Preserving Privacy in Collaborative Filtering through Distributed Aggregation of Offline Profiles

Transcription

1 Preserving Privacy in Collaborative Filtering throgh Distribted Aggregation of Offline Profiles Reza Shokri, Pedram Pedarsani, George Theodorakopolos, and Jean-Pierre Hbax Laboratory for Compter Commnications and Applications, EPFL, Switzerland ABSTRACT In recommender systems, sally, a central server needs to have access to sers profiles in order to generate sefl recommendations. Having this access, however, ndermines the sers privacy. The more information is revealed to the server on the ser-item relations, the lower the sers privacy is. Yet, hiding part of the profiles to increase the privacy comes at the cost of recommendation accracy or difficlty of implementing the method. In this paper, we propose a distribted mechanism for sers to agment their profiles in a way that obfscates the ser-item connection to an ntrsted server, with minimm loss on the accracy of the recommender system. We rely on the central server to generate the recommendations. However, each ser stores his profile offline, modifies it by partly merging it with the profile of similar sers throgh direct contact with them, and only then periodically ploads his profile to the server. We propose a metric to measre privacy at the system level, sing graph matching concepts. Applying or method to the Netflix prize dataset, we show the effectiveness of the algorithm in solving the tradeoff between privacy and accracy in recommender systems in an applicable way. Categories and Sbject Descriptors H.3.3 [Information Search and Retrieval]: [Information Filtering]; K.4.1 [Compters and Society]: Pblic Policy Isses Privacy General Terms Algorithms, Design, Secrity Keywords Recommender Systems, Privacy-Accracy Tradeoff 1. INTRODUCTION Recommendation systems are widely sed to help sers, overwhelmed by the hge nmber of options available to Permission to make digital or hard copies of all or part of this work for personal or classroom se is granted withot fee provided that copies are not made or distribted for profit or commercial advantage and that copies bear this notice and the fll citation on the first page. To copy otherwise, to repblish, to post on servers or to redistribte to lists, reqires prior specific permission and/or a fee. RecSys 09, October 23 25, 2009, New York, New York, USA. Copyright 2009 ACM /09/10...$ them, to find items that they might like. The items can be of any type: books, movies, web pages, restarants, sightseeing places, online news, and even lifestyles. By collecting information abot sers preferences for different items, a recommender system creates sers profiles. The preferences of a ser in the past can help the recommender system to predict other items that might also be of interest to the ser in the ftre. Collaborative filtering (CF), as one of the main categories of recommender systems, relies on the similarities of sers tastes: if two sers have similar preferences for certain items, each ser probably enjoys the items of interest to the other. Ths, the more each ser gives information abot his interests, the more meaningfl the recommendations will be. This is the basis of CF systems. In order to rn the process of recommending items to sers, recommender servers need to have access to sers profiles. Therefore, the profiles are sally stored on repositories to which collaborative filtering algorithms can have access. In sch systems, the sers do not have technical measres to limit the amont of information on their profiles to the server, that might not be necessary for generating recommendations. In other words, sers have to pt their profiles online (i.e., on the server) and trst the server (and the service providers) to keep the sers profiles private. The information available to the server hrts the privacy of the sers on two levels. First, if a ser s real identity is available to the server, the server can associate the ser s profile, which contains his private information, to his real identity (e.g., Amazon knows the real identities and postal addresses of those who have prchased prodcts and can link them with the profile of those sers). This is an obvios privacy breach, considering that a ser does not want the link between his real identity and his profile to be revealed, yet he wants to se the service. This threat becomes more obvios when sers share their opinion abot the locations they reglarly visit, e.g., restarants, libraries, coffee shops, or sport centers [2]. Second, even if the real identity of a ser is not known to the server, it can try to de-anonymize the ser s identity by correlating the information contained in the ser s profile and some information obtained from other databases [13]. Obviosly, hiding information from the server helps to thwart these threats. Nevertheless, sers want to receive accrate recommendations. Hence, the tradeoff between privacy and accracy appears. The more accrate information the server has abot sers profiles, the more meaningfl the server s recommendations are, bt the lower the sers privacy will be.

