Differentially-Private Two-Party Egocentric Betweenness Centrality

TL;DR

This paper introduces a privacy-preserving protocol for calculating egocentric betweenness centrality across two distrustful parties, combining differential privacy with a new sampling method to ensure efficiency and accuracy.

Contribution

It presents a novel two-party protocol that maintains differential privacy for edge data while improving computational efficiency with a new stratified sampling approach.

Findings

Achieves 16% error on Facebook data set

Provides strong differential privacy guarantees

Demonstrates practical efficiency on real-world graphs

Abstract

We describe a novel protocol for computing the egocentric betweenness centrality of a node when relevant edge information is spread between two mutually distrusting parties such as two telecommunications providers. While each node belongs to one network or the other, its ego network might include edges unknown to its network provider. We develop a protocol of differentially-private mechanisms to hide each network's internal edge structure from the other; and contribute a new two-stage stratified sampler for exponential improvement to time and space efficiency. Empirical results on several open graph data sets demonstrate practical relative error rates while delivering strong privacy guarantees, such as 16% error on a Facebook data set.

Figures

Tables

Table 1. TABLE I: Glossary of symbols used in this paper.

$X,Y$	The two parties e.g., competing service providers.
$V_X,V_Y$	The nodes per party.
$E_X,E_Y$	Edges entirely within each party.
$E_{XY}$	Edges spanning both parties.
$a$	The ego node (assumed WLOG to be in $X$).
$N_a$	The ego network of $a$.
$X^{-}$	Party $X$’s nodes $V_X$ excluding $a$.
$R^{\star }$	The ego network contained in $X$.
$T_{ij}$	Counts of 2-paths spanning $X,Y$.
$S_X,S_Y,S_{XY}$	Partial EBC sums by endpoints.
$R$	A private, randomised approximation to $R^{\star }$.
$Q_i$	For $i\in \{0,\dots ,\left|X^{-}\right|\}$, a partition of $𝒫\left(X^{-}\right)$.
$ϵ$	The differential-privacy budget.
$\Delta$	A global sensitivity bound.

Equations

$$\mathrm{EBC}(a)$$

$$\mathrm{Pr}\left(\mathcal{A}(D)\in R\right)$$

$$\Delta f$$

$$\frac{\exp (q(R)\cdot ϵ/(2\cdot \Delta q))}{{\sum }_{S\subseteq X}\exp (q(S)\cdot ϵ/(2\cdot \Delta q))},$$

$$(R\backslash R^{\star })\cup (R^{\star }\backslash R)$$

$$|(R\backslash R^{\star })\cup (R^{\star }\backslash R)|$$

$$q(R)$$

$$Q_i$$

$$C$$

$$\log \mathrm{Pr}(I=i)$$

$$=$$

$$\log \mathrm{Pr}(I=i)$$

$$=$$

$$C$$

$$\mathrm{Pr}(U=v)$$

$$\Delta f^{\prime }$$

Full text

I Introduction

Data sets such as social, communication, and transport networks are graph structured: people are nodes and their interactions edges. Such graph structures are valuable for understanding real-world properties. However, revealing the graph or its statistics can cause privacy disclosure even with anonymisation techniques [, , ]. Furthermore, for many corporations, customer data is an asset they are reluctant to share. This motivates interest in joint computation over databases with limited exposure to sensitive information.

Differential privacy (DP) [] guarantees that a release output distribution does not change by more than a small multiplicative factor under input data perturbation. We consider edge DP wherein perturbations correspond to edge flips: the existence of sensitive edges is not revealed by edge-DP release.

We envisage two (or more) networks controlled by different corporations, such as telephone or email providers, or two different social networks. The complete list of nodes (i.e., people) is public knowledge, but the individual connections between them are not, so we consider edge DP in order to hide the connection between the nodes in each network. Each service provider knows the connections within its own network, plus the connections between one of its members and the outside (e.g., when they contact someone in a different network), but not the internal connections in other networks.

