Not Where You Think: Defending against geolocation of photos by reasoning models, protecting location privacy

Core problem: large reasoning models can infer the shooting location from ordinary photos with metadata and obvious landmarks removed, causing location privacy leakage, while users lack means to break this content-based inference before sharing.

• Setting and importance: location information can expose sensitive information such as home address and daily trajectories; the authors cite a 2022 U.S. Department of Justice report stating that in 2019 about 2.7 million U.S. residents aged 16 and older experienced technology-facilitated stalking. The massive volume of ordinary photos on social media amplifies the risk.
• Shortcomings of existing research: the authors argue that traditional location privacy research targets explicit location data such as coordinates and trajectories; image geolocation research (PlaNet, GeoCLIP, etc.) is not designed for privacy; recent work [20][21] mainly demonstrates the feasibility of localization by reasoning models and lacks systematic analysis of the attack mechanism and mitigation means.
• Core observation: the authors propose the concept of a "visual clue chain"—the model extracts location-related visual evidence, combines geographic knowledge, narrows hypotheses from coarse to fine, and finally anchors on small but critical clues; broad scene attributes mainly support coarse localization, while precise localization relies more on small, editable local clues.
• Paper contributions: proposes the structured reasoning attack GeoTrace, a global benchmark of 525 ordinary images, and an active user-side defense GeoShift—preserving stable scene attributes, selecting visually compatible fake target locations, and rewriting high-impact clues to build a coherent alternative geographic hypothesis.
• Threat model (Section III, Fig. 1):
  • Attacker goal: infer the precise location where the victim's image was taken; the attacker may be a cyberstalker or someone intending location-aware phishing.
  • Attacker knowledge: visual-only, assuming no access to captions, user identity, posting history, shooting time, or coarse location hints and other auxiliary information.
  • Attacker capability: can query commercial multimodal reasoning models with web-search capability (e.g., Gemini, GPT) to extract visual clues and reason.
  • Defender setting: has the original image and true coordinates, and makes minimal semantic modifications before publishing; neither attacker nor defender has expert geolocation knowledge, and the defender may use a different model from the attacker.

Explicit location leakage and protection

• Early work formalized the risk of location disclosure and proposed perturbation/obfuscation mechanisms [2]–[5]; subsequent research examined leakage in real systems such as mobile apps [6][7], wireless scanning [8], public metadata [9], and social media trajectories [10][11]. The authors note that these works target explicit location information such as coordinates, metadata, and platform behavior, and do not address leakage from image content itself.
• Classic defense mechanisms include spatiotemporal cloaking [37], mix zones [38], personalized location k-anonymity [39], and geo-indistinguishability [3][4]; the authors note that these perturb or anonymize published location data and do not target image content leakage.

Image geolocation models

• PlaNet [13], ISN [14], and GeoDecoder [15] use classification-style methods to predict location on a geographic grid; GeoCLIP [16] and PIGEON [17] use retrieval or contrastive learning; G3 [18] and GeoRanker [19] introduce multimodal/vision-language models for retrieval-augmented reasoning and candidate ranking; GeoSURGE [36] strengthens geographic representations through hierarchical embeddings and semantic fusion. The authors note that these models are not designed for malicious use, but show that visual content can be misused for location inference.

Reasoning model-based location privacy attacks

• Liu et al. [20] (Mission: Impossible) use customized fine-tuning to improve localization performance; Luo et al. [21] (DoxBench/GeoMiner) conduct benchmark-driven analysis and prototype attacks under a restricted geographic setting (California). The authors note that these works mainly establish feasibility, whereas this paper studies ordinary images on a global scale, designs structured geographic reasoning attacks, and analyzes the visual factors behind localization.

Proactive image defenses

• GeoShield [40] targets VLM geolocation inference, identifies geographic leakage regions, and optimizes adversarial perturbations. The authors note that it mainly targets direct VLM geolocation and does not address reasoning-based localization, which is the core threat in this paper.

Baselines and benchmarks: The attack baselines are direct prompting, direct prompting + web, and GeoMiner [21] (Table II, all using GPT-5-mini); the defense baselines are Clue Removal/Inpainting, Fake-Location Watermark, and Generative Editing (Table V). The benchmark aggregates IM2GPS3K, YFCC26K, DoxBench, Mapillary, and manually collected photos.

The authors position this paper as follows: compared with [20][21], it provides mechanism-level understanding of the attack and a global benchmark; compared with GeoShield, it provides semantic editing defenses against reasoning-based localization.

Overall approach: first use the structured GeoTrace attack to decompose the reasoning model's localization process and gain mechanism-level understanding; then, based on this, design GeoShift, which breaks the visual cue chain through semantic editing before the image is published.

