Privacy protection against user profiling through optimal data generalization

Contents lists available at ScienceDirect Computers & Security journal homepage: www.elsevier.com/locate/cose Full length article Privacy protection against user profiling through optimal data generalization César Gil, Javier Parra-Arnau∗, Jordi Forné Department of Telematics Engineering, Universitat Politècnica de Catalunya, Barcelona, Spain ARTICLE INFO Keywords: Data privacy User profiling Personalized information systems Data generalization Data-perturbative mechanisms ABSTRACT Personalized information systems are information-filtering systems that endeavor to tailor informationexchange functionality to the specific interests of their users. The ability of these systems to profile users based on their search queries at Google, disclosed locations at Twitter or rated movies at Netflix, is on the one hand what enables such intelligent functionality, but on the other, the source of serious privacy concerns. Leveraging on the principle of data minimization, we propose a data-generalization mechanism that aims to protect users’ privacy against non-fully trusted personalized information systems. In our approach, a user may like to disclose personal data to such systems when they feel comfortable. But when they do not, they may wish to replace specific and sensitive data with more general and thus less sensitive data, before sharing this information with the personalized system in question. Generalization therefore may protect user privacy to a certain extent, but clearly at the cost of some information loss. In this work, we model mathematically an optimized version of this mechanism and investigate theoretically some key properties of the privacy-utility trade-off posed by this mechanism. Experimental results on two real-world datasets demonstrate how our approach may contribute to privacy protection and show it can outperform state-of-the-art perturbation techniques like data forgery and suppression by providing higher utility for a same privacy level. On a practical level, the implications of our work are diverse in the field of personalized online services. We emphasize that our mechanism allows each user individually to take charge of their own privacy, without the need to go to third parties or share resources with other users. And on the other hand, it provides privacy designers/engineers with a new dataperturbative mechanism with which to evaluate their systems in the presence of data that is likely to be generalizable according to a certain hierarchy, highlighting spatial generalization, with practical application in popular location based services. Overall, a data-perturbation mechanism for privacy protection against user profiling, which is optimal, deterministic, and local, based on a untrusted model towards third parties. 1. Introduction An estimated 4.1 billion people used the Internet in 2019 and, today, almost the entire world population stays connected to a mobile phone network (Union,2020). The digital universe is also estimated to reach a capacity of 44 zettabytes (1 ZB = 1021 bytes) this year. Phenomena such as information overload,datafication or overlapped real and digital lives accompany the fascinating and at the same time dizzying development of the Internet. New high impact technologies as the Big Data, IoT, 5G or Blockchain share scene with pressing global problems as the climate change, employment or recent pandemic. At the same time, Schwab (2015) highlighted in 2015 the future of the Internet as one of the ten most relevant issues facing the world. And from the social point of view, one of the most relevant challenges of this new industry are privacy concerns. In this sense, Schwab predicted that debates about fundamental issues such as the impact on our inner lives of the loss of control over our data will only intensify in the years ahead. ∗Corresponding author. E-mail addresses: [email protected] (C. Gil), [email protected] (J. Parra-Arnau), [email protected] (J. Forné). 1We shall interchangeably use the terms utility and personalization. In this context, personalized information systems (PISs) are a clear example of the rise of the Internet and its risks to user privacy. Amazon, YouTube or Netflix are exponents of these systems, which have radically changed the way of accessing information with a high impact on our economy. PISs typically collect personal, behavioral data of their users over time to profile them and thus infer their interests or preferences and classify them. It is in this profiling process (defined by U.S. NIST Boeckl et al.,2019 as an operation or set of operations performed upon personally identifiable information (PII) that can include, but is not limited to, the collection, retention, logging, generation, transformation, use, disclosure, transfer, and disposal of PII) where user privacy is compromised. However, because profiling is in fact what enables personalization, users of those systems are faced with a dilemma of great practical relevance: how to balance the trade-off between and privacy and personalization.1 https://doi.org/10.1016/j.cose.2024.104178 Received 17 October 2022; Received in revised form 22 May 2024; Accepted 22 October 2024 Computers & Security 148 (2025) 104178 Available online 5 November 2024 0167-4048/© 2024 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ ). C. Gil et al. In the context of PISs, balancing this trade-off has been scarcely studied for local profile protection (Kaaniche et al.,2020), that is, when the protection mechanism is put in place on the user side and the aim is countering the profiling carried out by those systems. This type of local protection is conventionally referred to as hard privacy, which, unlike soft privacy (Danezis,2007;Deng et al.,2011), assumes users need not trust the service provider nor even the network operator, and hence, because they just trust themselves, it is their own responsibility to protect their privacy. Undoubtedly, hard privacy is aligned with the principle of data minimization, by which one would minimize the amount of data they would share with an information system without significantly degrading the expected functionality. However, the literature of local mechanisms for profile protection can be classified essentially into two data-perturbation approaches: forgery, i.e., submitting false data; suppression, i.e., refraining from disclosing real, true data; and a combination of the two. In this work, we propose a novel category of data perturbation for profile-privacy enhancement, data generalization, which consists in replacing specific and sensitive data (e.g., a search query on AIDS treatment or a location at a hospital) with more general and thus less sensitive data, before sending them to the service provider in question. We hasten to stress, however, that the idea of data generalization is by no means new. As a matter of fact, generalization is an old acquaintance of the field of statistical disclosure control (SDC) (Hundepool et al.,2003). In SDC, generalization as well as forgery and suppression are applied to records of a database with the same aforementioned principle. Nonetheless, unlike SDC, our work investigates the application of generalization to protect adifferent data structure, namely, a user profile, which, like Xu et al. (2007a), Toubiana et al. (2010a,b), Fredrikson and Livshits (2011), Rebollo-Monedero and Forné (2010), Parra-Arnau et al. (2010,2011,2012b,a,2014c,b), Rodriguez-Carrion et al. (2015), Estrada-Jimenez et al. (2019), Parra-Arnau (2017,2018) and ParraArnau et al. (2014a), we assume it is modeled mathematically as a probability mass function (PMF). 