We are the first to consider differentially-private computation of egocentric betweenness centrality (EBC) []. Informally, EBC measures the importance of a node as a link between different parts of the graph. A node that forms a link between otherwise-isolated parts of the network has high betweenness centrality; a node that is simply an easily-bypassed member of an interconnected network has a low betweenness centrality. This is a property of the whole communication graph: one service provider cannot compute it using its partial view of the graph alone.

Betweenness centrality could be used in targeted advertising or customer retention campaigns, as individuals with high EBC have the capacity to transfer information from one community to another. EBC is equally important in understanding and combating the spread of misinformation or “fake news”: individuals with high EBC can be educated to be more discerning about what they spread through the network, thereby mitigating spread of fake news. The difficulty of assessing misleading political content and obstructing its spread has become one of the most important research questions in online social network analysis, to which even the networks themselves are devoting significant research effort.111https://newsroom.fb.com/news/2018/04/new-elections-initiative/

We enable a network provider to compute the egocentric betweenness centrality of a node, while requiring only differentially-private information about internal connections to be shared between networks. Our main contributions are:

We introduce a privacy preserving method to compute the egocentric betweenness centrality of nodes in undirected graphs. In this work the network has local connections, while there are also inter-network connections. 2. 2.

We propose a two-stage sampling process that delivers a simple approach to implement and exponential savings in time and space over naïve sampling from the exponential mechanism directly. 3. 3.

We report on thorough experiments using a Facebook graph data set on 63,000 nodes. The experiments in Section  ‣ IV show that the error is approximately 16% of the true EBC for reasonable values of privacy level $\epsilon$. Similar results hold for other networks from Enron and PGP email.

First we survey the technical background and give a precise definition of EBC. We then explain why a precise computation would expose individual links between networks. Section IV describes our differentially-private mechanism for communicating enough information between networks to permit effective approximation of EBC while preserving strong privacy guarantees. We then present empirical results testing the feasibility of our approach on samples of public data from Facebook, Enron and PGP.

I-A Related Work

$k$-anonymity [] represents a major, early attempt at preventing node and edge re-identification by graph transformation, but it has been proven to be insufficient [].

Differential privacy for graph processing was first introduced in [] and was followed up by further work [, , , ]. Two main privacy models exist when publishing graph-based information under differential privacy; node [] and edge differential privacy []. Hay et al. [] introduced an algorithm for publishing degree distributions under edge privacy, implicitly permitting private $K$-star counting as well. Projection-based techniques have been proposed to answer degree distribution queries under node differential privacy [, ].

Other statistics have been approximated under differential privacy such as frequent patterns of given sub graphs [, , ]. Bhaskar et al. [] used the exponential mechanism to publish the (approximately) most frequent patterns with high probability, and the Laplace mechanism to release the noisy frequency of maximising patterns. Karawa et al. [] proposed a differentially-private algorithm to output answers to sub-graph counting queries for $K$-star, $K$-triangle sub graphs while using local sensitivity [] to overcome high global sensitivity in sub-graph counting queries. An approach to finding arbitrary frequent patterns was proposed by Shen & Yu []. They utilise the exponential mechanism and Markov chain Monte Carlo sampling to output frequent patterns on graph data sets.

Finding node clusters in a single graph under differential privacy was first proposed by [] and followed by []. These techniques try to find the group of nodes sharing many links with other nodes in the same group but relatively few outside the group. They maintain the privacy of the output clusters under node or edge differential privacy.

Our work differs from previous studies in two key ways. First we focus on the problem of node influence, through the study of ego betweenness centrality. This particular task poses significant technical challenges, made efficient here by adopting two-stage stratified and accept-reject sampling. Second we consider a core graph processing task in a distributed two-party setting. While most existing work on graph mining under differential privacy can adopt a model of trusted computation, and there is some work on privacy for distributed systems [, ], these are based on distributed queries that are decomposed into sub-queries, each answered per database. Our setting requires untrusting parties to cooperate on computation without revealing one another’s privacy-sensitive data.

