On the Inherent Anonymity of Gossiping

TL;DR

This paper analyzes the inherent source anonymity of gossip protocols using $\u03b5$-differential privacy, revealing how graph connectivity impacts privacy guarantees and introducing new proof techniques for evaluating privacy in gossip networks.

Contribution

It provides a fundamental quantification of source anonymity limits in arbitrary graphs and introduces a novel proof method based on random walks with probabilistic die out.

Findings

Poor connectivity graphs offer no meaningful privacy guarantees.

Cobra walks provide tangible differential privacy guarantees.

Trade-off between dissemination speed and source anonymity is precisely characterized.

Abstract

Detecting the source of a gossip is a critical issue, related to identifying patient zero in an epidemic, or the origin of a rumor in a social network. Although it is widely acknowledged that random and local gossip communications make source identification difficult, there exists no general quantification of the level of anonymity provided to the source. This paper presents a principled method based on $\varepsilon$-differential privacy to analyze the inherent source anonymity of gossiping for a large class of graphs. First, we quantify the fundamental limit of source anonymity any gossip protocol can guarantee in an arbitrary communication graph. In particular, our result indicates that when the graph has poor connectivity, no gossip protocol can guarantee any meaningful level of differential privacy. This prompted us to further analyze graphs with controlled connectivity. We prove on these graphs that a large class of gossip protocols, namely cobra walks, offers tangible differential privacy guarantees to the source. In doing so, we introduce an original proof technique based on the reduction of a gossip protocol to what we call a random walk with probabilistic die out. This proof technique is of independent interest to the gossip community and readily extends to other protocols inherited from the security community, such as the Dandelion protocol. Interestingly, our tight analysis precisely captures the trade-off between dissemination time of a gossip protocol and its source anonymity.