Location data is frequently collected from populations and shared in
aggregate form to guide policy and decision making. However, the prevalence of
aggregated data also raises the privacy concern of membership inference attacks
(MIAs). MIAs infer whether an individual's data contributed to the aggregate
release. Although effective MIAs have been developed for aggregate location
data, these require access to an extensive auxiliary dataset of individual
traces over the same locations, which are collected from a similar population.
This assumption is often impractical given common privacy practices surrounding
location data. To measure the risk of an MIA performed by a realistic
adversary, we develop the first Zero Auxiliary Knowledge (ZK) MIA on aggregate
location data, which eliminates the need for an auxiliary dataset of real
individual traces. Instead, we develop a novel synthetic approach, such that
suitable synthetic traces are generated from the released aggregate. We also
develop methods to correct for bias and noise, to show that our synthetic-based
attack is still applicable when privacy mechanisms are applied prior to
release. Using two large-scale location datasets, we demonstrate that our ZK
MIA matches the state-of-the-art Knock-Knock (KK) MIA across a wide range of
settings, including popular implementations of differential privacy (DP) and
suppression of small counts. Furthermore, we show that ZK MIA remains highly
effective even when the adversary only knows a small fraction (10%) of their
target's location history. This demonstrates that effective MIAs can be
performed by realistic adversaries, highlighting the need for strong DP
protection.

在从群体中频繁收集和共享位置数据以指导政策和决策的过程中，存在成员推断攻击的隐私问题。本文提出了一种在汇总位置数据上进行零辅助知识攻击的方法，通过生成合适的合成轨迹，从而消除了对真实个体轨迹的辅助数据集的需求，并对偏差和噪音进行了校正。研究表明，这种方法在保护隐私机制应用之前仍然适用，且即使攻击者仅了解目标的一小部分位置历史也具有很高的有效性，因此强调了对差分隐私的强保护需求。

聚合位置数据的零辅助知识成员推理攻击

A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate  Location Data

Privacy policies provide individuals with information about their rights and
how their personal information is handled. Natural language understanding (NLU)
technologies can support individuals and practitioners to understand better
privacy practices described in lengthy and complex documents. However, existing
efforts that use NLU technologies are limited by processing the language in a
way exclusive to a single task focusing on certain privacy practices. To this
end, we introduce the Privacy Policy Language Understanding Evaluation (PLUE)
benchmark, a multi-task benchmark for evaluating the privacy policy language
understanding across various tasks. We also collect a large corpus of privacy
policies to enable privacy policy domain-specific language model pre-training.
We demonstrate that domain-specific pre-training offers performance
improvements across all tasks. We release the benchmark to encourage future
research in this domain.

通过多种任务的评估，我们介绍了隐私政策语言理解评估（PLUE）基准，并收集了大量的隐私政策，以促进未来该领域的研究；同时，我们证明了领域特定的预训练对所有任务都有性能提升。