Discretionary Social Networks: Balancing Re-Identification Risks with Utility Guarantees

TL;DR

Social network platforms like LinkedIn face a paradox: users need to see connection paths to build "bridging social capital," but revealing these paths exposes sensitive relationship data. This paper proposes the Similar Reachability Graph (SRG) algorithm. Instead of just "hiding" data, it generates a synthetic-like subgraph that guarantees reachability (who can reach whom in (k) steps) while intentionally distorting the actual ties to thwart malicious snoopers.

The Tension Between Trust and Privacy

Trust is the currency of Social Network Sites (SNS). High-fidelity data is required to foster "bridging social capital" (the value found in weak ties). However, publishing raw subgraphs is dangerous. Even with names removed, an attacker with a little bit of "structural knowledge"—knowing that Bob is connected to three people who are also connected to each other—can re-identify individuals in an anonymized graph through Structural Attacks.

Previous works treated utility as an afterthought, measuring "how much data is left" after applying privacy filters. This paper flips the script: Utility is the constraint, and privacy (via distortion) is the goal.

Methodology: The SRG Algorithm

The core insight is that for a social network to be useful, we don't need to know the exact middle-men between Alice and Bob; we just need to know if they are reachable within a certain proximity (e.g., the "six degrees of separation" principle).

Reachability Definitions

1. k-Reachability Graph ((G_k)): A graph where an edge exists between any two nodes that are within (k) hops in the original graph.
2. The Objective: Produce a modified graph (G') such that its k-reachability matches the original ((G'_k = G_k)), but its actual edge list is as different as possible (measured by distortion ( heta)).

Implementation: The SRG Workflow

The SRG algorithm uses a greedy iterative process:

• Step 1: Calculate the distance matrix of the original graph.
• Step 2: Iteratively add and delete edges.
• Step 3: After every modification, verify if the "Reachability Requirement" (RR) or the "Relaxed Reachability Requirement" (RRR) still holds using a pruned Warshall-Floyd algorithm.
• Step 4: Stop once the target distortion ( heta) is reached.

Figure 1: Example of how two structurally different graphs (G1 and G2) can share the same 2-reachability properties (middle).

Experimental Validation

The authors tested SRG on Flickr (dense social links) and Gnutella (peer-to-peer topology) datasets.

1. Superior Utility Preservation

Compared to Randomized Anonymization (RAA), which simply shuffles edges, SRG preserves the Earth-Mover's Distance (EMD) of degree distributions much more effectively. In layman's terms, the "feel" and "shape" of the network remain intact even when specific connections are changed.

Figure 2: EMD metrics showing SRG (solid lines) diverging significantly less from the original graph than random perturbation (dashed lines).

2. Resilience to Attacks

The "Acid Test" for any graph anonymization is whether it can resist a "Subgraph Injection Attack." The results showed that when distortion levels reach near 100%, the success rate for an attacker trying to find their "marker" nodes drops significantly, effectively protecting user identity.

Critical Insight & Conclusion

The brilliance of this work lies in recognizing that Social Network Utility is primarily about reachability. By mathematically formalizing reachability as a constraint rather than a byproduct, the authors provide a framework where SNS providers can provide "Discretionary Revelation."

While the SRG algorithm is computationally intensive for massive graphs (due to the distance matrix updates), it is perfectly suited for the user-centric snapshots common in professional networking apps today. It allows platforms like LinkedIn to say: "We can show you that you are 3 steps away from a recruiter, without exposing the private social ties of the people in between."