2 Moving from centralized approaches to distribted collaborative filtering algorithms solves the privacy isses to a great extent [4, 11]. Yet, distribted CF algorithms are not as accrate as their centralized versions that have complete information abot sers profiles. Moreover, they are not as practical as the centralized CF systems. The sers cooperation is needed not only to protect their privacy bt also to make the system rn properly. Making se of sophisticated cryptographic tools [6] might be another approach to solving the problem. However, these approaches are sally not practical and therefore remain nsed. The secrity of these systems depends on that of their key establishment and key management. Considering that the perfect implementation of these schemes is hard to achieve in practice, they are not well received. Therefore, finding a more practical soltion that does not trade mch system accracy in order to gain privacy for the sers is an nsolved problem and yet crcial for sers of CF systems. In this paper, we propose a method that provides a compromise for the tradeoff between privacy on the one hand and accracy and practicality on the other hand. In other words, or method increases the privacy in a practical way with a negligible effect on the recommendation accracy. To this end, we still rely on the central server to generate recommendations. Additionally, we employ a distribted commnication between sers in order to improve their privacy. In or model, each ser has two versions of his profile: the online (on the server) and the offline (located on the ser s side), where the online profile is freqently synchronized with the offline version. Basically, the actal profile of a ser is a sbset of his offline profile. Users offline profiles are aggregated in order to obfscate the actal items rated by each ser. As we will show, the hybrid natre of or approach helps sers to gain privacy from distribted aggregation and to reach a level of accracy comparable to the one achieved with a centralized CF. The remainder of this paper is organized as follows. In Section 2, we define or notations and basic elements of a CF and state the problem, i.e., privacy preserving in the presence of an ntrsted server. In Section 3, we provide an overview of the soltion and elaborate or approach. In Section 4, we define evalation metrics for privacy and recommendation accracy. In Section 5, we validate the efficiency of or method by applying it to the real data set from the Netflix prize competition. Finally, in Sections 6 and 7, we review the related work and conclde the paper. 2. PROBLEM STATEMENT 2.1 Definitions and Notations Formally, a collaborative filtering (CF) algorithm deals with a set of sers and a set of items. In this paper, the non-empty set of sers in the system is denoted by U, where U = N. We also represent the non-empty set of items by I, where I = M. Let r,i(t) be the rating of ser to item i at time t, where r,i(t) {1, 2, r max} and r max is the maximm valid rating. The set of items rated by ser p to time t is denoted by I (t) I. The profile of ser at time t is defined as {(i, r,i(t)) s.t. i I (t)} which is the set of items copled with their ratings rated by the ser ntil t. We denote by f i(t) the rating freqency of item i at time t which is the fraction of sers that have rated item i p to time t (i.e., f i(t) = { U s.t. i I (t)} /N). To simplify the presentation, we sometimes omit the time index if it is clear from the context. Collaborative filtering algorithms attempt to make predictions on the ratings of a particlar ser by collecting taste information from other sers. CF algorithms fall into two general classes: model-based and memory-based methods [5]. Model-based algorithms learn a probabilistic model from the nderlying data sing statistical techniqes, then they se the model to make predictions. Memory-based methods find similar sers or items in the dataset in order to predict the items that a ser might like and recommend them to him. This approach is based on the assmption that similar sers prefer similar items, or that the preferred items of a ser are similar. Memory-based CF methods can be frther divided into two grops: ser-based and item-based [16]. User-based methods, which are the focs of this paper, are heristics to predict a rating of a ser to an item by combining the ratings of sers who are most similar to the target ser (so called, the ser s neighbors). The Pearson s correlation coefficient, as a poplar measre [8], estimates the similarity w,v between two sers and v, as follows. i (I (r,i w,v = I v) r)(rv,i rv) i (I Iv) (r,i r)2 i (I (rv,i I v) rv)2 (1) where, r is the mean of ratings assigned by ser. In order to predict the rating of ser to item i, first, the similarity of to all other sers is compted and then the nearest neighbors of, denoted by set N, are determined. The set N contains N sers who are, based on (1), the most similar sers to. Next, the prediction of r,i, denoted by ˆr,i, is done by combining the ratings of neighbors of to item i [8, 15], as follows. ˆr,i = r + v N w,v(r v,i r v) v N w,v (2) Finally, the items that have a high potential of interest to the ser (i.e., are predicted to have high and positive ratings) are recommended to him. 2.2 Problem Definition We consider the scenario where a collaborative filtering algorithm (described in Section 2.1) is implemented on a server and sers give information abot their profiles to the server in order to receive recommendations. We define the problem as finding a mechanism by which the sers can adapt their profiles (available to the server) to the privacy level they expect from the system. The soltion mst have minimm effect on the system s accracy. We assme the server to be ntrsted, and we evalate the level of privacy in the system with respect to that. Yet, the information revealed among sers themselves, if there is any need for commnication, mst be nder the sers control (i.e., what information is given and to whom). Intitively, the system privacy is high if the server is not able to constrct the sers profiles based on the information available to it. 3. PROPOSED METHOD In this section, we first give an overview of or soltion in Section 3.1, and we define a few new concepts that we need to describe or scheme. Next, in Sections 3.2 and 3.3 we formally model the problem and or proposed soltion.

