Balancing Functionality and GDPR-Driven Privacy in ISAC Trajectory Sharing

This paper proposes a Fisher Information Density-constrained framework for Integrated Sensing and Communications (ISAC) that ensures GDPR-compliant trajectory sharing by enforcing a local lower bound on estimation uncertainty, thereby guaranteeing quantifiable privacy limits while preserving data utility for downstream tasks.

The Gist

Imagine you are walking through a busy city. You have a smart phone that talks to cell towers. In the future, these towers won't just send you texts; they will also "see" you, tracking exactly where you are, how fast you're walking, and where you're heading. This is called ISAC (Integrated Sensing and Communications).

This "super-vision" is amazing for traffic management and helping self-driving cars avoid collisions. But there's a big problem: Privacy.

If a cell tower knows your exact path, it can figure out where you live, where you work, and even what kind of person you are. The European Union's GDPR (a strict privacy law) says: "Don't collect more data than you absolutely need."

The problem is a tug-of-war:

• To help the network: You need perfect, high-quality data.
• To protect your privacy: You need blurry, low-quality data.

Usually, engineers just add a little bit of "static" or "noise" to the data to blur it, like putting a foggy filter on a camera. But the authors of this paper say that's a bad idea. If a hacker is smart enough, they can use powerful computers to "clean" that fog and see you clearly again, especially if the cell tower is using a lot of power to sense you.

The Paper's Solution: The "Smart Blur"

The authors propose a new way to share your location data that acts like a smart, unbreakable blur. They call it the Fisher Information Density (FID) framework.

Here is how it works, using a simple analogy:

1. The "Resolution Meter"

Imagine the cell tower has a "Resolution Meter" that tells it exactly how clear its picture of you is at any given moment.

• If you are far away or the weather is bad, the picture is naturally blurry (Low Resolution).
• If you are close and the tower is using a super-powerful laser, the picture is crystal clear (High Resolution).

2. The "Privacy Guard"

The new system looks at this meter.

• If the picture is already blurry: The system says, "Great, it's already safe. We don't need to add any more fog. Let's keep the data useful!"
• If the picture is too clear: The system says, "Whoa, this is too dangerous. We must add fog right now."

3. The "Unbreakable Fog"

Unlike the old "random noise" method, this system adds a calculated amount of fog. It guarantees that no matter how powerful the hacker's computer is, or how much the tower increases its power, they can never see you more clearly than a specific limit.

Think of it like a glass wall with a permanent, magical smudge.

• You can see through it enough to know someone is walking by (useful for traffic).
• But you can never see their face clearly enough to recognize them (private).
• Even if you shine a super-bright flashlight at the glass, the smudge stays exactly the same size. The "smudge" is mathematically guaranteed.

Why is this better?

The paper tested this against the old "random noise" method using real walking data.

• The Old Way (Random Noise): It's like putting a random amount of salt on your food. Sometimes it's too salty (ruining the taste/utility), and sometimes it's not salty enough (letting a hacker taste the food). If the chef (the cell tower) uses a stronger stove (more power), the salt might evaporate, and the hacker sees everything.
• The New Way (FID): It's like a smart thermostat. It keeps the room temperature (privacy risk) exactly where you want it. If the sun comes out (more sensing power), the AC kicks in harder to keep the room cool. If the sun goes down, the AC turns off so you don't waste energy.

The Results

The researchers found that their method:

1. Keeps you safe: It ensures that a hacker can only guess your location correctly about 20% of the time, and never for more than 2 or 3 seconds in a row.
2. Keeps the data useful: Because it only blurs the data when absolutely necessary, self-driving cars and traffic systems can still use the data to predict where people are going.

The Bottom Line

This paper offers a "Goldilocks" solution for the future of smart cities. It allows cell towers to be helpful "eyes" for traffic and safety without becoming "spies" that track your every move. It uses math to create a hard, unbreakable wall around your privacy, ensuring that even if technology gets stronger, your secrets stay safe.

Technical Summary

1. Problem Statement

The paper addresses the critical tension between data utility and privacy compliance in Integrated Sensing and Communications (ISAC) systems.

• The Utility Need: ISAC systems enable trajectory sharing to enhance beamforming, resource allocation, and cooperative perception (e.g., for autonomous driving). Higher data quality and density improve movement prediction accuracy.
• The Privacy Constraint: Under the EU General Data Protection Regulation (GDPR), specifically the data minimisation principle, personal data must be limited to what is strictly necessary.
• The Challenge: Traditional privacy methods (like fixed-noise addition) fail in ISAC contexts because:
  1. ISAC sensing is opportunistic and adaptive, leading to heterogeneous uncertainty and non-uniform sampling.
  2. High-quality, densely sampled trajectory segments inherently encode precise location and behavioral data, posing severe privacy risks even if the data volume is small.
  3. Fixed noise levels cannot guarantee privacy across varying sensing powers or adversarial post-processing capabilities.

