Differentially-private release of check-in data for venue recommendation

Abstract

Abstract-Recommender systems suggesting venues offer very useful services to people on the move and a great business opportunity for advertisers. These systems suggest venues by matching the current context of the user with the venue features, and consider the popularity of venues, based on the number of visits ("check-ins") that they received. Check-ins may be explicitly communicated by users to geo-social networks, or implicitly derived by analysing location data collected by mobile services. In general, the visibility of explicit check-ins is limited to friends in the social network, while the visibility of implicit check-ins limited to the service provider. Exposing check-ins to unauthorized users is a privacy threat since recurring presence in given locations may reveal political opinions, religious beliefs, or sexual orientation, as well as absence from other locations where the user is supposed to be. Hence, on one side mobile app providers host valuable information that recommender system providers would like to buy and use to improve their systems, and on the other we recognize serious privacy issues in releasing that information. In this paper, we solve this dilemma by providing formal privacy guarantees to users and trusted mobile providers while preserving the utility of check-in information for recommendation purposes. Our technique is based on the use of differential privacy methods integrated with a pre-filtering process, and protects against both an untrusted recommender system and its users, willing to infer the venues and sensitive locations visited by other users. Extensive experiments with a large dataset of real users' check-ins show the effectiveness of our methods.

Incremental release of differentially-private check-in data

“…For instance, every week it releases the number of check-ins done in each venue during the last seven weeks. As an example, consider the problem of periodically releasing the number of check-ins done in a specific venue v from week i to week i + 6 (i.e., ⟨S * [1,7] , S * [2,8] , S * [3,9] , . .…”

“…In our previous work [8], as well as in a preliminary investigation of this topic [9], we addressed the use of differential privacy for private release of check-in statistics. In those works, we assumed a single release of statistics about the whole set of check-ins.…”

“…For instance, considering Fig. 7, S * [3,9] is computed as c [3,4] + c [5,8] + c [9] + η [3,4] + η [5,8] + η [9] .…”

“…Indeed, at each depth of the binary tree B, ϵ log m -differential privacy is applied on disjoint subsets of D; for instance, referring to Fig. 7, ϵ log m -differential privacy is applied on D [1,4] and D [5,8], which are disjoint subsets of D. Hence, thanks to the parallel composition property, the resulting noisy statistics S * [1,4] and S * [5,8] achieve ϵ log m -differential privacy. Since each piece of original data belonging to D is used to compute log m noisy statistics, each achieving ϵ log m -differential privacy, applying the sequential composition property we can conclude that the algorithm achieves  log m · ϵ log m  -differential privacy.…”

The Long Road to Computational Location Privacy: A Survey

“…Counting users is one interesting thing to do with mobility data, but we want to publish entire trajectories and allow more mining tasks to be performed. Riboni and Bettini [143] introduced a way to publish check-in data (e.g., from Swarm [150]) in a differentially private manner, with the goal to allow venue recommandation from this data. They start by filtering check-ins that fall within regions of fixed size where a single user did too many check-ins, thus indicating that it may be an important or sensitive venue for him.…”