Source-linked AI summary
You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors
Neil Zhenqiang Gong, Bin Liu
TL;DR
The paper addresses privacy attacks that infer missing user attributes from publicly available social connections and behavioral records, which prior attacks considered separately. It integrates these sources in the SBA model and VIAL attack, achieving higher inference coverage than previous methods, including 57% city inference and over 90% among selectively targeted users. The paper also identifies learning link weights and developing defenses as future directions.
Problem
Private attributes can be inferred from publicly available social and behavioral information, while prior attacks use either social friends or behaviors rather than both.
Method
The SBA model integrates social structures, behaviors, and attributes, and VIAL propagates vote capacity through this unified network to infer target attributes.
Results
57% of users' lived-in cities were correctly inferred, rising to over 90% when confidence estimation enabled selective attacks on half of users.
Takeaways & Limitations
VIAL correctly infers attributes for substantially more users than previous attacks by combining publicly available social structures and behaviors.
Takeaways & Limitations
The reported attack uses given link weights; learning link weights is left as future work and could further improve success rates.
Abstract
from arXiv · showhide
We propose new privacy attacks to infer attributes (e.g., locations, occupations, and interests) of online social network users. Our attacks leverage seemingly innocent user information that is publicly available in online social networks to infer missing attributes of targeted users. Given the increasing availability of (seemingly innocent) user information online, our results have serious implications for Internet privacy -- private attributes can be inferred from users' publicly available data unless we take steps to protect users from such inference attacks. To infer attributes of a targeted user, existing inference attacks leverage either the user's publicly available social friends or the user's behavioral records (e.g., the webpages that the user has liked on Facebook, the apps that the user has reviewed on Google Play), but not both. As we will show, such inference attacks achieve limited success rates. However, the problem becomes qualitatively different if we consider both social friends and behavioral records. To address this challenge, we develop a novel model to integrate social friends and behavioral records and design new attacks based on our model. We theoretically and experimentally demonstrate the effectiveness of our attacks. For instance, we observe that, in a real-world large-scale dataset with 1.1 million users, our attack can correctly infer the cities a user lived in for 57% of the users, via confidence estimation, we are able to increase the attack success rate to over 90% if the attacker selectively attacks a half of the users. Moreover, we show that our attack can correctly infer attributes for significantly more users than previous attacks.
1 Introduction
The paper studies privacy attacks that infer missing user attributes from publicly available social connections and behaviors, addressing the limits of using either source alone. It proposes the SBA model and VIAL attack, which combine these sources and outperform prior attacks.
- Online social networks expose social friends, behavioral records, and profiles containing attributes such as majors, employers, and cities lived.
- Existing attacks separately use social friendship structures or user behaviors, limiting inference accuracy when the two information sources are not combined.
- The SBA network integrates social structures, user behaviors, and user attributes in a unified framework.
- VIAL iteratively distributes vote capacity through the SBA network, allowing structurally similar users to vote for the target user's attributes.
- 57% of users had their lived-in cities correctly inferred, increasing to over 90% when selectively attacking half of users via confidence estimation.
- VIAL substantially outperformed previous attacks, improving Precision by over 20% against friend-based attacks and around 100% against behavior-based attacks.
2 Problem Definition and Threat Model
The threat model considers attackers who collect publicly available social structures, profiles, and behaviors to infer missing attributes of targeted users. It formalizes social networks, behaviors, attributes, and the attribute-inference task while assuming limited defensive intervention.
- Attackers may include cyber criminals, social network providers, advertisers, data brokers, or surveillance agencies interested in users' attributes.
- The attack requires collecting publicly available social structures, user profiles, and behaviors through web crawlers or service-provider APIs.
- The dataset representation uses a social graph, binary behavior vectors, and categorical attribute values such as majors, employers, and cities lived.
- The model allows directed-graph generalization, although the attacks are presented using an undirected social graph.
- An attribute-inference attack receives social neighbors and behavior vectors for targeted users and infers their attribute vectors.
- Private friend lists may remain vulnerable because an attacker can recover relationships when at least one user exposes the friendship publicly.
3 Social-Behavior-Attribute Framework
The SBA framework augments a social graph with behavior and attribute nodes, linking users to their observed behaviors and attributes. Link weights can balance the influence of social, behavior, and attribute relationships.
- The SBA network is constructed from publicly collected social structures, user attributes, and behaviors.
- The augmented network adds one node for each behavior object and attribute value, then links users to their positive behaviors and attributes.
- SBA node types are social, behavior, and attribute nodes, with corresponding social, behavior, and attribute links; behavior and attribute nodes are not directly linked.
