Differentially Private Rank Aggregation

Abstract

Given a collection of rankings of a set of items, rank aggregation seeks to compute a ranking that can serve as a single best representative of the collection. Rank aggregation is a well-studied problem and a number of effective algorithmic solutions have been proposed in the literature. However, when individuals are asked to contribute a ranking, they may be concerned that their personal preferences will be disclosed inappropriately to others. This acts as a disincentive to individuals to respond honestly in expressing their preferences and impedes data collection and data sharing.We address this problem by investigating rank aggregation under differential privacy, which requires that a released output (here, the aggregate ranking computed from individuals' rankings) remain almost the same if any one individual's ranking is removed from the input. We propose a number of differentially-private rank aggregation algorithms: two are inspired by non-private approximate rank aggregators from the existing literature; another uses a novel rejection sampling method to sample privately from a complex distribution. For all the methods we propose, we quantify, both theoretically and empirically, the "cost" of privacy in terms of the quality of the rank aggregation computed.

Private rank aggregation under local differential privacy

“…For performance evaluation, we conduct experiments on three real-world datasets (TurkDots, TurkPuzzle and SUSHI) and several synthetic datasets generated from the Mallows model. By observing the average Kendall tau distance resulted from LDP-KwikSort, the state-of-the-art solution DP-KwikSort [4] for the curator model and the non-private KwikSort, it shows that our solution achieves strong privacy protection while maintaining an acceptable utility.…”

“…Rank aggregation under the differential privacy (DP) framework is a relatively new topic in the relevant community. [3], [4] considered the curator model of DP in which the trusted data curator has access to all agents' ranking preference profiles and would release the aggregated ranking by applying a differentially private algorithm M on them: Definition 1 (Differential Privacy). A randomized algorithm M satisfies -differential privacy if for all O ⊆ Range(M) and for all neighbouring datasets L and L differing on at most one record L i (i.e., the ranking preference profile of agent i), we have…”

“…Considering the above weakness of anonymization techniques and especially in the scenario of aggregated ranking release, two recent works [3], [4] adopted the rigorous differential privacy (DP) framework [5]- [7], and proposed several differentially private rank aggregation algorithms. Based on the properties of the curator model of DP, the data curator is assumed to be fully trusted and can access all agents' ranking preference profiles, while the adversary with any background knowledge could not confidently infer the existence of an agent's profile from the aggregated ranking released by the curator.…”

Secure Metric Learning via Differential Pairwise Privacy

“…For example, one can adopt the coin flipping style approach [18] to probabilistically change the relationship of any pair. In this case, any subsequently surmised relationship for a data pair can be possibly denied, such as [19]- [21]. If the privacy for individual feature is needed, one can resort to the input perturbation like [22].…”

DPWeVote: differentially private weighted voting protocol for cloud-based decision-making

“…Although there have been some existing researches on differentially private voting such as ; Leung and Lui (2012); Lee (2015); Hay, Elagina, and Miklau (2017), these methods do not consider the scenario of weighted voting, where the weights data are diverse and should also be protected. To our best knowledge, the differentially private weighted voting game is a novel problem.…”