Benchmark construction (Section IV)

• Scale and sources: 525 ordinary outdoor photos with true latitude and longitude, aggregated from IM2GPS3K (168), YFCC26K (151), DoxBench (97), Mapillary (63), and photos manually collected by 8 project team members with consent to use (46).
• Scene categories: nature (145), urban (135), residential (150), people-centric (95); covering six regions: North America (199), Asia (110), Europe (76), Latin America (61), Oceania (40), and Africa (39).
• Two-stage filtering: first, CLIP ViT-B/32 (OpenAI weights) is used to compute the cosine similarity between the image and prompts such as "a photo of a landmark", and images with a landmark score above 0.75 are discarded; then manual inspection removes images containing famous landmarks, identifiable POIs, visible metadata, or content that directly reveals location (Fig. 3 shows that this benchmark removes the high-score tail).
• Evaluation metrics: Leakage@r (r takes 1/25/200/750/2500 km, corresponding to street, city, region, country, and continent level), defined as Leakage@r=1/N∑_i 1[d(ŷ_i,y_i)≤ r], i.e., the proportion of images whose great-circle distance between the predicted and true coordinates does not exceed r; the mean/median localization error and GeoScore (GeoGuessr style, 0–5000 points) are also reported.

GeoTrace attack (Section V)

• Stage one: visual cue extraction: the multimodal reasoning model is prompted to extract structured cues from the image, covering 5 categories and 20 types of cues (semantic, built environment, natural environment, settlement, auxiliary), with each cue containing type, observed evidence, and confidence; it is explicitly instructed not to predict the final location at this stage. Appendix A (Fig. 15) gives the complete prompt.
• Stage two: coarse-to-fine hierarchical search: reasoning proceeds level by level along country → state/province → city → neighborhood → street/POI, with one most likely hypothesis submitted at each level and used as context for the next level; web search is used to verify intermediate hypotheses; the model is required to retain excluded regions, resolve cue conflicts before submitting, and return a coarser prediction when evidence is insufficient. Appendix A (Fig. 16) gives the complete prompt.
• Final prediction: a consistency check is performed on the complete reasoning chain, and the latitude and longitude, textual description, precision level, rationale, and confidence are output.

GeoShift defense (Section VI)

• Stage one: fake target selection: stable scene features S(x) are extracted from the image (attributes that should remain unchanged, such as climate, terrain, vegetation, urban density, and season), and based on these, a fake target location ỹ that is compatible with these attributes but different from the true location is inferred and searched for.
• Stage two: intervention planning: a list of editable cues C(x) in the image is constructed (recording type, region, content, location evidence, and editing rationale), and always includes a special candidate—a luminance-domain fake-location watermark (maximum luminance perturbation of 8 gray levels, embedded in a flat visually neutral region); then a structured intervention plan P is generated (source cue, bounding box, intervention type inject or swap, target content) and returned as JSON. Appendix B (Fig. 17) gives the complete prompt.
• Stage three: edit application: semantic editing is delegated to a generative image editor (Gemini-2.5-Flash image editor in the implementation) and acts only on the selected local regions; the watermark is rendered separately by modifying the luminance channel; generative editing comes first, then watermark rendering; the generative model is instructed to verify that the selected region exists before modification.
• Design rationale: the authors state that semantic editing directly modifies the evidence used for localization reasoning and relies less on cross-model, cross-transformation transferability than global adversarial perturbations (Section VII).

Experimental Setup

• Models under test: On the attack side, two commercial reasoning models, GPT-5-mini and Gemini-3-Flash; on the defense side, Gemini-3-Flash (API model) and Qwen-3-VL-30B-Instruct (local open-source model) are used for defense planning, and Gemini-2.5-Flash image editor is used for image editing.
• Benchmark: A self-built global benchmark of 525 ordinary images (four scenarios, six regions; composition given in Question 3).
• Attack baselines: direct prompting, direct prompting + web, GeoMiner [21], all using GPT-5-mini (Table II).
• Defense baselines: Clue Removal/Inpainting, Fake-Location Watermark, Generative Editing, re-evaluated with GeoTrace using GPT-5-mini (Table V).
• Metrics: Leakage@1/25/200/750/2500 km, mean/median localization error, mean/median GeoScore; visual quality using PSNR and CLIP similarity (CLIP-ViT-L/14).
• Number of repetitions and variance: Not reported in the paper.

