PRISMA: Differentially Private Synthetic In-Car Telemetry via Differentiable Simulation

PRISMA: Differentially Private Synthetic In-Car Telemetry via Differentiable Simulation

arXiv:2610.35521v1 [cs.CR] 26 Oct 2026

Kilian Zeiseweis∗ BIH at Charité kilian.zeiseweis@bih-charite.de

Nele Sophie Brügge∗ DFKI nele.bruegge@dfki.de

Ali Raza HRI Europe GmbH ali.raza@honda-ri.de

Esfandiar Mohammadi University of Luebeck esfandiar.mohammadi@uni-luebeck.de

Abstract

nologies. However, vehicle telemetry is inherently privacysensitive. Fine-grained speed profiles, location traces, and auxiliary sensor readings can reveal an individual’s daily routine, home address, and behavioral patterns. Synthetic data generation enables data sharing while mitigating privacy risks. By releasing artificial data that preserves important statistical properties of real-world observations, organizations can support downstream research without exposing sensitive records. A natural way to obtain formal privacy guarantees is to apply an established differentially private (DP) tabular synthesis algorithm directly to the raw trace. For time series data, this is unattractive: known DP lower bounds show that the achievable privacy–utility trade-off degrades with the square root of the number of released dimensions. Therefore, directly synthesizing every time step is a poor fit for high-resolution time series data. Especially for more complex time series, like vehicle telemetry, generating synthetic data that is simultaneously realistic and accompanied by formal privacy guarantees remains an open challenge. Our key observation is that an energy-consumption trace for a single trip has much lower intrinsic dimensionality than the trace itself. Given the trip’s start and end coordinates, the vehicle model, and a small number of behavioral parameters (how aggressively the trip was driven and how much detouring occurred), a physics simulation over publicly available map data (road network, elevation) and a public vehicle catalog can reconstruct a trace that closely resembles the real one. We propose P RISMA as an algorithm that synthesizes only the low-dimensional descriptor under DP and reconstructs the trace from this descriptor as a public, privacy-free postprocessing step. Our algorithm works in three stages: In the encoding stage, using public data, a differentiable physics simulation is fit to each real trace. The simulation produces a compact per-trip descriptor (start/end point, aggressiveness, detour factor, and a discrete vehicle choice) via gradient-based optimization. In the DP synthesis stage, the resulting table of descriptors is used to train the query-based DP tabular synthesis algorithm AIM [27], selecting informative low-order marginal queries adaptively. A synthetic descriptor table is

Differentially private synthesis of in-car energy consumption data is challenging because the output is high-dimensional, and known lower bounds show that the privacy-utility tradeoff degrades with the square root of the number of output dimensions. However, we observe that the intrinsic dimensionality of in-car energy consumption is much lower than that of the raw trace: given a small set of contextual personal variables–such as start point, end point, the car model, and the driving behavior–the consumption profile can be largely explained by publicly available map data (including elevation) combined with a physical model of vehicle energy use. We exploit this low intrinsic dimensionality in PRISMA, a Privacy-preserving In-car Synthesis and Modelling Algorithm. PRISMA involves three stages: (i) energy consumption traces are encoded into a low-dimensional latent space; (ii) the distribution of latent vectors is synthesized using the differentially private tabular data synthesis algorithm AIM, and (iii) samples drawn from this distribution are decoded back into full energy consumption traces via a differentiable physicsbased simulation, a step that consumes no additional privacy budget since it uses only public information. By using a compact, physically-grounded latent representation of the traces, PRISMA significantly reduces the effective output dimension. Our experimental results show that PRISMA achieves for a competetive ε = 0.5 a better data synthesis performance than prior tabular and marginal-based DP synthesis baselines by preserving the diversity of the original power consumption profiles without collapsing to a small set of modes.

1

Marven Kummerfeldt University of Luebeck marven.kummerfeldt@uni-luebeck.de

Introduction

Modern vehicles continuously generate large volumes of telemetry data through onboard sensors and electronic control units. These data capture driving behavior, vehicle dynamics, environmental conditions, and energy consumption, supporting a wide range of applications: energy-efficiency modeling, intelligent transportation systems, and driver-assistance tech1

B0 TimeGAN GRU LSTM DiffWave DDPM Flow Matching CSDI PRISMA 0

50 ACF dist.×floor ←

100

0

10

20

0.98

FID×floor ←

1

0

Precision →

0.5

1

Recall →

Figure 1: Generation fidelity and diversity comparison under differential privacy (ε = 0.5). Evaluation of PRISMA against baseline synthesis models (← means lower is better and → higher is better) across the three fidelity metrics ACF distance (autocorrelation, correlations over time), FID (Fréchet distance, Gaussian trajectory distribution discrepancy), and sample-level Precision (closeness to a real data points), and the diversity metric Recall (coverage of real data distribution). Error bars denote standard deviation across 15 runs. ACF and FID are reported as multiples of the empirical null floor, where a value of k × floor indicates the distance is k times worse than the distance between two splits of real holdout data.

2

then sampled directly from the fitted model. In the decoding stage, the same physics simulation is re-run forward on each synthetic descriptor to produce a full synthetic energy trace. Since this step only uses public inputs and the already private descriptor, it is DP-preserving post-processing and costs no additional privacy budget [13]. Prior DP synthesis methods target tabular data [27, 34, 44, 46] or time series [1, 14] directly. While the latter are tailored to high-dimensional temporal data, they do not exploit prior domain knowledge to reduce its dimensionality. Separately, simulation-based approaches are widely used to study driver behavior and vehicle energy consumption. P RISMA combines both and uses a differentiable physics simulation to encode each trace into a compact descriptor, which can then be synthesized with standard DP tabular methods. To our knowledge, combining simulation-based dimensionality reduction with DP synthesis has not yet been explored. We make the following contributions:

2.1

Background Differential Privacy

Differential privacy (DP) [12, 13] provides a formal definition of privacy loss when releasing statistics computed over a sensitive dataset. A randomized mechanism M satisfies (ε, δ)DP if, for any two neighboring datasets D and D′ differing in at most one individual’s record and any output set S: Pr[M (D) ∈ S] ≤ eε · Pr[M (D′ ) ∈ S] + δ. The parameter ε bounds privacy loss (smaller is stronger) and δ is a failure probability, set to 10−5 throughout this work. The Gaussian mechanism achieves (ε, δ)-DP by adding noise N (0, ∆2 σ2 ) calibrated to the ℓ2 -sensitivity ∆ of the released function [13]. A key property used in P RISMA is post-processing: any computation applied to the output of a DP mechanism without further access to the sensitive data is itself DP at the same (ε, δ) [13]. This is what allows P RISMA’s decoding stage to run without spending any additional privacy budget.

• We identify that in-car energy telemetry has low intrinsic dimensionality relative to the raw trace and show that this can be exploited by decoupling encoding/decoding (physics simulation) from distribution synthesis (tabular DP synthesis on a compact descriptor).

2.2

Differentiable Programming

Differentiable programming enables gradients to be computed automatically through an entire program, including programs with control flow and data structures [3]. The parameters of a simulation can therefore be adjusted with gradient-based optimization so that its output better matches observed data. In the context of this work, gradients of the simulated trace with respect to the simulation parameters are used to fit a low-dimensional representation of each trip. A practical challenge is posed by operations that are not differentiable, such as conditions, comparisons, and discrete switches. Before

• We design P RISMA’s encoder, which fits a per-trip descriptor to a real trace via gradient-based optimization through a differentiable physics simulation, and its decoder, which reconstructs a synthetic trace from a descriptor using the same simulation as public postprocessing. • We evaluate P RISMA against a range of suitable (DP) time series synthesis models. 2

gradient-based optimization can be applied, these operations are replaced with smooth, differentiable approximations.