2. Methodology

The authors propose a Fisher Information Density (FID)-constrained trajectory sharing framework. This approach uses Fisher Information as a principled proxy for the "informativeness" of the data, linking it directly to estimation uncertainty.

A. System Model

• Context: A dual-task MIMO-ISAC system where a Base Station (BS) communicates with users and senses targets.
• Sensing Accuracy: The system estimates sensing accuracy using the Cramer-Rao Bound (CRB). The Fisher Information ($I_i$) is defined as the inverse of the CRB.
• FID Definition: The framework defines Fisher Information Density (FID), denoted as $J_i(t)$, as the continuous-time limit of the average Fisher information rate over a time window. This represents the instantaneous quality of the trajectory data.

B. Privacy Mechanism

Instead of adding fixed noise, the system dynamically injects controlled error based on the local FID:

1. Thresholding: A privacy threshold ($\eta$) is set for the FID.
2. Dynamic Noise Injection:
   • If $J_i(t) \leq \eta$ (low information content), no noise is added to preserve utility.
   • If $J_i(t) > \eta$ (high information content), noise is added. The noise standard deviation ($\Delta\sigma$) is a saturating function of the FID, increasing smoothly as the information density rises.
3. Guarantee: This ensures that the reconstruction error for any trajectory segment cannot fall below a prescribed threshold ($\epsilon$), regardless of the adversary's processing power or the original sensing power.

C. Evaluation Metrics

• Privacy: Measured by the Privacy Leak Ratio (PLR) (fraction of points reconstructable within error $\epsilon$), average leakage segment duration, and maximum leakage segment duration.
• Utility: Measured by movement prediction performance using a Long Short-Term Memory (LSTM) model, evaluated via position, velocity, and heading angle prediction errors.

3. Key Contributions

1. FID-Constrained Framework: A novel method to enforce GDPR data minimisation by bounding estimation uncertainty locally via Fisher Information, rather than globally via fixed noise.
2. Hard Privacy Guarantees: The framework provides a worst-case privacy guarantee. It ensures that no trajectory segment can be reconstructed beyond a specific accuracy threshold, independent of the adversary's capabilities or the ISAC system's sensing power.
3. Model-Agnostic Design: The criterion is interpretable and does not depend on specific sensing algorithms or adversarial models.
4. Quantitative Trade-off Analysis: The paper establishes a clear relationship between sensing power, FID thresholds, and the resulting privacy-utility trade-off.

4. Simulation Results

Simulations were conducted using the OpenTraj dataset (real-world pedestrian trajectories) with a MIMO-ISAC setup.

• Privacy Performance:
  • The proposed method successfully kept the average PLR below 20–25%.
  • The maximum leakage segment duration was bounded under 2–2.5 seconds.
  • Unlike fixed-noise baselines (which either offered negligible protection or destroyed utility), the FID-constrained method maintained these bounds even as sensing power increased from 15 to 50 dBm.
• Utility Performance:
  • In low-to-moderate sensing power regimes (<30 dBm), the utility (prediction error) remained comparable to the "no privacy protection" baseline.
  • In high-power regimes, utility was intentionally lower-bounded to satisfy the privacy constraint, aligning with the GDPR principle of exposing "no more data than necessary."
  • The method significantly outperformed fixed-error baselines (e.g., $\Delta\sigma = 0.7$), which caused excessive degradation in prediction accuracy even at lower power levels.

5. Significance

• Regulatory Compliance: This work provides a concrete, mathematically rigorous pathway for ISAC system designers to comply with GDPR's data minimisation principle, moving beyond theoretical compliance to enforceable technical constraints.
• Dynamic Adaptation: By tying privacy protection to the information density of the data rather than a static noise floor, the system optimizes the trade-off, preserving high utility for low-risk data while strictly protecting high-risk segments.
• Future ISAC Design: The paper lays the groundwork for "privacy-by-design" in 6G and next-generation networks, suggesting that future resource allocation algorithms should inherently account for privacy leakage bounds derived from Fisher Information.

In conclusion, the paper demonstrates that it is possible to share ISAC trajectory data for cooperative perception and network optimization while strictly adhering to privacy regulations, provided the sharing is constrained by the fundamental limits of estimation uncertainty (Fisher Information).