Ghost: Manifold-Guided Adversarial Substitution for Next-POI Learning Protection

Check-in trajectories support mobility research, but the same temporal structure can train models to predict users' next locations. Protecting their training value poses a discrete optimization problem: substitutions must respect the semantics and geography of visited places while remaining disruptive after an adversary attempts to repair them. We introduce Ghost, a trajectory perturbation framework that combines an adversarial surrogate score with the conditional likelihood of a frozen trajectory language model. An alternating optimization procedure updates substitutions as the surrogate adapts, and stochastic candidate selection couples predictive disruption with a learned preference for real mobility patterns. A Gibbs variational interpretation exposes the rule as an adversarial tilt of a trajectory prior and makes the roles of likelihood and sampling temperature explicit. Experiments on Foursquare-NYC and Foursquare-TKY compare direct training with three paired-data restoration procedures. Under the evaluated protocols, Ghost reduces direct-training acc@1 by 60.6% on NYC and 72.1% on TKY relative to its clean-training baselines, and obtains the lowest mean accuracy after bigram-conditioned restoration among the compared methods on both datasets. Existing sensitivity results further characterize the roles of prior weighting, added entropy regularization, and leakage. These findings support manifold-guided substitution as a practical design direction for trajectory learning protection, while leaving unrestricted release security and cross-model transferability open. Code is available at https://anonymous.4open.science/r/Ghostt.