Feature‐Level Adversarial Attacks and Differential Privacy‐Enhanced Defenses for Trajectory Classification

Trajectory classification techniques are widely applied in personalized recommendation, precision marketing, and public opinion analysis. However, these models are susceptible to adversarial attacks, where subtle and imperceptible perturbations can mislead the models and significantly compromise classification accuracy. Existing adversarial attacks for trajectory classification often adopt black‐box strategies or single‐step gradient updates, directly perturbing raw trajectory data while neglecting the influence of trajectory features on classification. To address this issue, we propose a feature‐level adversarial attack framework that introduces perturbations at the trajectory feature level rather than on raw data. Specifically, trajectory features are first extracted using the spatial encoding‐based extraction algorithm. The MMOE model is then employed to compute feature importance weights, based on which minimal perturbations are added to the most influential features to maximize classification disruption while preserving trajectory structure. In addition, we develop a differential privacy‐enhanced defense strategy, which adds optimal Laplace noise to the trajectory features and performs inverse transformation to mitigate the impact of adversarial perturbations. Experiments on real‐world datasets show that the proposed adversarial attack successfully deceives the classification model, while the defense strategy significantly improves its robustness. Experimental code can be found at: https://github.com/whwh456/Trattack .