Accurate Estimation of the Degree Distribution of Private Networks
Michael Hay, Chao Li, Gerome Miklau, and David Jensen Department of Computer Science University of Massachusetts Amherst {mhay, chaoli, miklau, jensen}@cs.umass.edu
Abstract—We describe an efficient algorithm for releasing tee of anonymity ensures that private information is not a provably private estimate of the degree distribution of disclosed [7], [13], [22], [23]. In terms of utility, while a network. The algorithm satisfies a rigorous property of the transformed graph necessarily differs from the original, differential privacy, and is also extremely efficient, running on networks of 100 million nodes in a few seconds. Theoretical the hope is that it retains important structural properties of analysis shows that the error scales linearly with the number of interest to the analyst. A drawback of existing techniques is unique degrees, whereas the error of conventional techniques that they lack formal bounds on the magnitude of the error scales linearly with the number of nodes. We complement the introduced by the transformation. A common strategy for theoretical analysis with a thorough empirical analysis on real assessing utility is to measure familiar graph properties and and synthetic graphs, showing that the algorithm’s variance and bias is low, that the error diminishes as the size of the compare these measures numerically to the original data. input graph increases, and that common analyses like fitting a Empirically, it appears that with increasing anonymity, the power-law can be carried out very accurately. graph is rapidly distorted and some metrics are systemati- Keywords-privacy; social networks; privacy-preserving data cally biased [3], [7], [13], [22], [23]. mining; differential privacy. A final limitation of existing techniques is that few scale to the massive graphs that are now collected and studied. I. INTRODUCTION Most existing techniques have been evaluated on graphs The analysis of social networks is crucial to addressing a of about 5,000-50,000 nodes, and may be difficult to scale diverse set of societally important issues including disease much larger [7], [13], [22], [23]. transmission, fraud detection, efficiency of communication In this work, we focus on a specific utility goal— networks, among many others. Although technological ad- estimating the degree distribution of the graph—and develop vances have allowed the collection of these networks (often an algorithm that provides provable utility, strong privacy, massive in scale), privacy concerns have severely restricted and excellent scalability. The algorithm returns the degree the ability of social scientists and others to study these distribution of the graph after applying a complex two- networks. Valuable network data remains locked away in phase process of random perturbation. The error due to institutions, far from the scientists who are best equipped to random noise is provably low, yet sufficient to prevent even exploit it, because the data is too sensitive to share. powerful adversaries from extracting private information. The challenges of analyzing sensitive graph-structured The algorithm can scale to graphs with hundreds of millions data have recently received increased attention. It is now of nodes. The techniques we propose here do not result in a well-known that removing identifiers from a social network published graph. Instead we release only an estimate of the and releasing a “naively anonymized” isomorphic network true degree distribution to analysts. can leave participants open to a range of attacks [1], We choose to focus on the degree distribution because it [7], [17]. In response, a number of more sophisticated is one of the most widely studied properties of a graph. anonymization techniques have been proposed [3], [7], [13], It influences the structure of a graph and processes that [22], [23]. These techniques transform the graph—through operate on a graph, and a diverse line of research has studied the addition/removal of edges or clustering of nodes into properties of random ensembles of graphs consistent with a groups—into a new graph which is then published. The known degree distribution [12], [14], [18]. analyst uses the transformed graph to derive estimates of The simple strategy of releasing the exact degree distri- various properties of the original. bution fails to provide adequate privacy protection. Some The conventional goals of such algorithms are privacy and graphs have unique degree distributions (i.e., all graphs utility, although neither is satisfactorily achieved. Existing matching this degree distribution are isomorphic) making approaches provide anonymity, typically through transfor- the release of the degree distribution no