Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

Data Poisoning Attacks to Local Differential Privacy Protocols for Graphs

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An attacker with a small fraction of fake users can deliberately distort the degree centrality and clustering coefficient estimated by LDP graph protocols, and the paper identifies the attack that maximizes this distortion.

desk verdict A real gap and real experiments, but the paper's two central theorems rest on contradictory assumptions about how the server estimates degrees. read the letter →

arxiv 2412.19837 v1 pith:KCIC4VBF submitted 2024-12-23 cs.CR cs.DB

Xi He , Kai Huang , Qingqing Ye , Haibo Hu This is my paper · ORCID
classification cs.CRcs.DB
keywords datapoisoninglocaldifferentialprivacygraphmetricsdegreecentralityclusteringcoefficientfakeuserinjectionattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Local differential privacy for graphs asks each user to send a perturbed list of whom they are connected to and a reported degree to a central server, which then estimates metrics like degree centrality and clustering coefficient. This paper argues that an attacker who controls a modest number of fake users can craft those two atomic reports to push the estimated metrics of chosen target nodes in a desired direction. The paper proves that a Maximal Gain Attack, connecting fake nodes to targets as densely as an average-degree cap allows, maximizes the total distortion, and it gives explicit gain formulas for both metrics. Experiments on real social and communication networks show that even a 5% fraction of fake users substantially degrades the collected metrics, and two countermeasures based on frequent itemsets and degree consistency do not fully restore accuracy. If the claim is right, applications that rely on LDP graph collection for popularity or influence estimates should treat reported data as adversary-controlled input.

What carries the argument

The load-bearing object is the absolute gain $\mathrm{Gain} = \sum_{t \in T} |\tilde{f}_{t,a} - \tilde{f}_{t,b}|$: the attacker's optimization is to maximize this sum over crafted reports. For degree centrality, the mechanism is direct edge injection: each fake node connects to as many target nodes as allowed by an average-degree cap, which keeps fake nodes plausible. For the clustering coefficient, the mechanism is triangle construction: fake nodes are connected to each other and to targets so that, after the protocol's triangle-count calibration $R(\cdot)$, the estimated triangle count of a target rises while the estimated degree in the denominator is assumed unchanged. The average-degree cap computed from the perturbed graph is what ties the two attacks together, because it limits the number of crafted edges the attacker can add without being obvious.

What would settle it

Run the MGA clustering-coefficient attack against a server that estimates each node's degree from the same reconstructed adjacency bit vectors used for triangle counting, rather than from the separately reported degree values; if the target's reconstructed degree rises with the fake connections, the measured gain will diverge from Theorem 2's formula, and the claimed optimality of the attack would fail in that setting.

Watch

Extended reading notes

Core claim

The central claim is that an attacker who controls $m$ fake users in an edge-local differential privacy graph collection protocol can deliberately distort the estimated degree centrality and clustering coefficient of chosen target nodes. The attack surface is the pair of atomic reports each user sends: an adjacency bit vector and a degree. The paper defines the attack gain as $\mathrm{Gain} = \sum_{t \in T} |\tilde{f}_{t,a} - \tilde{f}_{t,b}|$, and proves in Theorems 1 and 2 that the Maximal Gain Attack (MGA) maximizes this quantity. For degree centrality, each fake node connects to as many target nodes as the average-degree cap allows, yielding a gain of $\mathrm{Gain} = \frac{m r}{N-1}\left(\frac{\min(r,\lfloor \tilde{d} \rfloor)}{r} - \frac{\tilde{d}}{N-1}\right)$. For the clustering coefficient, fake nodes are wired into triangles with the target and each other so that the calibrated triangle count rises while the denominator is treated as constant, producing the gain formula in Theorem 2. The paper further argues experimentally that MGA dominates random baselines and that two detection-oriented countermeasures only partially reduce the gain.

Load-bearing premise

For the clustering-coefficient theorem, the derivation assumes the target's estimated degree $\tilde{d}_i$ is the same before and after the attack; since the attack adds fake edges to the target, a server that recomputes degree from the reconstructed adjacency bit vectors would see the denominator $\tilde{d}_i(\tilde{d}_i-1)$ increase, and the fixed-denominator gain formula in Theorem 2 would not hold.

