  Statistics about traffic flow and people's movement gathered from multiple
geographical locations in a distributed manner are the driving force powering
many applications, such as traffic prediction, demand prediction, and
restaurant occupancy reports. However, these statistics are often based on
sensitive location data of people, and hence privacy has to be preserved while
releasing them. The standard way to do this is via differential privacy, which
guarantees a form of rigorous, worst-case, person-level privacy. In this work,
motivated by several counter-intuitive features of differential privacy in
distributed location applications, we propose an alternative privacy loss
against location reconstruction attacks by an informed adversary. Our
experiments on real and synthetic data demonstrate that our privacy loss better
reflects our intuitions on individual privacy violation in the distributed
spatio-temporal setting.
