Digital twin-assisted edge-local query resolution for privacy–utility trade-off in location-based services

Location-Based Services (LBS) generate large volumes of sensitive, location-dependent queries that must be processed under strict and often conflicting constraints of privacy and utility. Existing differential privacy (DP) mechanisms face a fundamental limitation: strong guarantees inject excessive noise and degrade utility, while utility-oriented methods under-protect users. We propose DT-ELR (Digital Twin-assisted Edge-Local Resolution), a framework that jointly optimises disclosure and retrieval utility through two tightly integrated algorithms and an on-device digital twin. Algorithm 1 (SensitivityClassifier) calibrates a monotone geo-indistinguishability budget from a data-derived sensitivity score, validated against a semantic venue-category labelling (AUC 0.81). The digital twin predicts from on-device signals alone whether releasing a query would improve its answer (AUC 0.90); self-sufficient queries are resolved against an on-device venue cache with no release and no budget spent. Algorithm 2 (ClosedFormAllocator) then distributes the remaining budget across released queries in closed form, matching the exact dynamic-programming optimum to within 1%. Experiments on three public check-in corpora — Foursquare-NYC, Gowalla and Brightkite — using an end-to-end nearest-venue retrieval task and three implemented adversaries, show that DT-ELR reduces optimal-inference localization success on sensitive queries from 61.3% to 11.4% on Foursquare-NYC at a matched mean budget, while raising end-to-end retrieval precision from 0.244 under full release to 0.559. Twin-guided release routing outperforms a tuned distance heuristic at every matched release rate, approaching an oracle ceiling of 0.565, and keeps 73% of sensitive queries entirely on the device. Component analysis confirms that each mechanism contributes independently, with edge-local resolution dominant, and the sensitivity model transfers to Gowalla and Brightkite without refitting. Against three recent location-perturbation mechanisms at a matched budget, DT-ELR attains a dominant privacy–utility frontier on all three corpora: higher utility at equal disclosure, and lower disclosure at equal utility.