safer than naive mations that make each node indistinguishable from others, anonymization. In general, it is unclear how to determine but they lack rigorous guarantees of privacy. They rely what the degree distribution reveals about the structure of the on the assumption that the adversary’s knowledge is lim- graph. The problem is compounded when either the adver- ited [3], [13], [22] and/or fail to prove that the guaran- sary has partial knowledge of graph structure, or the degree distribution is only one of several statistics published. Our it is important to know how accurately it can be estimated, goal is to design an approach that provides robust privacy independently of other properties. A long-term goal is to protection against powerful adversaries and is compatible develop a differentially private algorithm for publishing a with releasing multiple statistics. synthetic graph offering good utility for a range of analyses. The algorithms proposed here satisfy a rigorous privacy Because of the degree distribution’s profound influence on standard called differential privacy [4]. It protects against the structure of the graph, we believe that accurate estimation any adversary, even one with nearly complete knowledge of it is a critical step towards that long-term goal. of the private data. It also composes well: one can release multiple statistics under differential privacy, so long as II. DIFFERENTIAL PRIVACY FOR GRAPHS the algorithm for each statistic satisfies differential privacy. We first review the definition of differential privacy, and Thus while we focus on the degree distribution, additional then propose how it can be adapted to graph data. statistics can be incorporated into the privacy framework. While an existing differentially private algorithm [5] can A. Differential privacy be easily adapted to obtain noisy answers to queries about To define differential privacy, we consider an algorithm the degree distribution, the added noise introduces consider- A that operates on a private database I. The algorithm able error. In this work, we capitalize on a recent innovation is randomized and the database is modeled as a set of in differentially private algorithms that has been shown to records, each describing an individual’s private information. boost accuracy without sacrificing privacy [8]. The technique Differential privacy formally limits how much a single performs a post-processing step on the noisy answers, using individual record in the input can influence the output of the the fact that the queries impose constraints on the space of algorithm. More precisely, if I is a neighboring database— possible answers to infer a more accurate result. We apply i.e., one that differs from I by exactly one record—then an this technique to obtain an accurate estimate of the degree algorithm is differentially private if it is likely to produce distribution of a graph. the same output whether the input is I or I . Our contributions include the following. The following is a formal definition of differential privacy, • (Privacy) We adapt the definition of differential privacy due to Dwork [4]. Let nbrs(I) denote the set of neighbors to graph-structured data. We present several alterna- of I—i.e., I ∈ nbrs(I) if and only if |I ⊕ I | =1where tive formulations and describe the implications for the ⊕ denotes symmetric difference.1 privacy-utility tradeoff inherent in them. Definition II.1 ( -differential privacy). An algorithm A is - • (Scalability) We provide an implementation of the differentially private if for all instances I, any I ∈ nbrs(I), inference step of Hay et al. [8] that is linear, rather and any subset of outputs S ⊆ Range(A), the following than quadratic, in the number of nodes. As a result of holds: this algorithmic improvement the technique can scale to very large graphs, processing a 200 million node graph Pr[A(I) ∈ S] ≤ exp( ) × Pr[A(I ) ∈ S] in 6 seconds. We also extend the inference technique where probability Pr is over the randomness of A. to include additional constraints of integrality and non- negativity. The parameter measures the disclosure and is typically • (Utility) We assess utility of the resulting degree dis- also an input to the algorithm. For example, the techniques tribution estimate through comprehensive experiments used in this paper add random noise to their outputs, where on real and synthetic data. We show that: (i) estimates the noise is a function of . The choice of is a matter of are extremely accurate under strong privacy parameters, policy, but typically is “small,” say at most 1, making the exhibiting low bias and variance; (ii) for power-law probability “almost the same” whether the input is I or I . graphs, the relative boost in accuracy from inference An example illustrates