- Link weights balance the influence of social, behavior, and attribute links, with higher behavior-link weights representing greater predictive value.
- Node weights could represent relative importance, but the attack does not rely on them.
- The framework represents social nodes sharing behavior or attribute neighbors as hop-2 social neighbors.
4 Vote Distribution Attack (VIAL)
VIAL infers targeted users’ attributes by distributing vote capacity through an SBA network that integrates social, behavior-sharing, and attribute-sharing relationships. It uses iterative local rules, backtracking, and confidence estimation to identify likely attribute values.
- Overview: VIAL computes attribute similarity for each targeted user in two phases: vote-capacity propagation followed by attribute-value voting.Phase I propagates capacity among structurally similar users; Phase II divides users’ capacity among their attributes and aggregates votes.
- Local Rules: Each iteration applies dividing, backtracking, and aggregating rules across social, behavior-sharing, and attribute-sharing neighbors.The rules distribute capacity according to neighbor structure and link weights, return a fraction toward the target, and aggregate incoming capacity.
- Neighbor Types: Behavior-sharing neighbors receive more capacity when they share more predictive behavior neighbors with the source user.The model weights common behavior neighbors by their predictive contribution and combines the resulting shares.
- Neighbor Types: Attribute-sharing neighbors receive more capacity when they share more high-affinity attribute neighbors with the source user.Common attribute values contribute through their weights and affinity to the users’ attributes.
- Backtracking: A larger backtracking strength concentrates capacity nearer the targeted user, and the authors report better accuracy with backtracking.With no backtracking, VIAL’s performance significantly degrades because predictions become independent of the target user.
- Confidence Estimation: Clusterness estimates confidence by clustering candidate-attribute votes into two groups and subtracting their average votes.A larger difference indicates a stronger separation between likely and unlikely attribute values.
5 Theoretical Analysis
The theoretical analysis establishes convergence and closed-form behavior for VIAL’s vote-capacity iterations, then explains how backtracking affects predictions and gives the algorithm’s complexity.
- Convergence: For any backtracking strength α ∈ (0,1], VIAL’s vote-capacity vectors converge to α(I − (1 − α)M^T)^−1e_v.The result uses the dividing matrix M and the target-specific initialization vector.
- No Backtracking: When α = 0 and the SBA network is connected, the converged vote-capacity vector is proportional to the unique stationary distribution of M.The stationary distribution is defined by the Markov chain whose transition matrix is M.
- Corollary: Under the stated α = 0 weighting conditions, a user’s vote capacity is proportional to its weighted degree.The corollary assumes a connected SBA network and specified shares for social, behavior-sharing, and attribute-sharing neighbors.
- No Backtracking: With no backtracking, VIAL predicts the same attribute values for every targeted user and therefore achieves suboptimal performance.The authors report that performance significantly degrades when α = 0.
- Complexity: VIAL’s overall time complexity is O(d · m) for one targeted user, where d is the iteration count and m is the number of SBA links.Each sparse-matrix iteration costs O(m).
6 Data Collection
The evaluation combines a large Google+ social-and-profile dataset with Google Play review behavior to construct an SBA network for attribute inference. The study focuses on popular values for majors, employers, and cities lived, while noting dataset representativeness and unit-weight limitations.
- Google+ Dataset: The collected Google+ snapshot contains 1,111,905 users and 5,328,308 undirected social links after preprocessing.Undirected links were retained when users appeared in each other’s incoming and outgoing friend lists.
- Google Play Behavior: Google Play contributes publicly available review behavior, including likes and ratings linked to users through their Google IDs.The review data supplies behavior nodes representing reviewed items in the SBA network.
- Attributes: The study evaluates three attributes: major, employer, and cities lived.The authors note that the attack could also be applied to other attributes, including political and religious views.
- Attributes: After manual merging, the dataset contains 62 majors, 78 employers, and 70 cities, totaling 210 popular attribute values.The selected values come from the most frequently claimed profile entries.
- Limitations: The authors caution that the Google+ snapshot may not represent the entire recent Google+ network, limiting generalization of the measured success rates.This is an explicit dataset-representativeness limitation.
- Google Play Behavior: The processed behavior data contains 48,706 items and 3,635,231 reviews after filtering items reviewed by at least five users.Overall, 33% of Google+ users reviewed at least one item.
- Construction: All SBA link weights are set to 1, so the reported attack results represent a lower bound on performance achievable with learned weights.The authors state that machine learning could be used to learn link weights and improve success rates.