1.1. Contribution and plan of this paper In this paper, we investigate data generalization as a hard-privacy mechanism that aims to protect PMF-based profiles against non-fully trusted PISs. Our mechanism assumes users are willing to generalize certain pieces of personal information while interacting with a PISs, in order to avoid being accurately profiled by this or, in general, by any privacy attacker capable of collecting such information. Following this simple principle, our approach may protect user privacy to a certain degree, without having to trust the system provider nor the network operator, but at the cost a loss in utility, a degradation of the quality of the personalized service. Our first contribution is an architecture that implements this idea for a specific PISs, resource tagging, although it can be straightforwardly applied to any personalized service provider. The theoretical analysis of the trade-off between privacy and utility is our second contribution. We tackle this analysis in a systematic fashion, drawing upon the methodology of multiobjective optimization. We adopt a quantifiable measure of user privacy — the Shannon’s entropy of the probability distribution of the user’s data —, and formulate an optimization problem modeling the trade-off between privacy on the one hand, and on the other generalization rate as utility metric. Our theoretical analysis finds a closed-form expression of the critical generalization rate, i.e., the rate beyond which maximum privacy is attained. Our approach is then experimentally evaluated in a real-world application. Namely, we apply optimal data generalization to Foursquare and Brigthkite, two popular datasets from location-based social networks (LBSNs), and show, in a series of experiments, how our approach enables its users to enhance their privacy. Section 2explores some relevant approaches related to privacy and data-perturbative mechanisms in PISs. Section 3describes our privacy-enhancing mechanism, some considerations about the user profile model and the adversary capabilities, and ultimately a formulation of the trade-off between privacy and generalization. Section 4presents in detail a possible practical implementation of our generalization mechanism, including some assumptions of our approach on a user profile. Section 5presents a theoretical analysis of the optimization problem characterizing the privacy-generalization trade-off. In addition, this section shows a simples but insightful example that illustrates the formulation and theoretical analysis argued in the previous sections. Section 6presents an experimental evaluation of our technique in Foursquare and Brighkite datasets, including a discussion about it. Conclusions and future work are drawn in Section 7. 1.2. Practical implications and scope Research in privacy protection against user profiling encompasses a wide range of methods and application scenarios. Notable examples include dynamic optimization in online mobile advertising to prevent tracking via temporary application usage (Ullah and Binbusayyis,2022), adversarial approaches to counter profile tracking through mouse cursor movements (Leiva et al.,2021), and methods to safeguard data security through biometric sensors in user authentication (Hernández-Álvarez et al.,2020). Additionally, studies involve analyzing online behavioral models (Mamun et al.,2021) and exploring advanced defense mechanisms in social networks and the Internet of Things (IoT). These mechanisms address contemporary challenges such as protecting user locations, especially for minors, and combating cyberbullying (Shakil et al.,2021). For the generalization of data in the context of PISs, we propose two applications that could be of great impact, given the large number of potential users that they would involve. Firstly, we consider the urban mobility scenario, where users demand services in exchange for sharing their location and/or their assessments of the functioning of public services, for example. We include in this scenario applications from a health point of view with an eye on the recent COVID-19 epidemic, as far as mobility and privacy are concerned. And secondly, we also contemplate the context of aviation, where travelers can be profiled, for example, based on their navigation path over any of the world’s airports, or any other information of interest and usefulness to offer a personalized online service. We want to highlight that our experiments include generalization of spatial data, that is, on location coordinates (latitude and longitude), fundamental data on which the prolific field of location privacy and the popular location-based services are based. Finally, we would like to note that no less notable is the versatility of the scope of privacy-enhancing technologies (PETs) based on data perturbation, as is the case of the mechanism here proposed. We believe that our contributions can significantly aid in protecting privacy against user profiling from two perspectives. Firstly, they are designed for privacy designers/engineers, aiming to equip them with a new tool for evaluating their systems’ balance between user privacy and data utility for personalization. Secondly, these contributions empower users themselves. They enable users to protect their privacy independently, without relying on third parties or sharing resources with others. Additionally, they assist users in determining the optimal amount of data perturbation needed to minimize the impact on the quality of personalized services they receive. In general, we want to emphasize the local and deterministic nature of our proposal regarding the application scenario, assuming a untrusted model towards third parties, as well as the optimized solution we provide. 2. State of the art In the broad context of PISs, there are countless privacy-enhancing technologies (PETs) that allow the extraction and sharing of information while guaranteeing user privacy. According to Parra-Arnau et al. (2015), we can classify these technologies into five groups, namely, Computers & Security 148 (2025) 104178 2 C. Gil et al. (a) basic anti-tracking technologies, (b) TTP-based approaches, (c) collaborative mechanisms, (d) cryptography-based methods from private information retrieval (PIR) and (e) data-perturbation techniques. The mechanisms that we investigate belong to this last class. Focusing on this last group, data-perturbation techniques operate by obfuscating the information users explicitly or implicitly reveal when communicating with a PIS. They are a commonly used approach to prevent privacy attackers from attempting to accurately profile users. An illustrative example of this technique is sending false data, along with the user’s genuine data. It is important to note that PETs are characterized by the level of trust that users place in the entities with which they communicate, and that, specifically, data-perturbation techniques usually adopt the untrusted model, assuming that any third party is a potential privacy attacker. Or what is the same, the data perturbation occurs on the user side, although this is not an obstacle for them to be combined with other more collaborative mechanisms. If we take into account that personalization is the main objective of PISs and user profiling represents its main privacy risk, data perturbation poses a significant challenge: balancing the cost of functionality in the system and the utility of the data on the one hand, and on the other the privacy of users. In this section, we examine those works that aim to protect user profiles in PISs, and proceed depending on the type of perturbation technique applied: deterministic forgery, suppression, a combination of both, and random perturbation. We would like to emphasize, though, that all such techniques (together with the one proposed in this work based on generalization) can also be found in the field of SDC. However, the object of protection of the works analyzed in this section is a user profile, typically modeled as a PMF, whereas in SDC, those techniques aim to protect a whole database of records. 