Editorial extensions

If this is right

  • A 5% injection of fake users, each adding a handful of crafted edges, is enough to move estimated degree centrality and clustering coefficient of target nodes noticeably on all four datasets tested.
  • MGA consistently dominates the two random baselines for both metrics, so the threat is not an artifact of a particular graph or privacy budget.
  • The two countermeasures (frequent-itemset mining and reported-versus-reconstructed degree checking) can reduce the gain in some settings but leave a large residual distortion, and they can misclassify genuine high-degree nodes as fake.
  • Because the attacks operate on the atomic adjacency-bit-vector and degree reports, graph metrics beyond degree centrality and clustering coefficient, including modularity as the paper's experiments show, are also degraded.
  • The privacy guarantee does not by itself protect the server against fabricated reports; utility of any downstream graph metric is at risk.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same atomic-report model underlies many LDP graph estimators, so targeted poisoning probably extends to metrics the paper did not test, such as closeness or betweenness approximations, whenever those estimators are monotone in reported degrees or triangle counts.
  • An adaptive attacker could calibrate the number of crafted edges per fake node to sit just below the average-degree cap while still covering all targets, making both proposed detection methods less effective; testing this would require an implementation that tunes the cap against the detector's threshold.
  • A more promising defense direction is server-side consistency validation between the reported degree and the degree implied by the reconstructed graph, or robust aggregation that bounds the influence of any single fake user; the paper's negative countermeasure results motivate such designs rather than settle them.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies data poisoning attacks against local differential privacy (LDP) protocols for graph metric collection. The attacker controls a set of fake users and crafts their reported adjacency bit vectors and degree values to distort the server's estimates of degree centrality and clustering coefficient for chosen target nodes. The authors propose two baseline attacks (Random Value Attack and Random Node Attack) and one optimization-based attack (Maximal Gain Attack, MGA), and claim that MGA achieves the maximal distortion, stated as Theorems 1 and 2. They also propose two countermeasures (frequent-itemsets-based detection and degree-difference-based detection) and evaluate all methods on four real-world graph datasets. The paper concludes that the attacks significantly degrade metric quality and that the proposed countermeasures are only partially effective.

Significance. If the theoretical claims are correct, this paper opens a new and relevant research direction: the security of LDP protocols for graph data, which has not been systematically studied before. The experimental evaluation on multiple real-world datasets demonstrates that the proposed attacks can substantially lower the quality of estimated degree centrality and clustering coefficient, and the countermeasures are shown to be insufficient. The paper also makes a useful connection to prior poisoning attacks on non-graph LDP frequency estimation. However, the central optimality claims (Theorems 1 and 2) are not proved in the manuscript, and one of the derivations relies on an assumption about the target's degree that conflicts with the attack construction; these issues need to be resolved before the theoretical contribution can be accepted.

major comments (3)
  1. [Section VI, Eqs. (15)-(22), Fig. 5] The clustering coefficient derivation assumes that the target node's degree remains constant during the attack: the text before Eq. (19) states 'Since only the number of triangles changes for a node before and after the attack, while the degree remains constant,' and Eqs. (20)-(22) treat ed_i(ed_i-1) as a fixed denominator. Yet the attack construction in Fig. 5 and the surrounding cases (Case 1a-3b) explicitly adds edges between fake nodes and the target node, which increases the target's degree. The degree-centrality attack in Section V, Eq. (10), counts the same kind of added edges as increasing the target's degree. The paper never specifies whether the server's degree estimate comes from the target's own reported degree value (which an honest target would not update) or from the reconstructed adjacency matrix/bit vectors (which include the fake edges). Under the latter semantics, the denominator in Eq. (20) and the calibration function R in Eqs. (16)-(19) depend on the changing degree, so the closed form in Theorem 2 is not the maximum gain. Under the former semantics, the Section V degree-centrality attack would have no effect on the target's degree centrality. The paper must specify the degree estimation semantics precisely and revise one of the two derivations accordingly.
  2. [Theorems 1 and 2, Section V and VI] Theorems 1 and 2, which state that MGA achieves the maximal gain for degree centrality and clustering coefficient, are not proved in the manuscript. The paper only says 'Formal proofs of theorems are in [1]' and points to an external GitHub technical report. Since the paper's central contribution is the claim that MGA 'maximally distorts' the collected graph metrics (Section IV.B and the abstract), the absence of proofs or even proof sketches for these theorems leaves the main theoretical result unsupported in the paper itself. The authors should include full proofs or detailed proof sketches in the manuscript so that the optimality claim can be evaluated directly.
  3. [Section IV.B, Eqs. (6)-(7); Sections V and VI] The optimization problem in Eq. (6)-(7) is not formally specified. The constraint set Y is never defined, and the 'average degree limit' and 'number of new connections' constraints that are used to control the attack in Sections V and VI are described only informally (e.g., 'the number of additional connections for each fake node is carefully controlled' and 'we limit the number of new connections each fake node can create to the average degree'). Without a precise statement of these constraints, the meaning of 'maximal gain' is not well-defined, and even a proof of Theorems 1 and 2 would not be verifiable. The authors should formalize the feasible set Y in terms of the protocol parameters and the detection-avoidance heuristic.
minor comments (4)
  1. [Section VIII, Exp. 1] The text says 'MGA and RVA show a clear inverse relationship between the privacy budget and attack effectiveness' and then immediately says 'In contrast, the gain of MGA remains nearly unchanged.' The second sentence appears to refer to RNA, not MGA; this typo makes the paragraph confusing.
  2. [Section VI, Eqs. (15), (20)-(22)] The notation for the degree used in the clustering coefficient derivation is inconsistent: Eq. (15) uses 'di' as the perturbed degree, while Eqs. (20)-(22) use 'ed_i' (estimated degree). The paper should use a single notation consistently.
  3. [Theorem 1, Eq. (11)] The formula in Eq. (11) uses 'min(r, floor(dtilde))/r' and subtracts 'dtilde/(N-1)' without explanation. The expression appears dimensionally odd, and its sign is not discussed; if the subtracted term can exceed the first term, the formula would predict a negative gain, which would be impossible for a maximization attack. The derivation of this formula should be clarified or corrected.
  4. [Section VII.A and VII.B] The countermeasures rely on free parameters that are not formally defined. The 'predefined threshold' in the frequent-itemset detection (Section VII.A) and the '3-sigma' threshold in the degree-based detection (Section VII.B) are not connected to a specific distribution or variance, making the detection methods hard to reproduce from the description alone.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular reasoning found: the MGA gain formulas are derived from the attack construction and protocol parameters, not fitted to the target metrics; the score reflects only minor self-citation and an omitted proof in the authors' own technical report.

