AI in Wildlife Conservation, in depth: protecting species locations across camera traps, public releases and LLM assistants

Who wants the data and what they need

Start with who wants the data and what they already know. A poacher usually knows the general area, perhaps a park or a valley, and needs to narrow it to a waterhole, a roost or a den within a day's walk. A specialist collector of reptiles, birds' eggs or plants may need only one confirmed site. Neither needs your database; they need a few hundred metres of precision for one species at one time, which means small leaks are dangerous.

The defender's assets are therefore: exact coordinates of sensitive taxa, the timing of observations (an animal seen at dawn three days running is predictable), the positions and schedules of ranger patrols and sensors (an attacker who knows where the cameras are can avoid them), and images of people. Camera traps photograph rangers, researchers, herders and villagers far more often than poachers, so a pipeline that treats every person detection as evidence creates a surveillance archive of local communities. That archive is a harm in itself and a legal liability. Integrity failures matter too and are covered later, but a leaked precise point is the failure that cannot be undone.

Reference architecture: one precise store, many coarse views

The design principle is one precise store and many deliberately coarse views. Raw observations land in a store with exact coordinates, strict access control and an audit log. Everything that leaves that store, whether a public map, a partner export, a dashboard or an assistant's context, passes through a single release gate that applies the species' sensitivity policy. Detection runs before storage so that person and vehicle images can be routed away from the general archive immediately.

Detectors in this space typically follow the pattern popularised by MegaDetector: a first model that finds animals, people and vehicles in an image, and a second, often regional, classifier that names the species in each animal crop. Splitting the stages is useful for security as well as accuracy, because the first stage can divert human images before any species model, labeller or volunteer ever sees them.

How locations leak

Location leaks through more channels than the coordinate column. The common ones, roughly in order of how often they are overlooked:

• Image metadata. Camera and phone images carry EXIF fields such as GPSLatitude and timestamps. Publishing a beautiful leopard photo with intact EXIF publishes the camera's position.
• Image content. A distinctive rock, a signpost, a ridge line or the camera's own overlay text with a site code can be matched to satellite imagery or to other posts.
• Joins across releases. A coarse species map plus a precise habitat layer plus a published survey route often narrows a cell to one plausible site.
• Aggregates. Counts by grid cell, by week or by park can be differenced. If the count for a region rises by one when a single new record is added, the record's cell is revealed even if it was never shown.
• Narrative text. Field notes, model explanations and assistant answers say things like 'near the old fire tower', which no coordinate filter catches.
• Sensor inventory. Device lists, maintenance tickets and battery dashboards reveal where cameras and acoustic units are, and therefore where they are not.

Strip metadata at ingest, not at publication: write the coordinates into the precise store, then re-encode the image without EXIF before it goes anywhere else. Treat re-encoding as mandatory because some tools only blank selected fields.

A generalisation policy that holds up

Generalisation means replacing an exact point with a region before release. GBIF's best-practice guide on sensitive occurrence data gives a widely used starting point: withhold or release only at about one degree or by region for the most sensitive taxa, round to 0.1 degree for highly sensitive ones and to 0.01 degree for moderately sensitive ones. One degree of latitude is about 111 km, so those tiers correspond to cells of roughly 111 km, 11 km and 1.1 km north to south (narrower east to west away from the equator). Your national rules or partners may be stricter; encode whichever applies as data, not as code.

Three implementation details decide whether the policy actually protects anything. Snap deterministically to a fixed grid, never add random noise per release. Suppress small counts so a cell with one or two records is shown as present-but-unquantified or not at all. Delay release for species where timing matters, so a nesting season ends before the record appears.

import math
from dataclasses import dataclass

@dataclass(frozen=True)
class Policy:
    cell_deg: float | None   # None = never release coordinates
    min_count: int           # suppress cells with fewer records
    embargo_days: int        # hold records this long before release

POLICIES = {                 # loaded from a reviewed config, keyed by taxon id
    "tier_extreme": Policy(None, 0, 0),
    "tier_high":    Policy(0.1, 3, 180),
    "tier_medium":  Policy(0.01, 2, 30),
    "tier_open":    Policy(0.0001, 1, 0),
}

def snap(lat, lon, cell):
    """Return the south-west corner of the fixed grid cell; identical for every release."""
    return (math.floor(lat / cell) * cell, math.floor(lon / cell) * cell)

def release(records, tier_of, today):
    cells = {}
    for r in records:
        pol = POLICIES[tier_of(r.taxon_id)]
        if pol.cell_deg is None or (today - r.observed_on).days < pol.embargo_days:
            continue
        key = (r.taxon_id, snap(r.lat, r.lon, pol.cell_deg), pol.cell_deg)
        cells[key] = cells.get(key, 0) + 1
    out = []
    for (taxon, (lat0, lon0), cell), n in cells.items():
        if n < POLICIES[tier_of(taxon)].min_count:
            continue                      # do not publish "1" or "2" in a sensitive cell
        out.append({"taxon": taxon, "cell_sw": (round(lat0, 6), round(lon0, 6)),
                    "cell_deg": cell, "count": n})
    return out

The function never reads a precise coordinate into anything it returns, and the policy table is separate so that changing a species' tier is a reviewed configuration change with its own audit trail. Log every release with the policy version so you can later answer exactly what was public and when.

