Gρ-ASN: Defending Against Linkage Attacks in Joint Set-Valued and Social Network Data Sharing

TL;DR

In the era of big data, companies often release both user transaction records (set-valued data) and their social connections. This paper uncovers a critical vulnerability: even if both datasets are "anonymized" separately, an attacker can link them to de-anonymize users. The authors propose Gρ-ASN, a method that groups data to enforce strict uncertainty bounds while cleverly modifying social graph edges to keep community structures intact.

The Hidden Danger of Simultaneous Publishing

Data owners often rely on third-party institutions for data mining. A supermarket might share purchase history, while a social media platform shares friend lists. Traditionally, we might use ρ-uncertainty to ensure no specific item can be inferred with high probability, or k-degree anonymity to hide individuals in a crowd of similar-looking nodes.

The Motivation (The Insight): The core problem is the correlation. If Eve knows Alice bought a specific non-sensitive item (e.g., "Banana") and knows Alice has exactly 4 friends, she can cross-reference the transactional table with the social graph. Even if Alice is one of many with 4 friends, and one of many who bought bananas, there might be only one person who satisfies both conditions. This is the Linkage Attack.

Methodology: The Gρ-ASN Framework

The authors propose a synergistic approach that treats the two datasets as a unified entity.

1. Grouped ρ-uncertainty (GP)

Instead of applying privacy constraints globally, the method divides records into groups based on a Generalization Hierarchy.

• Local Generalization: Specific items (e.g., "Apple") are moved up the tree to broader categories (e.g., "Fruit").
• Partial Suppression: If generalization isn't enough to lower the confidence of a sensitive inference (ρ) below a threshold, specific items are deleted (suppressed).

2. Anonymizing the Correlative Social Network (ASN)

To stop the "degree-based" linkage, nodes within the same group must have the same degree. However, randomly adding or deleting edges destroys the "Community Structure" (vital for social analysis).

• The Intuition: When deleting edges to reduce degree, the algorithm preferentially removes intercommunal edges (links between different communities). When adding edges, it adds intracommunal edges. This keeps the "clusters" of the social network recognizable for researchers.

Fig 1: Illustrating how a 2-degree anonymized graph can still lead to re-identification when compared with transactional patterns.

Experimental Results & Data Utility

The researchers tested Gρ-ASN on Last.fm and Flixster.

• Information Loss (KL-Divergence): On the large Flixster dataset, Gρ-ASN outperformed the baseline TDControl. By grouping records, the algorithm avoids over-generalizing the entire dataset, maintaining high "truthfulness" in the data distribution.
• Graph Utility: By measuring Jaccard Similarity, the authors proved that their "community-aware" edge swapping preserved the original network topology much better than the standard Greedy_Swap algorithm.

Fig 2: Comparison of Information Loss (NCP) under different privacy thresholds (ρ).

Critical Analysis & Future Outlook

Takeaway: Gρ-ASN proves that privacy isn't just about hiding names; it's about hiding patterns across disparate datasets.

Limitations:

1. Static vs. Dynamic: The current model assumes a static snapshot of data. In the real world, social networks and purchase histories are dynamic. A "Temporal Linkage Attack" could potentially bypass Gρ-ASN.
2. Hierarchy Dependency: The method relies heavily on a "man-made" generalization hierarchy. In modern AI applications, pre-defined hierarchies may not capture the latent sensitive correlations found by deep learning models.

Conclusion: This paper serves as a vital reminder for data engineers: Context is the enemy of anonymity. As we move toward more complex data ecosystems, the Gρ-ASN approach offers a blueprint for balancing the high utility of social recommendations with the non-negotiable right to individual privacy.