## 2 Heat Map Confusion
The **Area Coverage Recall**\(AC_{\text{Recall}}(T,T^{\prime})\) measures the proportion of cells in the original trace \(T\) that are preserved in \(T^{\prime}\). \[AC_{\text{Recall}}\big{(}T,T^{\prime}\big{)}=\frac{|C(T)\cap C(T^{\prime})|}{| C(T)|} \tag{3}\]  
Finally, the **Area Coverage F-Score**\(AC(T,T^{\prime})\) combines precision and recall into a single metric. It is computed as the mean of precision and recall as depicted in Equation (4):  
\[AC\big{(}T,T^{\prime}\big{)}=\frac{2\cdot AC_{\text{Precision}}(T,T^{\prime}) \cdot AC_{\text{Recall}}(T,T^{\prime})}{AC_{\text{Precision}}(T,T^{\prime})+ AC_{\text{Recall}}(T,T^{\prime})} \tag{4}\]  
\(AC(T,T^{\prime})\) ensures that the reconstructed mobility trace achieves both high precision and recall, reflecting a balance between retaining relevant details from the original trace and minimizing unnecessary noise. The process of modifying the heat map \(H\) begins by identifying \(U\), the most similar heat map according to the Topsoe Divergence, and \(V\), the heat map with the best overlap in visited areas, i.e., the best Area Coverage F-Score [2]. An area is defined as a single cell \(X_{i,j}\) of a given heat map \(X\), where \(X\in\{H,\,U,\,V\}\). \(X_{i,j}\) is considered to be visited when there is at least one record \((x,y)\) in the mobility trace \(T\) such that \((x,y)\in X_{i,j}\). Overlap between two heat maps consists of all cells \(X_{i,j}\), which are visited in both heat maps simultaneously. If \(H\) and \(U\) belong to different users, \(H\) is returned unchanged. In other cases, \(H\) is iteratively altered by blending it with \(V\). In each iteration step, the values in overlapping cells between \(H\) and \(V\) are increased, while values in non-overlapping cells are reduced, creating an altered heat map \(H^{\prime}\)[2]. The strength of this alteration is determined by an obfuscation factor \(\alpha\). This process continues until \(H^{\prime}\) becomes more similar to \(V\) than to \(U\) or until the maximum number of iterations is reached. If no suitable solution is found, \(V\) is used as the final heat map \(H^{\prime}\)[2]. For example, in a scenario where \(H\) has high activity in cells \(A\) and \(B\), heat map \(U\) has activity in cells \(B\) and \(C\), while heat map \(V\) shows activity in cells \(C\) and \(D\). The algorithm will iteratively reduce activity in cell \(A\) and increase it in cell \(D\). At the same time, it keeps some overlap in cell \(B\) to maintain general movement trends. The result is a new heat map \(H^{\prime}\) that protects privacy but still keeps the overall movement patterns useful for analysis. 3. **Mobility Trace Reconstruction:** After the heat map \(H\) is modified into the obfuscated heat map \(H^{\prime}\), the next step reconstructs an anonymized mobility trace \(T^{\prime}\) that corresponds to \(H\). In [2], this process is described in detail. Mobility Trace Reconstruction results in the reconstructed mobility trace \(T^{\prime}\) following the general patterns of movement seen in the original trace \(T\), such as frequent visits to a certain area and realistic travel routes [2]. However, the exact details of the original movements are altered to prevent reidentification. The entire process of HMC is displayed in Figure 2.  
HMC is especially effective in protecting against reidentification attacks, such as the AP-Attack, as defined in Section 5, which uses combined heat map data to identify users. By changing heat maps to hide specific user patterns, HMC reduces the uniqueness of mobility traces. Thus, it protects up to 87% of users against reidentification, with minimal loss of data utility [2].