Embed Size (px)
Citation preview
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Personalized Social Recommendations -Accurate or Private ?
Ashwin Machanavajjhala, Aleksandra Korolova, Atish DasSarma
January 21, 2013
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Outline
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendations
Making recommendations or suggestions to users in orderto increase their degree of engagement is a commonpractice to websites.
The phenomenal participation of users in social networkssuch as Facebook and LinkedIn, has given a tremendoushope for designing a new type of user experience, thesocial one.
The feasibility of social recommendations has been fuledby initiatives such as Facebook’s Open Graph API andGoogle’s Social Graph API.
While traditional recommender systems default to genericrecommendations, a social-network aware system canprovide recommendations based on active friends.
We will focus on recommendation algorithms basedexclusively on graph-link analysis.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendations
Making recommendations or suggestions to users in orderto increase their degree of engagement is a commonpractice to websites.
The phenomenal participation of users in social networkssuch as Facebook and LinkedIn, has given a tremendoushope for designing a new type of user experience, thesocial one.
The feasibility of social recommendations has been fuledby initiatives such as Facebook’s Open Graph API andGoogle’s Social Graph API.
While traditional recommender systems default to genericrecommendations, a social-network aware system canprovide recommendations based on active friends.
We will focus on recommendation algorithms basedexclusively on graph-link analysis.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendations
Making recommendations or suggestions to users in orderto increase their degree of engagement is a commonpractice to websites.
The phenomenal participation of users in social networkssuch as Facebook and LinkedIn, has given a tremendoushope for designing a new type of user experience, thesocial one.
The feasibility of social recommendations has been fuledby initiatives such as Facebook’s Open Graph API andGoogle’s Social Graph API.
While traditional recommender systems default to genericrecommendations, a social-network aware system canprovide recommendations based on active friends.
We will focus on recommendation algorithms basedexclusively on graph-link analysis.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendations
Making recommendations or suggestions to users in orderto increase their degree of engagement is a commonpractice to websites.
The phenomenal participation of users in social networkssuch as Facebook and LinkedIn, has given a tremendoushope for designing a new type of user experience, thesocial one.
The feasibility of social recommendations has been fuledby initiatives such as Facebook’s Open Graph API andGoogle’s Social Graph API.
While traditional recommender systems default to genericrecommendations, a social-network aware system canprovide recommendations based on active friends.
We will focus on recommendation algorithms basedexclusively on graph-link analysis.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendations
Making recommendations or suggestions to users in orderto increase their degree of engagement is a commonpractice to websites.
The phenomenal participation of users in social networkssuch as Facebook and LinkedIn, has given a tremendoushope for designing a new type of user experience, thesocial one.
The feasibility of social recommendations has been fuledby initiatives such as Facebook’s Open Graph API andGoogle’s Social Graph API.
While traditional recommender systems default to genericrecommendations, a social-network aware system canprovide recommendations based on active friends.
We will focus on recommendation algorithms basedexclusively on graph-link analysis.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Cost of Social Recommendation
Improved social recommendations come at a cost - theycan potentially lead to. a privacy breach by revealingsensitive information.
Example (Reveal Shopping History)
For instance, if you only have one friend, a socialrecommendation algorithm that recommands to you only theproducts that your friend buy, would reveal the entire shoppinghistory of that friend.
Example (Lack of Trust)
A system that uses only trusted edges in friend suggestionsmay leak information about lack of trust along specific edges.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Cost of Social Recommendation
Improved social recommendations come at a cost - theycan potentially lead to. a privacy breach by revealingsensitive information.
Example (Reveal Shopping History)
For instance, if you only have one friend, a socialrecommendation algorithm that recommands to you only theproducts that your friend buy, would reveal the entire shoppinghistory of that friend.
Example (Lack of Trust)
A system that uses only trusted edges in friend suggestionsmay leak information about lack of trust along specific edges.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Cost of Social Recommendation
Improved social recommendations come at a cost - theycan potentially lead to. a privacy breach by revealingsensitive information.