full rationale

The paper's central derivation is not circular. Gain is defined in Eq. (5) as the absolute change in estimated graph metrics, and MGA is posed as an explicit optimization over crafted fake-user values (Eqs. (6)-(7)); Theorems 1 and 2 evaluate that objective under the stated construction and the average-degree constraint. The degree-centrality gain in Eq. (10) is the direct count of fake-target edges divided by N-1, and the clustering-coefficient equations (18)-(22) cancel common calibration terms so that the gain depends only on the triangle-count difference. No parameter is fitted to make the attack outcome match a target value, and the experiments use real datasets with pre-set beta, gamma, and epsilon. The clustering-coefficient proof does rest on an assumption that "the degree remains constant" before and after the attack (Section VI, text before Eq. (19)); if the server derives degree from reconstructed adjacency bit vectors rather than from the separately reported degree, this is inconsistent with the degree-centrality attack and the closed-form gain in Theorem 2 would not be the actual maximal gain. That is a correctness/rigor concern, not a circular reduction. The only self-citation that is at all load-bearing is the deferral "Formal proofs of theorems are in [1]" (end of Section I), an omitted proof in the authors' own technical report; this means the maximality claim is not fully discharged in the manuscript, but it does not make the derivation equivalent to its inputs. The calibration estimator in Section VI is also imported from LF-GDPR [62], a published prior framework co-authored by two of the current authors, but the attack is evaluated against that framework rather than defining it. Score 2 reflects these minor self-citation/omitted-proof issues rather than any fitted-input or definitional circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The attack construction relies on the attacker's ability to inject fake users and on the server using reported adjacency bit vectors in the reconstructed graph. No free parameters are fitted to the attack outcome; the countermeasure thresholds are hand-set. No new conceptual entities are introduced.

free parameters (2)
  • Frequent-itemset detection threshold = 50 to 300
    Chosen by hand for countermeasure evaluation; controls how many nodes are flagged as fake, and results in a U-shaped gain curve (Section VIII-D, Exp 7).
  • Degree-based detection threshold = maximum estimated degree plus 3 sigma of Laplace
    Hand-set threshold for the degree consistency countermeasure; not derived from data or theory (Section VII-B).
assumptions (3)
  • domain assumption The attacker controls m fake users and can send arbitrary adjacency bit vectors and degrees, bypassing the local perturbation mechanism.
    Threat model in Section IV-A; standard for poisoning attacks but not enforced by the protocol.
  • ad hoc to paper The server reconstructs graph metrics from reported bit vectors such that edges reported by fake users are counted toward target degree and triangle counts, while the target's own reported degree is treated as unchanged.
    Needed for the degree-centrality gain and for the 'degree remains constant' step in the clustering coefficient derivation (Section VI, Eqs. 18-20); the paper never specifies the aggregation rule.
  • domain assumption LF-GDPR's triangle correction formulas (Eq. 16 and surrounding cases) are correct and applicable to the attack setting.
    The clustering coefficient attack is built on the LF-GDPR estimator [62] and adopts its calibration function R without re-deriving it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Data Poisoning Attacks to Local Differential Privacy Protocols for Graphs." pith.science (2026). https://pith.science/paper/KCIC4VBF

@misc{pith2026241219837,
  author       = {Pith},
  title        = {Pith review of: Data Poisoning Attacks to Local Differential Privacy Protocols for Graphs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KCIC4VBF}},
  note         = {Machine review of arXiv:2412.19837}
}
read the original abstract