II Preliminaries

II-A Egocentric Betweenness Centrality

First proposed by Everett & Borgatti [] as an approximation to betweenness centrality [], egocentric betweenness centrality (EBC) has gained recognition in its own right as a natural measure of a node’s importance as a network bridge []. The EBC of a node $a$ is the sum, for all pairs of neighbours of $a$ that aren’t directly connected, of the fraction of 2-edge paths between them that pass through $a$.

Definition 1**.**

Egocentric betweenness centrality (EBC)* of node $a$ in simple undirected graph $(V,E)$ is defined as*

[TABLE]

where $N_{a}=\{v\in V\mid\{v,a\}\in E\}$ denotes the neighbourhood or ego network of $a$, $A$ denotes the $(|N_{a}|+1)\times(|N_{a}|+1)$ adjacency matrix induced by $N_{a}\cup\{a\}$ with $A_{ij}=1$ if $\{i,j\}\in E$ and [math] otherwise; $A^{2}_{ij}$ denotes the $ij$-th entry of the matrix square, guaranteed positive for all $i,j\in N_{a}$ since all such nodes are connected through $a$.

II-B Differential Privacy on Graphs

Differential privacy was proposed to quantify the indistinguishability of input databases when observing the output of data analysis []. With careful selection of which databases are to be indistinguishable—through the so-called neighbouring relation—the protective semantics of differential privacy may be controlled.

As detailed further in Section III, our concern is maintaining the privacy of connections in networks, e.g., who calls whom in a telecommunications network. We therefore use edge privacy [] and so relate graphs that differ by edges. The adjacency matrix fully represents the edgeset of a graph of known nodes (the indices into the adjacency matrix). As such, we focus on databases as sequences of bits: elements of $\{0,1\}^{n}$.

Formally, two databases $D,D^{\prime}\in\{0,1\}^{n}$ and are termed neighbouring (denoted $D\sim D^{\prime}$) if there exists exactly one $i\in[n]$ such that $D_{i}\neq D^{\prime}_{i}$ and $D_{j}=D^{\prime}_{j}$ for all $j\in[n]\backslash\{i\}$. In other words, $\|D-D^{\prime}\|_{1}=1$.

Definition 2**.**

For $\epsilon>0$, a randomised algorithm on databases or mechanism $\mathcal{A}$ is said to preserve $\epsilon$-differential privacy if for any two neighbouring databases $D,D^{\prime}$, and for any measurable set $R\subseteq\mathrm{Range}(\mathcal{A})$,

[TABLE]

II-B1 Generic Mechanisms for Privacy

We leverage two well-known DP mechanisms in this paper: the Laplace mechanism [] which applies additive noise to numeric vector-valued analyses, and the exponential mechanism [] which privately optimises a real-valued objective function bivariate in the database and the decision variable which need not be numeric. Common to most generic mechanisms, and the Laplace and exponential in particular, is the concept of sensitivity-calibrated randomisation: the more sensitive a target function is to input perturbation, the more randomisation is required to attain a level of differential privacy. Both mechanisms leveraged here are calibrated via the same measure of sensitivity, defined next.

Definition 3**.**

The $L_{1}$-global sensitivity of any function $f:\{0,1\}^{n}\to\mathbb{R}^{d}$ for any $d\in\mathbb{N}$, is defined as

[TABLE]

For functions of additional variables $f:\{0,1\}^{n}\times\Theta\to\mathbb{R}^{d}$ we extend this definition naturally as

[TABLE]

We can now define the aforementioned generic mechanisms.