Example (Reveal Shopping History)
For instance, if you only have one friend, a socialrecommendation algorithm that recommands to you only theproducts that your friend buy, would reveal the entire shoppinghistory of that friend.
Example (Lack of Trust)
A system that uses only trusted edges in friend suggestionsmay leak information about lack of trust along specific edges.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Paper Framework
The paper is a first theoretical study of the privacy-utilitytrade-off in personalized graph link-analysis based socialrecommender system.
There are many different settings in which socialrecommendations may be used, however all these problemshave a common structure - social graph.
The main contributions are intuitive and precise trade-offresults between privacy and utility for a clear formal modelof personlized social recommendations.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Paper Framework
The paper is a first theoretical study of the privacy-utilitytrade-off in personalized graph link-analysis based socialrecommender system.
There are many different settings in which socialrecommendations may be used, however all these problemshave a common structure - social graph.
The main contributions are intuitive and precise trade-offresults between privacy and utility for a clear formal modelof personlized social recommendations.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
The Paper Framework
The paper is a first theoretical study of the privacy-utilitytrade-off in personalized graph link-analysis based socialrecommender system.
There are many different settings in which socialrecommendations may be used, however all these problemshave a common structure - social graph.
The main contributions are intuitive and precise trade-offresults between privacy and utility for a clear formal modelof personlized social recommendations.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Modeling the Problem
The steps for formalizing the problem will be:
1 Describe what a social algorithm entails.
2 State the chosen notion of privacy - differential privacy.
3 Define the accuracy of an algorithm.
4 State the problem of designing a private and accuratesocial recommendation algorithm.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Modeling the Problem
The steps for formalizing the problem will be:
1 Describe what a social algorithm entails.
2 State the chosen notion of privacy - differential privacy.
3 Define the accuracy of an algorithm.
4 State the problem of designing a private and accuratesocial recommendation algorithm.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Modeling the Problem
The steps for formalizing the problem will be:
1 Describe what a social algorithm entails.
2 State the chosen notion of privacy - differential privacy.
3 Define the accuracy of an algorithm.
4 State the problem of designing a private and accuratesocial recommendation algorithm.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Modeling the Problem
The steps for formalizing the problem will be:
1 Describe what a social algorithm entails.
2 State the chosen notion of privacy - differential privacy.
3 Define the accuracy of an algorithm.
4 State the problem of designing a private and accuratesocial recommendation algorithm.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendation Algorithm
Let G = (V,E) be the graph that describes the network ofconnections between people and entities.
Each recommendation is an edge (i, r) where node i isrecommended to target node r.
We denote the utility of recommending node i to noder by uG,ri .
The utility is some function of the structure of G.
We assume that a recommendation algorithm R is aprobability vector on all nodes, where pG,ri denotes theprobability of recommending node i to node r in graph Gby the specified algorithm G.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendation Algorithm
Let G = (V,E) be the graph that describes the network ofconnections between people and entities.
Each recommendation is an edge (i, r) where node i isrecommended to target node r.
We denote the utility of recommending node i to noder by uG,ri .
The utility is some function of the structure of G.
We assume that a recommendation algorithm R is aprobability vector on all nodes, where pG,ri denotes theprobability of recommending node i to node r in graph Gby the specified algorithm G.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendation Algorithm
Let G = (V,E) be the graph that describes the network ofconnections between people and entities.
Each recommendation is an edge (i, r) where node i isrecommended to target node r.
We denote the utility of recommending node i to noder by uG,ri .
The utility is some function of the structure of G.
We assume that a recommendation algorithm R is aprobability vector on all nodes, where pG,ri denotes theprobability of recommending node i to node r in graph Gby the specified algorithm G.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendation Algorithm
Let G = (V,E) be the graph that describes the network ofconnections between people and entities.
Each recommendation is an edge (i, r) where node i isrecommended to target node r.