2.1. Forgery The idea behind query forgery is simply based on adding fake queries (or keywords) to the original ones. This approach allows users to obfuscate their profile, protecting them from precise profiling by privacy attackers, and avoiding the need to trust potentially harmful third parties. There are different alternatives based on the falsification of queries such as the system for private Web browsing called PRAW (Elovici et al.,2002a,b,2005,2006). This system protects the privacy of a group of users who access the Web through shared access. Assuming that users have logged in to a website and are therefore identified, while the attackers’ efforts focus on profiling the group, PRAW hides the users’ real profiles by generating false navigation traces in order to preserve their privacy. Inspired by the same methodology of false query injection, in Ye et al. (2009), the authors propose a generator of real and false queries based on complementary probabilities that are only available on the user side, and therefore assumed to be unknown to the adversary. A popular web browsing plugin that implements query forgery using different strategies is TrackMeNot (Howe and Nissenbaum,2009). An integrated keyword dictionary, which is fed with disparate sources of information, is the source used to generate the false queries that are forwarded to the server. Communication can be simulated in bursts, as if it were human web searches, or in time intervals. However, the vulnerability of TrackMeNot to certain attacks based on semantics or the time between false queries to distinguish them from the real one is argued in Chow and Golle (2009). Another proposal for profile obfuscation in software form is GooPir (Domingo-Ferrer et al.,2009). Its operation is based on mixing genuine query keywords with false keys that prove similar use (frequency). The result is sent in batches of keywords to the web search engine, so that attack attempts on the user’s query profiles are hindered at the precise moment. However, Balsa et al. (2012) presents a criticism of GooPir in the sense that its strategy does not prevent an attacker from being able to calculate correlations between keywords from different batches and finally infer the user’s real interest. Lastly, in any case it is essential to take into account the implicit handicap of adding false queries, which is clearly the traffic overload. This circumstance implies considering a trade-off between privacy and added traffic. Precisely, in Rebollo-Monedero and Forné (2010) the authors investigate theoretically this balance in the field of information retrieval with a mathematical model with the aim of optimizing the percentage of falsified queries and the privacy of users. 2.2. Suppression Suppression is the opposite alternative to introducing (false) activity into a user profile and is a perfectly viable perturbative technique. This is demonstrated by the authors in Parra-Arnau et al. (2010) on the scene of the semantic Web. The removal of labels, a process with associated costs in terms of resources, allows the user to improve their privacy although in a limited way, in compromise with the semantic degradation of the data. The Shannon entropy of the perturbed profile and the percentage of labels that the user is willing to delete are, respectively, the privacy and utility metrics on which the authors study their optimal balance through convex optimization in Parra-Arnau et al. (2012b). Along this line, Parra-Arnau et al. (2012a) presents an interesting application of label suppression in the context of resource recommendation and parental control. In this case, the impact of the perturbation is evaluated both in terms of costs associated with data degradation and in the precision of the assignment of one or another predefined parental control policies. 2.3. Combined forgery and suppression Combining forgery and suppression is a strategy used in the scenario of personalized recommender systems, such as Movielens.2In practical terms, coupling both techniques allows users to send false ratings and/or not rate elements that are of interest to them. In this subfield of PISs, the trade-off between privacy protection and utility of user profiles has been the subject of research in Parra-Arnau et al. (2011). More specifically, in Parra-Arnau et al. (2014c), the authors contribute a closed solution to the problem of optimal and simultaneous forgery and suppression of ratings, which they evaluate on the real-world Movielens dataset. 2.4. Local differential privacy for user-profile protection Differential privacy (DP) (Dwork,2006) was originally proposed as a privacy model in an interactive setting to protect the outcomes of queries to a database. In this setting, the assumption is that an anonymization mechanism sits between a user submitting queries and acentral, trusted database curator answering them. At a high level, DP promises that the participation of any single individual in a dataset will not noticeably alter the results of an analysis of the dataset. The DP guarantee holds even if an adversary is equipped with arbitrary auxiliary information about the participants in a dataset. Soon after its inception, the local mode of DP (Kasiviswanathan et al.,2011) was proposed with the attractive feature that data subjects need not trust the database curator. In this setting, data subjects have their local view of the dataset (typically, they only know their own data point) and each one independently obfuscates their data locally through an instance of a DP algorithm. Local DP (LDP), as it is known, provides stronger privacy guarantees compared to the central model but at a higher cost in terms of data utility. The particularities of LDP lead us to consider it suitable for our scenario of PISs, specifically in the context of data-perturbation techniques 2https://movielens.org/. Computers & Security 148 (2025) 104178 3 C. Gil et al. against user profiling. This is especially relevant as LDP complements the deterministic nature of our proposal and all approaches discussed in this section. While numerous proposals and applications of LDP have been extensively reported in Xiong et al. (2020), Wang et al. (2020) and Yang et al. (2023), even in the realm of PETs in PISs, which include major practical implementations by Google, Apple, and Microsoft (Kaaniche et al.,2020), and notable works that protect user trajectories (MirandaPascual et al.,2023) or locations (Wang et al.,2022) in the context of location-based services (LBS), there is a notable gap in the protection of user profiles based on probability mass functions (PMFs). It is worth noting that adding noise in differential privacy (and consequently in LDP) over the simplex unit can be a non-trivial task (Gohari et al., 2021). 