User Customizable and Robust Geo-Indistinguishability for Location Privacy

Geo-Indistinguishability (Geo-Ind), based on Differential Privacy, is a popular privacy notion of privacy used for protecting individual's location data. Existing approaches, to generate a Geo-Ind satisfying obfuscation function, rely on a server, as this generation is computationally expensive. As a result, these obfuscation functions are not modifiable by users and any customization will lead to weakening of the Geo-Ind privacy guarantees i.e., violation of constraints in the function. A non-customizable obfuscation function can map an individual to an undesirable location, leading to poor quality of service. We present a framework called CORGI, i.e., CustOmizable Robust Geo-Indistinguishability, which allows users to customize an obfuscation function and ensure it is robust i.e., after user customization only minimal number of Geo-Ind constraints are violated. The experimental results on a real-world dataset demonstrate the effectiveness of CORGI in generating obfuscation functions that are more robust against customization by users, e.g., removing 14.28% of locations from the range of the obfuscation function leads to 18.58% and 3.07% Geo-Indistinguishability constraint violations, when the obfuscation function is generated by prior approaches and CORGI respectively.