LEAF: Reconciling Trust and Anonymity for IPV Survivors through Social Mixing

TL;DR

LEAF (Lending Encouragement, Affirming Futures) is a privacy-conscious social network designed specifically for survivors of Intimate Partner Violence (IPV). By integrating a "Social Mix" model, it allows survivors to gain the benefits of a trusted social network—emotional and medical support—without the risk of identity disclosure or location tracking by abusers.

Contextual Positioning

In the landscape of social technology, we often face a binary: the High-Trust/Low-Privacy world of Facebook (where real-world identity fuels trust but invites stalking) and the Low-Trust/High-Privacy world of anonymous forums (where anonymity is high but credibility is low). LEAF occupies a critical niche as a specialized, high-trust, high-privacy OSN sanctioned for healthcare and legal intervention.

The Problem: The Privacy-Trust Paradox

For IPV survivors, the stakes of a privacy leak are not just digital—they are physical. Existing OSNs fail because:

• Identity Linking: Messages are typically tagged with the sender's identity to ensure authenticity, making it impossible to seek advice without "coming out."
• Geographical Barriers: Rural survivors lack physical support groups.
• The Safety Hazard: Standard OSN features like "nearby friends" or "tags" are weaponized by abusers to track survivors.

Methodology: The "Social Mix" Breakthrough

The core technical innovation is the Social Mix node. This applies the concept of cryptographic mix networks (like Tor) to a social graph.

1. The Shuffling Mechanism

A social mix node (a user m) takes messages from friends, shuffles them, and forwards them. As far as the recipient b is concerned, the message came from the mix, not the original sender a.

Fig: The Social Mix Network where Node m acts as a relay to break the link between a and b.

2. Guarding Against Probabilistic Attacks

In a social network, friendship strength isn't uniform. An attacker might guess that Alice is talking to Tom because they are "Best Friends." LEAF uses Pairwise Entropy to ensure that the probability of mapping a message to any user in an anonymity set is as uniform as possible.

The entropy $H(s)$ is defined as: $H(s)=-{\sum }_{j\in A}{p}_{s\to j}imes{\log }_2(p_{s\to j})$ The system aims for a pairwise entropy close to 1.0, meaning the attacker has the lowest certainty (50/50 chance) of linking a message to a specific source between any two users.

Implementation & Practical Safety Features

The system isn't just a theoretical model; it's a realized platform built on Drupal with specific survival-oriented UX:

• Escape Button: A dedicated keyboard shortcut ('Escape') that instantly replaces the LEAF interface with a decoy "safe" tab (like a news site) while clearing the original view.
• Anonymized Sharing: A user can "vouch" for a post (providing trust) while the system automatically strips the original author's metadata.
• Cookie-free Statefulness: Prevents persistent tracking of the user's browser history.

Fig: An anonymous post as viewed by a friend, showing the relationship (e.g., "A friend of a friend") instead of a name.

Critical Insights

LEAF represents a significant shift from "Access Control" to "Unlinkability." Most social networks focus on who can see a post; LEAF focuses on who can prove who wrote it.

Limitations:

1. Browser Artifacts: The authors admit that in certain browsers (Chrome/Firefox), split-second flashes of the original site can occur during an "Escape" trigger.
2. Manual Mixing: Currently, some mix-node selection is manual. For a large-scale deployment, this must be automated via robust routing algorithms.

Conclusion

The LEAF system provides a blueprint for "Privacy-by-Design" in social work. By treating the social graph as a cryptographic routing network, it offers a sanctuary for the vulnerable, proving that social connectivity doesn't have to come at the cost of personal safety.