3. Privacy protection via data generalization Based on the hard privacy assumptions (Deng et al.,2011), the optimal generalization is a privacy mechanism that is intended to prevent privacy attackers from profiling users on the basis of the data they share with the system. Conceptually, our approach protects user privacy to a certain extent, generalizing those data that make a user profile show a bias towards certain categories of interest. From a practical perspective, our profiling generalization technique is conceived to be deployed as a software application that runs on users’ local machines. The software implementation is then responsible, on the one hand, for warning the user when their privacy is being compromised and, on the other, for helping them decide which data should and should not be generalized. Consequently, our approach ensures user privacy to some extent without having to rely on an external entity, but at the cost of some local processing expenses and, more importantly, the information loss incurred by the generalization of data. In this section, we first propose a user-profile model, examine what the specialized literature understands by profiling, and then next describe our assumptions about the adversary capabilities. Afterwards, we justify a quantitative measure of the privacy of this profile. These considerations lead us to formulate the problem of choosing an optimal generalization strategy as a multi-objective optimization problem that takes into account both privacy and generalization rate. 3.1. User profile model In our scenario of PISs, we assume there is a computerized system that builds profiles from the activity data the system collects over a time period. However, in the construction of those profiles, users directly regulate their privacy and, therefore, the data they finally share with the system. For this reason, the user must make a decision: share some data without manipulating/altering them, or transmitting a perturbed and more general version of those data. Clearly, depending on the level of generalization applied for each collected data, the profile recorded in the server will resemble, to a greater or lesser extent, the genuine, accurate profile of an individual. In this work, we shall refer to these two profiles as the actual individual profile and the apparent individual profile, and denote them by 𝑞and 𝑡, respectively. Accordingly, define 𝑞as the probability mass function (PMF) of the authentic data of a particular individual, and 𝑝as a target distribution that is considered privacy insensitive. That is, if an individual’s distribution, built from his/her recorded data, was observed to be 𝑝by the service provider, then the individual would accept there is no privacy risk in the profiling of his/her activity. 3.2. Profiling Profiling is a method that identifies and characterizes individuals by constructing and applying profiles. In the technical literature on Table 1 According to the taxonomy provided in Anon (0000), privacy models can be classified into uncertainty-based and indistinguishability-based, among other types. In the former group, a myriad of information-theoretic quantities fall into (including Shannon’s entropy, the one utilized here), whereas in the former group, DP is the most prominent example. Furthermore, Shannon’s entropy and Kullback–Leibler divergence have been widely used to quantify the privacy of user profiles for individuation and classification adversaries (Xu et al.,2007a;Toubiana et al.,2010a,b;Fredrikson and Livshits,2011; Rebollo-Monedero and Forné,2010;Parra-Arnau et al.,2010,2011,2012b,a,2014c,b; Rodriguez-Carrion et al.,2015;Estrada-Jimenez et al.,2019;Parra-Arnau,2017,2018; Parra-Arnau et al.,2014a). Protection against Privacy metrics Data-perturbation techniques - Individuation - Classification Shannon’s entropy, Kullback–Leibler divergence - Forgery - Supression - Combination of both - Generalization (our proposal) - Other objectives (i.e. Indistinguishability) 𝜖-DP, 𝜖-LDP - (Local) Differential privacy profiling (Hildebrandt et al.,2005;Hildebrandt and Gutwirth,2008), the term identify has two distinct meanings: •It refers to uncovering the unique attributes of a person, known as individuation; •It also means categorizing a person as a member of a particular group. Thus, profiling involves distinguishing one individual from all others, as well as identifying an individual as part of a specific group. The dual application of profiles — either to differentiate an individual or to categorize them — leads to the concepts of individual and group profiling. In the context of information systems, individual profiling is commonly employed to tailor services to the unique interests and preferences of users, aiming to discover what sets a particular user apart from the broader user base. Conversely, technologies that use group profiling leverage the fact that a user’s profile may match with profiles derived from the data of many other individuals. This form of profiling applies profiles to people whose data did not contribute to the creation of those profiles. 3.3. Adversary model In this work, we consider a passive attacker that strives to individuate users, that is to say, the adversary wishes to target users who deviate from the average profile of interests. Our technique is built on the principle of generalization data. Under this principle, a user may wish to generalize some pieces of information to enable the resulting user profile 𝑡, as observed from the outside, to approach the uniform profile, (which we denote by 𝑢), thereby hiding a user’s particular bias towards certain categories of interest. Bearing in mind the attacker’s goal and the user-profile model described in Section 3.1, we discard the LDP model and resort to established privacy metrics based on divergence and the uncertainty of the observed profile compared to a reference profile (i.e., uniform, population-based, etc.) or group profile, such as Shannon entropy or Kullback–Leibler divergence. Table 1provides a classification (Anon, 0000) of privacy models and metrics depending on the attacker’s goal behind profiling. Last but not least, we also assume that the privacy attacker is unable to discern whether a particular user is adhered to the proposed privacy strategy, and therefore cannot estimate their generalization rate. 3.4. Generalization model We shall adopt the same notation for vectors used in Boyd et al. (2004). Specifically, we delimit vectors and matrices with square brackets, with the components separated by space, and use parentheses to construct column vectors from comma separated lists. Computers & Security 148 (2025) 104178 4 C. Gil et al. Fig. 1. Example of 1-level hierarchy. We model individual private data (e.g., location tags, music tastes, GPS coordinates, ratings and bookmarks) as a sequence of random variables (r.v.’s) taking on values in a common finite alphabet of categories, in particular the set X= {1,…, 𝑛}for some integer 𝑛⩾2. In our mathematical model, we assume these r.v.’s are independent and identically distributed. This assumption permits us to represent the profile of an individual by means of the probability mass function (PMF) according to which such r.v.’s are distributed, a model that is widely accepted in the privacy and security literature (Xu et