why this protects privacy. Suppose increases with graph size; (iii) an analyst can use a hospital wants to analyze the medical records of their the differentially private output to accurately assess patients and publish some statistics about the patient popu- whether the degree distribution follows a power-law. lation. A patient may wish to have his record omitted from These contributions are some of the first positive results the study, out of a concern that the published results will in the private analysis of social network data, showing that reveal something about him personally and thus violate his a fundamental network analysis task can be performed ac- privacy. The above definition assuages this concern because curately and efficiently, with rigorous guarantees of privacy. whether the individual opts-in or opts-out of the study, the Admittedly, the degree distribution is just one property probability of a particular output is almost the same. Clearly, of a graph, and there is evidence that a number of other properties are not constrained by the degree distribution 1Differential privacy has been defined inconsistently in the literature. The original definition (called indistinguishability) defines neighboring alone [12], [14]. Nevertheless, it is hard to imagine a useful databases in terms of Hamming distance [5]. Note that -differential privacy technique that distorts the degree distribution greatly. Thus (as defined above) implies 2 -indistinguishability. any observed output cannot reveal much about his particular who emails whom; edge-differential privacy protects email record if that output is (almost) as likely to occur even when relationships from being disclosed. the record is excluded from the database. However, in some applications, it may be desirable to extend the protection beyond individual edges. For example, B. Differential privacy for graphs Klovdahl et al. [9] analyze the social network structure of In the above definition, the database is a table whereas in “a population of prostitutes, injecting drug users and their the present work, the database is a graph. Below we adapt personal associates.” In this graph, an edge represents a the definition of differential privacy to graphs. sexual interaction or the use of a shared needle. Edges are The semantic interpretation of differential privacy rests on clearly private information, but so too are other properties the definition of neighboring databases. Since differential like node degree (the number of sexual/drug partners) and privacy guarantees that the output of the algorithm can- even membership in the network. not be used to distinguish between neighboring databases, A second adaptation of differential privacy to graphs pro- what is being protected is precisely the difference between vides much stronger privacy protection. In node-differential neighboring databases. In the above definition, a neighboring privacy, two graphs are neighbors if they differ by at most database is defined as the addition or removal of a single one node and all of its incident edges. Formally, G and G record. With the hospital example, the patient’s private infor- are neighbors if |V ⊕ V | =1and E ⊕ E = {(u, v)|u ∈ mation is encapsulated within a single record. So differential (V ⊕ V ) or v ∈ (V ⊕ V )}. privacy ensures that the output of the algorithm does not Node-differential privacy mirrors the “opt-in/opt-out” no- disclose the patient’s medical history. tion of privacy from the hospital example. It assuages any With network data, which is primarily about relationships privacy concerns, as a node-differentially private algorithm among individuals, the correspondence between private data behaves almost as if the participant did not appear in at all. and database records is less clear. To adapt differential pri- While node-differential privacy is a desirable privacy vacy to graphs, we must choose a definition for neighboring objective, it may be infeasible to design algorithms that are graphs and understand the privacy semantics of that choice. both node-differentially private and enable accurate network We propose three alternatives offering varying degrees of analysis. A differentially private algorithm must hide even privacy protection. the worst case difference between neighboring graphs, and We model the input as a graph, G =(V,E), where V this difference can be large under node-differential privacy. is a set of n entities and E is a set of edges. Edges are For instance the empty graph (n isolated nodes) is a neighbor undirected pairs (u, v) such that u and v are members of of the star graph (a hub node connected to n nodes). We V . (Results are easily extended to handle directed edges.) show in Sec III-A that estimates about node degrees are While the meaning of an edge depends on the domain—it highly inaccurate under node-differential privacy. could connote friendship, email exchange, sexual relations, To span the spectrum of privacy between edge- and node- etc.