Evolving Access Control: Solving the Privacy-Utility Paradox in Social Networks

TL;DR

Social network users want to share everything but fear the long-term consequences of "innocent" data becoming toxic. This paper proposes Evolving Access Control (EvAC)—a server-side algorithm that automatically and randomly oscillates data between public and private states. By treating privacy as a probabilistic coverage problem, it maximizes the amount of data shared while ensuring that sensitive clusters of information are almost never fully exposed simultaneously.

The Core Friction: Utility vs. Privacy

In the world of social media, Utility is defined by exposure: how much data can everyone else see? Privacy is defined by concealment: can an adversary reconstruct a "sensitive subset" (like a collection of photos that reveals a private behavior)?

Modern platforms rely on users to set their own permissions. However, the authors argue this is a failed model because:

• User Fatigue: Users don't want to constantly manage complex settings.
• Future-Blindness: What is safe to share today might be grounds for firing or insurance denial five years from now.
• Correlation Risks: A single photo might be fine, but five specific photos together create a sensitive profile.

Methodology: The EvAC Paradigm

The proposed solution is Server-Assisted Access Control. Instead of a static "public" or "private" tag, each data object $D_j$ has an attribute that evolves over time subintervals.

1. The Strategy

The server performs a random permutation of the user's database to mask the specific location of sensitive data. In each time period, it selects a subset of size $\ell$ to remain Public, while the rest are set to Private.

2. The Logic of Cover-Free Families

The core intuition is drawn from Cover-Free Families. If we view the "Sensitive Subset" $P$ as a set that needs to be "uncovered" (all elements set to public), the algorithm's goal is to ensure that for any attack period, at least one element in $P$ remains private.

Note: The system ensures that the probability $ϵ$ of an attacker seeing all elements of $P$ as public is kept beneath a strict threshold.

Mathematical Insight: The Trade-off

The authors provide a threshold-based utility function that balances how many objects are public versus the risk of exposure. The critical formula derived is: $\ell <n\cdot \left(1-{\left(1-{ϵ}^{1/s}\right)}^{1/m}\right)$ Where:

• $n$: Total data objects.
• $s$: Size of the sensitive subset.
• $m$: Number of time periods.
• $ϵ$: The privacy risk (probability of exposure).

Experimental Evidence

The paper visualizes this trade-off through two key performance vectors:

Fig 1: As the public attribute count ($\ell$) grows, the risk $ϵ$ increases. In Setup 1, keeping 47 objects public keeps risk under 0.001.

Fig 2: Shows how the system can maximize utility $\ell$ for a given allowed risk $ϵ$. The more objects ($n$) available, the higher the utility for the same safety level.

Critical Analysis & Conclusion

Takeaways

This work shifts the social network privacy conversation from "all or nothing" to "probabilistic availability." It acknowledges that total privacy is impossible if you want to be social, so it manages the exposure window instead.

Limitations

• Sensitive Subset Identification: The model assumes we know an upper bound $s$ for the size of sensitive data, but doesn't solve how to identify which data correlates to form a threat.
• User Experience: How would a user feel if their photo was public on Monday, private on Tuesday, and public again on Wednesday? The "flickering" of data might confuse social interactions.

Future Work

The authors suggest extending this to handle multiple sensitive subsets and more complex database structures beyond simple objects. As AI-driven data scraping becomes more prevalent, these time-evolving defenses might be the only way to prevent mass "dossier building" by automated crawlers.