7 Experiments
The experiments evaluate VIAL and competing attacks for inferring majors, employers, and cities using precision, recall, and F-score. VIAL outperforms attacks based only on friends, only on behaviors, or flattened combinations, while backtracking, shared behaviors, and confidence estimation affect performance.
- Evaluation setup: The evaluation uses Precision, Recall, and F-score for top-K predictions of majors, employers, and cities, averaging metrics over targeted users and trials.Precision measures correct predicted values, Recall measures recovered true values, and F-score summarizes the two.
- Compared attacks: RWwR-SAN performs best among friend-based attacks, while VIAL-B performs best among behavior-based attacks.RWwR-SAN benefits from random walks over an augmented graph, whereas VIAL-B better preserves behavior structure than feature-vector classifiers.
- Compared attacks: VIAL significantly outperforms the best friend-based and behavior-based attacks, showing the value of combining social structures and behaviors.The comparison includes Random, the strongest friend-based attack, and the strongest behavior-based attack.
- Parameter effects: VIAL more accurately infers attributes for users sharing more reviewed items, and confidence estimation raises city Precision from 0.57 to over 0.92 when attacking half the users.The confidence estimator selects users for attack, creating a trade-off between Precision and the fraction attacked.
8 Discussion
The work uses fixed link weights in the SBA network, while identifying learned link weights as a future direction that could improve attack success rates.
- VIAL propagates vote capacity through the SBA network with given link weights and remains applicable to any link weights.The discussion frames learning link weights as a possible extension rather than part of the current method.
9 Related Work
Prior attribute-inference work uses social links, groups, friends, writing, or behavioral records, with limitations in scalability, coverage, applicability, or computational complexity.
- Friend-based approaches infer attributes from social links, friends, and related user attributes, but some cannot handle users sharing no attributes.
- Social-link and group-based methods include binary friend features, local-community prediction, and multi-label classification using friends and wall posts.Community-based methods may fail outside detected communities and depend on whether communities correlate with attributes.
- Behavior-based methods infer attributes from movie ratings, music preferences, Facebook likes, or viewing behaviors using classifiers or topic models.One active-learning approach selects movies for users to review, which may not fit real-world scenarios when users are uninterested in those movies.
- Other attacks use account compromise, malicious applications, fake accounts, writing styles, or tweets and neighbors’ tweets to extract or infer user attributes.
- Social recommender approaches can combine social structure and behavior but have higher targeted-user computational complexity and challenging theoretical guarantees.The cited example has time complexity O(m · k · f · d) on a single machine.
10 Conclusion and Future Work
The paper integrates publicly available social structures and behaviors into an SBA model and VIAL attack, finding that combined information supports practical attribute inference at larger scale.
- The paper proposes the SBA network model and VIAL vote distribution attack to combine publicly available social structures and behaviors for attribute inference.The work reports theoretical and empirical demonstrations of the attack’s effectiveness.
- 1.1 million users: experiments find that combining social structures and behaviors enables successful attacks against more users.The paper attributes this success to statistical correlations between private attributes and publicly available information.
- Future work includes learning SBA link weights, inferring hidden social relationships, and defending against the inference attacks.
A Proof of Theorem 1
The proof setup states an equation from the vote-capacity analysis and establishes nonsingularity of its matrix through strict diagonal dominance.
- The matrix I − (1 − α)M^T is nonsingular because it is strictly diagonally dominant.
B Proof of Theorem 2
The matrix M defines a Markov chain on the SBA network, with transitions restricted to social neighbors and hop-2 social neighbors. When the SBA network is connected, this chain has a unique stationary distribution.
- M is a transition matrix because its entries are non-negative and each row sums to 1.
- Each social node is a Markov-chain state, and M_ux gives the transition probability from node u to node x.Non-zero transitions occur only to social neighbors or hop-2 social neighbors.
- A connected SBA network makes the Markov chain irreducible and aperiodic.
- The chain therefore has a unique stationary distribution π.The passage attributes this conclusion to standard Markov-chain theory and invokes the Perron-Frobenius theorem.
C Proof of Corollary 1
Under specified weight choices, the transition matrix M becomes a random walk on a weighted graph whose vertices are social nodes and whose edges connect social or hop-2 social neighbors.
- When wS = τ·d_u,S, wBS = τ·d_u,B, and wAS = τ·d_u,A, M defines a random walk on weighted graph G_w.
- G_w uses the social-node set V_s as vertices and connects each node to its social neighbors or hop-2 social neighbors.
- The edge weight combines social, behavioral-social, and attribute-social components through δ_ux,S·w_ux + δ_ux,BS·d_u,B·w_B(u,x) + δ_ux,AS·d_u,A·w_A(u,x).