PaperlayerView exact revision on arXiv

Source-linked AI summary

Resolving Multi-party Privacy Conflicts in Social Media

Jose M. Such, Natalia Criado

arXiv:1507.04642v2cs.SI

TL;DR

Co-owned social-media items can expose users’ privacy preferences to conflict, while current controls often leave them to negotiate manually. This paper proposes a mechanism that adapts conflict resolution to users’ concessions, and its user study found that it matched participants’ behavior significantly more often than existing approaches.

  • Problem

    Co-owned social-media items can involve conflicting privacy preferences, while current controls apply only the uploader’s settings and leave other users to negotiate manually.

    Source: §1 · p. 1

  • Method

    The paper proposes a computational mechanism that resolves conflicts by adapting its method to the concessions users may make in different situations.

    Source: §1 · p. 2

  • Results

    The user study found that the mechanism matched participants’ behavior significantly more often than other previously proposed approaches.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The mechanism aims to reduce the need for manual negotiation by proposing solutions acceptable to the users involved in an item.

    Source: §1 · p. 1

    The paper assumes users specify preferences with group-based access control, though it says other access-control approaches could also be used.

    Source: §2.1 · p. 2

Abstract

from arXiv · show

Items shared through Social Media may affect more than one user's privacy --- e.g., photos that depict multiple users, comments that mention multiple users, events in which multiple users are invited, etc. The lack of multi-party privacy management support in current mainstream Social Media infrastructures makes users unable to appropriately control to whom these items are actually shared or not. Computational mechanisms that are able to merge the privacy preferences of multiple users into a single policy for an item can help solve this problem. However, merging multiple users' privacy preferences is not an easy task, because privacy preferences may conflict, so methods to resolve conflicts are needed. Moreover, these methods need to consider how users' would actually reach an agreement about a solution to the conflict in order to propose solutions that can be acceptable by all of the users affected by the item to be shared. Current approaches are either too demanding or only consider fixed ways of aggregating privacy preferences. In this paper, we propose the first computational mechanism to resolve conflicts for multi-party privacy management in Social Media that is able to adapt to different situations by modelling the concessions that users make to reach a solution to the conflicts. We also present results of a user study in which our proposed mechanism outperformed other existing approaches in terms of how many times each approach matched users' behaviour.

1 INTRODUCTION

Co-owned social-media items can expose users to privacy violations when only the uploader controls sharing. The paper introduces a concession-adaptive conflict-resolution mechanism and reports that it matched participants’ behavior significantly more often than existing approaches.

1 INTRODUCTION

  • Co-owned items are common, but only the uploader can set their privacy settings, risking unwanted sharing and privacy violations.Examples include photos depicting multiple people, comments mentioning multiple users, and events with multiple invitees.Source: §1 · p. 1
  • Users often negotiate collaboratively and may accommodate others through situation-dependent concessions, while current controls leave them to negotiate manually.Manual negotiation can be time-consuming given the number of items and possible accessors.Source: §1 · p. 1
  • Automated negotiation is intended to find solutions acceptable to involved users and reduce the need for manual conflict resolution.The challenge is to produce acceptable solutions most of the time for all users involved in an item.Source: §1 · p. 1
  • Prior approaches either demand substantial human intervention or use fixed aggregation methods that do not model compromise and concessions.One approach lets the uploader alone choose among aggregation methods, without considering the other users’ preferences.Source: §1 · pp. 1–2
  • The user study found that the proposed mechanism matched participants’ behavior significantly more often than other previously proposed approaches.The comparison focused on how often each approach matched participants’ behavior in the study.Source: §1 · p. 2
  • The mechanism resolves conflicts by adapting its method to the concessions users may be willing to make in different situations.It takes each involved user’s individual privacy preferences as input.Source: §1 · p. 2

2 BACKGROUND

The paper models negotiations over access to a co-owned item using users’ individual privacy policies. It frames the problem as detecting contradictory access decisions and finding solutions that respect the negotiating users’ preferences.

