Privacy Loss in Distributed Constraint Reasoning: A Quantitative Framework for Analysis and its Applications

Abstract

It is critical that agents deployed in real-world settings, such as businesses, offices, universities and research laboratories, protect their individual users' privacy when interacting with other entities. Indeed, privacy is recognized as a key motivating factor in the design of several multiagent algorithms, such as in distributed constraint reasoning (including both algorithms for distributed constraint optimization (DCOP) and distributed constraint satisfaction (DisCSPs)), and researchers have begun to propose metrics for analysis of privacy loss in such multiagent algorithms. Unfortunately, a general quantitative framework to compare these existing metrics for privacy loss or to identify dimensions along which to construct new metrics is currently lacking. This paper presents three key contributions to address this shortcoming. First, the paper presents VPS (Valuations of Possible States), a general quantitative framework to express, analyze and compare existing metrics of privacy loss. Based on a state-space model, VPS is shown to capture various existing measures of privacy created for specific domains of DisCSPs. The utility of VPS is further illustrated through analysis of privacy loss in DCOP algorithms, when such algorithms are used by personal assistant agents to schedule meetings among users. In addition, VPS helps identify dimensions along which to classify and construct new privacy metrics and it also supports their quantitative comparison. Second, the article presents key inference rules that may be used in analysis of privacy loss in DCOP algorithms under different assumptions. Third, detailed experiments based on the VPS-driven analysis lead to the following key results: (i) decentralization by itself does not provide superior protection of privacy in DisCSP/DCOP algorithms when compared with centralization; instead, privacy protection also requires the presence of uncertainty about agents' knowledge of the constraint graph. (ii) one needs to carefully examine the metrics chosen to measure privacy loss; the qualitative properties of privacy loss and hence the conclusions that can be drawn about an algorithm can vary widely based on the metric chosen. This paper should thus serve as a call to arms for further privacy research, particularly within the DisCSP/DCOP arena.

Distributed Heuristic Forward Search for Multi-agent Planning

“…If this value does not end up being assigned in the solution, the agent revealed some private information that could not have been deduced from only viewing the solution. Thus, followup work focused on the question of how to measure this privacy loss (Franzin, Rossi, Freuder, & Wallace, 2004;Maheswaran, Pearce, Bowring, Varakantham, & Tambe, 2006), analyzing how much information specific algorithms lose (Greenstadt, Pearce, & Tambe, 2006), and on the question of how to alter existing DisCSP algorithms to handle stricter privacy demands (Greenstadt, Grosz, & Smith, 2007;Léauté & Faltings, 2009). Very recently, work that provides formal guarantees for some DisCSP algorithms has emerged (Léauté & Faltings, 2009;Grinshpoun & Tassa, 2014).…”

A survey of privacy in multi-agent systems

“…These works try to reduce privacy loss of existing DisCSP/DCOP algorithms. Metrics based on the Valuations of Possible States (Maheswaran et al, 2006) framework are usually considered to quantify the reduction in privacy loss. Greenstadt et al (2007) present the DPOP with Secret Sharing (SSDPOP) algorithm, which is an extension of DPOP based on the efficient cryptographic technique of secret sharing.…”

Protecting Privacy through Distributed Computation in Multi-agent Decision Making

“…Metrics have been proposed to evaluate constraint privacy loss in algorithms, in particular for distributed meeting scheduling (Franzin, Freuder, Rossi, & Wallace, 2004;Wallace & Freuder, 2005). Maheswaran, Pearce, Bowring, Varakantham, and Tambe (2006) designed a framework called Valuation of Possible States (VPS) that they used to measure constraint privacy loss in the OptAPO and SynchBB algorithms, and they considered the impact of whether the problem topology is public or only partially known to the agents. Greenstadt et al (2006) also applied VPS to evaluate DPOP and ADOPT on meeting scheduling problems, under the assumption that the problem topology is public.…”