al.,2007b; Toubiana et al.,2010a;Rebollo-Monedero and Forné,2010;Fredrikson and Livshits,2010;Parra-Arnau et al.,2017). Conceptually, we may interpret a profile as a histogram of relative frequencies of individual data within a predefined set of categories of interest. Intrinsic to data generalization is the existence of a hierarchy of concepts or taxonomy. In this work, we shall denote by 𝑑the number of hierarchy levels other than the bottom-level, and assume that the highest-level category (root) can be reached from any bottom-level category (leaf) in exactly 𝑑jumps. For 𝑟= 1,…, 𝑑, we denote by 𝑔𝑟= (𝑔𝑟 1,…, 𝑔𝑟 𝑛)ageneralization strategy of level 𝑟, which is a tuple specifying the percentage of user data that is generalized to that level and recorded as such. Accordingly, we define 𝐺∈R𝑛×𝑑 +as the matrix whose 𝑟th column is 𝑔𝑟. We model the way profiles are updated via the set of matrices 𝑈𝑟∈R𝑛×𝑛 +for 𝑟= 1,…, 𝑑. Intuitively, when the proposed mechanism (see Section 4for further details) generalizes a certain piece of data (e.g., a location) into a higher-level category ℎ, the mechanism i. implicitly refrains from recording that data, and ii. updates its knowledge about the individual’s profile on all bottomlevel categories falling below ℎ. The update can be made uniformly across all such bottom-level categories, or proportionally, according to some distribution. For simplicity, we shall assume the former case. For a 1-level hierarchy, we model the profile that results from optimal generalization (i.e., the apparent profile) as 𝑡=𝑞−𝑔1+𝑈1𝑔1.(1) We immediately note that generalization can be regarded as a combination of suppression and partial forgery. In the case of the hierarchy depicted in Fig. 1, where 𝑛= 10 and 𝑑= 1, the matrix 𝑈1takes this form: 𝑈1= ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣ 1 ∕21 ∕20 0 0 0 0 0 0 0 1 ∕21 ∕20 0 0 0 0 0 0 0 0 01 ∕31 ∕31 ∕30 0 0 0 0 0 01 ∕31 ∕31 ∕30 0 0 0 0 0 01 ∕31 ∕31 ∕30 0 0 0 0 0 0 0 0 01 ∕21 ∕20 0 0 0 0 0 0 01 ∕21 ∕20 0 0 0 0 0 0 0 0 01 ∕31 ∕31 ∕3 0 0 0 0 0 0 01 ∕31 ∕31 ∕3 0 0 0 0 0 0 01 ∕31 ∕31 ∕3 ⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ . Let 𝑉𝑟=𝑈𝑟−𝐼𝑛, where 𝐼𝑛is the identity matrix of size 𝑛×𝑛. It is interesting to note that 𝑉𝑟matrices are finally diagonal block matrices formed by the direct sum of negative centering matrices. Accordingly, in the general case when 𝑑⩾1, the apparent profile is modeled as 𝑡=𝑞+ 𝑑 ∑ 𝑟=1 𝑉𝑟𝑔𝑟.(2) Note from expressions (1) and (2) that we are dealing with a combination of suppression and proportional forgery on the actual profile, equivalent to a translation and centering in terms of matrix algebra. In this work, we shall assume all the data an individual generates can be classified into a bottom-level category of that taxonomy. In other words, we consider that the data collected by both our proposed privacy mechanism and the personalized service provider always refers to specific information about an individual; the aim of the proposed mechanism is precisely generalizing those individual data. The proposed generalization mechanism captures the utility loss incurred by generalizing individual data through a cost matrix of dimension 𝑛×𝑑 𝐶= ⎡ ⎢ ⎢ ⎢ ⎢ ⎣ 𝑐11 …𝑐1𝑑 𝑐21 …𝑐2𝑑 ⋮ ⋮ 𝑐𝑛1…𝑐𝑛𝑑 ⎤ ⎥ ⎥ ⎥ ⎥ ⎦ , where the entry 𝑐𝑖𝑟 ⩾0reflects the impact on utility due to generalizing a private data (e.g., a location) that belongs to the bottom-level subcategory 𝑖, into a category of the 𝑟th level of the hierarchy. For a single individual, we quantify the effectiveness of the protection mechanism in generalizing user data, through the accumulated total cost 𝑑 ∑ 𝑟=1 𝑐T ⋅,𝑟 𝑔𝑟, which each individual or user would like to upper bound. For simplicity, we shall assume the same bound is applied to all individuals within the population, and denote it by 𝛾. 3.5. Trade-off between privacy and generalization rate We quantify an individual’s privacy risk generically as =𝑓(𝑡, 𝑝), where 𝑓(𝑡, 𝑝)is aprivacy function that measures the extent to which the individual is discontent when the apparent profile is 𝑡and the target profile they would like to look like is 𝑝. As a first approximation, we may consider the target profile to be the uniform distribution 𝑢, and the privacy function to be the Shannon’s entropy of the apparent profile, = H(𝑡), and refer to it consistently as privacy gain, rather than privacy risk. We use Shannon’s entropy to reflect the intuition that an attacker will be able to compromise user privacy as long as the apparent user profile diverges from the uniform profile. Recall Cover (1999) that the entropy of a PMF 𝑡is defined as H(𝑡) = −∑ 𝑖=1 𝑡𝑖𝑙 𝑜𝑔𝑏(𝑡𝑖), where 𝑏is the base of the logarithm used. Common values of 𝑏are 2, 𝑒and 10. In those cases, the units of entropy are bit,nat and dit, respectively. For simplicity, we shall use natural logarithms throughout the paper and refer to log𝑒as ln, particularly because all bases produce equivalent optimization objectives. Consistently with this privacy entropic measure, now we define the privacy generalization function, or equivalently, the optimal privacyutility trade-off between privacy and generalization for an individual (𝛾) = max 𝐺 ≽0 𝐺𝟏≼𝑞 , ∑𝑑 𝑟=1 𝑐T ⋅,𝑟 𝑔𝑟=𝛾 H(𝑡),(3) Computers & Security 148 (2025) 104178 5 C. Gil et al. Fig. 2. Block diagram of the proposed architecture given a hierarchical taxonomy with labels arranged into a tree structure. which formally expresses the intuitive reasoning behind data generalization: the higher the data generalization rate 𝛾, the higher the uncertainty in terms of the entropy of the apparent distribution, and the higher user privacy. 4. User-side architecture We dedicate this section to describing, adapting a basic high-level architecture proposed in Arnau (2014), an eventual and practical implementation of our optimal data generalization mechanism. We know that the main purpose of our solution is for users to consciously protect their privacy against identification attempts by any attacker. And to do this, we assist them in deciding what proportion of data they should generalize at the cost of losing the minimum functionality in the service they receive. From this point of view, we want to highlight that we also conceive our proposal as adecision support system. Our approach is designed to be integrated into an application that the user already has installed on their computer, for example, a web browser plug-in. Inspired by the principles of hard privacy, the architecture we present is based on the untrusted model, eliminating the need for users to trust third parties to protect their data, beyond the software installed on their own machine. It is for this reason that we call it user-side architecture. The operation that the application must carry out is straightforward. When the user’s privacy is at risk, the system launches an alarm and then recommends them what data should be generalized to deal with the threat. Hence, it is the user who has the last word. However, before detailing the main functional components of our design, we must specify how a user’s profile could be obtained locally in an application that implements our technique. To do this, we base ourselves on three assumptions about said profile. 1. Common knowledge. First, We assume that both instances, the software application and the eventual privacy attackers, operate on an identical predefined taxonomy of categories of interest and therefore obtain, based on their categorization algorithms, the same user profile. This assumption is considered valid to the extent that we are dealing with sets of standard and generalized categories. 