3 3.1 Sketch of the Soltion We assme there is a central recommender system where sers profiles are stored and from which the sers receive recommendations. We call a ser s profile stored on the server his online profile. We assme that a ser can have a local repository where he stores his own profile; we call these locally stored profiles the offline profiles. The server does not have access to the sers offline profiles and the recommendations are prodced based on the online profiles available to the server. Each ser independently synchronizes his online profile with his offline profile. Therefore, from time to time, the changes that have been made to the offline profile, since the last synchronization, will be applied to the online version, all at once. Obviosly, the recently rated items are among these changes. In addition to these actal ratings, sers add other items to their profiles, which are not originally rated by them; instead, they are received from other sers with whom they commnicate. Users commnicate with each other throgh different media sch as face-to-face commnication in a meeting, commnicating over celllar networks, instant messaging throgh the Internet, commnicating via a social network, or exchanging s. We refer to any sch commnication as contact between two sers. A ser arbitrarily selects his peers and certain information abot the sers offline profiles is exchanged between them at each contact. Based on this information, they add a sbset of the other ser s items to their own profiles. The exchanged information between sers, the nmber of items that are added to their profile and the items (pls their associated ratings) that are selected for the aggregation depend on the aggregation fnction they se. From the server s point of view, each ser adds a batch of new items (pls the ratings) to his online profile at each synchronization. It is not known to the server which of these items have been actally rated by the ser. In other words, the ser s actal profile is hidden from the server; hence, there is privacy for the ser. This, of corse, comes at a cost: a drop in the recommendation accracy. In the next sections, we answer the following qestions, in order to find the appropriate aggregation fnctions: How many items shold be aggregated in each contact? What items are better candidates for aggregation? What is the effect of contact rate on the privacy and accracy? 3.2 The Model We model sers profiles by a bipartite graph, where nodes denote the sers and items, and weighted edges correspond to the ratings of the sers to the items. Let G t(u, V, E) be a bipartite weighted graph, where the vertex set U = U corresponds to the sers, the vertex set V = I corresponds to the items, and the edge set E(t) corresponds to the sers rating for the items ntil time t. Ths, an edge (, i) E(t) exists when ser U has rated item i V at some time before t. Each edge (, i) has an associated weight r,i(t) denoting the rating of ser assigned to item i. In sch a setting, a ser s profile or I (t) will be the set of nodes adjacent to node. We call G t the actal graph, becase it represents the actal sers ratings of the items, i.e., in the case that there is no privacy preserving method in se. Using or method, there will be two other graphs in the system. One shold represent the sers online profiles and the other shold model the sers offline profiles. i 1 i 2 i 3 i 4 i 5 i 6 i7 i 1 i 2 i 3 i 4 i 5 i 6 i7 contact v Figre 1: Aggregation of sers offline profiles after a contact. A contact occrs between sers and v at time t, with I off (t) = {i 1, i 2, i 4, i 6} and Iv off (t) = {i 3, i 4, i 5, i 7}. User gives {i 2, i 4, i 6}, which is a sbset of his profile, to v. User v also gives {i 3, i 5} to. Additional edges (dashed lines) appear after the aggregation, and the offline graph is evolved throgh aggregating the new added edges. After the aggregation, I off (t + ) = {i 1, i 2, i 3, i 4, i 5, i 6} and I off (t + ) = {i 2, i 3, i 4, i 5, i 6, i 7}. Let s denote the offline graph by G off t (U, V, E off ). This conceptal graph, which is stored in a distribted manner, is formed by the aggregation of edges throgh sers contacts and by rating new items over time ntil t. The edges that are added to the offline graph can appear either as a reslt of actal ratings by the sers, or throgh aggregation by contacting other sers. Hence, the actal graph G t is embedded and hidden in G off t. We also denote I off (t) to be the ser s offline profile at t. By definition, for every ser at any time t we have I (t) I off (t). Note that I off (t) \ I (t) is the set of items (pls their ratings) that are added throgh aggregation to a ser s offline profile. In or model, the online graph is denoted by G on t (U,V, E on ) and I on (t) represents the online profile of ser. The online graph gets pdated over time when sers synchronize their online profiles with their offline versions. As a reslt, at any time, there might be some edges in graph G off t that have not yet been added to the graph G on t. Therefore, I on (t) I off (t), for every ser at any time t. Figre 1 illstrates the effects of aggregation on the offline profiles of two sers after their contact. Assme two sers and v contact each other at time t, with offline profiles I off (t) and I off v (t) before the contact. We also denote I off (t + ) and Iv off (t + ) to be their offline profiles after contact. As it is shown, each ser (e.g., ) gives a sbset of his own profile to his peer (e.g., v) to be aggregated to the peer s previos profile. The way they select the mentioned sbset is explained in the next section. Note that the added edges preserve their weights (ratings). In the case the receiver is given an item that is already in his offline profile, he pdates its rating, if it is not an actal rating. We assme each ser, on average, contacts n sers per time nit and the contact peers are selected arbitrarily from U. The process of contacting other sers and pdating the offline profiles contines for all sers over time, in parallel with the process of actally rating new items. Ths, graph G off t will be accmlated. More formally, for t 1 < t 2, I off (t 1) I off (t 2), i.e., the reslting bipartite graph G off t 2 has the same vertex sets as G off t 1, and E off (t 1) E off (t 2). Each ser occasionally synchronizes his offline and online profiles at arbitrary time instants. Ths, the online graph on the server changes dynamically over time. Figre 2 shows this evoltion. v

