Privacy Against Statistical Matching: Inter-User Correlation

Abstract

Modern applications significantly enhance user experience by adapting to each user's individual condition and/or preferences. While this adaptation can greatly improve utility or be essential for the application to work (e.g., for ridesharing applications), the exposure of user data to the application presents a significant privacy threat to the users, even when the traces are anonymized, since the statistical matching of an anonymized trace to prior user behavior can identify a user and their habits. Because of the current and growing algorithmic and computational capabilities of adversaries, provable privacy guarantees as a function of the degree of anonymization and obfuscation of the traces are necessary. Our previous work has established the requirements on anonymization and obfuscation in the case that data traces are independent between users. However, the data traces of different users will be dependent in many applications, and an adversary can potentially exploit such. In this paper, we consider the impact of correlation between user traces on their privacy. First, we demonstrate that the adversary can readily identify the association graph, revealing which user data traces are correlated. Next, we demonstrate that the adversary can use this association graph to break user privacy with significantly shorter traces than in the case when traces are independent between users, and that independent obfuscation of the data traces is often insufficient to remedy such. Finally, we discuss how the users can employ dependency in their obfuscation to improve their privacy.

Privacy of Dependent Users Against Statistical Matching

“…Now, given the fact that all P (l) 's are outside of H (n) , we prove P n s l=2 D P (1) , P (l) Π ≤ ∆ n → 0. We show that P (l) Π 's are close to P (l) 's, and as a result, they will be outside of F (n) .…”

“…In the next step, we prove P n s l=2 D P (1) , P (l) Π ≤ ∆ n → 0. Note that for all groups other than Group 1, we have…”

Asymptotic Privacy Loss Due to Time Series Matching of Dependent Users

“…In [5], [6], a comprehensive analysis of the asymptotic (in the length of the time series) optimal matching of time series to source distributions is presented in a non-Bayesian setting, where the number of users is a fixed, finite value. In contrast, we have adopted a Bayesian setting in [7]- [10], where a powerful adversary is assumed to have accurate prior distributions for user behavior through past observations or other sources. We consider the length of observations available to the adversary that guarantee privacy, or, conversely, the Nazanin Takbiri and Minting Chen contributed equally to this work.…”

Asymptotic Loss in Privacy due to Dependency in Gaussian Traces

“…friends, relatives), and the adversary can potentially exploit such. In [20], [21], we extended the results of [16], [17] to the case where users are dependent and the adversary knows only the structure of the association graph, i.e., whether each pair of users are linked. As expected, the knowledge of the dependency graph results in a significant degradation in privacy [16], [17].…”