—we assume that it represents a sensitive relationship differential privacy, we introduce an extension to edge- that should be kept private. The focus of the present work is differential privacy that allows neighboring graphs to differ concerned with graph structure, so the inclusion of attributes by more than a single edge. In k-edge-differential privacy, on nodes or edges is left for future work. graphs G and G are neighbors if |V ⊕ V | + |E ⊕ E |≤k. The first adaptation of differential privacy to graphs is A larger setting of k leads to greater privacy protection. mathematically similar to the definition for tables. Neighbor- If k =1, then k-edge-differential privacy is equivalent to ing graphs are defined as graphs that differ by one “record.” edge-differential privacy. If k = |V |, then k-edge-differential Given a graph G, one can produce a neighboring graph G by privacy is even stronger than node-differential privacy, as the either adding/removing an edge in E, or by adding/removing set of neighboring graphs under k-edge-differential privacy an isolated node in V . Restricting to isolated nodes ensures is a superset of the neighbors under node-differential privacy. that the change to V does not require additional changes If 1 ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● constant time rather than linear time. 10 15 20 Before describing the algorithm, we introduce some no- tation and restate the minimum L2 solution of Theorem 1 0 5 10 15 20 25 using this notation. Let the minimum cumulative average at Index k be denoted as Mk = min1≤j≤k M[k, j]. Then we can rewrite the solution at s[k] as follows: Figure 1. Example sequence S(I), noisy estimate s˜ = S˜(I), and constrained inference estimate s = S(I). s[k] = max min M[i, j] = max Mi (1) 1≤i≤k i≤j≤n 1≤i≤k Example 1. Figure 1 shows a degree sequence S(I) fora25 node graph, along with a sampled s˜ and inferred s. While the The basic idea behind the linear time algorithm is to values in s˜ deviate considerably from S(I), s lies very close construct s incrementally, starting at the end of the sequence to the true answer. In particular, for subsequence [1, 20], the and working backwards toward the beginning. At each true sequence S(I) is uniform and the constrained inference step , the algorithm maintains a partial solution for the process effectively averages out the noise of s˜. The twenty- subsequence s˜[,...,n]—meaning that the sort constraints first position is a unique degree in S(I) and constrained are only enforced on this subsequence and the rest of s˜ is inference does not refine the noisy answer, i.e., s[21] =s ˜[21]. ignored. At each step, the subsequence is extended to include another element of s˜ and the partial solution is updated As suggested by the example, the error of S can be accordingly. lower than that of S˜, particularly when the degree sequence We denote the partial solution as r¯ , and from Equation 1, 2We simplify the presentation, as well as later experiments, by assuming the value of r¯ at position k is equal to that n is known. In practice, n is unlikely to be sensitive, especially for large networks. Alternatively, one could derive a very accurate estimate of r¯ [k] = max min M[i, j] = max Mi (2) n using Proposition 1 and then adjust S accordingly. This would result in ≤i≤k i≤j≤n ≤i≤k a small amount of additional error in the estimate for the number of low 1 degree nodes. Observe that partial solution r¯ is equal to the desired s. Given a partial solution r¯ , we can extend the solution to faster than updating r¯ and from J we can easily reconstruct −1 by extending the subsequence to include the observation the solution r¯ . The details are shown in Algorithm 1, which s˜[ − 1] and updating the partial r¯ to obtain r¯ −1. There are computes J (lines 1-8) for = n,...,1. Then, it constructs two components of the update procedure. First, we determine s using J 1 (lines 10-16). the value for the new observation at position − 1. From Equation 2 the solution is simply the minimum cumulative Algorithm 1 An algorithm for computing s given s˜ − −1 − M average starting at 1; i.e., r¯ [ 1] = −1. 