A prominent class of query-based methods combines marginal selection with probabilistic graphical models. MWEM+PGM [28] constructs a junction tree from a workload of noisy marginals and generates synthetic data from the resulting graphical model. It iteratively identifies poorly approximated marginals, measures them privately, and refines the graphical model. AIM [27] improves this framework through informed initialization, workload-aware candidate selection, adaptive budget allocation, and an improved privacy analysis. Model-based methods learn a generative model under differential privacy and sample from it. DPGAN [38] applies DP-SGD to the discriminator, clipping per-example gradients and adding Gaussian noise. PATE-GAN [42] replaces the discriminator with a PATE ensemble of teachers whose noisy aggregated labels train a student discriminator. For tabular data, CTGAN [39] uses conditional generation and a modespecific loss to handle mixed discrete–continuous columns. Its DP variants, DP-CTGAN and PATE-CTGAN, combine this architecture with DP-SGD or PATE, respectively [15]. Recent DP time series models follow the same DP-SGD approach. For example, [1, 14] apply DP-SGD to recurrent and GAN-based time series generators.

Differentiable simulation. A differentiable simulation can be represented as a discrete-time state-space model [37]. At time step k, the current state x(k) and input u(k) are mapped to the next state by x(k + 1) := f (x(k), u(k)) and to the output by y(k + 1) := g(x(k), u(k)), where f is the state-transition function and g is the output function. The simulation S := ( f , g) is differentiable when both mappings are differentiable with respect to their inputs and parameters. If conditions, comparisons, or discrete switches are required internally, they are replaced with smooth relaxations, for example, using sigmoid functions for binary conditions or softmax for discrete choices, so that gradients can be propagated through the entire simulation.

3 3.1

Related Work Synthetic Time Series Generation

Non-Private time series generation. Generative modeling of time series data has developed along architectures that explicitly account for temporal dependencies. Early neural approaches mainly used recurrent [7, 20] and adversarial architectures [23,41]. TimeGAN [41] combines an autoencoderbased embedding with supervised and adversarial objectives to jointly learn the latent representation and temporal dynamics of sequences, while TimeVAE [11] instead uses a variational autoencoder. DoppelGANger [23] models static attributes together with time-varying signals using a generative adversarial architecture with autoregressive generation. More recently, diffusion models have emerged as a powerful alternative. DiffWave [21] applies denoising diffusion to one-dimensional temporal signals, while CSDI [32] uses temporal and feature-wise attention to model multivariate series. Diffusion-TS [43] combines diffusion with a decomposition into trend- and Fourier-based seasonal components, and DiffTime [9] conditions the diffusion process on temporal constraints such as trends and fixed points. Flow-matching approaches use a related formulation based on learning continuous transport paths between distributions [24, 26].

3.2 Simulation-Based Approaches for Driver and Vehicle Modeling Simulation-based inference has received growing attention in recent years, particularly for inferring the behaviour of physical systems from observed data [10, 18]. Differentiable programming frameworks [3] have recently made it practical to differentiate through such simulations endto-end by replacing non-smooth operations (routing decisions, discrete choices) with smooth or straight-through approximations. P RISMA applies these techniques to fit a compact descriptor to each real trip and to reconstruct traces from synthetic descriptors, and combines this with DP tabular synthesis on the descriptor. Prior work on privacy in vehicular settings has largely focused on location privacy [40] and anonymization of GPS trajectories [25]. Combining a physics-based reduction of trace dimensionality with DP tabular synthesis, as P RISMA does, has not been explored previously to our knowledge.

Differentially-private approaches. Differentially private synthetic data generation can be broadly categorized into query-based and model-based methods. Query-based methods release input data statistics and construct a synthetic dataset consistent with them. Model-based methods learn a generative model and sample from it [28, 38, 42, 44]. Query-based approaches [2, 27, 36] commonly use marginal queries as they provide an expressive representation of attribute distributions while decomposing synthesis into tractable subproblems. Prior studies indicate that marginal-based methods often achieve a strong privacy-utility trade-off for tabular data [6].

4

PRISMA

P RISMA is designed to synthesize realistic in-car energy consumption traces. The main idea is to find a low-dimensional representation of the power trajectories that can be synthesized under differential privacy, and then to reconstruct the full traces from this representation using the differentiable simulation. Figure 2 illustrates the overall pipeline. The full process of synthesizing a dataset of traces can be seen in three 3

Public, data-independent inputs – no privacy cost: OpenStreetMap drive graph over a fixed bounding box · EPA vehicle catalogue · vehicle power equation · efficiency η = 0.30 · bin grids and ranges · the 500 s horizon · the row count N

Real traces N trips

Encode fit 3 numbers per trip

Descriptor table N×7

Synthesize AIM on public bins

Synthetic table N×7

Decode route → profile → driver → power

Synthetic traces

post-processing: no privacy cost

Figure 2: The P RISMA pipeline. The encoder fits a low-dimensional representation of each real trace using a differentiable physics simulation. The resulting descriptor table is synthesized under differential privacy using AIM. Due to the post-processing property of DP, the decoder can reconstruct full synthetic trajectories from the synthetic representation without spending additional privacy budget. stages: (i) encoding, (ii) synthesis, and (iii) decoding, which are described in detail in the following sections. In general, P RISMA can be seen as an autoencoder-like architecture, where the encoder maps a high-dimensional input (the real trace) to a low-dimensional latent space (the representation), and the decoder reconstructs the high-dimensional output (the synthetic trajectory) from the latent representation. The key difference is that the encoder and decoder are based on a differentiable physics simulation. This allows us to incorporate fine-grained domain knowledge about the underlying physical processes, which enables a realistic reconstruction of the traces from a low-dimensional representation that can be synthesised under differential privacy.

4.1

drag coefficient, and rolling resistance of a set of vehicles built and tested in the years 2000 to 2016. The idea behind using a public pool of vehicles is to reduce the dimensionality of the representation by only allowing a discrete set of vehicles to be chosen from, rather than allowing a continuous range of vehicle parameters. Further, they pin down the physics of the vehicle to realistic values, which is necessary to reconstruct a realistic power trace in the subsequent modeling steps. Together, they form a set of public parameters P that are used in the forward simulation S to compute the power trace from the low-dimensional representation of a trip. The public parameters are assumed to be known and do not contain any sensitive information about the individual trips, and therefore do not need to be protected under differential privacy.

Public Parameters

One of the key ideas of P RISMA is to leverage public domain knowledge about the physics of vehicles and the environment in which they operate to reduce the dimensionality of the representation. In order to reconstruct a realistic power trace from the low-dimensional representation of a trip, the forward simulation S requires a set of public parameters p. In detail, the following public parameters are assumed to be available and are therefore not part of the private representation d:

4.2

Latent Representation

The latent representation, in contrast to the public parameters, is a low-dimensional representation of a trip that contains all the information necessary to reconstruct the power trace using the forward simulation S . It is the result of the encoding stage (see Section 4.4) and is used as input to the decoding stage (see Section 4.6). The latent representation is designed to be low-dimensional, so that it can be synthesized under differential privacy without losing too much utility. Each trip is summarised by a representation d = (φs , ψs , φe , ψe , α, δ, κ) with seven fields: the start and end latitude/longitude (φ, ψ), a scalar aggressiveness α ∈ [0, 1] describing how aggressively the trip was driven, a scalar detour factor δ describing how much longer than the shortest path the route ran, and a categorical vehicle choice κ drawn from a released pool of EPA candidate vehicles V . Table 1 lists the fixed, public discretisation grids used when the descriptor table is later handed to AIM (Section 4.5). These grids are chosen before any data is read and do not depend on the dataset, so choosing them costs no privacy budget.