Graph analysis has become increasingly popular with the prevalence of big data and machine learning. Traditional graph data analysis methods often assume the existence of a trusted third party to collect and store the graph data, which does not align with real-world situations. To address this, some research has proposed utilizing Local Differential Privacy (LDP) to collect graph data or graph metrics (e.g., clustering coefficient). This line of research focuses on collecting two atomic graph metrics (the adjacency bit vectors and node degrees) from each node locally under LDP to synthesize an entire graph or generate graph metrics. However, they have not considered the security issues of LDP for graphs. In this paper, we bridge the gap by demonstrating that an attacker can inject fake users into LDP protocols for graphs and design data poisoning attacks to degrade the quality of graph metrics. In particular, we present three data poisoning attacks to LDP protocols for graphs. As a proof of concept, we focus on data poisoning attacks on two classical graph metrics: degree centrality and clustering coefficient. We further design two countermeasures for these data poisoning attacks. Experimental study on real-world datasets demonstrates that our attacks can largely degrade the quality of collected graph metrics, and the proposed countermeasures cannot effectively offset the effect, which calls for the development of new defenses.

Figures

Figures reproduced from arXiv: 2412.19837 by the authors.

Figure 1
Figure 1. Data poisoning attack. Adjacency bit vector Degree Genuine users Crafted adjacency bit vector Crafted degree Graph Metric Estimation Fake users Send to central server [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Genuine users report perturbed adjacency bit vectors [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. (a) Original graph; (b)−(d) Example of attacking degree centrality using (b) RVA; (c) RNA; and (d) MGA. connects each fake node to one random target node and then applies LDP perturbation to all connections. • Maximal Gain Attack (MGA). This is an optimization￾based attack strategy. The attacker crafts the value for each fake user to maximize the overall gain Gain by solving the optimization problem. Note that RVA (… view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Number of triangles incident to node i. where ccA,i and ccB,i represent the clustering coefficients after and before the attack, respectively. The optimization objective is to maximize the change for each target node: maxX t∈T ∆cct (14) For the perturbed graph, we can …
Figure 5
Figure 5. Figure 5: Connections between fake nodes and target nodes. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Overall gains of attacks to degree centrality. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Impact of β on attacks to degree centrality. (a) Facebook (b) Enron (c) AstroPh (d) Gplus [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Impact of γ on attacks to degree centrality. Exp 3. Effect of γ on Degree Centrality. We evaluate the impact of varying the proportion of target nodes on the effec￾tiveness of different attack strategies (RVA, RNA, and MGA) for degree centrality estimation. The results…
Figure 12
Figure 12. Figure 12: Countermeasures against attacks to degree centrality. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 10
Figure 10. Figure 10: Impact of β on the effectiveness of attacks to clustering coefficient. (a) Facebook (b) Enron (c) AstroPh (d) Gplus [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Impact of γ on the effectiveness of attacks to clustering coefficient. manipulation of the graph structure and, consequently, the estimated clustering coefficients. Observe that when β reaches a certain threshold (around 0.05-0.1 depending on the dataset), MGA’s perfo…
Figure 13
Figure 13. Figure 13: Countermeasures against attacks to clustering coeffi [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 15
Figure 15. Figure 15: Evaluation of attacks on LF-GDPR and LDPGen for [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?

    cs.LG 2025-05 conditional novelty 5.0 of 10

    LoRA fine-tuning is more robust than full fine-tuning against backdoor attacks but more vulnerable to untargeted label-flipping poisoning, based on BERT/GLUE experiments and NTK-information-geometry analysis.

Reference graph

Works this paper leans on

68 extracted references · 67 canonical work pages · cited by 1 Pith paper

  1. [65]

    Data poisoning attacks to local differential privacy protocols,

    X. Cao, J. Jia, and N. Z. Gong, “Data poisoning attacks to local differential privacy protocols,” in Proc. USENIX Secur. Conf., 2021, pp. 947-964

    work page 2021

  2. [1]

    Available: https://github.com/hahahumble/ DPA2Graphs/blob/main/TechnicalReport.pdf

    Technical Report [Online]. Available: https://github.com/hahahumble/ DPA2Graphs/blob/main/TechnicalReport.pdf

    work page

  3. [2]

    Facebook Scandal a ‘Game Changer’ in Data Privacy Regulation,

    B. Stephanie, “Facebook Scandal a ‘Game Changer’ in Data Privacy Regulation,” Bloomberg, Apr. 8, 2018. [Online]. Available: https://www.bloomberg.com/news/articles/2018-04-07/ facebookscandal-a-game-changer-in-dataprivacy-regulation

    work page 2018

  4. [3]

    [Online]