We denote the utility of recommending node i to noder by uG,ri .
The utility is some function of the structure of G.
We assume that a recommendation algorithm R is aprobability vector on all nodes, where pG,ri denotes theprobability of recommending node i to node r in graph Gby the specified algorithm G.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Social Recommendation Algorithm
Let G = (V,E) be the graph that describes the network ofconnections between people and entities.
Each recommendation is an edge (i, r) where node i isrecommended to target node r.
We denote the utility of recommending node i to noder by uG,ri .
The utility is some function of the structure of G.
We assume that a recommendation algorithm R is aprobability vector on all nodes, where pG,ri denotes theprobability of recommending node i to node r in graph Gby the specified algorithm G.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Definition - Differential Privacy
Since privacy protections are extremely important in socialnetworks, we will use a strong definition of privacy,Differential Privacy.
An algorithm preserves privacy of an entity if thealgorithm’s output is not sensitive to the presence orabsence of the entity’s information in the input data set.
In our setting of graph link-analysis based socialrecommendations, we wish to maintain the presence (orabsence) of an edge in the graph private.
Definiton
A recommendation algorithm R satisfies ε-differential privacy iffor any pair of graphs G and G′ that differ in one edge andevery set of possible recommendation S,Pr[R(G) ∈ S] ≤ exp(ε)× Pr[R(G′) ∈ S]
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Definition - Differential Privacy
Since privacy protections are extremely important in socialnetworks, we will use a strong definition of privacy,Differential Privacy.
An algorithm preserves privacy of an entity if thealgorithm’s output is not sensitive to the presence orabsence of the entity’s information in the input data set.
In our setting of graph link-analysis based socialrecommendations, we wish to maintain the presence (orabsence) of an edge in the graph private.
Definiton
A recommendation algorithm R satisfies ε-differential privacy iffor any pair of graphs G and G′ that differ in one edge andevery set of possible recommendation S,Pr[R(G) ∈ S] ≤ exp(ε)× Pr[R(G′) ∈ S]
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Definition - Differential Privacy
Since privacy protections are extremely important in socialnetworks, we will use a strong definition of privacy,Differential Privacy.
An algorithm preserves privacy of an entity if thealgorithm’s output is not sensitive to the presence orabsence of the entity’s information in the input data set.
In our setting of graph link-analysis based socialrecommendations, we wish to maintain the presence (orabsence) of an edge in the graph private.
Definiton
A recommendation algorithm R satisfies ε-differential privacy iffor any pair of graphs G and G′ that differ in one edge andevery set of possible recommendation S,Pr[R(G) ∈ S] ≤ exp(ε)× Pr[R(G′) ∈ S]
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Accuracy of an Algorithm
For simplicity, we focus on the problem of makingrecommandations for a fixed target node r.
Therefore the algorithm takes as input only one utilityvector u and returns one probability vector p.
Definiton 2 - Accuracy
The accuracy of an algorithm R is defined as min~u∑uipi
umax,
where umax = maxi(ui).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Accuracy of an Algorithm
For simplicity, we focus on the problem of makingrecommandations for a fixed target node r.
Therefore the algorithm takes as input only one utilityvector u and returns one probability vector p.
Definiton 2 - Accuracy
The accuracy of an algorithm R is defined as min~u∑uipi
umax,
where umax = maxi(ui).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Accuracy of an Algorithm
For simplicity, we focus on the problem of makingrecommandations for a fixed target node r.
Therefore the algorithm takes as input only one utilityvector u and returns one probability vector p.
Definiton 2 - Accuracy
The accuracy of an algorithm R is defined as min~u∑uipi
umax,
where umax = maxi(ui).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Accuracy of an Algorithm
In other words, an algorithm is (1− δ)-accurate if (1) the
output pi are such that∑uipi
umax≥ (1− δ), and (2) there
exists an input utility vector ~u such that the output pisatisfies
∑uipi
umax= (1− δ).