Lemma 4**.**

Consider any Euclidean vector-valued deterministic function $f:\{0,1\}^{n}\to\mathbb{R}^{d}$ for any $d\in\mathbb{N}$, and any scalar $\epsilon>0$. Given input $D\in\{0,1\}^{n}$, the Laplace mechanism releases responses in $\mathbb{R}^{d}$ distributed as $f(D)+\mathbf{X}$ where $\mathbf{X}$ is $d$ i.i.d. zero-mean Laplace222The zero-mean scalar Laplace with scale $\lambda>0$ has PDF $(2\lambda)^{-1}\exp(-|x|/\lambda)$. r.v.’s with scale $\Delta f/\epsilon$. Then the Laplace mechanism preserves $\epsilon$-differential privacy.

Lemma 5**.**

Consider any real-valued bivariate quality function $q:\{0,1\}^{n}\times\Theta\to\mathbb{R}$, which assigns quality score $q(D,\theta)$ to candidate response $\theta\in\Theta$, on input database $D\in\{0,1\}^{n}$. The exponential mechanism approximately maximises $q(D,\cdot)$ by releasing randomised response $\theta$ with likelihood proportional to $\exp(q(D,\theta)\cdot\epsilon/(2\cdot\Delta q))$. Then the exponential mechanism preserves $\epsilon$-differential privacy.

II-B2 Compositional Calculus

In order to build up more complex privacy-preserving computations, it is necessary to be able to quantify the privacy loss of compositions. Fortunately, differential privacy satisfies sequential composition and transformation invariance [, , ] among other compositions.

Lemma 6** (Sequential composition).**

For any sequence of randomised mechanisms $\mathcal{A}_{1},\mathcal{A}_{2},\ldots,\mathcal{A}_{k}$, if each $\mathcal{A}_{i}$ preserves $\epsilon_{i}$-differential privacy then the compound response on a database $D$, $(\mathcal{A}_{1}(D),\ldots,\mathcal{A}_{k}(D))$, preserves $\left(\sum_{i=1}^{k}\epsilon_{i}\right)$-differential privacy.

Lemma 7** (Transformation invariance).**

For any mechanism $\mathcal{A}_{1}$ that is $\epsilon$-differentially private, and any (possibly randomised) mapping $\mathcal{A}_{2}$ with domain containing the co-domain of $\mathcal{A}_{1}$, the randomised mechanism $\mathcal{A}=\mathcal{A}_{2}\circ\mathcal{A}_{1}$ preserves $\epsilon$-differential privacy.

III Problem Statement

Consider a two-party setting of a telecommunications network with two service providers $X,Y$: every customer is represented as a node $a$ that belongs to one and only one service provider; pairs of customers who e.g., have called one another are represented as edges in a simple undirected graph on the disjoint union of nodes. Edges can either connect nodes within one party ($X$ or $Y$) in which case are unknown to the other party ($Y$ or $X$ respectively), or edges span both parties and are known to both. We consider all nodes to be known to both parties, as being addressable within a global addressing system (e.g., a phone book).

Denote by $V_{X},V_{Y}$ the nodes of $X,Y$ respectively, $E_{X}\subseteq V_{X},E_{Y}\subseteq V_{Y}$ the edges (two-element sets) within parties $X,Y$ respectively, and $E_{XY}\subseteq V_{X}\cup V_{Y}$ the edges spanning $X,Y$ as sets with one element each from $V_{X},V_{Y}$. The simple undirected graph on the entire network comprises node-set disjoint union $V_{X}\cup V_{Y}$ and edge-set disjoint union $E_{X}\cup E_{Y}\cup E_{XY}$. Note we will often equivalently represent edge sets as adjacency matrices (or flattened vectors) with elements in $\{0,1\}$. Table I shows all of the symbols used in this paper.

We wish to enable one party (without loss of generality) $X$ to compute the ego betweenneess centrality (EBC) of one of its nodes $a\in V_{X}$, while maintaining edge privacy between parties. Before detailing a protocol for accomplishing this task, we must be precise about a privacy model.