    Facebook, 2020. [Online]. Available: https://developers.facebook.com/ docs/graph-api/

    work page 2020

  5. [4]

    Preserving privacy in social networks against neighborhood attacks,

    B. Zhou and J. Pei, “Preserving privacy in social networks against neighborhood attacks,” in Proc. IEEE 24th Int. Conf. Data Eng. , 2008, pp. 506–515

    work page 2008

  6. [5]

    Towards identity anonymization on graphs,

    K. Liu and E. Terzi, “Towards identity anonymization on graphs,” in Proc. ACM SIGMOD Int. Conf. Manage. Data , 2008, pp. 93–106

    work page 2008

  7. [6]

    Nissim, S

    K. Nissim, S. Raskhodnikova, and A. Smith, ”Smooth sensitivity and sampling in private data analysis,” in Proc. 39th Annu. ACM Symp. Theory Comput., 2007, pp. 75–84

    work page 2007

  8. [7]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Proc. Theory Cryptogr. Conf., 2006, pp. 265–284

    work page 2006

Show all 68 references
  1. [8]

    Calibrate: Frequency estimation and heavy hitter identification with local differential privacy via incorporating prior knowledge,

    J. Jia and N. Z. Gong, “Calibrate: Frequency estimation and heavy hitter identification with local differential privacy via incorporating prior knowledge,” in Proc. IEEE Conf. Comput. Commun. (INFOCOM), 2019, pp. 2008–2016

    2019

  2. [9]

    Marginal release under local differential privacy,

    G. Cormode, T. Kulkarni, and D. Srivastava, “Marginal release under local differential privacy,” in Proc. ACM SIGMOD Int. Conf. Manage. Data, 2018, pp. 131–146

    2018

  3. [10]

    BLENDER: Enabling local search with a hybrid differential privacy model,

    B. Avent, A. Korolova, D. Zeber, T. Hovden, and B. Livshits, “BLENDER: Enabling local search with a hybrid differential privacy model,” in Proc. 26th USENIX Secur. Symp. , 2017, pp. 747–764

    2017

  4. [11]

    Local privacy and statistical minimax rates,

    J. C. Duchi, M. I. Jordan, and M. J. Wainwright, “Local privacy and statistical minimax rates,” in Proc. IEEE 54th Annu. Symp. Found. Comput. Sci., 2013, pp. 429–438

    2013

  5. [12]

    Heavy hitter estimation over set-valued data with local differential privacy,

    Z. Qin, Y . Yang, T. Yu, I. Khalil, X. Xiao, and K. Ren, “Heavy hitter estimation over set-valued data with local differential privacy,” in Proc. ACM Asia Conf. Comput. Commun. Secur. (ASIACCS) , 2016, pp. 192- 203

    2016

  6. [13]

    Generating synthetic decentralized social graphs with local differential privacy,

    Z. Qin, T. Yu, Y . Yang, I. Khalil, X. Xiao, and K. Ren, “Generating synthetic decentralized social graphs with local differential privacy,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., 2017, pp. 425–438

    2017

  7. [14]

    Practical locally private heavy hitters,

    R. Bassily, K. Nissim, U. Stemmer, and A. G. Thakurta, “Practical locally private heavy hitters,” in Proc. Int. Conf. Neural Inf. Process. Syst., 2017, pp. 2285–2293

    2017

  8. [15]

    Local, private, efficient protocols for succinct histograms,

    R. Bassily and A. Smith, “Local, private, efficient protocols for succinct histograms,” in Proc. Conf. Symp. Theory Comput. , 2015, pp. 127–135

    2015

  9. [16]

    RAPPOR: Randomized aggregatable privacy-preserving ordinal response,

    ´U. Erlingsson, V . Pihur, and A. Korolova, “RAPPOR: Randomized aggregatable privacy-preserving ordinal response,” in Proc. ACM Asia Conf. Comput. Commun. Secur. , 2014, pp. 1054–1067

    2014

  10. [17]

    Extremal mechanisms for local differential privacy,

    P. Kairouz, S. Oh, and P. Viswanath, “Extremal mechanisms for local differential privacy,” in Proc. Int. Conf. Neural Inf. Process. Syst. , 2014, pp. 2879–2887

    2014

  11. [18]

    Discrete distribution estima- tion under local privacy,

    P. Kairouz, K. Bonawitz, and D. Ramage, “Discrete distribution estima- tion under local privacy,” in Proc. 33rd Int. Conf. Mach. Learn. (ICML), 2016, pp. 2436–2444

    2016

  12. [19]

    Locally differentially private protocols for frequency estimation,

    T. Wang, J. Blocki, N. Li, and S. Jha, “Locally differentially private protocols for frequency estimation,” inProc. USENIX Secur. Conf., 2017, pp. 729–745

