed raw times series. He/she then aims to determine whether (the time series of) a given target is associated to the additional attribute(s). This can actually be framed as a membership inference attack. We then show (Section 3) that this membership inference attack can be reduced to the subset sum problem, which can be solved as a constraint programming problem when data consist of time series. Each time point serves as a constraint to efficiently solve a subset sum problem. Based on this approach, we perform (Section 4) experiments on real-life data using the Gurobi solver, and show that our membership inference attack is successful in most cases.
Threat Model The usual threat model obviously considers an attacker who aims to retrieve from the published aggregates, protected through various privacy-preserving measures, the identity (or associated valuable information) of the people concerned by these data  (Jayaraman et al. , 2021)   (Bauer and Bindschaedler, 2020)   (Pyrgelis et al. , 2018). A step further consists in considering a threat model where the attacker has access both to the (published) aggregated time series and to the (leaked) raw time series (while the additional attributes remain secret and the goal of the attack remains unchanged). Two points should then be discussed: the relevance of this scenario and the attacker's motivation to perform an attack in such a scenario. Due to legal requirements and widespread security best practices, publishers usually store direct identifiers and raw time series in separate databases 10 applying for example traditional pseudonymization schemes.
Dedicated access control policies, archival rules, or security measures can then be applied to each database (e. g. , retention period limited to a couple of years for fine-grained electric consumption time series). Isolating direct identifiers from time series indeed prevents direct re-identifications from malicious employees or external attackers exploiting a leak 11. The same security principles might apply to the storage of the additional, possibly sensitive, attributes. Note that variants of the above context can be easily captured by our model. An example of a vari-ant, common in real-life, is when the additional attributes come from another data provider collaborating with the publisher for computing cross-database statistics. Whatever the scenario, this results in a set of databases, isolated one from the other, either for security reasons in order to mitigate the impacts of data leaks, or simply because multiple data providers collaborate.
EXPERIMENTS We perform an extensive experimental survey of the attack using two open datasets: the CER ISSDA dataset (CER, 2012) and the London Households Energy Consumption dataset. Our results show that the SUBSUM attack is highly efficient (e. g. , absolute success) when it's requirements are met, i. e. , when the vector of aggregates published contains a sufficient number of aggregates (sufficient number of constraints) and when the attacker has sufficient computing power.
Settings Experimental Environment. It consists of two software modules 12. First, the driver module, written in Python, is in charge of driving the complete set of experiments : deploying the experiments, launching them, stopping them, and finally fetching the experimental results. Based on the driver, we deployed our experiments on our own OAR2 (Linux) 13 computing cluster, allocating 2 cores (2. 6 GHz) and 2 GB RAM at least to each experiment. Each experiment is a SUBSUM attack fully parameterized (e. g. , full set of time series, aggregates published). We describe it below. The second software module is the solver in charge of performing a SUBSUM attack given a set of parameters. We use in our experiments the Gurobi solver (Gurobi Optimization, 2020), a wellknown and efficient IP solver, but any other solver can be used provided that it implements an API similar to the one used in Algorithm 1.
Datasets. We performed our experiments over the real-life ISSDA CER public dataset (CER, 2012) which contains power consumption time series of 6435 individuals for over 1. 5 years at a 30 mins rate. Removing the time series containing at least one missing value left us with 4622 time series. We changed the unit from kWh to Wh obtaining thus only integer values (required by our solver). We refer to this cleaned dataset as ISSDA-30m. 14  We replicate the experiments on the real-life London Households Energy Consumption dataset (UK Power Networks, 2013) containing 5567 individuals for over 2. 5 years at a 30 mins rate. As this dataset contains a lot of missing values (all individuals have at least one missing value), we filled the missing values using the consumption of the previous week. Then, we removed the individuals that have missing values along several weeks.
This left us with 5446 individuals. We also changed the unit from kWh to Wh in order to obtain only integer values. We refer to this cleaned dataset as London-30m. Experimental Protocol. We consider three main parameters impacting the SUBSUM attack: the size |S | of the set of time series, the size |A| of the vector of aggregates published (number of constraints), and the number of values aggregated in each aggregate |S A |. Table  2  shows the parameter values we use in our experiments. For each triple of parameters, we generate 20 experiments 15 where each experiment is a SUB-SUM attack over (1) a set of time series, (2) a vector A of aggregates published, and (3) a time budget θ. At each experiment, the full population S, together with the individuals S A that are part of the vector of aggregates, are randomly selected.
