Expanding the attack surface: Robust profiling attacks threaten the privacy of sparse behavioral data

Abstract

Behavioral data, collected from our daily interactions with technology, have driven scientific advances. Yet, the collection and sharing of this data raise legitimate privacy concerns, as individuals can often be reidentified. Current identification attacks, however, require auxiliary information to roughly match the information available in the dataset, limiting their applicability. We here propose an entropy-based profiling model to learn time-persistent profiles. Using auxiliary information about a single target collected over a nonoverlapping time period, we show that individuals are correctly identified 79% of the time in a large location dataset of 0.5 million individuals and 65.2% for a grocery shopping dataset of 85,000 individuals. We further show that accuracy only slowly decreases over time and that the model is robust to state-of-the-art noise addition. Our results show that much more auxiliary information than previously believed can be used to identify individuals, challenging deidentification practices and what currently constitutes legally anonymous data.

Anonymization: The imperfect science of using data while preserving privacy

“…On location data, profiling attacks have been proposed, which use, for example, histogram matching using likelihood-ratio tests ( 62 ) and frequency-based likelihoods ( 54 , 63 ) or Markov chain models ( 59 , 64 – 66 ) that capture regularity in the user behavior. Tournier and de Montjoye ( 67 ) recently improved on these results, proposing an entropy-based model that additionally estimates the correctness of the match. Profiling attacks have also been applied to interaction graphs derived from call detail records and Bluetooth close-proximity networks ( 68 ), smart meter recordings ( 69 ), and chess player actions ( 70 ).…”

Concerns about using a digital mask to safeguard patient privacy

“…These are trained to identify individuals in pictures, based on detected facial patterns, but are not optimized for DM-reconstructed images. It is likely that better reidentification algorithms could be developed to reidentify masked patients 8 , 9 . An attacker leveraging the additional information available, such as eyeballs, and better reidentification algorithms is thus likely to be able to reidentify an individual with an even higher rank-1 accuracy than the one we report here.…”