## 4 Combination of HMC and LDPTrace  
HMC and LDPTrace focus on different aspects of privacy and data utility in mobility data. HMC is designed to protect large-scale mobility patterns by creating and modifying heat maps that represent user traces. It changes these heat maps to look similar to those of other users, which helps protect overall mobility trends and frequently visited areas; see Figure 2. This makes HMC effective against attacks that try to identify users based on their general movement behavior. However, it does not focus on protecting individual data points.  
On the other hand, LDPTrace uses \(\varepsilon\)-differential privacy to anonymize data at a more detailed level. It adds noise to individual data features and uses probabilistic models to preserve patterns like region transitions and trajectory statistics. This makes LDPTrace better for applications that need detailed data, as it balances privacy and accuracy for each point. While HMC works well for protecting general mobility trends, LDPTrace provides stronger protection for specific data points.  
While LDPTrace protects the individual trajectories of a person, the trajectories are only useful in an aggregated form, e.g., in the form of heat maps. Because the central data curator generates synthesized trajectories using aggregated probability distributions of individual features of a trajectory, there is no direct link between an original trajectory and a synthesized trajectory. However, an aggregated heat map can also change during the execution of LDPTrace, as Figure 3 shows. Here, LDPTrace was applied to all Cabspotting data from San Francisco [18]. We measure these central changes in the heat map with the Topsee Divergence; see Section 2.  
In this paper, we combine HMC with LDP and, in particular, with LDPTrace. We thus utilize the strength of each method. This is performed according to the following sequential approach:  
* Synthetic Trajectory Generation with LDPTrace: First, LDPTrace creates synthetic mobility traces based on real mobility data from the San Francisco taxi dataset. These synthetic trajectories simulate movement patterns without directly revealing actual user locations. By introducing randomness in location data, LDPTrace makes it difficult to link specific movements to real individuals while maintaining patterns that resemble real-world data.
* Heat Map Confusion on Synthetic Data: Once the synthetic trajectories are generated, HMC further anonymizes the data. HMC creates heat maps from these synthetic traces and then alters them by merging similar patterns. This step reduces the likelihood of  
Figure 3: Visualization of the San Francisco Cabspotting dataset (**left**), together with a 6 \(\times\) 6 heat map of the original dataset (**middle**) and a corresponding heat map of the synthesized trajectories (**right**).  
reidentification based on movement patterns, as individual traces are grouped into less specific patterns. By transforming synthetic data into altered heat maps, this combined approach provides additional protection for individual locations and routes.  
However, while the computation of a heat map of a synthesized trajectory preserves \(\varepsilon\)-differential privacy because of the post-processing immunity--see [19]--the heat map alteration algorithm according to [2] does not. This is why in the following section we focus on reidentification attacks instead of a privacy budget on the one side and a utility metric, i.e., Topsee Divergence, on the other side.