1. Privacy of profile-based ad targeting Alexander Smal and Ilya Mironov

2. User-profile targeting Goal: increase impact of your ads by targeting a group potentially interested in your product. Examples: Social Network Profile = user’s personal information + friends Search Engine Profile = search queries + webpages visited by user 2 Privacy of profile-based targeting

3. Facebook ad targeting 3 Privacy of profile-based targeting

4. Characters Privacy of profile-based targeting 4 My system is private! Advertising companyPrivacy researcher

5. Simple attack [Korolova’10] Targeted ad Public: - 32 y.o. single man - Mountain View, CA - …. - has cat Private: - likes fishing Show - 32 y.o. single man - Mountain View, CA …. - has cat - likes fishing Amazing cat food for $0.99! Nice! Likes fishing # of impressions Likes fishing noise 5 Privacy of profile-based targeting Jon Eve

6. Privacy of profile-based targeting 6 My system is private! Unless your targeting is not private, it is not! How can I target privately? Advertising companyPrivacy researcher

7. How to protect information? Basic idea: add some noise Explicitly Implicit in the data noiseless privacy [BBGLT11] natural privacy [BD11] Two types of explicit noise Output perturbation Dynamically add noise to answers Input perturbation Modify the database 7 Privacy of profile-based targeting

8. 8 I like input perturbation better… Advertising companyPrivacy researcher

9. Input perturbation Pro: Pan-private (not storing initial data) Do it once Simpler architecture 9 Privacy of profile-based targeting

10. 10 I like input perturbation better… Signal is sparse and non-random Advertising companyPrivacy researcher

11. Adding noise Two main difficulties in adding noise: 11 Privacy of profile-based targeting 1000100010 0000000011 0001000001 0001001000 0110000001 0000100100 0010000110 0000000101 1010000000 0101010000 Sparse profiles 1001110100 0100000011 1000000010 1001111000 0110000011 1000100100 0111110111 0100000100 1011110000 0100000101 Dependent bits 1111100101 differential privacy deniability “Smart noise”

12. Privacy of profile-based targeting 12 I like input perturbation better… Signal is sparse and non-random Let’s shoot for deniability, and add “smart noise”! Advertising companyPrivacy researcher

13. “Smart noise” Consider two extreme cases All bits are independent independent noise All bits are correlated with correlation coefficient 1 correlated noise “Smart noise” hypothesis: “If we know the exact model we can add right noise” 13 Privacy of profile-based targeting Aha!

14. Dependent bits in real data Netflix prize competition data ~480k users, ~18k movies, ~100m ratings Estimate movie-to-movie correlation Fact that a user rated a movie Visualize graph of correlations Edge – correlation with correlation coefficient > 0.5 14 Privacy of profile-based targeting

15. Netflix movie correlations 15 Privacy of profile-based targeting

16. 16 Let’s construct models where “smart noise” fails Let’s shoot for deniability, and add “smart noise”! Advertising companyPrivacy researcher

17. How can “smart noise” fail? Privacy of profile-based targeting 17 large

18. Models of user profiles 18 Privacy of profile-based targeting 101…01 1101…0101 Are users well separated?

19. Privacy of profile-based targeting 19 Error-correcting codes Constant relative distance Unique decoding Explicit, efficient

20. Privacy of profile-based targeting 20 But this model is unrealistic! See — unless the noise is >25%, no privacy Let me see what I can do with monotone functions… Advertising companyPrivacy researcher

21. Monotone functions 21 Privacy of profile-based targeting

22. Approximate error-correcting codes 22 Privacy of profile-based targeting blatant non- privacy

23. Noise sensitivity Privacy of profile-based targeting 23 101…01 1101…0101 111…00 1000…1111 101…01 1101…0101 111…00 1111…0001

24. Monotone functions Privacy of profile-based targeting 24

25. Privacy of profile-based targeting 25 Hmmm. Does smart noise ever work? If the model is monotone, blatant non-privacy is still possible Advertising companyPrivacy researcher

26. Linear threshold model 26 Privacy of profile-based targeting

27. Conclusion Two separate issues with input perturbation: Sparseness Dependencies “Smart noise” hypothesis: Even for a publicly known, relatively simple model, constant corruption of profiles may lead to blatant non-privacy. Connection between noise sensitivity of boolean functions and privacy Open questions: Linear threshold privacy-preserving mechanism? Existence of interactive privacy-preserving solutions? 27 Privacy of profile-based targeting Arbitrary Monotone Linear threshold fallacy

28. Thank for your attention! Special thanks for Cynthia Dwork, Moises Goldszmidt, Parikshit Gopalan, Frank McSherry, Moni Naor, Kunal Talwar, and Sergey Yekhanin. 28 Privacy of profile-based targeting

29. 29