2 BACKGROUND

  • A negotiation concerns whether a set of negotiating users should grant a set of target users access to one co-owned item.The paper considers one item per negotiation and treats the set of target users broadly, without requiring a particular property.Source: §2 · p. 2

2.1 Individual Privacy Preferences

  • Users specify individual preferences using group-based access control, and a privacy policy is a tuple of granted-access groups and individual exceptions.The paper presents this model as a practical fit for mainstream social media, while noting that other access-control approaches could also be used.Source: §2.1 · p. 2

2.2 Problem Statement

  • The problem is to identify contradictory access decisions across users’ policies and, when conflicts exist, propose solutions that respect their preferences as much as possible.A policy’s groups grant access, while individual exceptions can deny or grant access to particular users.Source: §2.2 · p. 2, §2.1 · p. 2

3 MECHANISM OVERVIEW

The proposed mediator checks co-owners’ privacy policies for conflicting access decisions. If it finds conflicts, it prevents sharing and proposes a solution for each one.

3 MECHANISM OVERVIEW

  • A mediator can be integrated into a social-media privacy-control interface or implemented as an application interfacing with those controls.It detects conflicts by checking whether users’ policies give contradictory access decisions for the same target user.Source: §3 · pp. 2–3
  • When conflicts are detected, the item is not shared preventively while the mediator proposes a solution for each conflict.The process begins by inspecting all users’ individual policies for the item.Source: §3 · p. 3

4 CONFLICT DETECTION

Conflict detection compares the access decisions implied by each negotiating user’s policy for every target user. The mediator collects target users with differing decisions and passes detected conflicts to the resolution module.

4 CONFLICT DETECTION

  • The action function determines whether a policy grants or denies a target user access, regardless of the access-control model used.The function’s definition varies with the access-control model, but its purpose is to determine the resulting grant-or-deny decision.Source: §4 · p. 3
  • A conflict exists when at least two negotiating users assign different access actions to the same target user.Each user’s policy yields an action vector assigning grant or deny decisions across the target set.Source: §4 · p. 3
  • Algorithm 1 collects in conflict set C each target user for whom negotiating users’ action vectors disagree.If C is empty, the mediator returns the users’ preferred policies unchanged; otherwise it runs the conflict-resolution module.Source: §4 · pp. 3–4
  • The detection algorithm has polynomial complexity and worst-case complexity O(|U|^3) under the stated all-users, all-groups, and maximum group-size conditions.The stated worst case occurs when all users are negotiators and targets, all groups are granted access, and each negotiator has as many groups as users or all users belong to one group.Source: §4 · p. 3
  • In the Alice–Bob example, the policies disagree for Eve and Frank, so the conflict set is C = {Eve, Frank}.Alice’s policy grants access to Charlie and Dan, while Bob’s grants access to all four target users.Source: §4 · p. 4

5 CONFLICT RESOLUTION

The mediator resolves conflicting sharing preferences by estimating how important each conflict is to each user and how willing they are to change their preferred action. It applies concession rules designed to protect users from detrimental sharing while accommodating preferences when users are willing to concede.

5 CONFLICT RESOLUTION

  • The mediator prioritizes avoiding sharing that harms a user, sharing when it matters to someone and harms no one, and otherwise following the majority preference.These principles are operationalized through concession rules based on users’ preferred actions and estimated willingness to change.Source: §5 · p. 4

5.1 Estimating the Willingness to change an action

  • Willingness to change a preferred grant-or-deny action depends on both item sensitivity and the conflicting target user’s relative importance.The mediator estimates these factors to assess whether a solution may be acceptable to each negotiating user.Source: §5.1 · p. 4

5.1.1 Estimating Item Sensitivity

  • Item sensitivity is estimated from privacy-policy strictness: the minimum tie strength needed for access in each group is averaged across groups.A stricter policy—and thus a higher average minimum tie strength—indicates greater estimated sensitivity; the same item may have different sensitivity for different users.Source: §5.1.1 · pp. 4–5

5.1.2 Estimating the relative importance of the conflict

  • Relative importance compares a target user’s tie strength with the policy strictness for that user’s group; item sensitivity is used when the target belongs to no group.The measure captures how important the preferred action is for that particular target.Source: §5.1.2 · p. 5