4 t1 t 2 t 3 t 4 Offline Graph Online Graph Figre 2: Evoltion of the offline (left colmn) and online (right colmn) graphs over time (t 1 < t 2 < t 3 < t 4). Circles represent the items and the sers are shown by the sqares. We focs on the profiles of ser, distingished by the black sqare. In the left colmn, the solid lines are the actal ratings of the sers, and the dashed lines are the additional ratings aggregated to the sers offline profiles. Profiles I off and I on are synchronized at time t 1. Graph G on t stays nchanged, regarding ser, ntil the next synchronization time t 4. Graph G off t is accmlated throgh addition of both actal rating edges (solid lines) and also the aggregated edges (dashed lines). User rates a new item at t 2 and aggregates some other items at t 3. The solid lines in the right colmn (i.e., the online graph) indicate that the server is nable to distingish between the actal and dmmy (i.e., those added throgh aggregation) ratings. The grey lines belong to other sers profile that are evolving independently of each other. We emphasize that each time a ser synchronizes his online profile with the offline version, the server is incapable of distingishing between the new edges that belong to the ser s actal profile and the edges added throgh aggregation. Moreover, sers who contact each other have access only to information derived from the offline profiles of their peers and cannot pinpoint the actal items of each others offline profiles. Hence, a ser s privacy is protected not only against the server bt also against the other sers. In order to prevent a ser being confsed abot his own rated items, the process of aggregation and also the aggregated items (i.e., his offline profile mins his actal profile) can be made transparent to the ser. Hence, a ser can add, remove, or modify his actal ratings withot any confsion, althogh he is able to find ot what the extra items are in his profile. Looking from the server s side, the server is not aware of the items that are actally rated by the ser, and generates recommendations based on their online profiles. Therefore, the server passes the top items that might be of interest to a ser withot filtering ot the items already existing in his profile. Instead, the process of filtering is done at the ser s side, in a transparent way, i.e., the server recommends a set of highly recommended items to the ser and it is the ser application that avoids recommending the items that are previosly rated by the ser himself. This prevents a ser from missing a recommendable item becase it is in his profile bt not actally rated by the ser. 3.3 Profile Aggregation As described in the previos section, the process of pdating graph G off t is accomplished throgh an aggregation process where sers contact each other and pdate their offline profiles by adding a sbset of their peer s rated items to their own profile. Consider a contact between sers and v at time t. We denote Iv agg (t) (named the aggregated items from v) as the sbset of items (pls their ratings) in the offline profile of ser v, which are added to the offline profile of ser. Considering I off (t + ) as the offline profile of after the aggregation, the following eqation holds: I off (t + ) = I off (t) I agg v (t). (3) The same argment holds for the inverse case (pdated profile of v). Note that the added edges keep the same rating vale after being added to a ser s profile, i.e., assming item i is added to the offline profile of ser after his contact with ser v, we have: r off,i(t + ) = r off v,i(t), i I agg v (t),i / I (t). (4) Bt, if the candidate item already exists in s actal profile, i.e., i Iv agg (t) I (t), the rate stays nchanged. In order to choose the candidate items for aggregation, we shold consider two isses: 1) The nmber of items to be aggregated ( Iv agg (t) ), and 2) which sbset of Iv off (t) (with cardinality Iv agg (t) ) to choose. We provide answers to these qestions by introdcing different types of aggregation. In this work, we introdce two kinds of possible aggregation processes, focsing on or key idea: aggregation based on the similarity of the sers who contact each other. We believe that this approach yields the best performance of the system for preserving both privacy and accracy Similarity-Based Aggregation In this case, at each contact, the similarity of the two sers is calclated sing (1). Each ser then gives a proportion - eqal to the similarity vale - of his items in his offline profile to the other ser for aggregation, i.e., if we assme a contact between sers and v at time t, sing (3) we have, I off (t + ) I off (t) + sim,v I off v (t), (5) where I off (t + ) denotes the size of s offline profile after aggregation, and I off (t) and Iv off (t) denote the size of and v s profiles before aggregation, respectively. Note that Iv agg (t) = sim,v Iv off (t), and the eqality holds when I off (t) Iv off (t) = φ. We denote sim,v as the similarity between sers and v (vale between 0 and 1) is compted as follows: { w,v if w sim,v =,v > 0 (6) 0 otherwise In other words, the two sers only accept the aggregated items when there is a positive similarity between them, otherwise no aggregation occrs. Althogh or main focs is on the protection of the sers privacy against the ntrsted server and not against each

