## 3 Local Differential Privacy  
To ensure robust privacy protection for mobility data, the concept of \(\varepsilon\)-differential privacy is frequently used. It guarantees that the inclusion or exclusion of any single data entry in a database does not significantly alter the results of queries, thereby protecting individual user information [9]. Formally (see Equation (5)), an algorithm \(A\) satisfies \(\varepsilon\)-differential privacy if for all databases \(D_{1}\) and \(D_{2}\), differing by at most one element, and any possible outcome \(S\) of \(A\), the following condition holds:  
\[P[A(D_{1})\in S]\leq\varepsilon^{\varepsilon}P[A(D_{2})\in S] \tag{5}\]  
In this formula, \(\varepsilon\) represents the privacy budget, which controls the balance between privacy and data utility [9]. A smaller \(\varepsilon\) value means stronger privacy guarantees, because more noise is added to the data, making it harder to infer individual user details. However, this also reduces the usefulness of the data for analytical purposes. Conversely, a larger \(\varepsilon\) offers higher data accuracy but weaker privacy [9]. When applied to mobility data, this balance is particularly critical as even slight inaccuracies can disrupt transportation models or infrastructure planning. Thus, selecting an appropriate \(\epsilon\) value depends on the specific application and the sensitivity of the data [7, 8, 9]. In [16], [PERSON] et al. point out that there is no clear consensus on how to choose \(\varepsilon\) in an \(\varepsilon\)-differential privacy framework. The authors in [16] therefore suggest the creation of a publicly available communal body of knowledge about differential privacy implementations. Here, we use a similar \(\varepsilon\) as in [4] since our work builds on this approach. Unlike traditional differential privacy that requires a trusted data curator, LDP ensures privacy by allowing users to perturb their own data before sharing it. This protects individual trajectory data by guaranteeing that even if data is intercepted or analyzed, the original patterns remain private. In [4], LDPTrace, a concept for \(\varepsilon\)-local differential privacy for mobility data, is implemented. As HMC, LDPTrace works on a grid of rectangular cells covering the examined area. In order to implement LDPTrace, the following steps are performed:  
1. Feature Extraction: LDPTrace extracts three main features from individual user trajectories and obfuscates them with a privacy budget \(\varepsilon\): * Intra-trajectory Transitions: The movement between consecutive cells in a grid of a trajectory, capturing local movement behavior. * Start and End Points: Virtual markers indicate where trajectories begin and end, which helps in preserving trajectory structures. Figure 2: Heat Map Confusion—overview [2]. * Trajectory Length: A probability distribution is determined by a central data curator using the obfuscated trajectory lengths of each trajectory. * Frequency Estimation: To estimate frequencies for trajectory synthesis, Optimized Unary Encoding (OUE) is used for each of the features extracted. OUE represents each feature as a binary vector \(V\) of length equaling the maximal value of the feature, where \(V[i]=1\) at the index, which equals the feature value and zero otherwise. OUE adds noise to binary data to protect privacy before combining the data [3]. As depicted in Equation (6), the probability of a perturbed vector \(\hat{V}\) at index i being 1 is defined as \[P\big{(}\hat{V}[i]=1\big{)}=\left\{ \begin{array}{ll}\frac{1}{2},&\text{if }V[i]=1\\ \frac{1}{\sigma+1},&if\ V[i]=0\end{array} \right.\] (6) Here, \(\epsilon\) represents the privacy budget, with smaller values ensuring greater privacy at the cost of higher noise. This mechanism ensures that reconstructed trajectories retain key statistical properties, such as region transitions and visiting frequencies, while safeguarding individual user data.