Shortest Paths and Distances with Differential Privacy

We introduce a model for differentially private analysis of weighted graphs in which the graph topology (V,E) is assumed to be public and the private information consists only of the edge weights w:E→ℝ^+. This can express hiding congestion patterns in a known system of roads. Differential privacy requires that the output of an algorithm provides little advantage, measured by privacy parameters ε and δ, for distinguishing between neighboring inputs, which are thought of as inputs that differ on the contribution of one individual. In our model, two weight functions w,w' are considered to be neighboring if they have ℓ1 distance at most one. We study the problems of privately releasing a short path between a pair of vertices and of privately releasing approximate distances between all pairs of vertices. We are concerned with the approximation error, the difference between the length of the released path or released distance and the length of the shortest path or actual distance. For privately releasing a short path between a pair of vertices, we prove a lower bound of Omega(|V|) on the additive approximation error for fixed ε,δ. We provide a differentially private algorithm that matches this error bound up to a logarithmic factor and releases paths between all pairs of vertices. The approximation error of our algorithm can be bounded by the number of edges on the shortest path, so we achieve better accuracy than the worst-case bound for vertex pairs that are connected by a low-weight path with o(|V|) vertices. For privately releasing all-pairs distances, we show that for trees we can release all distances with approximation error O(log2.5|V|) for fixed privacy parameters. For arbitrary bounded-weight graphs with edge weights in [0,M] we can release all distances with approximation error tildeO(√|V|M).