(i) A public road network. This is extracted from OpenStreetMap [30] (OSM) and contains the road segments, their lengths, and speed limits. It was processed using OSMnx [4]. The road network is used to compute the route between the start and end points of the trip. (ii) A public elevation map. It is used to compute the slope of the road segments, which is necessary to compute the gravitational force acting on the vehicle. The elevation map was obtained from the Terrain Tiles archive of public elevation data [33]. (iii) A public pool of candidate vehicles V derived from the EPA’s fuel economy database [35]. It contains the mass, 4

Table 1: Representative fields of domain D and their fixed public discretisation grids. The evaluated bounding box gives roughly 1 km resolution per bin over the region covered by the ground-truth data. Symbol Field (φs , ψs ) (φe , ψe ) α δ κ

Domain

(i) Snap start and end points to the road network. The start and end coordinates (φs , ψs ) and (φe , ψe ) of the trip are snapped to the nearest road segments in the public road network. This ensures that the routing is performed on valid roads.

Bins

(ii) Route computation. Using the snapped start and end points, the shortest path is computed using Dijkstra’s algorithm for weighted graphs, where the weights are based on the length of the road segments. The resulting route is a sequence of road segments that connect the start and end points.

bbox1

Start lat. / lon. 32 × 32 End lat. / lon. bbox1 32 × 32 Aggressiveness [0, 1] 16 Detour [1.0, 2.5] 16 Vehicle EPA pool |V |

Representation

(iii) Unfold the route. The resulting route is unfolded into a sequence of waypoints along the road segments, resulting in a sequence of edges and their corresponding arc lengths li . The total length of the route is then computed as L = ∑i li . From this, a sequence of arc lengths s = (s1 , . . . , sS ) is constructed, where S is the number of waypoints along the route and si = ∑ij=1 l j .

D

Differentiable Simulation S

Preprocessing

Public Parameters Routing

Driver Model

È

'

U

OSM

Elevation

Æ

ˆ

(iv) Sample Speed Limit and Elevation. For each edge in the route, the speed limit u and elevation θ are sampled from the public road network data. This information is used to compute the drivable speed and the energy consumption in the subsequent steps.

Vehicle Power Model

Power Trajectory

W

(v) Constrain the drivable speed. Each junction along the route that has a traffic signal or stop sign lowers the drivable speed u to a creep speed ustop for a short distance. The drivable speed is computed as a smooth envelope that respects the speed limits and the junction constraints.

¢

Figure 3: The forward simulation S takes as input a trip representation d and public parameters p to produce a power trace. The pre-processing step computes the route from the start and end points of the trip, which is then used by the differentiable driver and vehicle models to compute the power trace.

4.3

This information is then used by the differentiable driver and the differentiable vehicle model to compute the power trajectory. 2. Modeling the driver. As shown in Figure 3, the second step of the forward simulation and the first step that is part of the differentiable simulation is the driver model. It consumes the route information (s, u, θ, L) from the previous routing step and the aggressiveness α, the detour factor δ, and the vehicle index κ from the trip representation d to compute a trace of the actual vehicle’s speed and acceleration over time. The procedure for the driver model is shown in Algorithm 1, which was inspired by Gipps’ car-following model [17]. The driver model is a simple proportional controller that tries to follow the speed limit while respecting the vehicle’s acceleration and deceleration limits. The aggressiveness α scales the maximum acceleration and deceleration, while the detour factor δ scales the length of the route. The driver model computes the target speed at each time step based on the current position along the route and the remaining distance to the end of the trip. The actual speed is then updated based on the target speed and the acceleration limits.

Forward Simulation Model

The physics of vehicles is well understood and can be expressed as a set of formulas and mechanistic models. The forward simulation S takes as input a representation of a trip d ∈ D and a set of public parameters p ∈ P , and outputs a power trace W ∈ RT , where T is the number of time steps in the trajectory S : D × P −→ RT . Figure 3 illustrates the simulation process. The following five steps are performed in order to compute the power trace from the trip representation d and public parameters p. 1. Routing. The routing is part of the pre-processing step before the actual simulation of the vehicle. The idea is to take the start and end points of the trip and compute the shortest path between them using the public road network. This route is then used in the differentiable simulation to compute the power trace. The algorithm works as follows: 5

tery Ptank based on the mechanical power at the wheels, the marginal tank-to-wheel efficiency η, the recuperated fraction r, and the idle power draw Pidle using Eq. 2.

Algorithm 1: Æ Driver Model Input: Profile (s, u, θ, L) of S points from the Algorithm in Section 4.3; detour δ, aggressiveness α, vehicle index κ; horizon T , time step ∆t Data: Public constants: acceleration ceiling A, brake fraction β, control gain K Output: Power trace p̂ ∈ RT

  Pwheel = mv + ρ2 Cd A v2 + Bv +Crr mg + mg sin θ v.

(1)

The reason behind this two-step calculation is that the mechanical power at the wheels is a function of the vehicle’s physical properties and the driving conditions, while the power drawn from the fuel tank or battery also depends on the efficiency of the powertrain and other factors, like peripheral power draw.

s ← δ · s; L ← δ · L; θ ← θ/δ; ∆s ← L/(S − 1) ; // Scale route for detour δ 2 amax ← α A; b ← β amax ; // acceleration ceiling and comfortable braking q
max ← min u , 2 (vmax 3 vi i i+1 ) + 2b ∆s for i = S, . . . , 1, 1

with vmax S+1 = 0 ; // backward pass: brake into what lies ahead

Ptank =

x ← 0; v ← 0 ; // position along the route (m) and speed (m/s) 5 for t ← 1 to T do 6 d ← max(L − x − v ∆t, 0) ; // distance still to drive, one step ahead √
⋆ 7 v ← min vmax (x), 2b d ; // target: road ahead vs. arrival
8 α ← clip K (v⋆ − v), −amax , amax ; // acceleration this step (m/s2 ) 9 p̂t ← vehiclePower(κ, v, α, θ(x)) ; // mechanical power at the wheels (W) 10 x ← x + v ∆t; v ← max(v + α ∆t, 0); 11 end 12 return p̂; 4

max(Pwheel , 0) + r min(Pwheel , 0) + Pidle . {z } |{z} | η | {z } idle recuperated

(2)

propulsive

The tractive force is computed using the standard longitudinal road-load form, which takes into account the vehicle’s mass, frontal drag area, rolling-resistance coefficient, and the gravitational force due to the road slope. The tank power, on the other hand, is computed based on the mechanical power at the wheels, the marginal tank-to-wheel efficiency η, the recuperated fraction r (in the case of hybrid or electric vehicles), and the idle power draw Pidle . The vehicle model is differentiable with respect to the vehicle index κ, which is crucial for the overall differentiability of the forward simulation and enables the use of gradient-based optimization methods to fit the low-dimensional representation of the trips.

While the driver model is a simplification of real-world driving behavior, it captures the essential dynamics of acceleration and deceleration in response to speed limits and road conditions. The model is differentiable with respect to the aggressiveness α and the detour factor δ, allowing for gradient-based optimization during the encoding stage.

4.4

Encoding

During encoding, each observed power trace is mapped to a low-dimensional latent representation. A simulated trace is generated from this representation by the differentiable physics model, and its parameters are adjusted to minimize the discrepancy between the simulated and observed traces. Because the simulation is differentiable with respect to these parameters, this adjustment can be performed using gradientbased optimization.