Main Results

According to Table III (attack localization accuracy before and after defense, %):

Swipe horizontally to read the table

Attack model	Defense model	Street-level 1km	City 25km	Region 200km	Country 750km	Continent 2500km
GPT-5-mini	None	16.95	48.38	66.86	78.67	87.05
GPT-5-mini	Qwen-3-VL	5.52	18.10	38.86	56.57	74.48
GPT-5-mini	Gemini-3-Flash	2.48	9.14	15.81	35.62	58.86
Gemini-3-Flash	None	25.71	58.48	78.86	89.71	94.86
Gemini-3-Flash	Qwen-3-VL	9.33	25.71	48.00	66.67	81.52
Gemini-3-Flash	Gemini-3-Flash	3.81	12.00	21.52	41.52	64.00

• The authors state that the defense consistently reduces localization accuracy under both attack models, and that the Gemini defense outperforms the Qwen defense at all thresholds.
• According to Table IV, under the Gemini-3-Flash attack, the median localization error rises from 9.24 km to 229.30 km (Qwen defense) and 1156.21 km (Gemini defense), and the median GeoScore drops from 4968.13 to 4275.84 and 2299.01; under the GPT-5-mini attack, the median error rises from 28.86 km to 523.33 km and 1500.00 km.
• The attack itself (Table I): GeoTrace achieves street-level 16.95% and city-level 48.38% on GPT-5-mini, and street-level 25.71% and city-level 58.48% on Gemini-3-Flash; the errors show a long-tailed distribution (Gemini-3-Flash mean 520.93 km, median 9.24 km).

Attack Baseline Comparison and Cost

• Baseline comparison (Table II, GPT-5-mini): GeoTrace street-level 16.95%, higher than Direct (7.62%), Direct+Web (11.05%) and GeoMiner (9.33%); city-level GeoTrace is 48.38%, and GeoMiner is 48.00%. The authors state that structured clue extraction and hierarchical reasoning are effective for fine-grained localization.
• Attack cost: Gemini-3-Flash uses about 4.29M input tokens, 6.11M output tokens, and 550 web searches, totaling $95.38 (about $0.173/image); GPT-5-mini uses 20.16M input and 3.45M output tokens, totaling $64.46 (about $0.117/image).
• Clue analysis (Section V-D, Gemini-3-Flash reasoning traces): For precisely localized (within 1 km) images, the most common clues are signage (69.2%), micro-infrastructure (65.7%), buildings (55.9%), road facilities (54.5%), and language/text (32.9%); for coarse localization (within 200 km), images are dominated by environment type (79.7%), vegetation (75.4%), climate (75.4%), and terrain (48.3%). On this basis, the authors argue that coarse localization relies on global scene attributes that are hard to edit, while precise localization relies on small local clues.

Defense Baselines, Stealthiness and Cost

• Defense baselines (Table V, GPT-5-mini re-evaluation): GeoShift street-level 2.48%, PSNR 33.76 dB, CLIP 0.979; Generative Editing street-level 9.52% but PSNR only 15.78 dB, CLIP 0.944; Fake-Location Watermark has the highest visual quality (PSNR 39.99 dB, CLIP 0.991) but still 15.62% at street level; Clue Removal/Inpainting street-level 10.86%. The authors state that GeoShift achieves a better privacy-utility trade-off.
• Stealthiness (Fig. 12): Gemini-3-Flash edits an average of 2.94 features per image, and Qwen-3-VL an average of 3.97; the mean CLIP similarity is 0.979 and 0.885 respectively, and the mean PSNR is 33.76 dB and 19.58 dB respectively.
• Defense cost: Qwen local deployment incurs only editor and other costs, totaling $16.87 for 525 images ($0.032/image), with an average latency of 54.8 s; Gemini-3-Flash defense uses 0.75M input and 2.08M output tokens, totaling $33.88 (about $0.0645/image), with an average latency of 36.3 s.

Adaptive Attacks and Robustness

• Adaptive attacks (Table VI/VII, on Gemini-3-Flash defense samples, with the attacker knowing the defense design): visual match, top-k candidates (k=3, success if any candidate hits; the paper notes the criterion is more lenient), and conflict-pruning. top-k is the strongest: for GPT-5-mini, street-level/city-level rises from 2.48%/9.14% to 5.14%/27.05%, and for Gemini-3-Flash from 3.81%/12.00% to 9.02%/23.61%; visual match under GPT-5-mini is instead slightly lower than the original attack (2.10% vs 2.48%). Under top-k, the median error remains 715.01 km (Gemini-3-Flash) and 498.22 km (GPT-5-mini).
• Post-processing robustness (Table VIII, GPT-5-mini re-evaluation): after JPEG compression, street-level remains 2.48%; after scaling/restoration, street-level is 1.33%; the authors state that the defense remains effective under common image-sharing operations.
• Failure cases (Section VI-E): Among samples still precisely localized under the Gemini-3-Flash defense, the authors analyze that 35% stem from combinations of POI-like clues that are hard to neutralize through local editing, and 65% are cases where the attacker detected clue-consistency conflicts and rejected the defense result.