5 other, we still can employ some tools to protect sers privacy from each other. Users, who contact each other, need to reveal their profiles to each other in order to compte the similarity vale. The level of privacy can be improved by sing methods that compte similarity between two profiles withot revealing their content. Lathia et al. [9] propose an interesting concordance measre to estimate the similarity between two sers in a distribted system withot revealing their profiles to each other. This method can be sed when one ser contacts another ser in whom he has little trst. To answer the qestion of which sbset of Iv off (t) to choose, we notice that the items in Iv agg (t) can be chosen throgh different methods. We hereby sggest two ways: Similarity-based Minimm Rating Freqency (SMRF) One way to choose the set Iv agg (t) is to sort the elements of Iv off (t) by their rating freqency, and select the first sim,v Iv off (t) elements with minimm rating freqency. In other words, we choose the sbset of the ser s rated items that have been least rated by the sers in the system (i.e., in the online graph). We assme that the server makes the crrent rating freqency of items, fi on (t), available to the sers. Similarity-based Random Selection (SRS) In this case, the sim,v Iv off (t) candidate items are selected niformly at random from the set of items in Iv off (t). We evalate the effectiveness of these aggregation fnctions and compare them in Section Fixed Random-Selection Aggregation Aside from choosing the aggregated items based on the similarity of sers, we consider another simple type of aggregation: fixed random selection, where each ser gives a fixed proportion of his rated items to the other ser, i.e., I off (t + ) I off (t) + k I off v (t), (7) where, k is a constant vale between 0 and 1. Note that here Iv agg (t) = k Iv off (t), and the aggregated items are chosen niformly at random. Union is an example of this aggregation, where each ser gives all of his rated items to the other ser, i.e., I off (t + ) = I off (t) I off v (t). (8) 4. EVALUATION METRICS In this section, we describe or definition of privacy and recommendation accracy. Following the definitions, we formalize or metrics for evalating the proposed method in terms of the privacy gain and the accracy loss. 4.1 Privacy Measrement We define the lack of privacy as the amont of information the server has abot the actal profile of the sers. In other words, it reflects how accrately the server can gess the actal profile of the sers (modeled as G t) sing the online graph G on t, and how valable the estimated profiles are, in terms of identifying the sers and distingishing between them. To define the privacy, we focs more on the sersitems connection rather than on the ratings the sers assign to the items (for an adversary who tracks a ser it is more interesting to know to which places the ser has been, rather than knowing the ser s opinion abot those places). To evalate the privacy provided by or method, based on the above-mentioned privacy definition, we define a privacy metric considering the graphs G t and G on t. We emphasize that privacy is preserved in or model throgh additional edges that exist in the online graph, bt not in the actal graph. Ths, we compte to what extent the strctres of graphs G t and G on t are similar, as a higher strctral difference acconts for higher privacy. This falls into the sbject of strctral graph matching, where the strctres of two graphs are compared with the goal of matching the correspondent nodes based on the strctres. In or problem, as the node set of the two graphs are the same, the strctral difference can be viewed as the difference between the correspondent edges. This idea has also been investigated in the field of pattern recognition where the edge-consistency of two graph patterns (in matching a data graph to a model graph) is sed to obtain the correspondence errors [10, 12]. Following the above discssion, we introdce the error measre for edge-inconsistency, considering only the strctres of two given graphs G 1(V, E 1) and G 2(V, E 2), where V denotes the node set (the same for both graphs), and E 1 and E 2 denote different edge sets. The matching error can be generally defined as the maximm likelihood estimator for edge differences over the edge sets of G 1 and G 2, i.e., the nmber of edges that exist in one graph with their correspondent edges not existing in the other graph: = 1 {(,i)/ E2 } + 1 {(,i)/ E1 }, (9) (,i) E 1 (,i) E 2 where 1 {A} denotes the indicator fnction on A, and (, i) denotes an edge between nodes and i in either of the two graphs. In or setting, graphs G t and G on t correspond to G 1 and G 2 respectively, with their node set divided into two sets V and U to exhibit the bipartite property of sers and items. The privacy metric is eqivalent to the matching error, as conts the nmber of differences in the corresponding edges of two graphs, and higher strctral difference reslts in higher privacy. In or case, the first smmation in (9) is zero, becase G on t is an accmlated version of G t. Consider or own notations, where I on and I stand for the items associated with ser in his online and actal graphs, respectively. Conting the edges by iterating over the ser set U, the matching error can be written as: = 1 {i/ I}. (10) i I on However, Narayanan and Shmatikov [13] show that an item with a high rating freqency contains less information abot those who have rated the item than an item with a low rating freqency (e.g., it is more valable, in identifying a ser, to know that a ser has prchased The Color of Pomegranates than the fact that he prchased a Harry Potter DVD). Their reslt shows that the higher the rating freqency of an item is, the more important this item is for identifying sers associated with that item, ths the more valable it is in system privacy preservation. If an adversary (the one who wants to break sers privacy) falsely believes that someone has rated an item with a low rating freqency, then the ser s privacy is mch higher than the case where the item has a high rating freqency.

