How To Break Anonymity of the Netflix Prize Dataset

By Arvind Narayanan, Vitaly Shmatikov. 2006

559 citations recorded by the source corpus.

We present a new class of statistical de-anonymization attacks against high-dimensional micro-data, such as individual preferences, recommendations, transaction records and so on. Our techniques are robust to perturbation in the data and tolerate some mistakes in the adversary's background knowledge. We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world's largest online movie rental service. We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber's record in the dataset. Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information.

Subfields: Artificial Intelligence, Sociology and Political Science, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

In Safety, Robustness & Interpretability

Citations in the corpus

Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing (2017, background): “Numerous linkage and membership inference attacks on both biomedical datasets [6-13] and from machine learning models [14-16] have demonstrated the ability to re-identify participants or reveal participation in a study.”
Marginal Release Under Local Differential Privacy (2017, background): “There is considerable precedent for considering such information in need of protection, from the US Video privacy protection act, to the debate around the data released as part of the Netflix Prize [28].”
Practical Differential Privacy for SQL Queries Using Elastic Sensitivity (2017, background): “Data anonymization attempts to provide privacy while allowing general-purpose analysis, but cannot be relied upon, as demonstrated by a number of re-identification attacks [13, 30, 32, 37].”
Differentially Private Distributed Constrained Optimization (2014, background): “A famous case is the reidentification of certain users from an anonymized dataset published by Netflix, which is an American provider of on-demand Internet streaming media.”
Privacy and analytics: it's a DELICATE issue a checklist for trusted learning analytics (2016, background): “Among those relatively easy approaches are also more computational ones as presented in [46][47].”
Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning (2021, background): “Unfortunately, these privacy definitions often have problems when dealing with high dimensional data [44]—allowing attacks that nevertheless reveal sensitive information.”
Differential Privacy for Statistics: What we Know and What we Want to Learn (2010, background): “While the height parable is contrived, examples such as the linkage attacks on the HMO [59] and Netflix prize [46, 47] data sets and the more subtle break of token-based hashing of query logs [40] show the power and diversity of auxiliary information.”
The Algorithmic Foundations of Differential Privacy (2014, background): “Sweeney [81] linked voter registration records to “anonymized” medical encounter data; Narayanan and Shmatikov carried out a linkage attack against anonymized ranking data published by Netflix [65].”
Recommender Systems (2016, unknown): “The well-known Netflix Prize data set was attacked using this methodology [451].”
Inferring social ties from geographic coincidences (2010, background): “Earlier work on privacy breaches has shown how people can be uniquely identified using information such as postal codes, gender, and dates and places of birth (12 – 14), as well as the contents of search engine queries and online reviews and discussion (15 – 17).”
When Machine Learning Meets Privacy (2020, background): “Squicciarini et al. [147] considered visual-content features and images’ metadata to develop and contrast several learning models.”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “Such a re-identification attack was demonstrated on a data set of movie reviews superficially anonymized for research purposes [41] and would almost certainly be possible for most users given the number and detail of predicates we would like to study.”
Differentially Private Filtering (2012, background): “This is demonstrated in [4], [5] for example, where private ratings and transactions from individuals on commercial websites are successfully inferred with the help of information from public recommendation systems.”