Digital Twins on Your Phone Could Keep Location Queries Private Without Ruining Their Answers

Every time you ask your phone for the nearest coffee shop, pharmacy, or late-night pharmacy, you leak a small but revealing trace of where you are and, by extension, who you are. Location-based services thrive on these queries, yet each one is a potential privacy breach waiting to be mined by advertisers, stalkers, or data brokers. A new study published in PLOS One by Mohammed Hasan A. and Nemi Chandra R. proposes a way to keep the answers useful while keeping the questions largely to yourself, using a digital twin that lives on the device and decides, query by query, whether anything needs to leave your phone at all.

The core tension the researchers tackle is a familiar one in privacy engineering. Differential privacy, the gold-standard mathematical framework for protecting individual records, works by adding calibrated noise to any data that leaves a system. The stronger the guarantee, the more noise is injected, and the more the answer degrades. For location queries, this trade-off is brutal: a heavily perturbed coordinate may point you to the wrong neighborhood entirely, while a lightly perturbed one may still reveal the sensitive venue you are standing in. Utility-oriented methods that skip the noise, meanwhile, leave users effectively unprotected. The field has largely treated this as a dial you must set once, accepting whatever losses come with your chosen position.

DT-ELR, the framework the authors call Digital Twin-assisted Edge-Local Resolution, refuses to accept a single dial setting. Instead, it treats each query as its own decision problem, asking two questions in sequence. First, how sensitive is this particular query? Second, does answering it actually require sending anything to the remote service at all? Only queries that fail the second test, meaning the on-device resources cannot resolve them, are released to the network, and only then does the system spend a carefully budgeted amount of privacy protection on them.

The sensitivity judgment is made by an on-device classifier trained to score how revealing a location query is, using semantic labels of venue categories as ground truth. The authors validated this model against those labels and achieved an area under the ROC curve of 0.81, meaning the classifier can distinguish sensitive from ordinary queries with reasonable reliability. Rather than applying a uniform privacy budget to everything, the system calibrates a monotone geo-indistinguishability schedule, spending more of the budget on queries the classifier flags as sensitive and less on benign ones. Geo-indistinguishability is a spatial adaptation of differential privacy that ensures nearby locations are indistinguishable to an adversary up to a distance-dependent factor.

The second and arguably more novel component is the digital twin itself. In industrial settings, digital twins are virtual replicas of physical systems used to simulate behavior before committing resources. Here, the twin is a lightweight model running entirely on the user’s device that predicts, from on-device signals alone, whether releasing a query to the remote service would actually improve the answer the user receives. The authors report that this prediction reaches an AUC of 0.90, remarkably accurate for a purely local decision. When the twin concludes that a query is self-sufficient, meaning the answer can be resolved against an on-device cache of venue information, the query never leaves the phone. No data is released, no privacy budget is spent, and the user gets their answer.

For queries that do need to go out, the second algorithm, called ClosedFormAllocator, distributes the remaining privacy budget across them. Rather than solving a computationally expensive optimization at runtime, the allocator derives its allocation in closed form, meaning it computes the optimal split directly with a formula. The authors show this closed-form solution matches an exact dynamic-programming optimum to within one percent, giving near-optimal budget allocation at a fraction of the computational cost. This matters because privacy budget allocation across a stream of queries is a genuinely hard combinatorial problem, and a solution that requires heavy computation on a phone is not practical.

To test the framework, the researchers ran experiments on three public check-in datasets: Foursquare data from New York City, and global check-in corpora from Gowalla and Brightkite. The retrieval task was end-to-end nearest-venue lookup, and the adversarial model included three implemented attackers attempting to infer the user’s true location from released queries. The results are striking. On the Foursquare-NYC dataset, DT-ELR reduced the success rate of optimal-inference localization on sensitive queries from 61.3 percent down to 11.4 percent, all while spending the same average privacy budget as a baseline that releases everything. Meanwhile, end-to-end retrieval precision, the fraction of queries answered correctly, rose from 0.244 under full release to 0.559 under DT-ELR.

That improvement in utility alongside a reduction in privacy loss might seem paradoxical, but it follows directly from the routing logic. When the twin keeps self-sufficient queries on the device, it avoids the noise penalty that would otherwise be applied to them, so those queries get exact answers. The queries that are released receive the full benefit of a budget that is no longer being diluted across unnecessary disclosures. The authors found that twin-guided release routing outperformed a tuned distance-based heuristic at every matched release rate, and approached an oracle ceiling of 0.565, the best achievable if the twin’s predictions were perfect. Notably, 73 percent of sensitive queries were kept entirely on the device, never released in any form.

Component analysis confirmed that each mechanism contributes independently, with the edge-local resolution, the decision to keep queries on the device, playing the dominant role. The sensitivity classifier, calibrated on Foursquare-NYC data, transferred to the Gowalla and Brightkite corpora without any refitting, suggesting the learned notion of query sensitivity is not an artifact of one city’s venue landscape but a more general property of how people query locations. Against three recent location-perturbation mechanisms at matched privacy budgets, DT-ELR achieved a dominant privacy-utility frontier on all three datasets, meaning it delivered higher utility at equal disclosure and lower disclosure at equal utility, with no trade-off point where a competing mechanism outperformed it on both axes simultaneously.

The implications extend beyond check-in apps. As location data flows into navigation, delivery, health, and emergency services, the question of how much to reveal per query becomes a design decision that scales to billions of interactions daily. A framework that pushes the privacy decision to the edge, onto the device where the data originates, inverts the usual architecture in which a central service decides how much protection to apply. Whether such on-device twins can be deployed at scale, how they behave under adversarial pressure beyond the three attackers tested, and how the venue caches stay current are questions the authors’ results motivate but do not fully settle. What the study demonstrates is that the privacy-utility trade-off in location-based services is not a fixed dial but a per-query decision problem, and that a well-trained twin can make that decision well enough to keep most of your questions, and the sensitive answers they imply, entirely on your own device.

Subject of Research: Privacy-utility optimization in location-based services using on-device digital twins and edge-local query resolution

Article Title: Digital twin-assisted edge-local query resolution for privacy–utility trade-off in location-based services

Article References: Hasan A., M., & R., N. C. (2026). Digital twin-assisted edge-local query resolution for privacy–utility trade-off in location-based services. PLOS One, 21(10), e0360633. https://doi.org/10.1371/journal.pone.0360633

Image Credits: AI Generated

DOI: 10.1371/journal.pone.0360633

Keywords: digital twin, differential privacy, location-based services, geo-indistinguishability, edge computing, privacy-utility trade-off, on-device machine learning, location privacy, check-in data, nearest-venue retrieval, privacy budget allocation, PLOS One