3. Modelling the vehicle. During the forward simulation in Algorithm 1, the vehicle model computes the power drawn from the fuel tank or battery based on the current speed, acceleration, and road slope. Therefore, the vehicle model takes as input the vehicle index κ, the current speed v, the current acceleration α, and the road slope θ to compute the power at time step t. The calculation is done in two steps:

Fitting the Representation. For each observed trip i, a descriptor is estimated to best reproduce the measured power trace Wi . The trip endpoints ei = (φs , ψs , φe , ψe ) are read directly from the trace and held fixed. Only the remaining descriptor variables are fitted: aggressiveness α, detour factor δ, and candidate-vehicle index κ. For a proposed set of values (α, δ, κ), a simulated trace is produced by the forward simulation S from these variables, the fixed endpoints, and the public parameters p. The fitted

1. Compute the mechanical power at the wheels Pwheel based on the vehicle mass, frontal drag area, rollingresistance coefficient, and the gravitational force due to the road slope using Eq. 1. 2. Compute the power drawn from the fuel tank or bat6

values are selected such that the loss L between the simulated and observed traces is minimized: (α⋆i , δ⋆i , κ⋆i ) = arg min L S (ei , α, δ, κ; p) Wi

and λS for energy, duration, and shape, respectively. The loss function is given by "  2  2 1 Êi − Ei D̂i − Di L = ∑ λE + λD n i Ei Di # (6)
2 λS + ∑ ŝi,t − si,t T t

(3)

(α,δ,κ)

The loss is defined in the next paragraph. This problem is solved independently for each trip. Because the simulator is differentiable with respect to the fitted variables, the reconstruction loss can be reduced iteratively by a gradient-based optimizer. During fitting, the categorical vehicle selection is represented by the simulator’s differentiable relaxation. After optimization, it is resolved to a single candidate vehicle. The resulting descriptors {d⋆i }ni=1 are used as the input table to the DP synthesis stage.

4.5 Data Synthesis in the Representation Space (AIM) For the synthesis in P RISMA’s representation space, we use the Adaptive and Iterative Mechanism (AIM) [27]. We choose AIM since it was the best-performing mechanism in the TAB B ENCH evaluation [6]. Here, we summarise the aspects of AIM relevant to our work. AIM follows the select-measure-generate paradigm common to marginal-based DP synthesis mechanisms. Under this paradigm, algorithms iteratively select a set of queries (such as low-dimensional marginals) to measure, privately measure them by adding noise, and then post-process the noisy measurements to construct a generative model from which synthetic records are sampled.

Loss Function. The loss function L essentially is a weighted sum of differences between the simulated and real power traces. Each trip i is scored by three relative residuals between its real power trajectory Wi and the simulated power trajectory Ŵi : 1. Energy Residual: The first residual is the total energy consumed during the trip. For a given sample interval of ∆t = 1 s, the total energy is computed as the sum of the power trace over all time steps: Ei = ∆t · ∑t Wi,t .

Data Model and Workload Error Let D be a sensitive dataset consisting of N records, where each record x ∈ D is a d-tuple over a finite domain Ω = Ω1 × · · · × Ωd . A marginal query Mr for a subset of attributes r ⊆ [d] computes a vector of counts over the marginal domain Ωr , which is of size nr = |Ωr |. A workload W = {(r1 , c1 ), . . . , (rk , ck )} consists of a collection of marginal queries ri paired with positive weights ci ≥ 0. The utility of the synthetic dataset D̂ is evaluated using the weighted, normalized L1 workload error [10]:

2. Duration Residual: The second residual is the total duration of the trip, which is simply the number of time steps in the power trace. However, since the duration of a trip is defined by the number of time steps in the power trajectory before the trace falls to zero, we define a soft duration residual that is computed as follows:   2 Di = ∆t ∑ 1 − e−((pi,t /θP) ) (4) t

where pi,t is the power at time step t, θ is a threshold parameter, and P is the span of power to road-load model admits over its public parameter. This soft duration residual allows for a differentiable approximation of the trip duration necessary for gradient-based optimization.

Error(D, D̂) =

k 1 ci ∥Mri (D) − Mri (D̂)∥1 ∑ k · |D| i=1

(7)

Algorithmic Components AIM optimizes the selectmeasure-generate pipeline by incorporating four primary design enhancements over the earlier MWEM+PGM [28] instantiation of this paradigm:

3. Shape Residual: The third residual is the shape of the power trace. It is computed as the cumulative distribution function (CDF) of the power trace. The shape residual is defined as follows:  .  si,t = ∑u≤t pi,u (5) ∑u≤T pi,u

1. Initialization: Rather than simply initializing with a uniform distribution, AIM allocates a small portion of the privacy budget to privately measure all 1-way marginals in the workload’s downward closure. This yields a robust initial independent distribution, saving privacy budget that would otherwise be wasted selecting these fundamental attributes in early rounds.

where pi,t is the power at time step t and T is the total number of time steps for the power trace. The shape residual captures the distribution of power over time, which is important for accurately reconstructing the power trace.

2. Candidates: The candidate set Ct at round t is drawn from the downward closure of the workload, defined as W + = {r | r ⊆ s, s ∈ W }. To ensure computational

The loss function L over all n trips is defined as the weighted sum of the three residuals, with weights λE , λD , 7

5

tractability, candidates are filtered so that the junction tree size of the Private-PGM [28] engine remains below a pre-specified limit, guaranteeing a predictable memory footprint and runtime.

For training and evaluation of P RISMA, we use the eVED dataset [45], which is a large-scale, diverse and public realworld dataset of vehicle energy consumption traces collected from a variety of different vehicles. It contains a collection of trips, each consisting of a time series of power consumption measurements, along with associated metadata such as vehicle type, route information, and environmental conditions. The ground truth data is assembled from the eVED dataset by selecting two columns: (i) the power consumption time series, and (ii) the GPS coordinates of the start and end points of each trip. The power consumption time series is a sequence of measurements taken at regular intervals, representing the energy consumed by the vehicle during the trip. The GPS coordinates provide information about the route taken by the vehicle, which can be used to extract additional features such as road type, elevation changes, and traffic conditions.

3. Workload-Aware Quality Score: Candidates are selected via the Exponential Mechanism using an improved quality score qr (D) that accounts for both expected L1 error improvement and workload relevance. It is given by ! r 2 σt nr , qr (D) = wr ∥Mr (D) − Mr (pt−1 )∥1 − π (8) where wr = ∑s∈W cs |r ∩ s| represents the overlap weight of marginal r with the workload queries. The penalty p term 2/πσt nr represents the expected L1 noise error, discouraging the selection of high-dimensional marginals with low signal-to-noise ratios. The sensitivity of the quality score is bounded by ∆t = maxr∈Ct wr .

6

4. Adaptive Rounds and Budget: AIM does not require specifying the number of rounds, making it hyperparameterfree. It checks if the informationpgain in round t is small, i.e. ∥Mrt (pt ) − Mrt (pt−1 )∥1 ≤ 2/πσt nrt . If triggered, AIM doubles εt+1 and halves σt+1 , allowing it to execute more rounds under larger privacy budgets and fewer rounds under tight budgets.

Experimental Setup

We train and evaluate P RISMA on a ground-truth data set of real trip traces, each with 500 time steps. The ground truth data was obtained and preprocessed as described in Section 5. We randomly split the data and fit the encoder on 10,000 traces, holding out 2,000 of the trips as a test set. We run P RISMA n times with different random seeds for fitting the encoder. For each run, we use a privacy budget of ε = 0.5 for fitting the AIM synthesis, plus two non-private references: In the first, we train AIM on the ride descriptors non-privately. In the second, we decode the raw representation from Section 4.2 directly, without going through AIM at all. This reference provides a utility ceiling against which the effect of privatization at each ε can be measured.

