GeoPointGAN: Synthetic Spatial Data with Local Label Differential Privacy

TL;DR

GeoPointGAN is a GAN-based method for generating synthetic spatial data that ensures high utility and strong privacy guarantees through label local differential privacy, outperforming existing solutions.

Contribution

We introduce GeoPointGAN, a novel GAN architecture with a point transformation generator and label local differential privacy, providing practical privacy guarantees for spatial data.

Findings

GeoPointGAN outperforms recent methods by up to 10 times in utility.

It maintains strong privacy with minimal utility loss.

Effective for privacy-preserving spatial data querying.

Abstract

Synthetic data generation is a fundamental task for many data management and data science applications. Spatial data is of particular interest, and its sensitive nature often leads to privacy concerns. We introduce GeoPointGAN, a novel GAN-based solution for generating synthetic spatial point datasets with high utility and strong individual level privacy guarantees. GeoPointGAN's architecture includes a novel point transformation generator that learns to project randomly generated point co-ordinates into meaningful synthetic co-ordinates that capture both microscopic (e.g., junctions, squares) and macroscopic (e.g., parks, lakes) geographic features. We provide our privacy guarantees through label local differential privacy, which is more practical than traditional local differential privacy. We seamlessly integrate this level of privacy into GeoPointGAN by augmenting the discriminator to the point level and implementing a randomized response-based mechanism that flips the labels associated with the 'real' and 'fake' points used in training. Extensive experiments show that GeoPointGAN significantly outperforms recent solutions, improving by up to 10 times compared to the most competitive baseline. We also evaluate GeoPointGAN using range, hotspot, and facility location queries, which confirm the practical effectiveness of GeoPointGAN for privacy-preserving querying. The results illustrate that a strong level of privacy is achieved with little-to-no adverse utility cost, which we explain through the generalization and regularization effects that are realized by flipping the labels of the data during training.