Relationship between the number of individuals and the success Figure  2  shows the minimal number of constraints required to have at least one success for several population sizes and for a time budget large enough for not interfering (i. e. , θ = 24h). We can see that, even if the required number of constraints before getting a success increases with the population size, it follows a parabolic shape for all population sizes. Figure  3  shows the results of attacks with respect to the aggregate size and the number of constraints for a small dataset of 1000 individuals and a small time budget of 1000s (approximately 15 minutes). As already seen in Figure  2 , Figure  3  shows that the attacks fail in a parabolic area centered around aggregates of half the population size. These failures are due to the fact that the solver reaches the maximum allocated time.
Outside this area of failure, the attacks are mostly successful with the exception of a few, randomly distributed, failed experiments which depend on the original aggregate and population samples. In this "light" area, the few failures are due to the existence of several possible solutions (we provide below in Section 4. 2. 3 an advanced analysis of the cases where several solutions exist). After reaching With a small aggregate size (lower than 50% of the population size) the number of constraints needed is often twice the size of the aggregate: in general the number of constraints needed to successfully attack a population of size |S | should be at least in the order of the aggregate size |S A |. Conversely, if the number of constraints is much lower than the aggregate size, the dataset is deemed safe (relatively to the time budget θ and to the pool size p) to the SUBSUM attack.
Impact of the time budget For practical reasons, we evaluate the impact of the time budget on a rather small dataset with |S | = 2000. As can been seen in Figure  4 , the time budget θ has an impact on the attack success: the higher the time budget, the higher the success rate. However, as shown in Figure  4d , even with a high time budget, attacking an aggregate with a small number of constraints (the left dark sides of Figures  4b, 4c  and 4d ) will be unsuccessful. Conversely, if the time budget is too low and the number of constraints is too high (the right black / grey area of the Figures  4a, 4b  and 4c ), the solver does not have the time to solve the problem with its given parameters. Figure  5  shows the experiments time (in seconds). We note three areas of interest: 1) an area with missing points (before reaching 25% of constraints) corresponding to the, previously defined, parabolic area of failures 2) the failures due to reaching the allowed solver time and 3) when increasing the number of constraints, the sudden drop in execution time until a point where the attack is the fastest for all aggregate sizes.
Attacking large populations The attacks on our largest dataset provide results similar to the ones previously described. However, since the dataset is larger, we need to increase the time budget to 24h to observe the same phenomena. As shown in Figure  6 , the relationship between the dataset size, the aggregate size and the number of aggregates required for the attack to succeed is similar to what we observed in the other experiments. In particular, in this case, we need roughly twice more constraints than the aggregate size until we reach an aggregate size of 25% of |S |. After that, the number of constraints needed to reach a success remains stable at 50% of |S |. It is worth to note that we set the pool size to p = 100 in these experiments, meaning that the attack is considered to be successful if the number of solutions found is between 1 and 99.
This allows us to study the cases where several solutions are found, which make G worth analyzing. We chose the experiment in which the solver returned the highest number of solutions and where the intersection of these solutions is the smallest (in other words, where the number of individuals that are part of several solutions is the highest). This case occurred in one of the 20 repetitions of the attack performed with the following parameters: dataset = ISSDA-30m, |S | = 4500, θ = 24h, p = 100, |S A | = 225 (5%) and |A| = 900 (20%). It resulted in a pool containing 3 solutions. We represent in Figure  7  the part of the guess vector limited to the individuals found in the 3 solutions. Figure  7   associated to eleven possible ranges of guess in G 17 (X-axis). The figure shows that 224 (98.
RELATED WORKS In the literature, attacks applicable against the privacy-preserving publication of electrical consumption data can be separated in three categories. First, there is the Linear reconstruction attacks where the attackers aim at finding back the original dataset from a publication. Secondly, the Membership Inference Attacks (MIA in short) looks if a specific individual is part of a publication. Lastly, NonIntrusive Load Monitoring (or NILM) tries to infers valuable information (e. g. , the devices used) from an electrical consumption time series. We consider our attack as being a membership inference attack (we try to know which individuals take part in a publication) by using methodologies explored by the reconstruction attacks (the usage of linear programming solvers).