Worked example: averaging away the noise

Suppose a portal protects a rare antelope by adding random noise: each time a record is exported, its point is moved to a uniformly random position within 5 km. That sounds safe, because any single release is wrong by up to 5 km. Now suppose the same site produced 40 camera-trap records, each released separately, as happens when every trigger becomes an observation.

For a point drawn uniformly from a disc of radius R, the spread along each axis has a standard deviation of R/2, here 2.5 km. The mean of 40 independent releases has a standard deviation of 2.5 divided by the square root of 40, about 0.40 km per axis. An attacker who simply averages the published points finds the camera to within a few hundred metres, which is exactly the precision the noise was meant to deny. The same happens if one record is jittered afresh on every export: query it 40 times and average.

With the policy above the antelope is tier_high: every record snaps to the same 0.1 degree cell, the cell is published once with a count of 40 after the 180-day embargo, and the forty-first record changes the count but not the geometry. The residual risk is the join attack: if the cell contains only one patch of suitable habitat, the cell still points to it. That is why high-tier species need a human review of the habitat layer before release, and why some programmes publish such species only at regional level regardless of the grid.

An assistant that cannot leak a point

Assistants are now attached to sightings databases so that rangers, researchers and the public can ask questions in plain language. The safe design is to make leakage impossible by construction rather than to ask the model to be careful. The model's tools query the released, generalised tier only; no tool accepts a precise-store credential; and answers pass an output check before display.

Field notes and volunteer comments are untrusted text that will be retrieved into the model's context, so they can carry prompt injection, for example a note instructing the assistant to fetch raw records or to include coordinates. Because the tools cannot reach raw records, the injection has nothing to escalate to. Narrative leaks remain, so place names and landmarks from a sensitive-site gazetteer are filtered too.

import re

COORD = re.compile(r"-?\d{1,3}\.\d{3,}\s*[,; ]\s*-?\d{1,3}\.\d{3,}")   # 3+ decimals ~ 100 m
DMS = re.compile(r"\d{1,3}\s*\u00b0\s*\d{1,2}\s*['\u2032]")

def sightings_tool(taxon, region):
    """The only data tool the model has. Reads the public release table, never raw points."""
    return released_cells(taxon=taxon, region=region)      # already snapped and suppressed

def check_answer(answer, sensitive_names):
    problems = []
    if COORD.search(answer) or DMS.search(answer):
        problems.append("coordinate-like text")
    low = answer.lower()
    problems += [f"sensitive place: {n}" for n in sensitive_names if n.lower() in low]
    return problems    # non-empty: block, log the conversation, return a generic reply

The regex is a backstop, not the control: the control is that the model never held a precise point. Review blocked answers weekly: repeated probing about one species is a signal.

Detector and label integrity

Two integrity risks deserve explicit controls. First, the person and vehicle classes drive anti-poaching alerts, so measure their recall at night, in rain and on partially occluded subjects separately, and choose thresholds per site from that measurement rather than from a global benchmark. A missed vehicle at a remote gate costs more than ten false alarms, but alert fatigue is real, so route low-confidence detections to a review queue instead of a radio.

Second, crowdsourced labels train and evaluate the species classifier. A coordinated group can mislabel images to suppress a species from a region or to inflate it. Keep an expert-verified holdout that volunteers cannot write to, weight new labellers lower until they agree with experts, and gate every retrain on the holdout. Treat a sudden shift in a species' predicted range as an incident to investigate, not just a model update.

Person images need their own policy: blur faces before any human review outside the enforcement team, keep originals for a short, documented period, and agree with local communities and authorities when, if ever, images may be used as evidence. Writing that policy down before the first deployment is far easier than retrofitting it.

Failure modes

Operations and trade-offs

Operationally, the hardest part is not code but agreement on tiers. Assign sensitivity per taxon and, where needed, per region, because a species common in one country can be critically threatened in another. Review the tier list at least yearly and whenever trafficking intelligence changes. Give the precise store a short list of named users, require a reason for each query, and alert on bulk reads.

The trade-offs are real. Coarse releases weaken species distribution models built by outside researchers, so offer a vetted-access route with data-use agreements for precise data rather than loosening public tiers. Embargoes slow conservation responses that depend on fresh data, so give partner agencies live access through accounts, not through the public portal. Filtering assistant answers will occasionally block a harmless reply; that cost is small next to a published den site.

What to do next

1. List every outward channel: portals, exports, dashboards, reports, social posts and assistants.
2. Strip and re-encode image metadata at ingest, and confirm with a tool that reads EXIF.
3. Put sensitivity tiers in reviewed config, starting from GBIF's guidance and your national rules.
4. Replace any random jitter with fixed-grid snapping, minimum counts and embargoes.
5. Route person and vehicle detections to a restricted, short-retention bucket with a written policy.
6. Give any LLM assistant coarse-tier tools only, and filter answers for coordinates and sensitive place names.
7. Measure detector recall per condition and per site, and gate classifier retrains on an expert holdout.
8. Audit precise-store access monthly and alert on bulk or unexplained reads.

Related reading on this site: tamper-evident environmental sensor data, securing ocean-science ML pipelines, data exfiltration through LLM applications, privacy budgets for repeated releases and prompt injection through retrieved text.