AIM satisfies ρ-zero-Concentrated Differential Privacy (ρzCDP). The Gaussian mechanism satisfies 2σ1 2 -zCDP and 2

the Exponential mechanism satisfies ε8 -zCDP. Each round consumes budget from exactly one invocation of the exponential mechanism (selection) and one invocation of the Gaussian mechanism (measurement). By using a zCDP privacy filter [5, 16,31], AIM monitors the cumulative privacy loss 2 ρused = ∑t ε8t + 2σ1 2 and terminates when the budget is ext hausted [27].

4.6

eVED Dataset

6.1

Metrics

We compare the same 2,000 held-out power consumption time series against 2,000 synthetic samples of each model. For this comparison, we used the following metrics.

Decoding

Decoding re-runs the same forward model (Figure 3) on each representation – private, for the AIM-released rows, or raw, for the non-private reference condition described in Section 6– using that representation’s own endpoints for routing and its own aggressiveness. The only difference from encoding is that the vehicle choice is now resolved as a hard lookup rather than a soft one-hot, since the encoder (or AIM) has already committed to a single candidate. Decoding reads no real telemetry: its only inputs are the descriptor itself and public reference data (the road network, the EPA vehicle catalogue, and terrain/elevation data). Consequently, whichever DP guarantee a descriptor carries is inherited, unchanged, by the trace decoded from it, by the post-processing property of differential privacy [13].

Fréchet distance. We fit a multivariate Gaussian (mean and full T × T covariance) to each population directly in the T dimensional space of raw traces, and compute the closed-form Fréchet distance between them, normalized by the squared robust amplitude scale of the real population. Autocorrelation distance. For every time series, we calculate the empirical autocorrelation function (ACF) at lags 1, . . . , L, L = min(32, , T − 2), after centering and variancenormalizing the sequence, rendering the statistic scale-free by construction so that amplitude discrepancies are captured 8

Diffusion and flow-based models. We evaluate four diffusion- or flow-based models that generate power trajectories through iterative denoising or numerical integration.

exclusively by the Wasserstein-based metrics rather than conflated here. Per-sequence ACF curves are averaged within each population, and we report the mean absolute deviation between the resulting real and synthetic curves, lag by lag. This isolates fidelity to the temporal dependency structure — how quickly a trace decorrelates from its own recent past — independent of its marginal amplitude distribution.

• DDPM. DDPM [19] uses a convolutional U-Net trained to predict Gaussian noise at randomly sampled diffusion steps using an MSE objective. The generation follows the standard ancestral reverse process. The default configuration uses 1000 diffusion steps, a linear β schedule from 10−4 to 0.02, a base width of 64, depth 4, and 200 training epochs. In contrast to Ho et al., we use a 1D rather than a 2D image U-Net. We use this network as one non-private baseline.

Precision. Following [22], we embed both populations into a fixed-length per-sequence summary-statistic space (mean, variance, skewness, ten autocorrelation coefficients, four spectral-band energies), construct a k-nearest-neighbor ball around every real point using the distance to its k-th nearest real neighbor as radius (k = 3), and report the fraction of synthetic points falling inside at least one such ball. Precision measures sample-level fidelity: whether individual synthetic traces are plausible members of the real manifold, independent of whether the synthetic population as a whole covers that manifold’s extent.

• Flow Matching. Flow Matching uses the same 1D U-Net backbone but learns a velocity field with the rectifiedflow objective of [24, 26]. The model regresses the constant velocity x1 − x0 along the interpolation xt = (1 − t)x0 + tx1 , with t ∼ U [0, 1]. Generation solves the resulting ODE using deterministic Euler integration with 100 steps.

Recall. The complementary quantity under the same construction: k-nearest-neighbor balls are instead built around every synthetic point, and we report the fraction of real points falling inside at least one. Recall measures diversity, i.e. whether the generated samples reach every mode of the real distribution. We additionally report FID and ACF distance as a multiple of a real vs. real null floor, which is computed between two random halves of the real holdout using the same metric, averaged over 15 splits.

6.2

• DiffWave. DiffWave [21] uses a WaveNet-style [29] dilated-convolution architecture adapted from the original audio implementation to the 500-step sequences considered in this work. The residual stack is reduced to 12 layers with a dilation cycle of 8. The model predicts diffusion noise using the implementation’s L1 loss and generates samples through ancestral reverse diffusion. Since, in contrast to the mel-spectrogram conditioning from the original paper, a power-consumption curve has no analogous signal to condition on, we train the model in an unconditioned way.

Baseline Models

• CSDI/DiffTime. CSDI [32] is evaluated in its unconditional setting instead of its original imputation setting. Unlike for DiffWave, for this model, this modification is substantive since CSDI is originally designed for conditional imputation, not unconditional generation. Its denoising network is run with no observedvalue/imputation mask conditioning at all. It is therefore close to the DiffTime [9] implementation rather than exactly reproducing CSDI’s imputation task. Also, we do not use CSDI’s own mask-aware training and instead rebuild the side information conditioning tensor as a plain sinusoidal time-position embedding concatenated with a learned, per-feature embedding, dropping the mask term entirely. We also changed the training objective to match the x0 -prediction convention the other diffusion baselines in this suite use: The original CSDI network is trained to predict the injected noise, with the loss masked to the held-out imputation positions. This adapter instead trains it to predict x0 directly with an unmasked MSE loss over the full sequence. This baseline model uses a dual-attention transformer with four layers, 64 channels,

We compare P RISMA against eight baseline models and include both non-private and DP-SGD-trained variants. For the DP variants, we retain the corresponding non-private architecture and generation procedure and differ only in their training procedure. All models are trained and evaluated on the same 10,000-ride training split and 2,000-ride holdout. B0: Closed-form statistical release. B0 is a non-learning baseline that releases the mean power-consumption curve without noise and applies differential privacy only to a perride energy scaling factor. It clips each ride’s energy to a public range [0, Emax ]. We set Emax to 108 . B0 then releases a DP histogram of the resulting values using the Gaussian mechanism. At generation time, it then samples an energy from the noisy histogram to rescale the mean curve. The privacy budget may be split between the histogram and, in earlier variants, a curve-shape statistic. B0 provides a deliberately simple utility floor: models that fail to outperform a mean curve with a single private scalar do not capture meaningful individual-level structure. 9

and 8 attention heads. The model predicts x0 at randomly sampled steps of a 50-step diffusion schedule, followed by ancestral reverse diffusion at generation time.

in FID, DDPM by 638×, while P RISMA’s FID is unchanged within noise (0.96×). This makes it the most faithful model in the comparison. The precision and recall results largely reflect the models’ constructions rather than differences in training. Precision is nearly saturated for every model in both conditions (≥ 0.975). Although B0 achieves the nominal maximum of 1.000, it produces only a single rescaled mean curve. Its non-private recall of 0.40 reveals the resulting lack of coverage. Recall is therefore more informative here. P RISMA achieves the highest recall in both conditions and remains unchanged under privacy (0.999). In contrast, F LOW M ATCHING, CSDI, and D IFF WAVE lose coverage under privacy, reaching 0.844, 0.573, and 0.551, respectively. DDPM is an instructive exception: its recall increases to 0.996, while its FID worsens by 638×, indicating increased diversity at the expense of fidelity. This pattern reflects a fundamental difference in how the models interact with the privacy mechanism. Because P RISMA operates in a low-dimensional space, the noise it must absorb is small and its fidelity is largely unaffected. The deep generative baselines, by contrast, privatize highdimensional raw telemetry, and the much larger noise budget required renders their outputs unfaithful. In other words, the physical representation is not what makes P RISMA accurate in the non-private setting–it is what makes it resilient when privacy is enforced.