Linear reconstruction attacks Linear reconstruction attacks  (Cohen and Nissim, 2020; Dinur and Nissim, 2003; Dwork et al. , 2007; Dwork and Yekhanin, 2008; Lacharité et al. , 2018; Quadrianto et al. , 2008) , illustrated by  Cohen & al. (Cohen and Nissim, 2020) , are probably the closest from our attack. In these attacks, an attacker is given access to an interface allowing him to generate aggregates from limited queries on the dataset. The attacker sends a set of queries, each of them getting a new aggregate from a randomly selected subset of the dataset. Each query is then used to build a set of constraints that are then solved by a linear programming solver. As for our attack, the goal is to extract private information from a set of constraints. However, the SUBSUM attack differs in several ways.
First, the linear reconstruction attack aims to reconstruct a private dataset (e. g. , the values of the dataset elements) while our attack aims to reconstruct private aggregates from known data. The attack aims to infer the presence or the absence of individuals in an aggregate and not their values. Second, due to the different objective of the attack, the attacker does not require the same background knowledge. Our attack does not require access to a query interface and can be performed on a static set of aggregates as they are generally published in open data programs. However, the large number of queries required by the linear reconstruction attack is somewhat balanced by the requirement of the individuals' values.
Membership inference attacks Membership inference attacks are another family of attacks where the attacker wishes to infer the presence or the absence of a target inside a dataset or whether a target has played a part in the result of a function  (Dwork et al. , 2017; Rigaki and Garcia, 2020). Datasets can broadly take the form of aggregates  (Bauer and Bindschaedler, 2020; Büscher et al. , 2017; Jayaraman et al. , 2021; Pyrgelis et al. , 2020a; Pyrgelis et al. , 2018; Pyrgelis et al. , 2020b; Zhang et al. , 2020) , data used to train machine learning model  (Long et al. , 2020; Melis et al. , 2019; Salem et al. , 2019; Shokri et al. , 2017; Truex et al. , 2019; Yeom et al. , 2018) , genomics database  (Homer et al. , 2008; Samani et al. , 2015; Sankararaman et al. , 2009)  or original data used to generate synthetic ones  (Stadler et al.
Membership inference attack on ML models These attacks  (Long et al. , 2020; Melis et al. , 2019; Salem et al. , 2019; Shokri et al. , 2017; Truex et al. , 2019; Yeom et al. , 2018)  aim to find whether an individual is part of the dataset used to train a machine learning model. The attacker has access to unlimited queries to a black box model and to records sampled from the same distribution as the original training data. Usually  (Shokri et al. , 2017; Truex et al. , 2019) , the attacker will train an ML-based attack model against multiple shadow models which replicate the behavior of the attacked model and are trained with some known datasets (with and without the target individual). The attack model will then be applied against the real model to attack. Membership attacks on ML models requires knowledge of distribution of the attacked records and large amount of data to train the shadow models.
CONCLUSION Membership inference attacks aim to infer whether a specific individual belongs to a given aggregate. In this work, we introduced a new technique to perform inference attacks on (threshold-based) aggregated time series. Given a publicly known dataset of time series, and aggregated values (one value per timestamp) calculated from a private subset of that dataset, the adversary that we consider is able to reidentify the individuals belonging to the private subset. To do so, we modeled the membership inference attack as a subset sum problem and we used Gurobi to solve it. We completed experiments on two real-life datasets containing power consumption time series, from UK and Ireland, respectively. We showed that if the number of available aggregated values is larger than the aggregate size (i.
θ = 8000s Figure 4: Evolution of the success (0 : all failed, 1 : all succeed) depending on the time budget. Parameters : dataset = ISSDA-30m, |S | = 2000, θ = {1000s, 2000s, 4000s, 8000s}, p = 2, 20 repetitions. Evolution of experiments time depending on the time budget. Parameters : dataset = ISSDA-30m, |S | = 2000, θ = {2000s, 8000s}, p = 2, 20 repetitions.
The rightmost panels of Figure  2A  and B show enhanced views on this region for the SANS data compared to the SANS curves calculated from the PDB structures. Interestingly, neither of the curves calculated from the PBD structures match the measured SANS data, suggesting that the solution structure of CorA cannot be described by any of these single structures, regardless of whether or not CorA is in the presence of Mg 2+. While SANS data provided information on the overall molecular shape of CorA in the two preparations, we used MAS NMR to obtain insight into structural changes at the residue-level length-scale. MAS NMR data were recorded on uniformly 13 C, 15 N-labelled CorA, reconstituted in 1,2-dimyristoylsn-glycero-3-phosphocholine (DMPC) lipid bilayers, in the presence or absence of Mg 2+.