[论文解读] Privacy Attacks on Network Embeddings

Michael Ellers, Michael Cochez+3 more|arXiv (Cornell University)|Dec 23, 2019

Privacy-Preserving Technologies in Data参考文献 36被引用 7

一句话总结

本文研究了从社交网络中移除用户并删除其嵌入向量后，是否仍会泄露关于其已删除连接的私密信息。通过测量嵌入向量中距离的变化，并在合成节点删除上训练分类器，作者表明，被删除节点的邻居可被高精度恢复——这意味着在GDPR框架下实现真正隐私保护需进行完整重训练。

ABSTRACT

Data ownership and data protection are increasingly important topics with ethical and legal implications, e.g., with the right to erasure established in the European General Data Protection Regulation (GDPR). In this light, we investigate network embeddings, i.e., the representation of network nodes as low-dimensional vectors. We consider a typical social network scenario with nodes representing users and edges relationships between them. We assume that a network embedding of the nodes has been trained. After that, a user demands the removal of his data, requiring the full deletion of the corresponding network information, in particular the corresponding node and incident edges. In that setting, we analyze whether after the removal of the node from the network and the deletion of the vector representation of the respective node in the embedding significant information about the link structure of the removed node is still encoded in the embedding vectors of the remaining nodes. This would require a (potentially computationally expensive) retraining of the embedding. For that purpose, we deploy an attack that leverages information from the remaining network and embedding to recover information about the neighbors of the removed node. The attack is based on (i) measuring distance changes in network embeddings and (ii) a machine learning classifier that is trained on networks that are constructed by removing additional nodes. Our experiments demonstrate that substantial information about the edges of a removed node/user can be retrieved across many different datasets. This implies that to fully protect the privacy of users, node deletion requires complete retraining - or at least a significant modification - of original network embeddings. Our results suggest that deleting the corresponding vector representation from network embeddings alone is not sufficient from a privacy perspective.

研究动机与目标

• 研究在节点和向量被移除后，网络嵌入是否仍保留关于用户已删除连接的私密信息。
• 评估删除节点及其嵌入向量是否足以在GDPR的删除权下实现隐私保护。
• 开发并评估一种隐私攻击，该攻击仅利用剩余网络和嵌入信息，恢复被移除节点的邻域结构。
• 确定从残留嵌入信息中重建已删除用户关系的可行性和准确性。
• 强调在用户删除后，必须对嵌入进行重训练或修改，以确保完全隐私。

提出的方法

• 使用标准算法（如node2vec、HOPE）在原始网络上训练网络嵌入。
• 移除目标节点，并在剩余网络上重新计算嵌入，以获得新的嵌入表示。
• 计算原始嵌入与修改后嵌入之间的成对距离差异，以检测由节点删除引起的结构变化。
• 在合成节点删除上训练监督机器学习分类器，以预测哪些节点是被删除节点的邻居。
• 利用分类器基于嵌入空间中的距离变化，推断真实被删除节点的邻域。
• 通过AUC和precision@10等指标，在多个真实世界数据集上评估攻击性能。

实验结果

研究问题

• RQ1 能否仅从网络中剩余节点的嵌入向量中重建被删除用户节点的邻域？
• RQ2 仅删除节点及其嵌入向量是否足以完全擦除关于该用户连接的私密信息？
• RQ3 仅利用剩余网络和嵌入数据，隐私攻击能多准确地恢复被移除节点的链接结构？
• RQ4 哪些类型的节点（例如高阶度节点）在网络嵌入中对这类隐私泄露最为脆弱？
• RQ5 该攻击的性能是否因不同嵌入算法（如node2vec与HOPE）而异？

主要发现

• 在使用node2vec嵌入的Facebook网络上，该攻击的AUC为0.72，precision@10为0.41。
• 使用HOPE嵌入时，该攻击的AUC为0.91，precision@10为0.60，表明恢复准确率显著更高。
• 高阶度节点被发现尤其容易遭受隐私恢复，表明其在信息泄露方面风险更高。
• 即使在向量被删除后，被删除节点的边信息仍大量编码在剩余节点的嵌入中。
• 结果表明，仅移除节点及其向量不足以实现隐私保护，必须进行完整重训练或显著修改嵌入。
• 该攻击在多个数据集和嵌入算法上均有效，表明当前网络嵌入实践存在普遍性漏洞。