[Paper Review] Beyond Random Noise: Insights on Anonymization Strategies from a Latent Bandit Study

Alexander Galozy, Sadi Alawadi+2 more|arXiv (Cornell University)|Sep 30, 2023

Privacy-Preserving Technologies in DataComputer Science3 citations

TL;DR

This paper evaluates privacy-preserving anonymization strategies in a latent bandit setting, demonstrating that simple noise injection (e.g., Laplace mechanism) harms performance and fails to ensure privacy, while combining noise with aggregation strategies like clustering and averaging offers better trade-offs. It reveals that standard privacy metrics like ADS do not reliably predict de-anonymization risk, urging attack-specific evaluation over one-size-fits-all approaches.

ABSTRACT

This paper investigates the issue of privacy in a learning scenario where users share knowledge for a recommendation task. Our study contributes to the growing body of research on privacy-preserving machine learning and underscores the need for tailored privacy techniques that address specific attack patterns rather than relying on one-size-fits-all solutions. We use the latent bandit setting to evaluate the trade-off between privacy and recommender performance by employing various aggregation strategies, such as averaging, nearest neighbor, and clustering combined with noise injection. More specifically, we simulate a linkage attack scenario leveraging publicly available auxiliary information acquired by the adversary. Our results on three open real-world datasets reveal that adding noise using the Laplace mechanism to an individual user's data record is a poor choice. It provides the highest regret for any noise level, relative to de-anonymization probability and the ADS metric. Instead, one should combine noise with appropriate aggregation strategies. For example, using averages from clusters of different sizes provides flexibility not achievable by varying the amount of noise alone. Generally, no single aggregation strategy can consistently achieve the optimum regret for a given desired level of privacy.

Motivation & Objective

• To investigate the effectiveness of anonymization strategies in a privacy-preserving recommendation system under realistic linkage attacks.
• To assess whether traditional noise-based methods like Laplace mechanism provide adequate privacy without degrading performance.
• To evaluate the reliability of the ADS metric in predicting real-world de-anonymization risk.
• To explore whether combined strategies of noise and aggregation outperform isolated techniques.
• To advocate for attack-aware design of privacy mechanisms instead of relying on generic metrics or one-size-fits-all solutions.

Proposed method

• Employs a latent bandit framework to simulate user knowledge sharing in recommendation tasks.
• Applies various anonymization strategies: Laplace noise, tSVD transformation, and aggregation via averaging, nearest neighbor, and clustering.
• Uses real-world datasets (CASAS, Endomondo, Fitbit) to evaluate privacy and performance trade-offs.
• Employs a linkage attack scenario where adversaries use publicly available auxiliary data to re-identify anonymized records.
• Measures performance via regret and privacy via de-anonymization probability and the ADS metric.
• Compares anonymization outcomes across noise levels and aggregation configurations to identify optimal trade-offs.

Experimental results

Research questions

• RQ1 Does adding Laplace noise to individual user records effectively protect privacy while maintaining recommender system performance?
• RQ2 Can aggregation strategies like clustering and averaging provide better privacy-performance trade-offs than noise alone?
• RQ3 How well does the ADS metric predict actual de-anonymization probability in linkage attacks?
• RQ4 Is there a single optimal anonymization strategy that performs well across all privacy levels?
• RQ5 To what extent do standard privacy metrics mislead data owners about actual re-identification risk?

Key findings

• Laplace noise added to individual records results in the highest regret across all noise levels, indicating poor performance and weak privacy protection.
• Combining noise with aggregation—especially clustering with varying cluster sizes—provides greater flexibility and better privacy-performance trade-offs than adjusting noise levels alone.
• No single aggregation strategy achieves optimal regret across all desired de-anonymization probabilities, indicating that multiple strategies are needed for comprehensive protection.
• The ADS metric shows a significant mismatch with actual de-anonymization probability: it overestimates privacy at high noise levels and underestimates it at low noise levels.
• Even simple deanonymization algorithms can lead to substantial overestimation of privacy, suggesting that more advanced attacks would further undermine trust in current metrics.
• The findings imply that privacy mechanisms must be evaluated against realistic attack models rather than relying on generic metrics like ADS or GAN-based anonymization objectives.