Autoregressive recurrent models. The autoregressive baseline uses a single recurrent GRU [7] or LSTM [8, 20] cell layer and predicts a Gaussian distribution (µ, log σ2 ) for the next timestep. Training uses teacher forcing and Gaussian negative log-likelihood. The generation proceeds autoregressively from a fixed zero start token. We report GRU and LSTM as separate configurations. Gradient-norm clipping (default maximum norm 1.0) is applied during training to mitigate error accumulation under autoregressive sampling. TimeGAN. TimeGAN [41] combines an Embedder, Recovery network, Generator, Supervisor, and Discriminator to model both the marginal distribution and temporal dynamics of sequential data. The model first learns a reversible mapping between the observation space and a lower-dimensional latent space through non-adversarial reconstruction training. It then pretrains the Supervisor using a stepwise supervised objective that encourages the latent representation to capture temporal transitions. Finally, the components are jointly optimized through adversarial training, combining adversarial, supervised, and moment-matching objectives. For the DP variant, we train the Embedder, Recovery network, Supervisor, and Discriminator using DP-SGD, as these components are trained with access to the real data.

7

7.2

Table 2 reports two ablations: (i) applying the encoder and decoder without AIM (PRISMA AE) as a non-private upper bound, and (ii) AIM applied to an unfitted representation (PRISMA untrained) as a lower bound on fidelity.

Results and Discussion

All models are trained on the same 10,000-ride training split and evaluated on the same 2,000-ride holdout (Section 6). Reported values are the means and standard deviations over 15 random seeds for each model and privacy budget. Both distances are normalized by the real vs. real null floor, which is computed between two random halves of the real holdout using the same metric. The FID and autocorrelation distance are reported as multiples of this floor, while precision and recall are reported as absolute values.

7.1

Ablation Studies

Ablation: no mechanism. This ablation uses the encoder and decoder, removing AIM and providing a non-private upper bound on fidelity. On ACF distance, this ablation behaves as a ceiling at 12.72× the real vs. real floor against 15.88× for the full pipeline. This suggests that the encoder and decoder effectively capture the underlying structure of the data, and the mechanism and noise together are responsible for roughly a fifth of the degradation in fidelity. On FID, the ablation is at 1.99× the real vs. real floor against 1.92× for the full P RISMA pipeline. Thus, the encoder and decoder account for most of the fidelity loss, while AIM has only little measurable impact.

Fidelity under Privacy

Table 2 and Figure 1 summarize both conditions. The nonprivate rows show that the diffusion and flow-based models are the strongest models in the comparison, with F LOW M ATCHING and DDPM achieving the best FID and autocorrelation distance. The autoregressive models are mid-field, while P RISMA is slightly worse than the best baseline but still competitive. The non-learning baseline B0 performs poorly, as expected. Under ε = 0.5, the diffusion and flow-based models degrade substantially, while P RISMA’s fidelity is largely unchanged. F LOW M ATCHING degrades by a factor of 3.1×

Ablation: no fitting. This ablation uses AIM applied to a representation that was never fitted, which provides a lower bound on fidelity. Its autocorrelation distance increases to 25.27× the floor and its FID to 2.27×, compared with 15.88× and 1.92× for P RISMA, respectively. These results show that fitting the representation is essential for preserving fidelity. 10

Table 2: Baseline comparison at ε = 0.5 and ε = ∞. For each model, the non-DP row uses no privacy mechanism at all. The ε = 0.5 row is that same model trained under DP-SGD. All values are reported as mean ± standard deviation over 15 seeds. FID×floor is reported as a multiple of its own real-vs-real null floor, which is computed between two random halves of the real holdout using the same metric, averaged over 15 splits. ACF dist.×floor ↓

FID×floor ↓

Precision ↑

Recall ↑

B0 TimeGAN GRU LSTM DiffWave DDPM Flow Matching CSDI

81.099 ± 11.472 61.240 ± 13.152 14.746 ± 6.782 15.470 ± 12.588 24.259 ± 3.640 33.230 ± 5.487 15.616 ± 3.467 26.191 ± 3.394

11.252 ± 0.971 4.589 ± 0.873 12.189 ± 14.309 6.037 ± 5.292 4.527 ± 0.152 850.675 ± 321.032 2.426 ± 0.212 10.282 ± 0.301

1.000 ± 0.000 0.982 ± 0.006 0.981 ± 0.005 0.975 ± 0.011 0.987 ± 0.007 0.989 ± 0.014 0.984 ± 0.005 0.999 ± 0.002

0.340 ± 0.345 0.915 ± 0.025 0.781 ± 0.044 0.848 ± 0.076 0.551 ± 0.041 0.996 ± 0.004 0.844 ± 0.028 0.573 ± 0.053

PRISMA + AIM PRISMA AE PRISMA (untrained)

15.884 ± 2.177 1.916 ± 0.056 0.999 ± 0.001 0.999 ± 0.001 no mechanism — non-private reference only 25.271 ± 3.848 2.272 ± 0.064 0.999 ± 0.001 0.999 ± 0.001

Model With privacy (ε = 0.5)

Without privacy (ε = ∞)

7.3

B0 TimeGAN GRU LSTM DiffWave DDPM Flow Matching CSDI

82.330 ± 10.912 22.193 ± 2.150 17.240 ± 10.631 15.856 ± 7.083 25.966 ± 4.829 2.962 ± 0.366 6.928 ± 1.753 18.507 ± 9.929

10.087 ± 0.136 2.939 ± 0.176 6.598 ± 8.105 5.060 ± 3.749 3.978 ± 0.223 1.334 ± 0.979 0.773 ± 0.040 2.786 ± 1.062

1.000 ± 0.000 0.981 ± 0.011 0.980 ± 0.009 0.981 ± 0.010 0.983 ± 0.001 0.985 ± 0.004 0.981 ± 0.004 0.985 ± 0.003

0.401 ± 0.101 0.502 ± 0.045 0.850 ± 0.211 0.855 ± 0.148 0.758 ± 0.021 0.985 ± 0.007 0.982 ± 0.001 0.980 ± 0.008

PRISMA + AIM PRISMA AE PRISMA (untrained)

14.502 ± 1.911 12.721 ± 1.682 23.559 ± 3.104

1.987 ± 0.054 1.994 ± 0.032 2.637 ± 0.045

0.999 ± 0.001 0.999 ± 0.000 0.999 ± 0.000

0.999 ± 0.001 0.999 ± 0.001 0.999 ± 0.001

Distributional Structure

is able to generate synthetic data that is more faithful to the underlying structure of the real data, even under privacy constraints. This is consistent with the quantitative results in Table 2, which show that P RISMA achieves better fidelity than the other models under privacy constraints.

Table 2 quantifies fidelity but does not capture distributional structure. We therefore use t-SNE to project real and synthetic sequences into two dimensions and visualize their density contours.

7.4

The decoded traces. Figure 4 shows t-SNE density contour plots of real vs. synthetic sequences for all mechanisms for ε = 0.5. The plots show that P RISMA is able to preserve the structure of the data better than most other models under privacy constraints.

Limitations

Low-dimensional representation. P RISMA represents each trip using only three fitted quantities (aggressiveness, detour, and vehicle) beyond its endpoints. This enables privatisation in a low-dimensional space rather than over raw telemetry, but necessarily discards variation not captured by these parameters. For example, weather, auxiliary loads, and fine-grained driving behavior cannot be recovered by the decoder, irrespective of the privacy budget.