We follow the paradigm of worst-case performanceanalysis from the algorithm literature.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Accuracy of an Algorithm
In other words, an algorithm is (1− δ)-accurate if (1) the
output pi are such that∑uipi
umax≥ (1− δ), and (2) there
exists an input utility vector ~u such that the output pisatisfies
∑uipi
umax= (1− δ).
We follow the paradigm of worst-case performanceanalysis from the algorithm literature.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Problem Statement
Definiton 3 - Private Social Recommandations
Design a social recommendation algorithm R with maximumpossible accuracy under the constraint that R satisfiesε-differential privacy.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Generic Privacy Lower Bounds
Instead of assuming a specific graph link-basedrecommendation algorithm, more ambitiously. we aim todetermine accuracy bounds for a general class ofrecommendation algorithms.
We first define properties that one can expect mostreasonable utility functions and recommandtion alogrithmsto satisfieys.
We then present a general bound that applies to allalgorithms and utility functions satisfying those properties.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Generic Privacy Lower Bounds
Instead of assuming a specific graph link-basedrecommendation algorithm, more ambitiously. we aim todetermine accuracy bounds for a general class ofrecommendation algorithms.
We first define properties that one can expect mostreasonable utility functions and recommandtion alogrithmsto satisfieys.
We then present a general bound that applies to allalgorithms and utility functions satisfying those properties.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Generic Privacy Lower Bounds
Instead of assuming a specific graph link-basedrecommendation algorithm, more ambitiously. we aim todetermine accuracy bounds for a general class ofrecommendation algorithms.
We first define properties that one can expect mostreasonable utility functions and recommandtion alogrithmsto satisfieys.
We then present a general bound that applies to allalgorithms and utility functions satisfying those properties.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
A meaningful utility function in the context ofrecommendations on social network should be satisfy twoaxioms:
Axiom 1 (Exchangeability)
Let G be a graph and let h be an isomorphism on the nodesgiving graph Gh, s.t. for target node r, h(r) = r. Then∀i : uG,ri = uGh,r
h(i) .
The utility of a node i should not depend on the node’sidentity.
The utility for target node r only depends on the structualproperties of the graph, and so, nodes isomorphic from theperspective of r should have the same utility.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
A meaningful utility function in the context ofrecommendations on social network should be satisfy twoaxioms:
Axiom 1 (Exchangeability)
Let G be a graph and let h be an isomorphism on the nodesgiving graph Gh, s.t. for target node r, h(r) = r. Then∀i : uG,ri = uGh,r
h(i) .
The utility of a node i should not depend on the node’sidentity.
The utility for target node r only depends on the structualproperties of the graph, and so, nodes isomorphic from theperspective of r should have the same utility.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
A meaningful utility function in the context ofrecommendations on social network should be satisfy twoaxioms:
Axiom 1 (Exchangeability)
Let G be a graph and let h be an isomorphism on the nodesgiving graph Gh, s.t. for target node r, h(r) = r. Then∀i : uG,ri = uGh,r
h(i) .
The utility of a node i should not depend on the node’sidentity.
The utility for target node r only depends on the structualproperties of the graph, and so, nodes isomorphic from theperspective of r should have the same utility.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
Axiom 2 (Concentration)
There exists S ⊂ V (G), such that |S| = β, and∑i∈S ui ≥ Ω(1)
∑i∈V (G) ui
This says there are some β nodes that together have atleast a constant fraction of the total utility.
In large graphs there are usually a small number of nodesthat are very good recommendations for r and a long tailof those that are not.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
Axiom 2 (Concentration)
There exists S ⊂ V (G), such that |S| = β, and∑i∈S ui ≥ Ω(1)
∑i∈V (G) ui
This says there are some β nodes that together have atleast a constant fraction of the total utility.