1: J ←∅, J.push(n) − th The second step is to check whether including the ( 1) 2: for k from n to 1 do ∗ element requires updating the existing solution for positions 3: j ← k, j ← J.top() ∗ ∗ ,...,n. From Equation 2, we can see that we must update 4: while J = ∅ and M[j +1,j] ≤ M[k, j ] do ∗ any k = ,...,n where the current solution r¯ [k] is smaller 5: j ← j, J.pop(), j ← J.top() − −1 − than the new value at 1 position, r¯ [ 1]: 6: end while −1 ∗ r¯ [k] = max Mi 7: J.push(j ) −1≤i≤k 8: end for 9: b ← 1 = max M −1, max Mi ≤i≤k 10: while J = ∅ do ∗ −1 − 11: j ← J.pop() = max r¯ [ 1], r¯ [k] ∗ 12: for k from b to j do M ∗ Thus, each step requires first computing −1 and then 13: s[k] ← M[b, j ] updating the existing solution for positions ,...,n.We 14: end for ∗ show next that we can use the partial solution r¯ to simplify 15: b ← j +1 M the cost of finding −1. While computing an individual 16: end while M −1 can take linear time in the worst-case, the amortized 17: return s cost is only O(1). Furthermore, we store partial solution r¯ in such a way that once M −1 is found, no additional work is required to update the solution. Example 2. The following table shows a sample input s˜ Given a partial solution r¯ , break it into subsequences along with the computations used to compute s. such that each subsequence is uniform and has maximal length. Let J be the set of indexes marking the ends of k s˜[k] s[k] arg mink≤j≤n M[k, j] the uniform subsequences. E.g., if all of the elements in r¯ 1 1 1 M[1, 1] are distinct, then J = {,...,n}; if the values of r¯ are all 2 9 5 M[2, 5] the same, then J = {n}. 3 4 5 M[3, 4] The following theorem shows how we can use r¯ to 4 3 5 M[4, 4] compute the minimum cumulative average M −1. Re- 5 4 5 M[5, 5] M − ∗ call that −1 = min −1≤k≤n M[ 1,j]. Let j de- The algorithm begins with J 5 = {5}. Stack J 4 becomes note the end index of this minimum average, i.e., j∗ = {4, 5} after s˜[4] is considered since s˜[4] < M5. When it arg min −1≤j≤n M[ − 1,j]. 3 comes to s˜[3], the stack J is {4, 5} since M3 = M[3, 4]. Theorem 3. Given r¯ and a corresponding J , one of the When s˜[2] is added since M[2, 5] ~s s s CF(x) 0.0 0.2 0.4 0.6 0.8 1.0 ) x ( S bias −0.15 0.05 01 49194901 4919490 1 4 9 19 49 99 01 4919490 1 4 9 19 49 99 01 491949 x x x x x x (a) Complementary CDFs of S(I), s˜ and s (top). Bias of S (bottom) flickr livejournal orkut youtube power random ~ S S S sampling KS distance to 0.0 0.1 0.2 0.3 0.4 0.5 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 ε ε ε ε ε ε (b) Privacy ( ) vs. Accuracy (KS distance) flickr livejournal orkut youtube power random ~ S S S sampling Mallows distance to Mallows 5e−02 5e−01 5e+00 5e+01 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 ε ε ε ε ε ε (c) Privacy ( ) vs. Accuracy (Mallows distance with p =2) power power Power−law Fit Estimating α Estimating xmin ~ α~ ~ θ from x^ xmin ~ ~ ~ min α S S θ from ~x xmin S min S ● S sample ^ ^ θ α S from x ● sampling ● ● ● sampling min θ from x ● ● ● min ● θ^ from x^ ● ● min ●● ● ● x ● KS distance to KS distance to s Absolute Error to Mallows distance to Mallows ●●●●● ● ● ● ● ● ● ● ● 0.002 0.006 0.010 0.014 1 2 5 10 50 200 0.0 0.1 0.2 0.3 0.4 0.5 10 20 50 200 500 0e+00 2e+06 4e+06 0e+00 2e+06 4e+06 0.0010.010 0.005 0.020 0.032 0.100 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 0.010 0.032 0.100 0.320 1.000 size size ε ε ε (d) Size vs. Accuracy for fixed =0.01 (e) Accuracy of estimating power-law model using S˜, S. Figure 3. The privacy-utility tradeoff of two differentially private estimators S˜ and S. VI. RELATED WORK produces accurate, nearly unbiased estimates of the degree distribution—and provide a more complete characterization The constrained inference technique that underlies this of the privacy-utility tradeoffs. work was originally proposed in [8]. That work focuses on using constraints to improve accuracy for a variety of count- Most prior work focuses on protecting privacy through ing queries. While applications to degree estimation were anonymization, transforming the graph so that nodes cannot recognized by the authors, a number of issues necessary be re-identified [3], [7], [13], [22], [23]. The output is a for practical network analysis were left open. The present published graph which the analyst can study in place of the paper shows that inference only requires linear time and original. While publishing a graph allows a broader range of that the framework can be extended to include the additional analysis, anonymization is a much weaker notion of privacy constraints of integrality and non-negativity constraints. Fur- and is vulnerable to attack (e.g., [6], [21]). ther, we resolve open questions about the practical utility of Furthermore, for the analyst interested in studying the the algorithm—showing that it scales to large graphs and degree distribution, these techniques may not scale to large graphs and can introduce considerable distortion. For exam- [6] S. Ganta, S. Kasiviswanathan, and A. Smith. Composition ple, the technique of Liu & Terzi [13], which is the most attacks and auxiliary information in data privacy. In KDD, scalable approach, appears to considerably bias power-law 2008. degree distributions, reducing