Who Started This Rumor? Quantifying the Natural Differential Privacy of Gossip Protocols

Gossip protocols (also called rumor spreading or epidemic protocols) are widely used to disseminate information in massive peer-to-peer networks. These protocols are often claimed to guarantee privacy because of the uncertainty they introduce on the node that started the dissemination. But is that claim really true? Can the source of a gossip safely hide in the crowd? This paper examines, for the first time, gossip protocols through a rigorous mathematical framework based on differential privacy to determine the extent to which the source of a gossip can be traceable. Considering the case of a complete graph in which a subset of the nodes are curious, we study a family of gossip protocols parameterized by a “muting” parameter s: nodes stop emitting after each communication with a fixed probability 1− s. We first prove that the standard push protocol, corresponding to the case s = 1, does not satisfy differential privacy for large graphs. In contrast, the protocol with s = 0 (nodes forward only once) achieves optimal privacy guarantees but at the cost of a drastic increase in the spreading time compared to standard push, revealing an interesting tension between privacy and spreading time. Yet, surprisingly, we show that some choices of the muting parameter s lead to protocols that achieve an optimal order of magnitude in both privacy and speed. Privacy guarantees are obtained by showing that only a small fraction of the possible observations by curious nodes have different probabilities when two different nodes start the gossip, since the source node rapidly stops emitting when s is small. The speed is established by analyzing the mean dynamics of the protocol, and leveraging concentration inequalities to bound the deviations from this mean behavior. We also confirm empirically that, with appropriate choices of s, we indeed obtain protocols that are very robust against concrete source location attacks (such as maximum a posteriori estimates) while spreading the information almost as fast as the standard (and non-private) push protocol. 2012 ACM Subject Classification Security and privacy → Privacy-preserving protocols

[1]  P. Erd6s.  ON A CLASSICAL PROBLEM OF PROBABILITY THEORY b , 2001 .

[2]  Morteza Zadimoghaddam,et al.  How Efficient Can Gossip Be? (On the Cost of Resilient Information Exchange) , 2010, ICALP.

[3]  Richard Nock,et al.  Advances and Open Problems in Federated Learning , 2019, Found. Trends Mach. Learn..

[4]  Nicholas C. Wormald,et al.  On the Push&Pull Protocol for Rumor Spreading , 2017, SIAM J. Discret. Math..

[5]  Gerome Miklau,et al.  Exponential random graph estimation under differential privacy , 2014, KDD.

[6]  Calvin C. Newport,et al.  How to Discreetly Spread a Rumor in a Crowd , 2016, DISC.

[7]  Wanlei Zhou,et al.  Identifying Propagation Sources in Networks: State-of-the-Art and Comparative Studies , 2017, IEEE Communications Surveys & Tutorials.

[8]  Stephen P. Boyd,et al.  Randomized gossip algorithms , 2006, IEEE Transactions on Information Theory.

[9]  Chryssis Georgiou,et al.  Confidential Gossip , 2011, 2011 31st International Conference on Distributed Computing Systems.

[10]  Johannes Gehrke,et al.  Gossip-based computation of aggregate information , 2003, 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings..

[11]  Scott Shenker,et al.  Epidemic algorithms for replicated database maintenance , 1988, OPSR.

[12]  Martin Jaggi,et al.  Decentralized Stochastic Optimization and Gossip Algorithms with Compressed Communication , 2019, ICML.

[13]  Úlfar Erlingsson,et al.  Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity , 2018, SODA.

[14]  Borja Balle,et al.  The Privacy Blanket of the Shuffle Model , 2019, CRYPTO.

[15]  David Eisenstat,et al.  Fast computation by population protocols with a leader , 2006, Distributed Computing.

[16]  Herbert W. Hethcote,et al.  The Mathematics of Infectious Diseases , 2000, SIAM Rev..

[17]  Marc Tommasi,et al.  Decentralized Collaborative Learning of Personalized Models over Networks , 2016, AISTATS.

[18]  Rachid Guerraoui,et al.  Who started this rumor? Quantifying the natural differential privacy guarantees of gossip protocols , 2019, 1902.07138.

[19]  Richard M. Karp,et al.  Randomized rumor spreading , 2000, Proceedings 41st Annual Symposium on Foundations of Computer Science.

[20]  Martin J. Wainwright,et al.  Dual Averaging for Distributed Optimization: Convergence Analysis and Network Scaling , 2010, IEEE Transactions on Automatic Control.

[21]  Rachid Guerraoui,et al.  Asynchronous gossip , 2013, JACM.

[22]  Jurek Czyzowicz,et al.  Efficient Information Exchange in the Random Phone-Call Model , 2010, ICALP.

[23]  Kannan Ramchandran,et al.  Hiding the Rumor Source , 2015, IEEE Transactions on Information Theory.

[24]  Anne-Marie Kermarrec,et al.  Privacy-Conscious Information Diffusion in Social Networks , 2015, DISC.

[25]  Alan M. Frieze,et al.  The shortest-path problem for graphs with random arc-lengths , 1985, Discret. Appl. Math..

[26]  Stéphan Clémençon,et al.  Gossip Dual Averaging for Decentralized Optimization of Pairwise Functions , 2016, ICML.

[27]  Adam D. Smith,et al.  Distributed Differential Privacy via Shuffling , 2018, IACR Cryptol. ePrint Arch..

[28]  Marek Klonowski,et al.  On Location Hiding in Distributed Systems , 2016, SIROCCO.

[29]  Rachid Guerraoui,et al.  Personalized and Private Peer-to-Peer Machine Learning , 2017, AISTATS.

[30]  Martin Vetterli,et al.  Locating the Source of Diffusion in Large-Scale Networks , 2012, Physical review letters.

[31]  Laurent Massoulié,et al.  Gossiping With Multiple Messages , 2006, IEEE Transactions on Information Theory.

[32]  Dariusz R. Kowalski,et al.  Estimating Time Complexity of Rumor Spreading in Ad-Hoc Networks , 2013, ADHOC-NOW.

[33]  Ian Goodfellow,et al.  Deep Learning with Differential Privacy , 2016, CCS.

[34]  Moni Naor,et al.  Our Data, Ourselves: Privacy Via Distributed Noise Generation , 2006, EUROCRYPT.

[35]  Devavrat Shah,et al.  Rumors in a Network: Who's the Culprit? , 2009, IEEE Transactions on Information Theory.

[36]  Anne-Marie Kermarrec,et al.  Epidemic information dissemination in distributed systems , 2004, Computer.

[37]  Mahmoud Fouz,et al.  Social networks spread rumors in sublogarithmic time , 2011, STOC '11.

[38]  Zhiyi Huang,et al.  Optimal Differentially Private Algorithms for k-Means Clustering , 2018, PODS.

[39]  Haipei Sun,et al.  Analyzing Subgraph Statistics from Extended Local Views with Decentralized Differential Privacy , 2019, CCS.

[40]  B. Pittel.  On spreading a rumor , 1987 .

[41]  Anand D. Sarwate,et al.  Differentially Private Empirical Risk Minimization , 2009, J. Mach. Learn. Res..

[42]  Aaron Roth,et al.  The Algorithmic Foundations of Differential Privacy , 2014, Found. Trends Theor. Comput. Sci..