In large graphs there are usually a small number of nodesthat are very good recommendations for r and a long tailof those that are not.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
We now define a property of a recommendation algorithm:
Definition 4 (Monotonicity)
An algorithm is said to be monotonic if ∀i, j, ui > uj impliesthat pi > pj .
A very natural notion for recommendation algorithm tosatisfy - the algorithm recommends a higher utility nodewith a higher probability than a lower utility node.
Example (Number of common neighbors utility function)
Given a target node r and graph G, the number of commonneighbors utility function assigns a utility uG,ri = C(i, r), whereC(i, r) is the number of common neighbors between i and r.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
We now define a property of a recommendation algorithm:
Definition 4 (Monotonicity)
An algorithm is said to be monotonic if ∀i, j, ui > uj impliesthat pi > pj .
A very natural notion for recommendation algorithm tosatisfy - the algorithm recommends a higher utility nodewith a higher probability than a lower utility node.
Example (Number of common neighbors utility function)
Given a target node r and graph G, the number of commonneighbors utility function assigns a utility uG,ri = C(i, r), whereC(i, r) is the number of common neighbors between i and r.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Properties of Utility Functions and Algorithms
We now define a property of a recommendation algorithm:
Definition 4 (Monotonicity)
An algorithm is said to be monotonic if ∀i, j, ui > uj impliesthat pi > pj .
A very natural notion for recommendation algorithm tosatisfy - the algorithm recommends a higher utility nodewith a higher probability than a lower utility node.
Example (Number of common neighbors utility function)
Given a target node r and graph G, the number of commonneighbors utility function assigns a utility uG,ri = C(i, r), whereC(i, r) is the number of common neighbors between i and r.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
Lower bound on the privacy parameter ε for anydifferentially private recommendation algorithm that (a)achives a constant accuracy and (b) is based on any utilityfunctions that satisfies the former axioms.
Proof technique for the lower bound using the number ofcommon neighbors utility metric.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
Lower bound on the privacy parameter ε for anydifferentially private recommendation algorithm that (a)achives a constant accuracy and (b) is based on any utilityfunctions that satisfies the former axioms.
Proof technique for the lower bound using the number ofcommon neighbors utility metric.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.
2 The nodes in any graph can be split into two groups - V rhi,
nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.6 We show that we can carefully modify the graph G by
adding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.2 The nodes in any graph can be split into two groups - V r
hi,nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.6 We show that we can carefully modify the graph G by
adding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.
2 The nodes in any graph can be split into two groups - V rhi,
nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.6 We show that we can carefully modify the graph G by
adding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.2 The nodes in any graph can be split into two groups - V r
hi,nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.6 We show that we can carefully modify the graph G by
adding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.2 The nodes in any graph can be split into two groups - V r
hi,nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.
6 We show that we can carefully modify the graph G byadding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.2 The nodes in any graph can be split into two groups - V r
hi,nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.6 We show that we can carefully modify the graph G by
adding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
1 Let r be the target node for recommedation.2 The nodes in any graph can be split into two groups - V r
hi,nodes which have a high utility for the target node r andV rlo, nodes that have a low utility.
3 Since the recommendation algorithm has to achive aconstant accuracy, it has to recommand one of the highutility nodes with constant probability.
4 By the conccentration axiom, there are only a few nodesin V r
hi, but there are many nodes in V rlo.
5 Hence, there exists a node i in the high utility group and anode l in the low utility group such that Γ = pi
plis very
large.
6 We show that we can carefully modify the graph G byadding/or deleting a small number (t) of edges in such away that the node l becomes the node with highest utilityin G′ (using the exchangeability axiom).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
It now follows from differential privacy that ε ≥ 1t logΓ.
After generalizing it further, we will get the followinglemma states the main trade-off relationship between theaccuracy parameter 1− δ and the privacy parameter ε of arecommendation algorithm: ε ≥ 1
t (ln( c−δδ ) + ln(n−kk+1 ).
The lemma gives us a lower bound on the privacy guarnteeε in terms of the accuracy parameter 1− δ.
