Entropy Ghost

Inspiration

Location data is one of the most sensitive forms of personal information, and we wanted to know just how much an attacker could infer from it. Using only publicly available datasets, we found that identifying someone's home from anonymized data was frighteningly easy. This motivated us to build Entropy Ghost - a privacy layer that uses differential privacy to protect users while preserving data utility.

What it does

Entropy Ghost applies Laplace noise to location coordinates, providing mathematically rigorous privacy guarantees. We validated it against a home location inference attack where without protection an attacker could pinpoint a user's home within 50–100 meters, but after adding Laplace noise this radius expanded 5-10x, making confident identification infeasible.

How we built it

We used Python to preprocess raw GPS trajectories from a public mobility dataset, implemented the Laplace mechanism with configurable epsilon, and built the home inference attack using clustering on nighttime location points across 182 users.

Challenges we ran into

Tuning the privacy-utility tradeoff was the main challenge - too much noise destroys data value, too little leaves users exposed. We also had to rigorously define what attack success means statistically, since privacy is only meaningful relative to a concrete threat model.

Accomplishments that we're proud of

We demonstrated that differential privacy actually works against realistic, quantifiable attacks. We expanded the home inference radius by 5-10x, making high-confidence identification infeasible, and built a complete end-to-end pipeline from raw GPS data to privacy-preserving output.

What we learned

Differential privacy works in practice, not just theory. Location patterns over time leak sensitive information like where you live. The privacy-utility tradeoff is real, but there's a sweet spot that protects users without destroying data value.

What's next for Entropy Ghost

We envision Entropy Ghost as a drop-in SDK for iOS/Android developers who want to collect location data responsibly, a data processing API for aggregators selling privacy-certified datasets, and potentially a platform-level integration with Apple or Google's location services.