6 Hence, we se the rating freqency f i in (10) to weight the items. We then normalize it per ser by dividing it by its maximm vale for each ser. This also garantees a vale between 0 and 1 for the system privacy. Ths, privacy in the crrent work can be defined as the normalized weighted edge-difference fnction over the node pairs of the two graphs. Rewriting (10), this can be expressed as follows. For the sake of simplicity, we omit the time index. privacy = 1 N ( ) 1 i (I on\i) f i i I on ( 1 f i ) (11) To pt is simply, looking at the bipartite graph, for each ser we compte the weighted difference of his rated items in graphs G t and G on t, with the weights being the inverse of the item s rating freqency. The overall system privacy is then compted as the normalized sm of all sch terms for all sers. Sch a metric captres both the server s chance for sccessflly gessing the sers actal profiles and the importance of the profiles in identifying the sers (sing the rating freqency). Let s have a deeper look at how the privacy metric can be interpreted. The closer is the privacy degree of a system to 1, the harder is for the adversary to distingish the actal profiles of the sers in their online profiles. Moreover, it becomes harder for the adversary to distingish between sers and de-anonymize their profiles [13]. As it approaches 1, the privacy growth becomes slower by adding more items to the profile of sers, whereas its growth is faster for small privacy vales. The privacy becomes 1 if the actal graph is infinitely small compared to the online graph and it is 0 if they are the same. It is important to note that this metric is not designed to compare the privacy of two systems with different settings, rather to reflect the privacy gain inside a system. Note that there are some items in a ser s offline profile whose rating changes de to 1) being rated later by the ser himself, 2) being received again from contacting sers. The first sbset is not distingishable from the second and their ratio intitively follows (11). Therefore, we do not re-evalate the effect of this factor on the sers privacy. 4.2 Recommendation Accracy Modifying the sers actal profiles in order to increase their privacy level might impose some error on the accracy of the recommendation system. We measre the cost of rnning or method as the difference between the recommendation error in or system and the system with no privacy. In both cases we compte the recommendation error based on RMSE. Let Î denote the set of predicted items in the recommender system for ser. The system error for any graph G is compted as follows (the same for graph G on ). i Î(r,i ˆr,i)2 RMSE(G) = Î (12) Finally, the cost of sing or method is compted as the percentage of the accracy loss, i.e., the additionally imposed error, formalized as follows. accracy loss = RMSE(Gon ) RMSE(G) RMSE(G) (13) 5. EXPERIMENTAL RESULTS In this section, we validate the effectiveness of or model and the mechanisms we proposed in Section 3. First, we describe the data set that we sed for the experiments and explain or simlation model. Next, we evalate the effectiveness of different aggregation fnctions sed in or mechanism based on the metrics described in Section 4. In each experiment, we sed a sbset of the Netflix data set, released for Netflix prize [1], containing 300 randomly chosen profiles with ratings between early 2001 and late The ratings are on a scale from 1 to 5 (integral) stars. To evalate the recommendation accracy, we sed 10% of the actal ratings of each ser as the testing set and the remaining 90% as the training set. For each experiment, we evalated the privacy achievement and also the accracy of the system for different vales of sers contact rates. The contacts between sers were selected niformly at random, both for the contacting peers and their time of contact. We evalated the privacy and accracy of an aggregation fnction with respect to the average sers contact rate. We made the evalation at the end of each experiment (December 2006). The contact rate vale determines the average nmber of sers a given ser has contact with per year. Besides, in all experiments the nmber of neighbors of each ser, needed for generating recommendations, was selected to be 30 (i.e., N = 30 for any ser ). Otcome of varios experiments are averaged to obtain the final reslts. In this setting, we implemented the following aggregation fnctions. Similarity-based minimm rating freqency (SMRF) Similarity-based random selection (SRS) Union aggregation The Union fnction provides the maximm privacy that can be achieved sing or method. Therefore, it acts as a benchmark to evalate the effectiveness of the similaritybased aggregation fnctions. Figres 3(a) and 3(b) illstrate the privacy preservation level and accracy loss, respectively, for different aggregation fnctions, calclated sing Eqations (11) and (13). Using these reslts, one can easily observe the privacy-accracy trade-off for different mechanisms, and select the appropriate type of aggregation. The effect of contact rate on the privacy level and accracy loss is also shown. As depicted in Figre 3(a), sing Union aggregation the system privacy level qickly approaches the maximm vale of 1 as the average contact rate increases. Moreover, when this aggregation is sed, the sers profiles (offline and therefore online) become more flat as time goes on (i.e., sers profiles become more similar). This leads to a considerable decrease in system accracy, compared to other aggregation fnctions (Figre 3(b) shows a fast increase in accracy loss for Union fnction). Contrarily, Figre 3(b) shows that the other two methods SRS and SMRF reslt in a slight decline in the system accracy, in comparison with Union aggregation, for different vales of contact rate. The efficiency of or mechanism becomes more visible when we notice that a small nmber of contacts per ser sbstantially increases the privacy level and imposes minor costs in terms of accracy. For instance, notice that sing the SMRF (SRS) aggregation fnction, nmber of 6 contacts per year per ser reslts in a 0.64 (0.48) degree increment in system privacy with an accracy loss of less than 2% (1%).

