Beyond Random Noise: Insights on Anonymization Strategies from a Latent Bandit Study
It addresses privacy-preserving machine learning for recommendation tasks, highlighting the need for tailored strategies over generic solutions, though it is incremental in its focus on specific attack patterns.
This paper tackles the problem of privacy in recommendation systems by evaluating anonymization strategies in a latent bandit setting, finding that adding Laplace noise to individual data performs poorly in terms of regret, while combining noise with aggregation methods like clustering offers better trade-offs.
This paper investigates the issue of privacy in a learning scenario where users share knowledge for a recommendation task. Our study contributes to the growing body of research on privacy-preserving machine learning and underscores the need for tailored privacy techniques that address specific attack patterns rather than relying on one-size-fits-all solutions. We use the latent bandit setting to evaluate the trade-off between privacy and recommender performance by employing various aggregation strategies, such as averaging, nearest neighbor, and clustering combined with noise injection. More specifically, we simulate a linkage attack scenario leveraging publicly available auxiliary information acquired by the adversary. Our results on three open real-world datasets reveal that adding noise using the Laplace mechanism to an individual user's data record is a poor choice. It provides the highest regret for any noise level, relative to de-anonymization probability and the ADS metric. Instead, one should combine noise with appropriate aggregation strategies. For example, using averages from clusters of different sizes provides flexibility not achievable by varying the amount of noise alone. Generally, no single aggregation strategy can consistently achieve the optimum regret for a given desired level of privacy.