2. Profile initialization. Second, we assume that to decide whether to generalize a particular category or not, our approach needs an initial user profile. This circumstance can be taken into account through a training period prior to the implementation of the architecture we propose. Exclusively during this previous phase, the user will explain her interests since under this assumption, an attacker could know her real profile. 3. Long-term profile. And additionally, we assume that the user’s profile is not subject to frequent changes, in line with the socalled long-term profiles (Gauch et al.,2007). The profile acquires stability after the initialization phase previously noted, when the user has shared a significant number of elements. Still, we must recognize that, in practice, user interests can vary significantly over time and, therefore, our solution must take this into account. Fig. 2describes, through a block diagram, the software architecture that we propose as an application. It is made up of a series of modules that interact locally and/or with the system, so that each of them performs a specific function based on the parameters it receives. Although our solution can work with any type of generalizable data, the figure shows the case of resource tagging on the Web, that is, when users’ private data are tags. From a general perspective, the figure shows a user interacting with a single, simple PIS, and more specifically, with an hierarchical tagging system. It is an entity that, in exchange for personalized information of interest, stores and provides users with elements of information (for example, music, videos and web pages, points of interest or geographical coordinates) and their corresponding associated tags, which can form part of a hierarchical taxonomy. Below we provide a functional description of the modules that make up this architecture. Web browser. Unlike the rest of the modules, we assume that the web browser can be previously installed on the user’s computer. This is an external element to our generalization application, which we understand as a complement to the first. The browser is responsible for the user’s communication with the PIS, entities that feed each other information. Thus, a user downloads through his or her browser that content (e.g. images, web pages, etc.) that will be tagged according to his or her interests, including the tags that other users have published Computers & Security 148 (2025) 104178 6 C. Gil et al. in the tagging system. And in the same way, the browser sends the labels proposed by the user to the PIS. Meanwhile, all data retrieved by the browser (e.g. metadata) is passed to the context analyzer module to process the information. Context analyzer. The purpose of this module is to assist the category extractor module in deciding which user profile category should be updated (generalized). This process could be carried out using the vector space model (Salton et al.,1975), as is normally done in the field of information retrieval, to represent Web pages as tuples containing their most representative terms. For example, term inverse document frequency (TF-IDF) could be applied to calculate the weights of each term that appears on the web page that includes the item to be categorized. Subsequently, taking some of the most weighted terms from the tuple, it would send them to the category extractor module. Category extractor. This element plays a crucial role in classifying the tags that the user submits to the PIS within a predefined set of categories. In certain cases, these categories are provided by the labeling system, as seen on platforms such as Amazon, but they can also be acquired through specialized databases, such as the Curlie Directory.3 During this process, the label suggested by the user and the contextual information provided by the context analyzer module are integrated. The result, presented in the form of categories, is transmitted to the user profile constructor and privacy alarm generator modules. User profile constructor. This module generates the user profile. In specific terms, it receives the categories associated with the tags sent by the user and, accordingly, estimates and/or updates their profile. As mentioned above, our proposed architecture assumes that, when estimating the histogram, the relative frequencies of activity are sufficiently stable once the user has generated a significant number of labels. A crucial aspect that a practical implementation of this module must take into account is profile initialization. One option could be to start this profile at zero (Viejo et al.,2012). On the other hand, an approach based on the principle of maximum entropy would choose to use the uniform distribution. Importantly, this module remains active even when the user explicitly declares her profile. Since the profile indicated by the user may not accurately reflect their online behavior, our architecture may decide, after the training phase, to replace it with the profile implicitly inferred from their interaction activity (tagging) with the system. Generalization strategy generator. This module is responsible for the user’s privacy and therefore we consider it the central element of the architecture we propose. Equipped with the implementation of our optimal generalization mechanism, and based on two input parameters, the real user profile 𝑞, the number of hierarchy levels other than the bottom-level 𝑑and the generalization rate 𝛾, which represents the percentage of data to be generalized, the result of its calculations is the optimal tuple of generalized data 𝑔∗. For example, the component 𝑔∗ 𝑖refers to the percentage of data that is suggested to be categorized into the top-level category 𝑖. In Section 3.5, we provide more detailed specification of this module. Privacy alarm generator. The task of this module is to alert the user about possible violations of their privacy. Whenever the user shares their personal information through tags, this module waits for the category extractor module to send the category corresponding to said tag, represented by the index 𝑖. And when it receives the tuple, it executes the following actions. A privacy warning with probability 𝑔𝑖 is generated, notifying the user. It is the user’s responsibility to decide whether or not to generalize the data in case of alarm activation. And otherwise, our application will not identify any privacy threats and will transmit the information to the web browser. 