Location data is frequently collected from populations and shared in
aggregate form to guide policy and decision making. However, the prevalence of
aggregated data also raises the privacy concern of membership inference attacks
(MIAs). MIAs infer whether an individual's data contributed to the aggregate
release. Although effective MIAs have been developed for aggregate location
data, these require access to an extensive auxiliary dataset of individual
traces over the same locations, which are collected from a similar population.
This assumption is often impractical given common privacy practices surrounding
location data. To measure the risk of an MIA performed by a realistic
adversary, we develop the first Zero Auxiliary Knowledge (ZK) MIA on aggregate
location data, which eliminates the need for an auxiliary dataset of real
individual traces. Instead, we develop a novel synthetic approach, such that
suitable synthetic traces are generated from the released aggregate. We also
develop methods to correct for bias and noise, to show that our synthetic-based
attack is still applicable when privacy mechanisms are applied prior to
release. Using two large-scale location datasets, we demonstrate that our ZK
MIA matches the state-of-the-art Knock-Knock (KK) MIA across a wide range of
settings, including popular implementations of differential privacy (DP) and
suppression of small counts. Furthermore, we show that ZK MIA remains highly
effective even when the adversary only knows a small fraction (10%) of their
target's location history. This demonstrates that effective MIAs can be
performed by realistic adversaries, highlighting the need for strong DP
protection.

在从群体中频繁收集和共享位置数据以指导政策和决策的过程中，存在成员推断攻击的隐私问题。本文提出了一种在汇总位置数据上进行零辅助知识攻击的方法，通过生成合适的合成轨迹，从而消除了对真实个体轨迹的辅助数据集的需求，并对偏差和噪音进行了校正。研究表明，这种方法在保护隐私机制应用之前仍然适用，且即使攻击者仅了解目标的一小部分位置历史也具有很高的有效性，因此强调了对差分隐私的强保护需求。