Most existing membership inference attacks (MIAs) utilize metrics (e.g., loss) calculated on the model's final state, while recent advanced attacks leverage metrics computed at various stages, including both intermediate and final stages, throughout the model training. Nevertheless, these attacks often process multiple intermediate states of the metric independently, ignoring their time-dependent patterns. Consequently, they struggle to effectively distinguish between members and non-members who exhibit similar metric values, particularly resulting in a high false-positive rate.

By adding noise to real data locally and providing quantitative privacy protection that can be rigorously mathematically proven, Local differential privacy is the suitable technology for the private collection of two dimensional location data. Most current solutions discretize the location information into grids, and then apply LDP-based frequency oracle to obtain distribution information of all users for spatial range query. However, the discretization step of gridding will result in a more or less loss of accuracy, while eliminating the inherent correlation between adjacent grids. Thus leading to a large overall error. Drawing on the idea of continuous perturbation on finite intervals, we propose a two-dimensional continuous density estimation method, called LTD-EM. It takes advantage of numerical nature of the map domain and uses the near-neighbor perturbation and EM algorithm. We also optimize the algorithm considering the irregular shape of the geography map. The experimental results show that the accuracy of the spatial range query provided by LTD-EM is significantly better than that of existing solutions.