    2017

  13. [20]

    LoPub: High-dimensional crowdsourced data publication with local differential privacy,

    X. Ren et al., “LoPub: High-dimensional crowdsourced data publication with local differential privacy,” IEEE Trans. Inf. Forensics Secur. , Sep. 2018, vol. 13, no. 9, pp. 2151–2166

    2018

  14. [21]

    Locally differentially private frequent itemset mining,

    T. Wang, N. Li, and S. Jha, “Locally differentially private frequent itemset mining,” in Proc. IEEE Eur. Symp. Secur. Privacy (EuroS&P) , 2018, pp. 127–143

    2018

  15. [22]

    Answering multi-dimensional analytical queries under local differential privacy,

    T. Wang et al., “Answering multi-dimensional analytical queries under local differential privacy,”’ in Proc. ACM SIGMOD Int. Conf. Manage. Data, 2019, pp. 159–176

    2019

  16. [23]

    Locally differentially private frequency estimation with consistency,

    T. Wang, M. Lopuha ¨o-Zwakenberg, Z. Li, B. Skoric, and N. Li, “Locally differentially private frequency estimation with consistency,” in Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS) , 2020, pp. 1–16

    2020

  17. [24]

    Locally differentially private heavy hitter identification,

    T. Wang, N. Li, and S. Jha, “Locally differentially private heavy hitter identification,” IEEE Trans. Dependable Secure Comput., vol. 18, no. 2, pp. 982–993, Mar./Apr. 2021

    2021

  18. [25]

    PrivKVM ∗: Revisiting key-value statistics estimation with local differential privacy,

    Q. Ye et al., “PrivKVM ∗: Revisiting key-value statistics estimation with local differential privacy,”IEEE Trans. Dependable Secure Comput., vol. 20, no. 1, pp. 17–35, Jan./Feb. 2022

    2022

  19. [26]

    CALM: Consistent adaptive local marginal for marginal release under local differential privacy,

    Z. Zhang, T. Wang, N. Li, S. He, and J. Chen, “CALM: Consistent adaptive local marginal for marginal release under local differential privacy,” inProc. ACM Asia Conf. Comput. Commun. Secur. (ASIACCS), 2018, pp. 212–229

    2018

  20. [27]

    PrivKV: Key-value data collection with local differential privacy,

    Q. Ye, H. Hu, X. Meng, and H. Zheng, “PrivKV: Key-value data collection with local differential privacy,” in Proc. IEEE Eur. Symp. Secur. Privacy (EuroS&P), 2019, pp. 317–331

    2019

  21. [28]

    Beyond value perturbation: Local differential privacy in the temporal setting,

    Q. Ye, H. Hu, N. Li, X. Meng, H. Zheng, and H. Yan, “Beyond value perturbation: Local differential privacy in the temporal setting,” in Proc. IEEE Conf. Comput. Commun. (INFOCOM) , 2021, pp. 1–10

    2021

  22. [29]

    LDP-IDS: Local differential privacy for infinite data streams,

    X. Ren et al., “LDP-IDS: Local differential privacy for infinite data streams,” in Proc. ACM SIGMOD Int. Conf. Manage. Data , 2022, pp. 1064-1077

    2022

  23. [30]

    L-SRR: Local differential privacy for location-based services with staircase randomized response,

    H. Wang et al., “L-SRR: Local differential privacy for location-based services with staircase randomized response,” in Proc. ACM Asia Conf. Comput. Commun. Secur. (ASIACCS) , 2022, pp. 2809-2823

    2022

  24. [31]

    Locally differentially private sparse vector aggregation,

    M. Zhou et al., “Locally differentially private sparse vector aggregation,” in Proc. IEEE Eur. Symp. Secur. Privacy (EuroS&P), 2022, pp. 422–439

    2022

  25. [32]

    Trajectory data collection with local differential privacy,

    Y . Zhang et al., “Trajectory data collection with local differential privacy,” in Proc. VLDB Endow., Jul. 2023

    2023

  26. [33]

    LDPTrace: Locally differentially private trajectory syn- thesis,

    Y . Du et al., “LDPTrace: Locally differentially private trajectory syn- thesis,” arXiv preprint arXiv:2302.06180 , Feb. 2023

    2023 arXiv

  27. [34]

    Local differentially private heavy hitter detection in data streams with bounded memory,

    X. Li et al., “Local differentially private heavy hitter detection in data streams with bounded memory,” arXiv preprint arXiv:2311.16062, Nov. 2023

    2023 arXiv

  28. [35]

    PrivShape: Extracting shapes in time series under user-level local differential privacy,

    Y . Mao, Q. Ye, H. Hu, Q. Wang, and K. Huang, “PrivShape: Extracting shapes in time series under user-level local differential privacy,” in Proc. IEEE Int. Conf. Data Eng. (ICDE) , 2024