7 System Privacy Accracy Loss UNION SMRF SRS Average Yearly Contact Rate of Users (a) Privacy gain for different sers contact rate UNION SMRF SRS Average Yearly Contact Rate of Users (b) Accracy loss for different sers contact rate Figre 3: Performance of different aggregation fnctions with respect to the achieved privacy and drop in system accracy. We observe that althogh the SRS method cases a smaller accracy loss, the major increase in system privacy for SMRF distingishes it as a good alternative mechanism. This is de to the fact that sorting the aggregated candidates by minimm rating freqency makes the sers more indistingishable for the server. However, SRS is the most practical aggregation fnction, as it is not dependent on any system parameter or any kind of information from the server. Another advantage of SRS over SMRF is the stability of its accracy loss for different contact rate vales. In general, experimental reslts validate or proposed mechanism in preserving privacy in a distribted way. The reslts show that similarity-based aggregation achieves decent reslts in terms of higher system privacy with a negligible effect on accracy loss for small average contact rates. When sers have information abot the rating freqency of items, giving the items with minimm rating freqency increases the privacy. This is becase it increases the nmber of sers who have rated sensitive items of a ser (i.e., the items that help identifying the ser). Yet, if sch information is not available for sers, the SRS aggregation can be sed, which provides a bit less privacy bt imposes a lower accracy loss. SRS is also more stable (in terms of the accracy loss) for different contact rate vales. The key factor of similarity-based aggregation fnctions is that they preserve the similarity between sers almost nchanged, compared to the case where there is no privacy protection mechanism in se. 6. RELATED WORK Several techniqes have been proposed to preserve the privacy of sers in recommender systems. Pertrbing sers ratings, sing cryptographic tools sch as homomorphic cryptography, and storing sers profiles in a distribted manner are the main categories for privacy preservation in collaborative filtering systems. Polat and D [14] propose a randomized pertrbation techniqe to preserve privacy in collaborative filtering. Users ratings are modified by adding random noise to them in order to prevent the central server from deriving the sers actal ratings. The challenge is to find a pertrbation algorithm that imposes the smallest error on the recommendation process. The sers enjoy a high level of privacy if the server is not able to estimate the actal ratings they assigned to the items. However, the items rated by the sers are revealed in the proposed techniqe, regardless of the pertrbation level. This is despite the fact that keeping the connection between sers and items is more crcial (in order to preserve sers privacy) than disgising the ratings assigned to those connections. Revealing the places visited by the sers to the server enables it to track sers over space and time, whether they liked those places or not. Using homomorphic cryptography in the pblic server in order to hide the operations of the recommender system is proposed by Canny [6, 7]. In the proposed method, sers create commnities and each ser searches for recommendations from the most appropriate commnity with the hope of receiving more valable recommendations, rather than asking from those who have similar profiles. Each commnity of sers can compte a pblic aggregate of their profiles, which does not expose the individals profiles. Homomorphic cryptography allows the sers to hide the aggregation operation from the server, althogh it is performed by the server itself. Participation of sers in the distribted system to provide privacy for others was assmed to happen in this work, which might not be the case in reality. Moreover, the implementation of sch a cryptographic scheme, especially its reqired key management, is difficlt to achieve, considering the stats of the crrent sage of cryptographic systems in the Internet. Similar ideas are proposed in [3] where homomorphic cryptography is sed to hide similarity measrement from server s eyes. Storing sers profiles on their own side and rnning the recommender system in a distribted manner, withot relying on any server, is another option. Miller et al. [11] propose transmitting only the similarity measres over the network and keeping sers profiles secret on their side to preserve their privacy. Berkovsky et al. [4] propose a distribted P2P system to avoid storing sers profiles on a single server. Althogh these methods eliminate the main sorce of threat against sers privacy, they need high cooperation among sers to generate meaningfl recommen-