5.1.3 Estimating Willingness

  • Willingness is based on Canberra distance between item sensitivity and target importance and is normalized to [0,1].The relative distance is used so the measure works regardless of the maximum tie-strength value δ.Source: §5.1.3 · pp. 5–6

5.2 Modelling Concessions

  • Under the I do not mind rule, high willingness to accept the nonpreferred action leads the user to concede; exactly 0.5 is classified as low.For example, a user with a low-sensitivity item may accept sharing with a target whom another user wants to include.Source: I do not mind (IDM) rule · pp. 6–7

I understand (IU) rule

The mediator models when users concede or hold to their preferred actions, then applies those rules to resolve each conflict. When willingness is low, the preferences of users unwilling to change can determine the outcome.

I understand (IU) rule

  • When users with low willingness to grant access face an objection from someone affected by the item, they may concede to denying access.The rule reflects users’ willingness to listen to objections when an item may be detrimental to others.Source: I understand (IU) rule · p. 7, No concession (NC) rule · p. 7
  • When neither IDM nor IU applies, the no-concession rule keeps users’ preferred actions for the conflicting target.The rule is formalized using users’ willingness and preferred actions.Source: No concession (NC) rule · p. 7

5.3 Computing Conflict Resolution

  • If all users have high willingness, modified majority selects the most-preferred action; with low-willingness users, disagreement among them yields denial, otherwise their preferred action decides.The algorithm has complexity O(|C|×|N|^2), or O(|U|^3) in the stated worst case.Source: §5.3 · p. 8
  • In the example, the resulting action vector grants access to Charlie, Dan, and Eve, while denying it to Frank.The mediator uses the low-willingness user’s suggested action to resolve each conflict in the example.Source: §5.3 · p. 8

6 USER STUDY

The user study compared the proposed mechanism and existing voting approaches with participants’ concession behavior. AR outperformed the alternatives, while results also showed that performance varied by situation and was not significantly affected by participant characteristics once a rule was instantiated.

6.1 Method

  • To elicit behavior without requiring sensitive disclosures, participants immersed themselves in recreated photo-sharing situations rather than merely self-reporting their behavior.Each participant completed 10 scenarios; 50 participants provided data for 500 scenarios.Source: §6.1 · pp. 8–9, §6.2 · p. 9

6.2 Participants

  • The study recruited 50 volunteers from university and non-academic communities, who completed the study online.The application described the data to be collected and obtained consent before participation.Source: §6.2 · p. 9

6.3 Results

  • The comparison included uploader overwrites, majority voting, and veto voting as automated alternatives to the proposed mechanism.Uploader overwrites follows the uploader’s preferred action; majority voting selects the action preferred by most negotiating users; veto voting denies access if any user prefers denial.Source: §6.3 · p. 9
  • AR clearly outperformed uploader overwrites, majority voting, and veto voting in matching participants’ concession behavior.Figure 3 presents the percentage of scenarios in which each approach matched participant behavior.Source: Figure 3 · p. 10, §6.3 · p. 10
  • AR performed similarly across its concession rules, while state-of-the-art approaches’ performance varied significantly by rule across 500 situations.Table 5 counts rule instantiations; Figure 4 breaks approach performance down by the rule AR would apply.Source: §6.3 · p. 10, Figure 4 · p. 10, Table 5 · p. 11
  • Participant demographics, social media use, and privacy concern did not significantly affect whether users followed an instantiated concession rule.The reported information gains and correlations were negligible and not statistically significant (p > 0.05).Source: §6.3 · p. 11

7 DISCUSSION

The study suggests the adaptive mechanism matched participants’ concession behavior more often than existing approaches, while the discussion identifies factors and prerequisites that bound its scope. The authors also describe interface options and a fallback when agreement is not reached.