    2024

  29. [36]

    Collaborative sampling for partial multi-dimensional value collection under local differential privacy,

    Q. Qian, Q. Ye, H. Hu, K. Huang, T. T. L. Chan, and J. Li, “Collaborative sampling for partial multi-dimensional value collection under local differential privacy,” IEEE Trans. Inf. Forensics Secur. , pp. 3948-3961, 2023

    2023

  30. [37]

    Stateful switch: Optimized time series release with local differential privacy,

    Q. Ye, H. Hu, K. Huang, M. H. Au, and Q. Xue, “Stateful switch: Optimized time series release with local differential privacy,” in Proc. IEEE Conf. Comput. Commun. (INFOCOM) , 2023, pp. 1-10

    2023

  31. [38]

    Local model poisoning attacks to byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” in Proc. USENIX Secur. Symp., 2020

    2020

  32. [39]

    Influence function based data poisoning attacks to top-n recommender systems,

    M. Fang, N. Z. Gong, and J. Liu, “Influence function based data poisoning attacks to top-n recommender systems,” in Proc. Int. World Wide Web Conf. (WWW) , 2020

    2020

  33. [40]

    Adversarial machine learning,

    L. Huang, A. D. Joseph, B. Nelson, B. I. P. Rubinstein, and J. D. Tygar, “Adversarial machine learning,” in Proc. ACM Workshop Artif. Intell. Secur. (AISec), 2011

    2011

  34. [41]

    Intrinsic certified robustness of bagging against data poisoning attacks,

    J. Jia, X. Cao, and N. Z. Gong, “Intrinsic certified robustness of bagging against data poisoning attacks,” in Proc. AAAI Conf. Artif. Intell. , 2021

    2021

  35. [42]

    Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,

    M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” in Proc. IEEE Symp. Secur. Privacy (SP), 2018, pp. 19-35

    2018

  36. [43]

    Systematic poisoning attacks on and defenses for machine learning in healthcare,

    M. Mozaffari-Kermani, S. Sur-Kolay, A. Raghunathan, and N. K. Jha, “Systematic poisoning attacks on and defenses for machine learning in healthcare,” IEEE J. Biomed. Health Inform. , vol. 19, no. 6, pp. 1893- 1905, Nov. 2015

    1905

  37. [44]

    LDPGuard: Defenses against data poisoning attacks to local differential privacy protocols,

    K. Huang, G. Ouyang, Q. Ye, et al., “LDPGuard: Defenses against data poisoning attacks to local differential privacy protocols,” IEEE Trans. Knowl. Data Eng. , vol. 36, no. 7, pp. 3195-3209, July. 2024

    2024

  38. [45]

    Anonymizing weighted social network graphs,

    S. Das, ¨O. E ˘gecio˘glu, and A. El Abbadi, “Anonymizing weighted social network graphs,” in Proc. IEEE Int. Conf. Data Eng. (ICDE) , 2010

    2010

  39. [46]

    Neighborhood- privacy protected shortest distance computing in cloud,

    J. Gao, J. X. Yu, R. Jin, J. Zhou, T. Wang, and D. Yang, “Neighborhood- privacy protected shortest distance computing in cloud,” in Proc. ACM SIGMOD Int. Conf. Manag. Data , 2011

    2011

  40. [47]

    Privacy-preserving query over encrypted graph- structured data in cloud computing,

    N. Cao, Z. Yang, et al., “Privacy-preserving query over encrypted graph- structured data in cloud computing,” in Proc. IEEE Int. Conf. Distrib. Comput. Syst. (ICDCS) , 2011

    2011

  41. [48]

    Privacy and efficiency guaranteed social subgraph matching,

    K. Huang, H. Hu, S. Zhou, et al., “Privacy and efficiency guaranteed social subgraph matching,” VLDB J., 2022

    2022

  42. [49]

    FRESH: Towards Efficient Graph Queries in an Outsourced Graph,

    K. Huang, Y . Li, Q. Ye, Y . Tian, X. Zhao, Y . Cui, H. Hu, and X. Zhou, “FRESH: Towards Efficient Graph Queries in an Outsourced Graph,” in Proc. IEEE Int. Conf. Data Eng. (ICDE) , 2024

    2024

  43. [50]

    Protecting respondents identities in microdata release,

    P. Samarati, “Protecting respondents identities in microdata release,” IEEE Trans. Knowl. Data Eng., vol. 13, no. 6, pp. 1010-1027, Nov./Dec. 2001

    2001

  44. [51]

    K-automorphism: A general framework for privacy preserving network publication,

    L. Zou, L. Chen, and M. T. ¨Ozsu, “K-automorphism: A general framework for privacy preserving network publication,” Proc. VLDB Endowment, vol. 2, no. 1, pp. 946-957, 2009