Other Ablations and Analyses

• Defense feature analysis: Among successfully misled images, the most frequently modified features are signage (100%), language/text (68.9%), and watermarks (49.1%).
• Number of edits: Images misled beyond 200 km receive an average of 1.94 generative edits, while images still precisely localized receive an average of 2.22; the authors argue that defense effectiveness depends on editing high-impact and coherent clues rather than on the number of edits.

Limitations noted by the authors and future directions

• Cue consistency conflict (Section VI-E failure case analysis): in 65% of defense failures, the attacker explicitly detected a cue consistency conflict and rejected the defense result; the authors state this reflects a limitation of the current defense—the edited cues are not coherent or stealthy enough, even though the model was explicitly instructed to achieve this.
• POI-like cues are hard to neutralize (Section VI-E): 35% of failures stem from unique combinations of visual patterns in the image acting as landmark-level cues, which cannot be fully neutralized through local editing.
• On-device deployment (Section VII Discussion): the authors propose that in the future, a small on-device VLM or a task-specific language model plus a local editor could reduce overhead and be packaged as a user-side application; when automatic editing is infeasible, a system that only issues high-risk warnings would also be useful.
• Multi-image collaborative protection (Section VII Discussion): the authors point out that if multiple images of the same location are redirected to different fake locations separately, the cues will contradict each other, giving adaptive attackers an opportunity; a natural extension is location-level protection—multiple images of the same true location are jointly mapped to the same fake target while keeping semantic cues consistent.
• Benchmark release (Ethical Considerations): the authors plan to release the benchmark under the original source licenses, with metadata removed and sensitive content excluded, using a protective policy (only image identifiers, derived annotations, or evaluation metadata).

Scope of experiments

• On the attack side, the models tested are GPT-5-mini and Gemini-3-Flash, 2 commercial reasoning models in total; the defense planning models are Gemini-3-Flash and Qwen-3-VL-30B-Instruct, 2 in total.
• The benchmark consists of 525 ordinary outdoor images, covering four scene categories—nature, urban, residential, and people-centric—and six geographic regions; indoor photos are outside the evaluation scope (Section IV states that all images are outdoor photos).
• The adaptive attack evaluation covers three types—visual match, top-k candidates (k=3), and conflict-pruning—and is conducted only on samples defended by Gemini-3-Flash (Section VI-D).
• The post-processing robustness evaluation covers two transformations, JPEG compression and scaling/restoration, and is re-evaluated with GPT-5-mini (Table VIII).
• The paper does not report the number of experimental repetitions, confidence intervals, or statistical significance tests; token overhead and latency for attack and defense are reported, but no human evaluation (e.g., edit perceptibility) was conducted, and stealthiness is measured only by PSNR and CLIP similarity.

An attack-defense study on image location privacy: large reasoning models can infer the shooting location from the visual content of an ordinary photo alone; the authors first decompose this capability and then block it before the image is published.

• Problem: after metadata and obvious landmarks are removed, ordinary photos can still leak precise location through visual cues; the authors believe that existing work mostly demonstrates feasibility and lacks mechanistic understanding and proactive defense.
• Attack (GeoTrace): a two-stage prompting attack—first extract 5 categories and 20 types of structured visual cues, then reason level by level from country to street/POI and verify with web search. On a self-built global benchmark of 525 ordinary images, Gemini-3-Flash achieves 25.71% street-level (1 km) localization and 58.48% city-level (25 km) localization, and GPT-5-mini achieves 16.95% and 48.38% (Table I), outperforming direct prompting and the GeoMiner baseline (Table II); the cost is about $0.117–$0.173 per image.
• Mechanism findings: after analyzing reasoning traces, the authors believe that coarse localization mainly relies on global scene attributes that are hard to edit (environment type, vegetation, climate), while precise localization relies more on small, editable local cues (signage appears in 69.2% of precisely localized images).
• Defense (GeoShift): stable scene attributes are preserved, a visually compatible fake target location is selected, and local semantic edits are made to a small number of high-impact cues (including a luminance-domain fake-location watermark). Gemini-3-Flash defense reduces street-level localization for the GPT-5-mini attack from 16.95% to 2.48% and for the Gemini-3-Flash attack from 25.71% to 3.81% (Table III), raises the median localization error to 1156.21–1500.00 km (Table IV), with PSNR 33.76 dB and CLIP similarity 0.979.
• Robustness: under three adaptive attacks—visual match, top-k candidates, and conflict-pruning—street-level localization rises to at most 9.02% (Gemini-3-Flash attack, top-k, looser criterion), and the defense remains effective after JPEG compression and scaling (Table VIII).
• Authors' conclusion: reasoning models are both a new source of privacy risk and can be repurposed as privacy protection tools; the authors acknowledge that the defense can still be seen through by strong attackers who detect cue conflicts (65% of failure cases), and propose on-device deployment and multi-image collaborative protection as future directions.