3https://curlie.org/. Table 2 Description of the variables used in our notation. Symbol Description 𝑛Number of interest categories 𝑑Number of hierarchy levels 𝑚Number of top-level categories 𝑛𝑘Number of bottom-level categories by each top-level category 𝑔𝑟Ageneralization strategy is an 𝑛-tuple with the percentage of observed data that is generalized at level 𝑟 𝑞The actual user profile is the genuine profile of interests 𝑡The apparent user profile is the perturbed profile, as observed from the outside, resulting from the generalization of certain percentage of observed data 𝑢Uniform profile across the 𝑛categories 𝑉𝑟The generalization matrix at level 𝑟 𝐶The cost matrix on which the proposed generalization mechanism captures the utility loss incurred by generalizing individual data H(𝑡)User privacy is measured as the Shannon’s entropy of the apparent user profile 𝛾The generalization rate is the percentage of observed data that the user is willing to generalize (𝛾)Function modeling the privacy–generalization trade-off 𝛾𝑐 𝑟𝑖𝑡 The critical generalization is the generalization rate beyond which the privacy–generalization function attains its maximum value or critical privacy 5. Theoretical analysis In this section, we shall analyze one of the main and fundamental properties of the privacy-generalization function (3) defined in the previous section. Our theoretical analysis only considers the case when all given probabilities are strictly positive: 𝑞𝑖>0for all 𝑖= 1,…, 𝑛. (4) This assumption will be properly justified in Section 5.1. We shall suppose further, now without loss of generality, that 𝑞𝑖≤⋯≤𝑞𝑛for all 𝑖= 1,…, 𝑛. (5) Before proceeding with the mathematical analysis, it is immediate from the definition of the privacy-generalization function that its initial value is (0) = H(𝑞). The notation used throughout this section is summarized in Table 2. 5.1. Critical generalization The following theoretical property confirms the intuition that there must exist a generalization rate beyond which critical privacy is achievable, in the sense that the privacy–generalization function attains its maximum theoretical value by groups of top-level categories, that is, (𝛾) =𝜙≤ln(𝑛).4This critical generalization is 𝛾𝑐 𝑟𝑖𝑡 = 1 − 𝑚𝑑 ∑ 𝑘=1 𝑛𝑘𝑞1𝑘,(6) where 𝑚𝑑is the number of category sets at top-level of the hierarchy and according to the labeling assumption (5). Our purpose is to formulate and prove a theorem that captures this property. It is important to note that this property also provides an upper bound on the value of (𝛾). Theorem 1(Critical Generalization).For all 𝛾∈ [0,1), if 𝛾≥𝛾𝑐 𝑟𝑖𝑡, then (𝛾) =∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘). Conversely, if 𝛾 < 𝛾𝑐 𝑟𝑖𝑡, then (𝛾)<∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘). Proof. First, suppose that at the maximum value of (𝛾)the apparent profile 𝑡is constant (uniform) for groups of top-level categories. In the 4Note that with only one set of top-level categories (𝑚= 1), it follows that 𝑡=𝑢= 1∕𝑛and (𝛾) =𝑙 𝑛(𝑛). Computers & Security 148 (2025) 104178 7 C. Gil et al. case of a single hierarchy level (𝑑= 1), by algebraic manipulation of Eq. (1) we can express the resources 𝑔in the form 𝑔𝑖𝑘 =𝑔1𝑘+𝑞𝑖𝑘 − 𝑞1𝑘∀𝑖 >1, 𝑘. Adding all the terms we arrive at an expression for the generalization rate, that is, 𝛾= 1 +∑𝑚 𝑘=1 𝑛𝑘𝑔1𝑘−∑𝑚 𝑘=1 𝑛𝑘𝑞1𝑘. For 𝛾to reach its highest value within the interval [0,1), the first component of the resources of each group of high-level categories will necessarily have to be zero, that is, 𝑔1𝑘= 0,𝑘= 1,…, 𝑚, thus obtaining the desired Eq. (6). Furthermore, in all cases we can express the optimal resource strategy for the critical generalization ratio in the form 𝑔𝑖𝑘 =𝑞𝑖𝑘 −𝑞1𝑘 for all 𝑖 >1and 𝑘. In this way, the apparent profile 𝑡will have a uniform value for each group of top-level categories, that is, 𝑡𝑖𝑘 =𝑞𝑘, 𝑘= 1,…, 𝑚, understanding 𝑞𝑘as the average of actual user profile at the 𝑘th group of categories. Then, the critical value of the privacy– generalization function is (𝛾) =∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘). Following the same reasoning, the particular case (𝑑= 1) is extensible to the general case. ■ Corollary 2(Privacy Bound).The critical privacy (𝛾) =∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘)is upper bounded by ln(𝑛). Proof. From Gibbs’ inequality we know that H𝑛attains its maximum value when all probabilities are equal, i.e., H𝑛(𝑞1,…, 𝑞𝑛)≤ H𝑛(1∕𝑛, …,1∕𝑛). In that case, H𝑛(1∕𝑛, …,1∕𝑛) = ln(𝑛). In turn, according to the structure of our problem we have −∑𝑚 𝑘=1 ∑𝑛𝑘 𝑖=1 1∕𝑛ln(1∕𝑛) = ∑𝑚 𝑘=1 𝑛𝑘H(1∕𝑛) =𝑙 𝑛(𝑛). It follows then that (𝛾) =∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘)≤ ∑𝑚 𝑘=1 𝑛𝑘H(1∕𝑛) = ln(𝑛).■ Comparison with forgery and suppression. The analytical characterization of the critical generalization rate is a fundamental result: we can analytically determine the amount of perturbation needed to achieve maximum protection, and based on this, figure out whether or not a user can achieve it more or less easily. Although obviously the critical rate depends on each profile, a natural question one would ask is: how is this critical rate in relation to state-of-the-art perturbation techniques, namely, forgery and suppression. We aim to shed some light into this question next. We conduct our first experiment for some concrete user profile, evaluating the state-of-the-art techniques optimal forgery (RebolloMonedero and Forné,2010) and optimal suppression (Parra-Arnau et al.,2012b;Rodriguez-Carrion et al.,2015), versus the proposed optimal generalization mechanism. Together with Rebollo-Monedero and Forné (2010), henceforth denoted forgery v.1, we also assess a variation thereof (forgery v.2), which models the apparent profile as follows: 𝑡= (𝑞+𝑟)∕(1 +𝜌), where 𝜌is the perturbation rate and 𝑟a forgery strategy analogous to our 𝑔. This model is in contrast with the original formulation of optimal forgery (Rebollo-Monedero and Forné, 2010), where 𝑡= (1 −𝜌)𝑞+𝜌 𝑟. Fig. 3shows the results for the user profile 𝑞= (0.02,0.03,0.04,0.05,0.07,0.10,0.12,0.15,0.17,0.25) and the hierarchy ‘‘3-level toy28’’ of Fig. 5(e). In the figure, we can observe that, for this specific profile, 𝜌crit < 𝛾crit < 𝜎crit, which means that forgery can provide the highest level of protection with a smaller perturbation rate than generalization and suppression would do. In the figure, we would like to note that, unlike generalization, suppression and forgery rely on bottom-level categories to perturb profiles (which is denoted with the label ‘‘0-level’’ in the figure). The fact that there is no hierarchy of categories in suppression and forgery implies, on account of Theorem 1, that the privacy level attained by these two techniques will never be smaller than that offered by generalization. Because the results reported in Fig. 3are highly dependent on the chosen profile, our second experiment contemplates 608 random Fig. 3. Privacy, measured as the Shannon’s entropy of a user’s apparent profile, vs. perturbation rate, for 3-level generalization, suppression and two versions of the forgery technique. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.) Fig. 4. Critical perturbation rates of 608 randomly-generated, 16-dimensional profiles vs. the difference 𝑞16 −𝑞1, for optimal generalization, suppression and forgery v.1. Each data point reflects a profile, and darker profiles in generalization imply larger number of high-level categories. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.) profiles of dimension 𝑛= 16 over some possible high-level hierarchies. More specifically, for each of these random profiles, we show in Fig. 4 the critical rates of generalization, suppression and forgery in the ordinate, and the difference 𝑞16 −𝑞1in the abscissa. Our choice for the abscissa is justified by the fact that 𝜌crit = 1 − −1∕𝑛 𝑞𝑛(RebolloMonedero and Forné,2010) and 𝜎crit = 1 − −𝑛 𝑞1(Parra-Arnau et al., 2012b), which, together with Eq. (6), imply 𝑞1and 𝑞𝑛are the only profile components affecting the three critical rates. Hierarchy-wise, from Eq. (6) it follows that 𝛾crit depends just on the highest level. To explore the effect of the number of high-level categories in generalization, data points (i.e., profiles) in Fig. 4with darker color reflect profiles with higher number of such categories. Fig. 4shows the superiority of generalization in terms of critical rates with respect to the state-of-the-art perturbation techniques. For the random profiles generated, optimal generalization largely achieves the maximum privacy level ∑𝑚 𝑘=1 𝑛𝑘H( 𝑞𝑘)at significantly lower perturbation rates than forgery and suppression. In Section 6we shall examine deeper this question with real profiles. Computers & Security 148 (2025) 104178 8 C. Gil et al. Fig. 5. Toy examples of d-level hierarchies. 