8 dations. Every ser pays the price of sing this method, regardless of his interest in protecting his privacy. Lathia et al. [9] propose a concordance measre to estimate the similarity between two sers in a distribted system withot revealing their actal profiles to each other. A randomly generated temporal profile is shared between two sers, and both of them compte the nmber of concordant, discordant and tied pairs of ratings between their own profile and the temporal profile. Exchanging the reslts, they are able to estimate the similarity between their profiles. Hence, they keep the items they have rated as well as the rating vales private. In this method, sers need to reveal their profiles for generating recommendations. Therefore, this method provides privacy only for measring similarity, not for a collaborative filtering system as a whole. Two sers who do not trst each other, in or proposed method, can se Lathia s method to estimate their similarity. Finally, the concept of approximate graph matching from which the idea of privacy metric in or work was inspired has been widely stdied in literatre. The sbject of strctral graph matching has been investigated more specifically in pattern recognition where the goal is to match a data graph to a model graph based on nodes and edges attribtes of the graphs. Myers et al. [12] introdce the edit distance measre as a metric for the strctral difference of two graphs, defined as the weighted sm of the costs of edit operations to match the graphs. Also, the se of edgeconsistency for compting correspondence errors in matching two graphs has been widely sed, e.g., in the recent work of Lo and Hancock [10] in which they developed a likelihood fnction for graph matching. 7. CONCLUSION AND FUTURE WORK In this work, we proposed a novel method for privacy preservation in collaborative filtering recommendation systems. We addressed the problem of protecting the sers privacy in the presence of an ntrsted central server, where the server has access to sers profiles. To avoid privacy violation, we proposed a mechanism where sers store locally an offline profile on their own side, hidden from the server, and an online profile on the server from which the server generates the recommendations. The online profiles of different sers are freqently synchronized with their offline versions in an independent and distribted way. Using a graph theoretic approach, we developed a model where each ser arbitrarily contacts other sers over time, and modifies his own offline profile throgh a process known as aggregation. To evalate the privacy of the system, we applied or model to the Netflix prize data set to investigate the privacyaccracy tradeoff for different aggregation types. Throgh experiments, we showed that sch a mechanism can lead to a high level of privacy throgh a proper choice of aggregation fnctions, while having a marginal negative effect on the accracy of the recommendation system. The reslts illstrate that similarity-based aggregation fnctions, where sers receive items from other sers proportional to the similarity between them, yield a considerable privacy level at a very low accracy loss. As ftre work, or mechanism can be implemented in a realistic setting in which sers contact each other based on their friendship (e.g., in social networks) or their physical vicinity (e.g., sing wireless peer-to-peer commnication). In sch a setting, varios practical isses sch as the effect of the privacy preserving mechanism on the overhead of sers profiles and their maintenance, and the acceptability of the system in a real world scenario can be investigated. Moreover, the robstness of the algorithm to sophisticated adversarial attacks and its relation to the proposed metric are worth stdying. Acknowledgments We wold like to thank Marcin Potralski and also the anonymos reviewers for their helpfl feedback on earlier versions of this work. Special thanks go to Antoine Parisod who implemented the simlations. 8. REFERENCES [1] Netflix prize, [2] Rmmble, [3] W. Ahmad and A. Khokhar. An architectre for privacy preserving collaborative filtering on web portals. In International Symposim on Information Assrance and Secrity (IAS), Ag [4] S. Berkovsky, Y. Eytani, T. Kflik, and F. Ricci. Enhancing privacy and preserving accracy of a distribted collaborative filtering. In Proceedings of ACM RecSys, [5] J. S. Breese, D. Heckerman, and C. Kadie. Empirical analysis of predictive algorithms for collaborative filtering [6] J. Canny. Collaborative filtering with privacy. In IEEE Symposim on Secrity and Privacy, [7] J. Canny. Collaborative filtering with privacy via factor analysis. In ACM SIGIR, [8] J. L. Herlocker, J. A. Konstan, A. Borchers, and J. Riedl. An algorithmic framework for performing collaborative filtering. In ACM SIGIR, [9] N. Lathia, S. Hailes, and L. Capra. Private distribted collaborative filtering sing estimated concordance measres. In Proceedings of ACM RecSys, [10] B. Lo and E. R. Hancock. Strctral graph matching sing the em algorithm and singlar vale decomposition. IEEE Trans. Pattern Anal. Mach. Intell., 23(10), [11] B. N. Miller, J. A. Konstan, and J. Riedl. Pocketlens: Toward a personal recommender system. ACM Trans. Inf. Syst., 22(3), [12] R. Myers, R. C. Wilson, and E. R. Hancock. Bayesian graph edit distance. IEEE Trans. Pattern Anal. Mach. Intell., 22(6), [13] A. Narayanan and V. Shmatikov. Robst de-anonymization of large sparse datasets. In IEEE Symposim on Secrity and Privacy, [14] H. Polat and W. D. Privacy-preserving collaborative filtering sing randomized pertrbation techniqes. In Proceedings of IEEE ICDM, [15] P. Resnick, N. Iacovo, M. Schak, P. Bergstorm, and J. Riedl. Groplens: An open architectre for collaborative filtering of netnews. In Proceedings of ACM Conference on Compter Spported Cooperative Work, [16] B. Sarwar, G. Karypis, J. Konstan, and J. Reidl. Item-based collaborative filtering recommendation algorithms. In WWW, 2001.