the power-law coefficient by [7] M. Hay, G. Miklau, D. Jensen, D. Towsley, and P. Weis. 0.5 for reasonable settings of the privacy parameters. Our Resisting structural re-identification in anonymized social estimates have much smaller error (e.g., 0.004 at =0.01) networks. In VLDB, 2008. and satisfy a much stronger privacy condition. [8] M. Hay, V. Rastogi, G. Miklau, and D. Suciu. Boosting the Differential privacy has been an active area of research accuracy of differentially-private histograms through consis- (Dwork [4] provides a survey). Enabling accurate analysis tency. arXiv:0904.0942, 2009. of social networks is an often mentioned goal, but we are aware of only a few concrete results: techniques for [9] A. Klovdahl, J. Potterat, D. Woodhouse, J. Muth, S. Muth, computing properties such as clustering coefficient that have and W. Darrow. Social networks and infectious disease: the Colorado Springs study. Soc Sci Med, 1994. high sensitivity [19], [20] and a forthcoming approach that estimates the parameters of a random graph model [15]. [10] G. Kossinets and D. Watts. Empirical Analysis of an Evolving Social Network. Science, 311(5757):88–90, 2006. VII. CONCLUSION For the task of approximating the degree distribution of a [11] J. Leskovec, J. Kleinberg, and C. Faloutsos. Graphs over time: Densification laws, shrinking diameters and possible private social network, we present an algorithm that protects explanations. In KDD, 2005. privacy, scales to large graphs, and produces extremely accurate approximations. Our approach satisfies differential [12] L. Li, D. Alderson, J. Doyle, and W. Willinger. Towards privacy, which means that, unlike approaches based on a theory of scale-free graphs: Definition, properties, and implications. Internet Mathematics, 2005. anonymization, it provides extremely robust protection, even against powerful adversaries. Finally, given the importance [13] K. Liu and E. Terzi. Towards identity anonymization on of the degree distribution to the structure of a graph, we graphs. In SIGMOD, 2008. believe that our techniques are a critical first step towards [14] P. Mahadevan, D. Kiroukov, K. Fall, and A. Vahdat. System- the ultimate goal of publishing synthetic graphs that are both atic topology analysis and generation using degree correla- accurate and ensure differential privacy. tions. In SIGCOMM, 2006. ACKNOWLEDGMENTS [15] D. Mir and R. Wright. A differentially private graph estima- Hay and Jensen were supported by the Air Force Research tor. In International Workshop on Privacy Aspects of Data Laboratory and the Intelligence Advanced Research Projects Ac- Mining, 2009. tivity (IARPA), under agreement number FA8750-07-2-0158. Hay, [16] A. Mislove, M. Marcon, K. P. Gummadi, P. Druschel, and Miklau, and Li were supported by NSF CNS 0627642. The U.S. B. Bhattacharjee. Measurement and analysis of online social Government is authorized to reproduce and distribute reprints for networks. In IMC, 2007. Governmental purposes notwithstanding any copyright notation [17] A. Narayanan and V. Shmatikov. De-anonymizing social thereon. The views and conclusion contained herein are those of the networks. In IEEE Symposium on Security and Privacy authors and should not be interpreted as necessarily representing (Oakland), 2009. the official policies or endorsements, either expressed or implied, of the Air Force Research Laboratory and the Intelligence Advanced [18] M. Newman, S. Strogatz, and D. Watts. Random graphs with arbitrary degree distributions and their applications. Physical Research Projects Activity (IARPA), or the U.S. Government. Review E, 64(2), 2001. REFERENCES [19] K. Nissim, S. Raskhodnikova, and A. Smith. Smooth sensi- [1] L. Backstrom, C. Dwork, and J. Kleinberg. Wherefore art tivity and sampling in private data analysis. In STOC, 2007. thou R3579X? . In WWW, 2007. [20] V. Rastogi, M. Hay, G. Miklau, and D. Suciu. Relationship [2] A. Clauset, C. R. Shalizi, and M. Newman. Power-law privacy: Output perturbation for queries with joins. In PODS, distributions in empirical data. SIAM Review, 2009. 2009. [3] G. Cormode, D. Srivastava, S. Bhagat, and B. Krishnamurthy. [21] R. C.-W. Wong, A. W.-C. Fu, K. Wang, and J. Pei. Minimality Class-based graph anonymization for social network data. In attack in privacy preserving data publishing. In VLDB, 2007. VLDB, 2009. [22] B. Zhou and J. Pei. Preserving privacy in social networks [4] C. Dwork. Differential privacy: A survey of results. In TAMC, against neighborhood attacks. In ICDE, 2008. 2008. [23] L. Zou, L. Chen, and T. Ozsu. K-Automorphism: A general [5] C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating framework for privacy preserving network publication. In noise to sensitivity in private data analysis. In TCC, 2006. VLDB, 2009.