Rethinking $(k,\ell)$-anonymity in social graphs: $(k,\ell)$-adjacency anonymity and $(k,\ell)$-(adjacency) anonymous transformations

This paper treats the privacy-preserving publication of social graphs in the presence of active adversaries, that is, adversaries with the ability to introduce sybil nodes in the graph prior to publication and leverage them to create unique fingerprints for a set of victim nodes and re-identify them after publication. Stemming from the notion of (k, l)-anonymity, we introduce (k, l)-anonymous transformations, characterising graph perturbation methods that ensure protection from active adversaries levaraging up to l sybil nodes. Additionally, we introduce a new privacy property: (k, l)-adjacency anonymity, which relaxes the assumption made by (k, l)-anonymity that adversaries can control all distances between sybil nodes and the rest of the nodes in the graph. The new privacy property is in turn the basis for a new type of graph perturbation: (k, l)-adjacency anonymous transformations. We propose algorithms for obtaining (k, 1)-adjacency anonymous transformations for arbitrary values of k, as well as (2, l)-adjacency anonymous transformations for small values of l.