Problem 8** (Private Two-Party EBC).**

Consider a simple undirected graph $(V_{X}\cup V_{Y},E_{X}\cup E_{Y}\cup E_{XY})$ partitioned by parties $X,Y$ as above, and an arbitrary node $a\in V_{X}$. The problem of private two-party egocentric betweenness centrality is for the parties $X,Y$ to collaboratively approximate $\mathrm{EBC}(a)$ under assumptions that:

1. A1.

Both parties $X,Y$ know the entire node set $V_{X}\cup V_{Y}$; 2. A2.

Each party knows every edge incident to nodes within their own network. That is, $X$ knows $E_{X}\cup E_{XY}$ while $Y$ knows $E_{Y}\cup E_{XY}$; and 3. A3.

The computed $\mathrm{EBC}(a)$ needs to be available to $X$ but need not be shared with $Y$.

Any solution must not reveal to $X,Y$ what is not already known except for $X$ discovering $\mathrm{EBC}(a)$ (Assumption 3). We seek solutions under an honest-but-curious adversarial model: while $X,Y$ will follow any agreed upon protocol prescribing computations to take and messages to send to one-another, without attempting to manipulate the other party; each party is curious about the other’s edges and may apply arbitrary auxiliary computation and leverage data sources in attempting to discover the other’s edges. Formally, what is revealed by $X$ ($Y$) to $Y$ (respectively $X$) must preserve $\epsilon$-differential privacy with respect to $E_{X}$ (respectively $E_{Y}$).

IV Warm-Up: A Non-Private Protocol

We first consider how $X,Y$ might cooperate without preserving differential privacy. In particular $X$ cannot itself count 2-paths that are

• •

Contained entirely within $Y$; or

• •

Ending in both $X,Y$ with intermediate node in $Y$.

Any protocol must involve $Y$ in aggregating over such paths. But while the first case can be aggregated independently by $Y$, the second case requires $X$ to communicate its endpoint neighbours of $a$ to $Y$. This significantly complicates the differentially-private solution developed in the next section.

Recall that $N_{a}=\{v\in V\mid\{v,a\}\in E\}$ denotes the ego network of $a$ anywhere in the graph (notably not including $a$ since the graph has no self-loops). Figure LABEL:fig:EBC summarises the following protocol.

Protocol 9**.**

Proceeding in sequence:

1. i.

[Forward message] $X$ sends to $Y$ the set $R^{\star}=N_{a}\cap V_{X}$ of neighbours of $a$ contained within $X$; 2. ii.

[Backward message] $Y$ computes and sends to $X$, for each $i\in R^{\star}$ and for each $j\in N_{a}\cap V_{Y}$ (where $i,j$ are not directly connected), a count $T_{ij}$ of 2-paths with endpoints $i,j$ and intermediate point in $N_{a}\cap V_{Y}$; 3. iii.

[Backward message] $Y$ computes and sends to $X$, the EBC partial sum over endpoint nodes $i,j\in N_{a}\cap V_{Y}$ with intermediate nodes in $N_{a}\cup\{a\}$. That is, $S_{Y}=\sum_{i,j\in N_{a}\cap V_{Y}:A_{ij}=0,j>i}1/A_{ij}^{2}$; 4. iv.

$X$* increments the received $T_{ij}$ by the number of 2-paths between $i,j$ with intermediate point in $R^{\star}\cup\{a\}$. It then sets $S_{XY}$ to the sum of their reciprocals;* 5. v.

$X$* computes, over distinct and disconnected endpoint nodes $i,j\in R^{\star}$ with intermediate node in $N_{a}\cup\{a\}$, the EBC partial sum. That is: $S_{X}=\sum_{i,j\in R^{\star}:A_{ij}=0,j>i}1/A_{ij}^{2}$; and* 6. vi.

$X$* completes computation of $\mathrm{EBC}(a)$ as $S_{X}+S_{XY}+S_{Y}$.*