Adversarial for Social Privacy: A Poisoning Strategy to Degrade User Identity Linkage

TL;DR

This paper introduces a novel adversarial poisoning strategy to degrade user identity linkage across social networks by perturbing the target network's structure, effectively fooling UIL models while maintaining imperceptibility.

Contribution

The paper proposes the first cross-network adversarial attack method for UIL, utilizing kernelized topology changes and efficient greedy algorithms to prevent user linkage.

Findings

Effective at fooling various UIL models

Balances attack success with imperceptibility

Validated on three real-world datasets

Abstract

Privacy issues on social networks have been extensively discussed in recent years. The user identity linkage (UIL) task, aiming at finding corresponding users across different social networks, would be a threat to privacy if unethically applied. The sensitive user information might be detected through connected identities. A promising and novel solution to this issue is to design an adversarial strategy to degrade the matching performance of UIL models. However, most existing adversarial attacks on graphs are designed for models working in a single network, while UIL is a cross-network learning task. Meanwhile, privacy protection against UIL works unilaterally in real-world scenarios, i.e., the service provider can only add perturbations to its own network to protect its users from being linked. To tackle these challenges, this paper proposes a novel adversarial attack strategy that poisons one target network to prevent its nodes from being linked to other networks by UIL algorithms. Specifically, we reformalize the UIL problem in the perspective of kernelized topology consistency and convert the attack objective to maximizing the structural changes within the target network before and after attacks. A novel graph kernel is then defined with Earth mover's distance (EMD) on the edge-embedding space. In terms of efficiency, a fast attack strategy is proposed by greedy searching and replacing EMD with its lower bound. Results on three real-world datasets indicate that the proposed attacks can best fool a wide range of UIL models and reach a balance between attack effectiveness and imperceptibility.