Using the concentration axiom with parameter β theyprove: For (1− δ) = Ω(1) and β = o( n
logn),
ε ≥ logn−o(logn)t .
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
It now follows from differential privacy that ε ≥ 1t logΓ.
After generalizing it further, we will get the followinglemma states the main trade-off relationship between theaccuracy parameter 1− δ and the privacy parameter ε of arecommendation algorithm: ε ≥ 1
t (ln( c−δδ ) + ln(n−kk+1 ).
The lemma gives us a lower bound on the privacy guarnteeε in terms of the accuracy parameter 1− δ.
Using the concentration axiom with parameter β theyprove: For (1− δ) = Ω(1) and β = o( n
logn),
ε ≥ logn−o(logn)t .
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
It now follows from differential privacy that ε ≥ 1t logΓ.
After generalizing it further, we will get the followinglemma states the main trade-off relationship between theaccuracy parameter 1− δ and the privacy parameter ε of arecommendation algorithm: ε ≥ 1
t (ln( c−δδ ) + ln(n−kk+1 ).
The lemma gives us a lower bound on the privacy guarnteeε in terms of the accuracy parameter 1− δ.
Using the concentration axiom with parameter β theyprove: For (1− δ) = Ω(1) and β = o( n
logn),
ε ≥ logn−o(logn)t .
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
It now follows from differential privacy that ε ≥ 1t logΓ.
After generalizing it further, we will get the followinglemma states the main trade-off relationship between theaccuracy parameter 1− δ and the privacy parameter ε of arecommendation algorithm: ε ≥ 1
t (ln( c−δδ ) + ln(n−kk+1 ).
The lemma gives us a lower bound on the privacy guarnteeε in terms of the accuracy parameter 1− δ.
Using the concentration axiom with parameter β theyprove: For (1− δ) = Ω(1) and β = o( n
logn),
ε ≥ logn−o(logn)t .
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
Theorem 1
For a graph with maximum degree dmax = αlogn adifferentially private algorithm can guarantee constant accuracyonly if ε ≥ 1
α(14 − o(1)).
Example (A graph with maximum degree logn)
As an example, the theorem implies that for a graph withmaximum degree logn, there is no 0.24-differentially privatealgorithm that achives any constant accuracy.
The model can be extended.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
Theorem 1
For a graph with maximum degree dmax = αlogn adifferentially private algorithm can guarantee constant accuracyonly if ε ≥ 1
α(14 − o(1)).
Example (A graph with maximum degree logn)
As an example, the theorem implies that for a graph withmaximum degree logn, there is no 0.24-differentially privatealgorithm that achives any constant accuracy.
The model can be extended.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
General Lower Bound
Theorem 1
For a graph with maximum degree dmax = αlogn adifferentially private algorithm can guarantee constant accuracyonly if ε ≥ 1
α(14 − o(1)).
Example (A graph with maximum degree logn)
As an example, the theorem implies that for a graph withmaximum degree logn, there is no 0.24-differentially privatealgorithm that achives any constant accuracy.
The model can be extended.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Specific Utility lower Bounds
We’ll prove a stronger lower bounds for particular utilityfunctions using tighter upper bounds on t.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
Consider a graph and a target node r.
We can make any node x have the highest utility byadding edges from it to all r’s neighbors.
If dr is r’s degree, it suffices to add t = dr +O(1) edgesto make a node the highest utility node.
Theorem 2
Let U be a utility function that depends only on and ismonotonicaly increasing with C(x, y), the number of commonneighbors between x and y. A recommandation algorithmbased on U that guarantees any constant accuracy for targetnode r has a lower bound on privacy given by ε ≥ 1−o(1)
α wheredr = αlogn.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
Consider a graph and a target node r.
We can make any node x have the highest utility byadding edges from it to all r’s neighbors.
If dr is r’s degree, it suffices to add t = dr +O(1) edgesto make a node the highest utility node.
