On the Inherent Anonymity of Gossiping

TL;DR

This work quantifies the inherent source anonymity of gossip protocols on general graphs using ε-differential privacy, revealing a universal lower bound and demonstrating tight, provable privacy guarantees for cobra walks and Dandelion on expander and near-Ramanujan graphs. A novel reduction to a random walk with probabilistic die-out, together with spectral analysis of a non-curious subgraph and an absorbing Markov-chain framework, yields explicit ε bounds that illuminate the trade-off between dissemination speed and anonymity. The results generalize previous DP-gossip analyses beyond complete graphs, establishing principled limits and design guidance for privacy-aware epidemic and rumor-spreading protocols in realistic network topologies. Potential extensions include relaxations to alternative privacy definitions (Pufferfish, Renyi DP) and applications to privacy in decentralized learning and anonymity-friendly distributed systems.

Abstract

Detecting the source of a gossip is a critical issue, related to identifying patient zero in an epidemic, or the origin of a rumor in a social network. Although it is widely acknowledged that random and local gossip communications make source identification difficult, there exists no general quantification of the level of anonymity provided to the source. This paper presents a principled method based on $\varepsilon$-differential privacy to analyze the inherent source anonymity of gossiping for a large class of graphs. First, we quantify the fundamental limit of source anonymity any gossip protocol can guarantee in an arbitrary communication graph. In particular, our result indicates that when the graph has poor connectivity, no gossip protocol can guarantee any meaningful level of differential privacy. This prompted us to further analyze graphs with controlled connectivity. We prove on these graphs that a large class of gossip protocols, namely cobra walks, offers tangible differential privacy guarantees to the source. In doing so, we introduce an original proof technique based on the reduction of a gossip protocol to what we call a random walk with probabilistic die out. This proof technique is of independent interest to the gossip community and readily extends to other protocols inherited from the security community, such as the Dandelion protocol. Interestingly, our tight analysis precisely captures the trade-off between dissemination time of a gossip protocol and its source anonymity.

Figures (2)

• Figure 1: Illustration of the reduction from a cobra walk (Fig. \ref{['fig:test1']}) to a random walk with probabilistic die out (Fig. \ref{['fig:test2']}). In Fig. \ref{['fig:test1']}, the dissemination continues after the walk branches and hits the curious set $F$ in several places. In the random walk with die out, instead of letting the dissemination branch, we stop the dissemination as soon as the cobra walk branches and report the position of the branching node.
• Figure 2: Illustration of an anaconda walk. $s$ is the source of dissemination, $Y_i$ corresponds to nodes active at round $i$. Red nodes correspond to the main branch: each red node in $Y_i$ is a head $h_i$ respectively. As the head branches, the branching counter is updated at each step: $c_1=0; c_2 = c_3= 1; c_4=c_5=2$. Blue nodes are those that did not receive the gossip yet.

Theorems & Definitions (58)

• Definition 1: Vertex cut & connectivity
• Definition 2: Expander graph
• Remark 3
• Definition 4: Differential privacy
• Theorem 5
• Definition 6
• Lemma 6
• Theorem 7
• Definition 8: Near-Ramanujan family of graphs
• Corollary 8