KMPA: Enhancing Path Privacy in Social Graphs through Dual-Edge Modification

TL;DR

In social network data publishing, protecting the "shortest path" between two individuals is crucial for hiding sensitive relationships. This paper presents KMPA (K-Multiple Paths Anonymization), a technique that achieves $k$-anonymity by making $k$ paths equally "short." Unlike previous methods that only tinkered with unused edges, KMPA modifies both Never-Visited (NV) and All-Visited (AV) edges, significantly lowering information loss and providing a more robust privacy framework.

Problem & Motivation: The Subtle Leakage of Shortest Paths

Sharing social network data (nodes as people, edges as relationships, weights as trust or distance) is vital for sociological and marketing research. However, even if you remove Names and IDs, the structural properties—specifically shortest paths—can allow an attacker to identify sensitive links.

Previous attempts at k-anonymous path privacy focused solely on modifying Never-Visited (NV) edges. The logic was simple: change the edges that aren't on the shortest path to create "fake" shortest paths. However, this is often mathematically impossible or results in "fuzzing" the data so much that it becomes useless for analysis. The authors recognized that by also allowing modifications to All-Visited (AV) edges—those bottleneck links that every version of a "shortest path" must cross—they could achieve the same privacy level with much less distortion to the overall graph statistics.

Methodology: The Logic of Proportional Modification

The core of the KMPA algorithm is a greedy strategy. For a given pair of nodes that need protection, the algorithm identifies the "Top-K" shortest paths and works to equalize their lengths.

Edge Classification

To understand the modification, we must classify edges based on their involvement in the target paths:

1. NV (Never-Visited): Edges not part of any shortest path.
2. AV (All-Visited): Edges common to every shortest path between the two nodes.
3. PV (Partially-Visited): Edges that appear in some, but not all, of the paths.

The KMPA Algorithm

The algorithm finds the $k$-th shortest path and reduces the weights of its non-overlapping edges proportionally until its total length matches the optimal shortest path.

Figure 1: A sample graph where the shortest path between $v_1$ and $v_6$ is hidden by creating a second path with an identical total weight.

A critical component is Lemma 1, which acts as a consistency check. When anonymizing multiple pairs of nodes, modifying an edge to help Pair A might accidentally break the anonymity of Pair B. The algorithm uses this lemma to skip modifications that would cause such conflicts.

Experiments: Privacy vs. Utility

The researchers tested KMPA on a synthetic dataset of 65 nodes and 1,021 edges. They measured success using two metrics: Perturbation Ratio (how many edges were changed) and KL Divergence (how much the "information" or distribution of weights changed).

Key Findings:

• Higher Flexibility: Including AV edges allows for more options to reach the $k$ threshold. While the percentage of perturbed edges increases (up to 50% for $k=10$), the "severity" of each change is lower.
• Superior Utility: This is the real win. By modifying both NV and AV edges, the KL Divergence (information loss) dropped from 0.0466 to 0.003.

Figure 2: The ratio of perturbed edges increases as the privacy requirement ($k$) grows, reflecting the increased effort needed to hide sensitive paths.

Critical Insight & Conclusion

The significance of this work lies in its pragmatic approach to the Privacy-Utility Trade-off. In graph theory, AV edges are often "critical infrastructure." While modifying them changes the absolute path length (e.g., making the shortest path 10 units instead of 8), it preserves the relative relationships and graph entropy much better than if we only attacked the peripheral NV edges.

Limitations & Future Work

The current KMPA algorithm is still "greedy," meaning it might not find the global mathematical optimum for all possible $k$ paths. Furthermore, the authors have yet to incorporate Partially-Visited (PV) edges, which could offer even more granular control. Future research plans to extend this logic to other sensitive structures like Minimal Cost Spanning Trees (MST).

Takeaway: If you want to hide a secret path in a social forest, don't just build new trails (NV edges); sometimes you have to shorten the main road (AV edges) that everyone is already walking on.