Theorem 2
Let U be a utility function that depends only on and ismonotonicaly increasing with C(x, y), the number of commonneighbors between x and y. A recommandation algorithmbased on U that guarantees any constant accuracy for targetnode r has a lower bound on privacy given by ε ≥ 1−o(1)
α wheredr = αlogn.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
Consider a graph and a target node r.
We can make any node x have the highest utility byadding edges from it to all r’s neighbors.
If dr is r’s degree, it suffices to add t = dr +O(1) edgesto make a node the highest utility node.
Theorem 2
Let U be a utility function that depends only on and ismonotonicaly increasing with C(x, y), the number of commonneighbors between x and y. A recommandation algorithmbased on U that guarantees any constant accuracy for targetnode r has a lower bound on privacy given by ε ≥ 1−o(1)
α wheredr = αlogn.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
Consider a graph and a target node r.
We can make any node x have the highest utility byadding edges from it to all r’s neighbors.
If dr is r’s degree, it suffices to add t = dr +O(1) edgesto make a node the highest utility node.
Theorem 2
Let U be a utility function that depends only on and ismonotonicaly increasing with C(x, y), the number of commonneighbors between x and y. A recommandation algorithmbased on U that guarantees any constant accuracy for targetnode r has a lower bound on privacy given by ε ≥ 1−o(1)
α wheredr = αlogn.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
This is a very strong lower bound.
Since significant fraction of nodes in real-world graphshave small dr, we can expect no algorithm based oncommon neighbors utility to be both accurate and satisfydifferential with reasonable ε.
Moreover, this is contrary to the commonly held beliefthat one can eliminate privacy risk by connecting to a fewhigh degree nodes.
Example (Maximum Degree - logn)
To understand the consequence of this theorem, consider anexample of a graph on n nodes with maximum degree logn.Any algorithm that makes recommendations based on thecommon neighbors utility function achieves a constantaccuracy is at best 1.0-differentially private.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
This is a very strong lower bound.
Since significant fraction of nodes in real-world graphshave small dr, we can expect no algorithm based oncommon neighbors utility to be both accurate and satisfydifferential with reasonable ε.
Moreover, this is contrary to the commonly held beliefthat one can eliminate privacy risk by connecting to a fewhigh degree nodes.
Example (Maximum Degree - logn)
To understand the consequence of this theorem, consider anexample of a graph on n nodes with maximum degree logn.Any algorithm that makes recommendations based on thecommon neighbors utility function achieves a constantaccuracy is at best 1.0-differentially private.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
This is a very strong lower bound.
Since significant fraction of nodes in real-world graphshave small dr, we can expect no algorithm based oncommon neighbors utility to be both accurate and satisfydifferential with reasonable ε.
Moreover, this is contrary to the commonly held beliefthat one can eliminate privacy risk by connecting to a fewhigh degree nodes.
Example (Maximum Degree - logn)
To understand the consequence of this theorem, consider anexample of a graph on n nodes with maximum degree logn.Any algorithm that makes recommendations based on thecommon neighbors utility function achieves a constantaccuracy is at best 1.0-differentially private.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy Bound for Common Neighbors
This is a very strong lower bound.
Since significant fraction of nodes in real-world graphshave small dr, we can expect no algorithm based oncommon neighbors utility to be both accurate and satisfydifferential with reasonable ε.
Moreover, this is contrary to the commonly held beliefthat one can eliminate privacy risk by connecting to a fewhigh degree nodes.
Example (Maximum Degree - logn)
To understand the consequence of this theorem, consider anexample of a graph on n nodes with maximum degree logn.Any algorithm that makes recommendations based on thecommon neighbors utility function achieves a constantaccuracy is at best 1.0-differentially private.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy-Preserving Algorithms
Exponential Mechanism
The exponential mechanism creates a smooth probabilitydistribution from the utility vector and samples from it.
