Quantifying the likelihood of de-anonymizing metro users using asynchronous smart card data

Smart card data are increasingly used to optimize public transit services and analyze urban mobility patterns, but the release of such data may expose metro users to the risk of de-anonymization. This study proposes a quantitative framework for assessing privacy risks based on limited historical trip records. The framework characterizes individual travel behavior using station visitation distributions and station-to-station transition patterns, which are measured using Kullback–Leibler divergence and a Markov model. These complementary similarity measures are integrated through a weighted voting mechanism and further optimized through a bipartite matching algorithm to resolve identity conflicts in large-scale datasets. Experiments using Chengdu metro smart card records show that the voting method alone correctly de-anonymizes about 48% of users. After incorporating bipartite matching, the framework achieves 88% precision and 90% recall. These findings provide quantitative evidence of substantial de-anonymization risks in transit data and highlight the need to develop and implement robust privacy-preserving mechanisms prior to data publication.