The released representation. Figure 5 shows a heatmap of the start and end coordinates of the ground-truth dataset and the coordinates synthesized using AIM with ε = 0.5. The heatmap indicates that P RISMA is able to preserve the spatial distribution of the data even under privacy constraints. Both the t-SNE plots and the heatmap suggest that P RISMA

Dependence on public reference data. Reconstruction fidelity is constrained by the coverage and quality of the public 11

20

20 t-SNE 2

10 0

0

−20

0

−10 −20

−50

0

−10

50

t-SNE 2

(a) DP-B0

40

10

20

0

0

−10

−20

0

−20

10

(b) DP-DiffWave

20

−20

0

20

−40

(d) DP-LSTM

0

20

(c) DP-GRU

10

0 −10 −20

0

−10

20

(e) DP-TimeGAN

0

10

(f) DP-CSDI

20 t-SNE 2

10

10

0

0

−10

−10 −50

0 t-SNE 1

(g) DP-DDPM

50

0

−20 −10 0 10 t-SNE 1 (h) DP-Flow Matching

−20 −20 −10

0 10 t-SNE 1

20

(i) PRISMA

Figure 4: t-SNE density contour plots of real (blue) vs. synthetic (red) sequences for all compared models and ε = 0.5.

8

road network, elevation data, and the EPA vehicle catalog used by the decoder. Trips involving vehicles poorly represented in the candidate pool, or routes that differ substantially from those selected by the public router, may therefore be difficult to reconstruct faithfully even when the underlying descriptor is accurately estimated.

Conclusion

We presented P RISMA, a differentially private synthesis pipeline for in-car energy telemetry that exploits the low intrinsic dimensionality of trip-level energy consumption. P RISMA fits each trip with a compact, physically interpretable descriptor, applies the AIM mechanism only to this low-dimensional representation, and reconstructs telemetry from the resulting synthetic descriptors through privacy-free post-processing. This design avoids applying differential privacy directly to high-dimensional time series and thereby mitigates the associated dimensionality penalty. Our experimental results show that at a strong privacy budget of ε = 0.5, P RISMA retains the best fidelity of any model evaluated, and that its fidelity is

Dataset scope. Our evaluation is conducted on a dataset with a specific geographic and temporal scope (Section 6). This may limit the generality of our findings, particularly where road topology, vehicle composition, driving behavior, or environmental conditions differ compared to the eVED dataset. 12

ESANN 2021 proceedings, pages 617–622, Online event (Bruges, Belgium), 2021. Ciaco - i6doc.com. URL: https://www.esann.org/sites/default/ files/proceedings/2021/ES2021-20.pdf, doi:10.14428/esann/2021.ES2021-20. [2] Sergul Aydore, William Brown, Michael Kearns, Krishnaram Kenthapadi, Luca Melis, Aaron Roth, and Ankit Siva. Differentially private query release through adaptive projection. Proceedings of the 38th International Conference on Machine Learning, PMLR, 2021. arXiv:2103.06641.

Figure 5: heatmap of the start and end coordinates of the ground-truth dataset (left) and that of the coordinates synthesized using AIM (right) with ε = 0.5.

The El[3] Mathieu Blondel and Vincent Roulet. ements of Differentiable Programming, June 2025. arXiv:2403.14606 [cs]. doi:10.48550/arXiv.2403. 14606.

essentially unchanged from the non-private setting. In contrast, the fidelity of all other models degrades substantially under privacy, with one (DDPM) losing more than 600× in Fréchet distance. These results demonstrate that P RISMA is a promising approach for generating high-fidelity synthetic energy telemetry under strong privacy constraints.

[4] Geoff Boeing. Modeling and analyzing urban networks and amenities with OSMnx. Geographical Analysis, 57(4):567–577, 2025. doi:10.1111/gean.70009. [5] Mark Cesar and Ryan Rogers. Bounding, concentrating, and truncating: Unifying privacy loss composition for data analytics. In Proceedings of the 32nd International Conference on Algorithmic Learning Theory, pages 421– 457. PMLR, 2021.

Ethical Considerations P RISMA is designed to increase privacy protection by enabling the release of synthetic instead of real data. The framework provides formal (ε, δ)-differential privacy guarantees that bound the privacy loss for any individual driver whose data contributes to the released statistics. Our empirical evaluation uses the Extended Vehicle Energy Dataset (eVED) [45], a publicly available, anonymized research dataset of real-world vehicle energy consumption traces. The data was collected by the original authors in compliance with relevant data-sharing guidelines and contains no direct personal identifiers (such as driver names, vehicle identification numbers, or user IDs). Because our study involves exclusively secondary analysis of an existing public dataset without interaction with human participants, it does not constitute human-subjects research requiring Institutional Review Board (IRB) approval.

[6] Kai Chen, Xiaochen Li, Chen GONG, Ryan McKenna, and Tianhao Wang. Benchmarking differentially private tabular data synthesis algorithms. In ICLR 2025 Workshop: Will Synthetic Data Finally Solve the Data Access Problem? (SynthData), Singapore, 2025. doi: 10.1145/3769764. [7] Kyunghyun Cho, Bart van Merriënboer, Caglar Gulcehre, Dzmitry Bahdanau, Fethi Bougares, Holger Schwenk, and Yoshua Bengio. Learning phrase representations using RNN encoder–decoder for statistical machine translation. In Alessandro Moschitti, Bo Pang, and Walter Daelemans, editors, Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 1724–1734. Association for Computational Linguistics, 2014. doi: 10.3115/v1/D14-1179.

Open Science

[8] Junyoung Chung, Caglar Gulcehre, KyungHyun Cho, and Yoshua Bengio. Empirical evaluation of gated recurrent neural networks on sequence modeling, 2014. doi:10.48550/arXiv.1412.3555.

The source code of P RISMA, including the differentiable driver and car simulations, privacy mechanism, and optimization loop, will be made publicly available upon acceptance at https://anonymous.4open.science/ r/PRISMA-6C17/README.md.

[9] Andrea Coletta, Sriram Gopalakrishnan, Daniel Borrajo, and Svitlana Vyetrenko. On the constrained timeseries generation problem. In Advances in Neural Information Processing Systems, volume 36, pages 61048– 61059. Curran Associates, Inc., 2023. doi:10.52202/ 075280-2668.

References [1] Hiba Arnout, Johanna Bronner, and Thomas Runkler. Differentially Private Time Series Generation. In 13

[10] Kyle Cranmer, Johann Brehmer, and Gilles Louppe. The frontier of simulation-based inference. Proceedings of the National Academy of Sciences, 117(48):30055–30062, December 2020. GSCC: 0001680 arXiv:1911.01429 [stat]. URL: http: //arxiv.org/abs/1911.01429, doi:10.1073/pnas. 1912789117.

A Survey on Problems, Methods and Applications, March 2023. arXiv:2211.08064 [cs]. URL: http://arxiv.org/abs/2211.08064, doi:10.48550/arXiv.2211.08064. [19] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, pages 6840–6851. Curran Associates Inc., 2020.

[11] Abhyuday Desai, Cynthia Freeman, Zuhui Wang, and Ian Beaver. TimeVAE: A Variational Auto-Encoder for Multivariate Time Series Generation, December 2021. arXiv:2111.08095 [cs.LG]. doi:10.48550/ arXiv.2111.08095.

[20] Sepp Hochreiter and Jürgen Schmidhuber. Long shortterm memory. Neural Computation, 9(8):1735–1780, 1997. doi:10.1162/neco.1997.9.8.1735.

[12] Cynthia Dwork. Differential privacy. In Proceedings of the 33rd International Conference on Automata, Languages and Programming - Volume Part II, ICALP’06, page 1–12, Berlin, Heidelberg, 2006. Springer-Verlag. doi:10.1007/11787006_1.

[21] Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. DIFFWAVE: A VERSATILE DIFFUSION MODEL FOR AUDIO SYNTHESIS. In International Conference on Learning Representations (ICLR), 2021. doi:10.48550/arXiv.2009.09761.

[13] Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy. Foundations and Trends® in Theoretical Computer Science, 9(3-4):211– 487, August 2014. GSCC: 0012269. doi:10.1561/ 0400000042.

