[论文解读] PrivateFetch: Scalable Catalog Delivery in Privacy-Preserving Advertising

Muhammad Haris Mughees, Gonçalo Pestana+2 more|arXiv (Cornell University)|Sep 16, 2021

Privacy-Preserving Technologies in Data被引用 4

一句话总结

PrivateFetch 提出了一种隐私保护的广告投放系统，通过客户端偏好计算和高效的单服务器私有信息检索（PIR）技术，在不向服务器暴露用户偏好的前提下检索目标广告。该系统在包含超过一百万条记录的数据库中，以不到40秒的时间完成30条广告的交付，通信开销仅为192 KB，运营成本不足平均广告收入的1%。

ABSTRACT

In order to preserve the possibility of an Internet that is free at the point of use, attention is turning to new solutions that would allow targeted advertisement delivery based on behavioral information such as user preferences, without compromising user privacy. Recently, explorations in devising such systems either take approaches that rely on semantic guarantees like $k$-anonymity -- which can be easily subverted when combining with alternative information, and do not take into account the possibility that even knowledge of such clusters is privacy-invasive in themselves. Other approaches provide full privacy by moving all data and processing logic to clients -- but which is prohibitively expensive for both clients and servers. In this work, we devise a new framework called PrivateFetch for building practical ad-delivery pipelines that rely on cryptographic hardness and best-case privacy, rather than syntactic privacy guarantees or reliance on real-world anonymization tools. PrivateFetch utilizes local computation of preferences followed by high-performance single-server private information retrieval (PIR) to ensure that clients can pre-fetch ad content from servers, without revealing any of their inherent characteristics to the content provider. When considering an database of $>1,000,000$ ads, we show that we can deliver $30$ ads to a client in 40 seconds, with total communication costs of 192KB. We also demonstrate the feasibility of PrivateFetch by showing that the monetary cost of running it is less than 1% of average ad revenue. As such, our system is capable of pre-fetching ads for clients based on behavioral and contextual user information, before displaying them during a typical browsing session. In addition, while we test PrivateFetch as a private ad-delivery, the generality of our approach means that it could also be used for other content types.

研究动机与目标

• 为解决行为广告中的隐私-效用权衡问题，消除客户端向广告服务器泄露数据的情况。
• 设计一种系统，实现在不依赖 Tor 等第三方匿名网络的前提下，实现私密且高性能的广告检索。
• 相比将整个数据库发送给客户端的方式，降低目标广告投放的开销和带宽。
• 利用密码学难题提供强隐私保障，而非依赖 k-匿名性等语法或启发式隐私模型。
• 构建一个实用且可部署的框架，适用于广告以外的其他私密内容分发场景。

提出的方法

• 客户端在本地使用局部敏感哈希（LSH）对行为和上下文数据进行处理，计算用户偏好。
• 系统采用单服务器、无状态的 PIR 协议，从不可信服务器中私密地检索选定广告。
• 应用密码学优化以最小化客户端状态并提升 PIR 效率。
• PIR 协议确保服务器无法获知客户端的查询内容或偏好信息。
• 系统设计为模块化结构，未来可轻松替换为更高效的底层 PIR 方案。
• 通过可配置的 PIR 参数最小化通信开销，实现低带宽使用。

实验结果

研究问题

• RQ1 能否构建一个实用且可扩展的系统，在不向广告提供商泄露用户偏好信息的前提下实现目标广告投放？
• RQ2 如何高效地将私有信息检索（PIR）集成到现实世界的广告投放流程中？
• RQ3 与直接传输整个数据库相比，使用 PIR 进行广告检索带来的性能和成本开销如何？
• RQ4 PIR 系统在现实部署场景中能否同时实现强隐私保护和可接受的性能表现？
• RQ5 PIR 在多大程度上可以替代匿名网络（如 Tor）在私密内容检索中的应用？

主要发现

• PrivateFetch 在包含超过一百万条记录的数据库中，40秒内完成30条目标广告的交付，通信量仅为192 KB。
• 系统将运营成本降低至平均广告收入的1%以下，相比将整个数据库发送给客户端的方式，实现10倍的财务节省。
• 性能与非私密广告定位系统相当，证明了其在不牺牲隐私的前提下具备实用性。
• 系统避免依赖 Tor 等外部匿名网络，提升了可用性和兼容性。
• 该方法具有通用性，仅需少量协议修改，即可扩展用于其他类型内容的私密异步获取。
• 密码学优化使客户端状态极小化，显著提升了在现实环境中的可部署性与效率。