Laplace Mechanism
The Laplace mechanism first adds random noise drawn from aLaplace distribution and like the optimal mechanism, picks thenode with the maximum noise-infused utility.
Algorithms AL(ε) and AE(ε) guarantee ε differentialprivacy.
AL(ε) and AE(ε) achieve very similar accuracies.
Both algorithms assume the knowledge of the entire utilityvector.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy-Preserving Algorithms
Exponential Mechanism
The exponential mechanism creates a smooth probabilitydistribution from the utility vector and samples from it.
Laplace Mechanism
The Laplace mechanism first adds random noise drawn from aLaplace distribution and like the optimal mechanism, picks thenode with the maximum noise-infused utility.
Algorithms AL(ε) and AE(ε) guarantee ε differentialprivacy.
AL(ε) and AE(ε) achieve very similar accuracies.
Both algorithms assume the knowledge of the entire utilityvector.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy-Preserving Algorithms
Exponential Mechanism
The exponential mechanism creates a smooth probabilitydistribution from the utility vector and samples from it.
Laplace Mechanism
The Laplace mechanism first adds random noise drawn from aLaplace distribution and like the optimal mechanism, picks thenode with the maximum noise-infused utility.
Algorithms AL(ε) and AE(ε) guarantee ε differentialprivacy.
AL(ε) and AE(ε) achieve very similar accuracies.
Both algorithms assume the knowledge of the entire utilityvector.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Privacy-Preserving Algorithms
Exponential Mechanism
The exponential mechanism creates a smooth probabilitydistribution from the utility vector and samples from it.
Laplace Mechanism
The Laplace mechanism first adds random noise drawn from aLaplace distribution and like the optimal mechanism, picks thenode with the maximum noise-infused utility.
Algorithms AL(ε) and AE(ε) guarantee ε differentialprivacy.
AL(ε) and AE(ε) achieve very similar accuracies.
Both algorithms assume the knowledge of the entire utilityvector.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Experiments Setup
Present experimental results on two real-world graphs andfor two particular utility functions.
Compute accuracies achived by the Laplace andExponential mechanisms and compare them with thetheoretical upper bound on accuracy that anyε-differentially private algorithm can hope to achive.
We use two publicity available networks - Wikipedia votenetwork (GWV ) and Twitter connections network (GT ).
We use two particular utility functions: the number ofcommon neighbors and weighted paths (practical use bymany companies).
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Results
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Results
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Results
Exponential vs Laplace mechanism: - All experimentsverified that Laplace mechnism achives nearly identicalaccuracy as the Exponential mechanism.
For a large fraction of nodes, the accuracy achieved byLaplace and Exponential mechanisms is close to the bestpossible accuracy suggested by the theoretical bound.
For most nodes, our bounds suggest that there is aninevitable harsh trade-off between privacy and accuracywhen making social recommendations, yielding pooraccuracy under reasonable privacy parameter ε.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Future Work and Extensions
Examine other utility functions.
Most works on making recommendations deal with staticdata.
What happens when a certain edges are sensitive.
Examine weaker privacy notion than the differential.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Future Work and Extensions
Examine other utility functions.
Most works on making recommendations deal with staticdata.
What happens when a certain edges are sensitive.
Examine weaker privacy notion than the differential.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Future Work and Extensions
Examine other utility functions.
Most works on making recommendations deal with staticdata.
What happens when a certain edges are sensitive.
Examine weaker privacy notion than the differential.
Introduction
Modeling theProblem
Social Recom-mendationAlgorithm
PrivacyDefinition
Accuracy of anAlgorithm
ProblemStatement
GenericBounds
Properties ofAlgorithms
General LowerBound
SpecificBounds
Privacy Boundfor CommonNeighbors
Privacy-PreservingAlgorithms
Summary
Future Work and Extensions
Examine other utility functions.
Most works on making recommendations deal with staticdata.
What happens when a certain edges are sensitive.
Examine weaker privacy notion than the differential.