[22] Tuomas Kynkäänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models. Curran Associates Inc., Red Hook, NY, USA, 2019. [23] Zinan Lin, Alankar Jain, Chen Wang, Giulia Fanti, and Vyas Sekar. Using GANs for Sharing Networked Time Series Data: Challenges, Initial Promise, and Open Questions. Proceedings of the ACM Internet Measurement Conference, pages 464–483, October 2020. Conference Name: IMC ’20: ACM Internet Measurement Conference ISBN: 9781450381383. doi:10.1145/3419394. 3423643.

[14] Cristóbal Esteban, Stephanie L. Hyland, and Gunnar Rätsch. Real-valued (Medical) Time Series Generation with Recurrent Conditional GANs, December 2017. arXiv:1706.02633 [stat.ML]. URL: http://arxiv.org/abs/1706.02633, doi:10. 48550/arXiv.1706.02633. [15] Mei Ling Fang, Devendra Singh Dhami, and Kristian Kersting. Dp-ctgan: Differentially private medical data generation using ctgans. In Artificial Intelligence in Medicine: 20th International Conference on Artificial Intelligence in Medicine, AIME 2022, Halifax, NS, Canada, June 14–17, 2022, Proceedings, page 178–188, Berlin, Heidelberg, 2022. Springer-Verlag. doi:10. 1007/978-3-031-09342-5_17.

[24] Yaron Lipman, Ricky T.Q. Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. In International Conference on Learning Representations (ICLR), 2023. [25] Qi Liu, Juan Yu, Jianmin Han, and Xin Yao. Differentially private and utility-aware publication of trajectory data. Expert Systems with Applications, 180:115120, 2021. URL: https://www.sciencedirect.com/ science/article/pii/S0957417421005613, doi:10.1016/j.eswa.2021.115120.

[16] Vitaly Feldman and Tijana Zrnic. Individual privacy accounting via a rényi filter. In Advances in Neural Information Processing Systems, volume 34, pages 28080– 28091. Curran Associates, Inc., 2021.

[26] Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. In International Conference on Learning Representations, ICLR, 2023.

[17] P.G. Gipps. A behavioural car-following model for computer simulation. Transportation Research Part B: Methodological, 15(2):105–111, 1981. URL: https://www.sciencedirect. com/science/article/pii/0191261581900370, doi:10.1016/0191-2615(81)90037-0.

[27] Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. Aim: an adaptive and iterative mechanism for differentially private synthetic data. Proc. VLDB Endow., 15(11):2599–2612, July 2022. doi: 10.14778/3551793.3551817.

[18] Zhongkai Hao, Songming Liu, Yichi Zhang, Chengyang Ying, Yao Feng, Hang Su, and Jun Zhu. Physics-Informed Machine Learning: 14

[28] Ryan McKenna, Daniel Sheldon, and Gerome Miklau. Graphical-model based estimation and inference for differential privacy. CoRR, abs/1901.09136, 2019. URL: http://arxiv.org/abs/1901.09136, arXiv: 1901.09136.

[38] Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network, 2018. arXiv:1802.06739. [39] Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Modeling tabular data using conditional GAN. CoRR, abs/1907.00503, 2019. URL: http://arxiv.org/abs/1907.00503, arXiv: 1907.00503.

[29] Aaron van den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. WaveNet: A generative model for raw audio. arXiv:1609.03499[cs.SD], doi:10.48550/arXiv.1609.03499.

[40] Xun Yi, Xuechao Yang, Xiaoning Liu, Andrei Kelarev, Kwok-Yan Lam, Mengmeng Yang, Xiangning Wang, and Elisa Bertino. Differential Privacy, pages 87– 112. Springer Nature Switzerland, Cham, 2025. doi: 10.1007/978-3-031-95140-4_4.

[30] OpenStreetMap contributors. OpenStreetMap. https: //www.openstreetmap.org, 2026. Data licensed under the Open Database License (ODbL) v1.0.

[41] Jinsung Yoon, Daniel Jarrett, and Mihaela van der Schaar. Time-series generative adversarial networks. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.

[31] Ryan M. Rogers, Salil P. Vadhan, Aaron Roth, and Jonathan Ullman. Privacy odometers and filters: Pay-asyou-go composition. In Neural Information Processing Systems, 2016. doi:10.5555/3157096.3157312.

[42] Jinsung Yoon, James Jordon, and Mihaela van der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2019.

[32] Yusuke Tashiro, Jiaming Song, Yang Song, and Stefano Ermon. Csdi: Conditional score-based diffusion models for probabilistic time series imputation. In Advances in Neural Information Processing Systems, 2021.

[43] Xinyu Yuan and Yan Qiao. Diffusion-TS: Interpretable Diffusion for General Time Series Generation. In International Conference on Learning Representations, ICLR, 2024. arXiv:2403.01742 [cs.LG]. doi:10. 48550/arXiv.2403.01742.

[33] Tilezen. Terrain Tiles. Registry of Open Data on AWS, https://registry.opendata.aws/ terrain-tiles, 2026. Accessed 2026-08-14. 3DEP/SRTM data courtesy of the U.S. Geological Survey.

[44] Jun Zhang, Graham Cormode, Cecilia M. Procopiuc, Divesh Srivastava, and Xiaokui Xiao. PrivBayes: Private Data Release via Bayesian Networks. ACM Transactions on Database Systems, 42(4):1–41, December 2017. doi:10.1145/3134428.

[34] Gianluca Truda. Generating tabular datasets under differential privacy, August 2023. arXiv:2308.14784 [cs]. doi:10.48550/arXiv.2308.14784. Test [35] U.S. Environmental Protection Agency. car list data (data on cars used for testing fuel economy). https://www.epa. gov/compliance-and-fuel-economy-data/ data-cars-used-testing-fuel-economy, 2026. Model years 2000–2016.

[45] Shiliang Zhang, Dyako Fatih, Fahmi Abdulqadir, Tobias Schwarz, and Xuehui Ma. Extended vehicle energy dataset (eved): An enhanced large-scale dataset for vehicle energy consumption analysis. In 2025 IEEE 101st Vehicular Technology Conference (VTC2025-Spring), pages 01–07, 2025. doi:10.1109/ VTC2025-Spring65109.2025.11174415.

[36] Giuseppe Vietri, Cedric Archambeau, Sergul Aydore, William Brown, Michael Kearns, Aaron Roth, Ankit Siva, Shuai Tang, and Zhiwei Steven Wu. Private synthetic data for multitask learning and marginal queries. In Private Synthetic Data for Multitask Learning and Marginal Queries, 2022. arXiv:2209.07400.

[46] Zhikun Zhang, Tianhao Wang, Ninghui Li, Jean Honorio, Michael Backes, Shibo He, Jiming Chen, and Yang Zhang. PrivSyn: Differentially private data synthesis. In 30th USENIX Security Symposium (USENIX Security 21), pages 929–946. USENIX Association, August 2021. doi:10.48550/arXiv.2012.15128.

[37] Qifan Wang, Yuhong Jin, Zhenyong Lu, Qiang Gao, Xiangdong Ge, Zhonggang Li, and Lei Hou. State space model: a magical tool for state prediction in Nonlinear systems. Nonlinear Dynamics, 113(7):6577–6603, April 2025. GSCC: 0000007. URL: https://link. springer.com/10.1007/s11071-024-10730-8, doi:10.1007/s11071-024-10730-8. 15

Related documents

• PRISMA: Differentially Private Synthetic In-Car Telemetry via Differentiable Simulation#1458991
• the privacy complications#1145653
• Notice After Notice-and-Consent: Why Privacy Disclosures Are Valuable Even If Consent Frameworks Aren’t#771653
• Privacy, Confidentiality, and Health Research#24142
• Bildung, Betreuung und Erziehung von Kindern zwischen privater und öffentlicher Verantwortung#658300