7 DISCUSSION

  • The mechanism matched participants’ concession behavior significantly more often than other existing approaches.Table 6 reports IGs and CCs for each rule based on participants’ demographics, social media use, and privacy concern.Source: §7 · p. 11, Table 6 · p. 11
  • The mechanism is independent of how an interface presents proposed solutions and collects user feedback.Suggested options include privacy visualisation tools and configurable default responses.Source: §7 · p. 11
  • The mechanism models willingness to concede using individual preferences, item sensitivity, and the target’s relative importance, but other factors may matter.The discussion names negotiator relationships as a possible additional factor for future research.Source: §7 · p. 11
  • The approach starts after co-owners and their individual privacy policies are known; automatically identifying co-owned items is out of scope.The authors distinguish this prerequisite from detecting and resolving conflicts.Source: §7 · p. 11
  • If no agreement is reached, preventive face blurring may preserve an individual privacy baseline, though it may seriously diminish sharing utility.The authors present blurring as a possible alternative in this circumstance.Source: §7 · p. 12

8 RELATED WORK

Prior approaches either leave conflict resolution to users, constrain aggregation to fixed rules, or make a unilateral rule choice. Game-theoretic work offers an analytic framework but may not capture real users’ behavior.

8 RELATED WORK

  • Wishart et al. let parties specify strong and weak privacy preferences, but offer suggestions rather than an automated way to resolve conflicts.Users still try to solve conflicts manually.Source: §8 · p. 12
  • The incentive approach lets users bid with earned numeraire, but bidding may be difficult to understand and accumulated funds may enable unilateral decisions.The passage notes these concerns in.Source: §8 · p. 12
  • The approach in requires users to specify several item-level inputs and assigns the same action to all conflicting targets in a segment.The authors argue that uniform segment decisions can be far from what users would accept.Source: §8 · p. 12
  • Voting approaches, aggregate grant-or-deny votes using rules such as uploader overwrites, majority voting, or veto voting.These rules apply a fixed aggregation method across situations.Source: §8 · p. 12
  • In, the uploader chooses the voting rule for each item, leaving the choice unilateral and requiring manual selection.The uploader may also lack other users’ preferences when anticipating which rule will work best.Source: §8 · p. 12
  • Game-theoretic proposals, study negotiation protocols and solution concepts, but may not capture social idiosyncrasies or users’ departure from perfect rationality,,.The passage gives Nash equilibrium as an example of a solution concept.Source: §8 · p. 12

9 CONCLUSIONS

The paper presents an adaptive conflict-resolution mechanism based on concession rules and reports that it matched participants’ behavior more often than existing approaches. The authors frame it as a step toward more automated resolution while identifying further factors to investigate.

9 CONCLUSIONS

  • The mediator inspects users’ individual policies for conflicts and proposes a solution for each conflict using concession rules that model negotiation in this domain.The strategy adapts to the particular situation and draws on empirical evidence about privacy negotiations and disclosure-driving factors.Source: §9 · p. 12
  • The mechanism matched participants’ concession behavior significantly more often than existing approaches, while adaptive aggregation outperformed static approaches that were far from users’ behavior.The evaluation was a user study across a number of situations.Source: §9 · pp. 12–13
  • Future work will investigate additional factors that may shape concessions, including previous negotiations and relationships between negotiators.The authors describe the research as a step toward more automated conflict resolution.Source: §9 · p. 13

APPENDIX A PROOF OF THE PRINCIPLES

The appendix argues that the conflict-resolution algorithm satisfies principles governing when to share or withhold content. Its proofs use the algorithm’s cases to rule out outcomes that violate the first two principles.

APPENDIX A PROOF OF THE PRINCIPLES

  • Principle 1 says content should not be shared when doing so is detrimental to one of the users involved.The proof argues that the algorithm’s sharing cases contradict the assumed combination of a user’s refusal and detriment.Source: Appendix A · p. 14
  • Principle 2 says to share when sharing is important to at least one user and detrimental to none of the users involved.The proof examines the algorithm’s non-sharing cases and argues each contradicts those conditions.Source: Appendix A · p. 14
  • For cases outside Principles 1 and 2, the appendix says modified majority voting aggregates all users’ preferences; the proof of Principle 3 is omitted as trivial.The passage identifies this as the remaining set of cases.Source: Appendix A · p. 14
Loading 1507.04642v2…