5.2. Numerical example In this section, we show some numerical results for a simple but insightful example that will illustrate the formulation presented in Sections 3.4 and 3.5 and the theoretical analysis argued in Section 5. Throughout this subsection, all results correspond to a same artificial user. The experimental analysis of our privacy-enhancing mechanism in a real-world application is presented later in Section 6. In this practical example, we shall consider 𝑛= 10 bottom-level categories and assume that the user distribution is again 𝑞= (0.02,0.03,0.04, 0.05,0.07,0.10,0.12,0.15,0.17,0.25), thus fulfilling both the positivity and the labeling assumptions (4) and (5). For simplicity, we also assume that the cost matrix 𝐶is the all-ones matrix. Furthermore, on the same user profile, we consider five possible generalization hierarchies with levels 𝑑= 1,2and 3, which we illustrate in Fig. 5. Note that the examples evolve from the lower prelevel example, starting with the same basic 1-level example, namely toy2323. In Fig. 6we can observe the structure of the generalization matrices 𝑉1, 𝑉2and 𝑉3in order to form in each case the corresponding Eq. (2) from the 1-level toy2323, 2-level toy253 and 3-level toy73 examples. Notice how, at each level, the generalization matrix has as many diagonal blocks as groups of categories that have been defined for that level. Furthermore, the dimension of each square block corresponds to the number of lowest level categories that the group of categories contains. To solve numerically the optimization problem (3) we used CVX, a package for specifying and solving convex programs (Grant and Boyd, 2014a,b) and MOSEK (ApS,2019). Both have been run on Matlab software (Matlab R2021 9.10.0.1602886 64-bit win64) with an Intel CoreTM i3-2370 2.4 GHz CPU, 4 Gb RAM in a Windows 10 64-bit operating system. From the point of view of the user profiles, in Fig. 7we represent the apparent profile of the user from the 3-level toy73 example, for different values of the generalization rate 𝛾. When 𝛾= 0, no perturbation takes place and the apparent profile 𝑡represented in Fig. 7(a) actually corresponds to the genuine user profile 𝑞. According to the reasoning behind the optimal generalization strategies previously described, the higher 𝛾, the more uniform is the resulting apparent profile. As illustrated in Fig. 7(d), the maximum level of privacy is attained precisely for 𝛾=𝛾𝑐 𝑟𝑖𝑡 = 0.41, when the apparent profile is completely uniform by the two top-level categories and therefore, following the expressions obtained in the Theorem 1,𝑡∗≃ (0.06,0.06,0.06,0.06,0.06,0.06,0.06,0.19,0.19,0.19) and H(𝑡∗) ≃ 2.1463. All this information is also captured in Fig. 8, where we plot the privacy-generalization function (3), that is, the function modeling the optimal trade-off between privacy and utility, the latter being measured as the percentage of data generalized by the user. However, in the figure we collect the information for the five hierarchy examples that we use on the same user. From this point of view, the first thing we observe is that in all cases, the function (𝛾)behaves non-decreasing and quasciconcave, as we pointed out at the end of our theoretical analysis. Starting from a common initial value, namely (0) = H(𝑞) = 2.0652, and depending on the rate of generalization 𝛾, the optimal trade-off grows with different intensities until it reaches critical value of the rate, namely 𝛾crit, and following the calculations of (6), at which privacy growth stalls. In this sense, the best increase of 7% is obtained when the user categorizes their interests under the 3-level toy28, so that H(𝑡∗) = ≃2.2086 although at the cost of a critical rate 𝛾crit = 0.64. A final remark is the influence of the hierarchy level 𝑑on user privacy. We observe that the higher the hierarchy level, the greater the privacy. 6. Experimental analysis In this section, we will discuss the extent to which our technique enables users to enhance their privacy in a personalized real-world system. Our analysis also looks at the impact that data generalization has on information loss using a measure of utility that we call the generalization rate, namely 𝛾. 6.1. Datasets We applied the proposed technique to Foursquare (Yang et al., 2014) and Brightkite (Cho et al.,2011), two real-world datasets collected from location-based social networks (LBSNs) which are wellknow by the scientific community for data mining tasks in the field. Computers & Security 148 (2025) 104178 9 C. Gil et al. Schwab, K., 2015. The fourth industrial revolution: what it means, how to respond. Foreign Aff. 12, 2015–2017. Shakil, Arif, M., Sohail, S.S., Alam, M.T., Ubaid, S., Nafis, M.T., Wang, G., 2021. Towards a two-tier architecture for privacy-enabled recommender systems (PeRS). In: Inernational Conference on Ubiquitous Security. Springer, pp. 268–278. Toubiana, V., Narayanan, A., Boneh, D., Nissenbaum, H., Barocas, S., 2010a. Adnostic: Privacy preserving targeted advertising. In: Proceedings Network and Distributed System Symposium. Toubiana, V., Narayanan, A., Boneh, D., Nissenbaum, H., Barocas, S., 2010b. Adnostic: Privacy preserving targeted advertising. In: Proc. Symp. Netw. Distrib. Syst. Secur.. SNDSS, pp. 1–21. Ullah, I., Binbusayyis, A., 2022. Joint optimization of privacy and cost of in-app mobile user profiling and targeted ads. IEEE Access 10, 38664–38683. Union, I.T., 2020. Measuring digital development: Facts and figures 2020. Viejo, A., Sánchez, D., Castella-Roca, J., 2012. Using profiling techniques to protect the user’s privacy in Twitter. In: International Conference on Modeling Decisions for Artificial Intelligence. Springer, pp. 161–172. Wang, H., Hong, H., Xiong, L., Qin, Z., Hong, Y., 2022. L-srr: Local differential privacy for location-based services with staircase randomized response. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. pp. 2809–2823. Wang, T., Zhang, X., Feng, J., Yang, X., 2020. A comprehensive survey on local differential privacy toward data statistics and analysis. Sensors 20 (24), 7030. Xiong, X., Liu, S., Li, D., Cai, Z., Niu, X., 2020. A comprehensive survey on local differential privacy. Secur. Commun. Netw. 2020, 1–29. Xu, Y., Wang, K., Zhang, B., Chen, Z., 2007a. Privacy-enhancing personalized web search. In: Proc. Int. WWW Conf.. ACM, pp. 591–600. Xu, Y., Wang, K., Zhang, B., Chen, Z., 2007b. Privacy-enhancing personalized web search. In: Proceedings of the 16th International Conference on World Wide Web. pp. 591–600. Yang, M., Guo, T., Zhu, T., Tjuawinata, I., Zhao, J., Lam, K.-Y., 2023. Local differential privacy and its applications: A comprehensive survey. Comput. Stand. Interfaces 103827. Yang, D., Zhang, D., Zheng, V.W., Yu, Z., 2014. Modeling user activity preference by leveraging user spatial temporal characteristics in LBSNs. IEEE Trans. Syst. Man Cybern. 45 (1), 129–142. Ye, S., Wu, F., Pandey, R., Chen, H., 2009. Noise injection for search privacy protection. In: 2009 International Conference on Computational Science and Engineering. Vol. 3, IEEE, pp. 1–8. Computers & Security 148 (2025) 104178 16