    2009

  45. [52]

    De-anonymizing social networks,

    A. Narayanan and V . Shmatikov, “De-anonymizing social networks,” in Proc. IEEE Symp. Secur. Privacy (SP) , 2009, pp. 173-187

    2009

  46. [53]

    L-opacity: Linkage- aware graph anonymization,

    S. Nobari, P. Karras, H. Pang, and S. Bressan, “L-opacity: Linkage- aware graph anonymization,” in Proc. Int. Conf. Extending Database Technol. (EDBT), 2014, pp. 583-594

    2014

  47. [54]

    Sharing graphs using differentially private graph models,

    A. Sala, X. Zhao, C. Wilson, H. Zheng, and B. Y . Zhao, “Sharing graphs using differentially private graph models,” in Proc. ACM SIGCOMM Conf. Internet Meas. Conf. (IMC) , 2011, pp. 81-98

    2011

  48. [55]

    A differentially private estimator for the stochastic kronecker graph model,

    D. Mir and R. N. Wright, “A differentially private estimator for the stochastic kronecker graph model,” in Proc. Joint EDBT/ICDT Work- shops, 2012, pp. 167-176

    2012

  49. [56]

    Exponential random graph estimation under differential privacy,

    W. Lu and G. Miklau, “Exponential random graph estimation under differential privacy,” in Proc. 20th ACM SIGKDD Int. Conf. Knowl. Discov. Data Mining (KDD) , 2014, pp. 921-930

    2014

  50. [57]

    Private analysis of graph structure,

    V . Karwa, S. Raskhodnikova, A. Smith, and G. Yaroslavtsev, “Private analysis of graph structure,” Proc. VLDB Endowment, vol. 4, no. 11, pp. 1146-1157, 2011

    2011

  51. [58]

    Analyzing subgraph statistics from extended local views with decentralized differential privacy,

    H. Sun et al., “Analyzing subgraph statistics from extended local views with decentralized differential privacy,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS) , 2019, pp. 703-717

    2019

  52. [59]

    Analyzing graphs with node differential privacy,

    S. P. Kasiviswanathan, K. Nissim, S. Raskhodnikova, and A. Smith, “Analyzing graphs with node differential privacy,” in Proc. Theory Cryptogr. Conf. (TCC), 2013, pp. 457-476

    2013

  53. [60]

    Accurate estimation of the degree distribution of private networks,

    M. Hay, C. Li, G. Miklau, and D. Jensen, “Accurate estimation of the degree distribution of private networks,” in Proc. 9th IEEE Int. Conf. Data Mining (ICDM) , 2009, pp. 169-178

    2009

  54. [61]

    On learning cluster coefficient of private networks,

    Y . Wang, X. Wu, J. Zhu, and Y . Xiang, “On learning cluster coefficient of private networks,” Soc. Netw. Anal. Mining, vol. 3, no. 4, pp. 925-938, 2013

    2013

  55. [62]

    LF-GDPR: A framework for estimating graph metrics with local differential privacy,

    Q. Ye, H. Hu, M. H. Au, X. Meng, and X. Xiao, “LF-GDPR: A framework for estimating graph metrics with local differential privacy,” in IEEE Trans. Knowl. Data Eng. , vol. 34, no. 10, pp. 4905-4920, Oct. 2020

    2020

  56. [63]

    Top-k Discovery under Local Differential Privacy: An Adaptive Sampling Approach,

    R. Du, Q. Ye, Y . Fu, et al. “Top-k Discovery under Local Differential Privacy: An Adaptive Sampling Approach,” in IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  57. [64]

    LDP-Purifier: Defending against Poisoning Attacks in Local Differential Privacy,

    L. Wang, Q. Ye, H. Hu, X. Meng, K. Huang, “LDP-Purifier: Defending against Poisoning Attacks in Local Differential Privacy,” in Interna- tional Conference on Database Systems for Advanced Applications , 2024

    2024

  58. [66]

    Manipulation attacks in local differential privacy,

    A. Cheu, A. Smith, and J. Ullman, “Manipulation attacks in local differential privacy,” in Proc. IEEE Eur. Symp. Secur. Privacy , 2021, pp. 883–900

    2021

  59. [67]

    Fast algorithms for mining association rules,

    R. Agrawal and R. Srikant, “Fast algorithms for mining association rules,” in Proc. 20th Int. Conf. Very Large Data Bases (VLDB) , 1994, pp. 487–499

    1994

  60. [68]

    Continuous release of data streams under both centralized and local differential privacy

    T. Wang, J. Q. Chen, Z. Zhang, et al. “Continuous release of data streams under both centralized and local differential privacy” inProc. of the 2021 ACM CCS, 2021, pp. 1237-1253

    2021

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.