Sharing graphs using differentially private graph models

Abstract

Continuing success of research on social and computer networks requires open access to realistic measurement datasets. While these datasets can be shared, generally in the form of social or Internet graphs, doing so often risks exposing sensitive user data to the public. Unfortunately, current techniques to improve privacy on graphs only target specific attacks, and have been proven to be vulnerable against powerful de-anonymization attacks.Our work seeks a solution to share meaningful graph datasets while preserving privacy. We observe a clear tension between strength of privacy protection and maintaining structural similarity to the original graph. To navigate the tradeoff, we develop a differentiallyprivate graph model we call Pygmalion. Given a graph G and a desired level of ǫ-differential privacy guarantee, Pygmalion extracts a graph's detailed structure into degree correlation statistics, introduces noise into the resulting dataset, and generates a synthetic graph G ′ . G ′ maintains as much structural similarity to G as possible, while introducing enough differences to provide the desired privacy guarantee. We show that simply applying differential privacy to graphs results in the addition of significant noise that may disrupt graph structure, making it unsuitable for experimental study. Instead, we introduce a partitioning approach that provides identical privacy guarantees using much less noise. Applied to real graphs, this technique requires an order of magnitude less noise for the same privacy guarantees. Finally, we apply our graph model to Internet, web, and Facebook social graphs, and show that it produces synthetic graphs that closely match the originals in both graph structure metrics and behavior in application-level tests.

Efficient Privacy-Preserving Stream Aggregation in Mobile Sensing with Low Aggregation Error

“…Grouping has been recently used for differentially-private publication of graph topologies [22,23]. These solutions divide a dataset into disjoint groups, which is different from our interleaved grouping technique.…”

LBSNSim: Analyzing and modeling location-based social networks

“…They found that two models consistently generate synthetic graphs with common graph metric values similar to those of the original graphs, and one produces high fidelity results in application-level tests. In a followup work the authors investigated how to share social network graphs without compromising user privacy [17]. Previous research has also studied how to generate synthetic social graphs with different properties [8], [9].…”

“…Third, LBSN datasets with different properties can be generated on demand, which can help researchers improve the statistical confidence in their experimental results. Previous work investigated the graph models that produce synthetic social graphs of online social networks [8], [9], [16], [17]. Given all these advantages of the model-generated LBSN datasets, however, no LBSN model has been proposed in the literature.…”

A workflow for differentially-private graph synthesis

“…Happily, the answer is no. The analysis of [13] shows that the noise required to protect the privacy of the JDD can be non-uniform: for each (d1, d2) entry of the JDD, it suffices to add noise proportional to 4 max(d1, d2). Indeed, one consequence of our work is that these sorts of non-uniformities exist in many graph analysis problems, e.g., counting triangles, motifs, etc..…”

“…We can significantly improve the accuracy of differentially private graph measurements by exploiting opportunities to apply noise non-uniformly [13]. However, each new measurement algorithm requires a new non-trivial privacy analysis, that can be quite subtle and error prone.…”