Local Node Differential Privacy

2026-02-17

AI Summary

This work proposes a Local Node Differential Privacy (LNDP) model to enable secure release of structural statistics from graph data in untrusted server environments. It establishes the first local privacy framework tailored for graph-structured data, wherein each node locally randomizes its adjacency list before sending perturbed information to an untrusted aggregator, which then answers linear queries such as degree distribution. The study reveals fundamental differences between LNDP and conventional local differential privacy models, and introduces a novel lower-bound proof technique combined with a fuzzy approximation of degree distributions to rigorously analyze privacy under overlapping inputs. The proposed algorithm achieves optimal accuracy over multiple rounds of interaction, matching the error lower bounds and attaining accuracy comparable to that of centralized node differential privacy for several fundamental graph statistics.

Technology Category

• Machine Learning: Privacy
• Reasoning under Uncertainty: Graphical Models
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

We initiate an investigation of node differential privacy for graphs in the local model of private data analysis. In our model, dubbed LNDP, each node sees its own edge list and releases the output of a local randomizer on this input. These outputs are aggregated by an untrusted server to obtain a final output. We develop a novel algorithmic framework for this setting that allows us to accurately answer arbitrary linear queries on a blurry approximation of the input graph's degree distribution. For some natural problems, the resulting algorithms match the accuracy achievable with node privacy in the central model, where data are held and processed by a trusted server. We also prove lower bounds on the error required by LNDP that imply the optimality of our algorithms for several fundamental graph statistics. We then lift these lower bounds to the interactive LNDP setting, demonstrating the optimality of our algorithms even when constantly many rounds of interaction are permitted. Obtaining our lower bounds requires new approaches, since those developed for the usual local model do not apply to the inherently overlapping inputs that arise from graphs. Finally, we prove structural results that reveal qualitative differences between local node privacy and the standard local model for tabular data.

Problem

• Local Node Differential Privacy
• Graph Privacy
• Local Model
• Differential Privacy
• Degree Distribution

Innovation

• Local Node Differential Privacy
• Graph Privacy
• Degree Distribution
• Local Differential Privacy
• Optimality Lower Bounds