## 2 Heat Map Confusion  
Heat Map Confusion (HMC) [1; 2; 6] is used to anonymize mobility traces. HMC is an LPPM designed to protect users' mobility data from reidentification attacks using detailed heat map representations of movement patterns. Unlike standard LPPMs, which mainly focus on small-scale mobility data, such as single location points, HMC works with broader mobility features. It converts user data into heat maps that show frequently visited places and overall movement trends (see Figure 1), as described in [2]. Main Principles of HMC  
1. **Heat Map Creation:** The first step in the HMC process is to turn a user's mobility trace \(T\). A mobility trace \(T\) of length \(n\) is a sequence of latitude, longitude, and timestamp: \(T=\left(\left\{\text{lat}_{1},\text{long}_{1},t_{1}\right\}\right)\), \(\left\langle\text{lat}_{2},\text{long}_{2},t_{2}\right\rangle\), \(\left\langle\text{lat}_{3},\text{long}_{3},t_{3}\right\rangle,\ldots,\left \langle\text{lat}_{n},\text{long}_{n},t_{n}\right\rangle\right)\) into a heat map \(H\). The heat map creation step involves dividing a specific geographical area into a grid of squares, where each cell represents a location. The intensity of each cell shows how often a specific user has visited that spot (see Figure 1). This approach makes raw GPS data more general, creating a wider view of movement patterns and hiding precise location details. 2. **Heat Map Alteration:** To anonymize the data, HMC changes each user's heat map by comparing and merging it with the heat map of a similar user from a reference set \(P\). This step ensures that the final heat map does not show unique patterns of the original user. To calculate the similarity of two different heat maps, the Topsoe Divergence is used. The **Topsoe Divergence** is a metric used to measure the dissimilarity between two heat maps \(P\) and \(Q\)[2; 15]. \[d_{\textit{Topsoe}}(P,Q)=\sum_{i,j}\left(P_{i,j}ln\left(\frac{2P_{i,j}}{P_{i,j }+Q_{i,j}}\right)+Q_{i,j}ln\left(\frac{2Q_{i,j}}{P_{i,j}+Q_{i,j}}\right)\right) \tag{1}\]  
Here, \(P_{i,j}\) and \(Q_{i,j}\) represent the probabilities at cell (\(i\),\(j\)) in the specific heatmap. The metric combines two terms: the first measures how \(P\) diverges from \(Q\), while the second evaluates how \(Q\) diverges from \(P\). A value close to zero indicates high similarity between the distributions, whereas larger values mean greater dissimilarity. The Topsoe Divergence is an asymmetric version of the Kullback-Leibler Divergence and therefore has a range between 0 and 2; see Tables 1-4. The merging process works step by step and starts with an original heat map \(H\) that needs to be obfuscated. For this process, two additional heat maps are selected from the entirety of known user profiles \(\mathcal{R}\): \(U\), the heat map that is the most similar to \(H\), determined by selecting the profile with the lowest Topsoe Divergence, and \(V\), the heat map that has the highest utility, determined by the most overlapping visited cells, which is defined as Area Coverage [2]. **Area Coverage (AC)** is a metric used to compare two mobility traces, \(T\) and \(T^{\prime}\), by checking how similar the areas they cover are. This metric is important because it helps determine how well an anonymized mobility trace keeps the useful patterns of the original one. AC includes three components: precision, recall, and F-score. The **Area Coverage Precision**\(AC_{\text{Precision}}(T,T^{\prime})\) measures how much of the reconstructed trace \(T^{{}^{\prime}}\) overlaps with the original trace \(T\). \[AC_{\textit{Precision}}\left(T,T^{\prime}\right)=\frac{|C(T)\cap C(T^{\prime} )|}{|C(T^{\prime})|} \tag{2}\]  
Figure 1: Single trajectory of the San Francisco Cabspotting data transformed into a heat map with rectangular grids, where the colors stand for the number of data points in a rectangle. Here, \(C(T)\) represents the set of all cells visited in \(T\), and \(C(T^{\prime})\) is the set of all cells visited in \(T^{\prime}\).