The recently launched LinkedIn Salary product has been designed with the goal of providing compensation insights to the world's professionals and thereby helping them optimize their earning potential. We describe the overall design and architecture of the statistical modeling system underlying this product. We focus on the unique data mining challenges while designing and implementing the system, and describe the modeling components such as Bayesian hierarchical smoothing that help to compute and present robust compensation insights to users. We report on extensive evaluation with nearly one year of de-identified compensation data collected from over one million LinkedIn users, thereby demonstrating the efficacy of the statistical models. We also highlight the lessons learned through the deployment of our system at LinkedIn.
Privacy : Preserving user privacy is crucial when collecting compensation data. We encountered unique challenges associated with privacy and security while designing our system. Our methodology for addressing these challenges through a combination of techniques such as encryption, access control, de-identification, aggregation, and thresholding is described in @cite_11 . Please refer this paper for a discussion of different privacy techniques (in contrast with our approach), and an empirically study of the tradeoffs between privacy and modeling needs.
@cite_11
2782817518 2005107218 2166658587 1602085912
We study a mechanism design problem of privacy- preserving data collection with privacy protection uncertainty. A data collector wants to collect enough data to perform a certain computation that benefits the individuals who contribute the data, with the possibility of individual privacy leakage. The data collector adopts a privacy-preserving mechanism by adding some random noise to the computation result, which reduces the accuracy of the computation. Individuals decide whether to contribute data based on the potential benefit and the possible privacy cost induced by the mechanism. Due to the intrinsic uncertainty involved in privacy protection, we model individuals' privacy-aware participation using the prospect theory, which more accurately models individuals' behavior under uncertainty than the traditional expected utility theory. We show that the data collector's utility maximization problem involves a polynomial of high and fractional order, which is difficult to solve analytically. We get around this issue by proposing an approximation method, which allows us to obtain a closed form unique solution of the data collector's decision problem. We numerically show that the approximation error is small when the number of individuals is large. By comparing with the results under the expected utility theory, we conclude that a data collector who considers the more realistic prospect theory modeling should adopt a stricter privacy-preserving mechanism to boost her utility. Privacy-preserving data publishing addresses the problem of disclosing sensitive data when mining for useful information. Among the existing privacy models, ∈-differential privacy provides one of the strongest privacy guarantees and has no assumptions about an adversary's background knowledge. Most of the existing solutions that ensure ∈-differential privacy are based on an interactive model, where the data miner is only allowed to pose aggregate queries to the database. In this paper, we propose the first anonymization algorithm for the non-interactive setting based on the generalization technique. The proposed solution first probabilistically generalizes the raw data and then adds noise to guarantee ∈-differential privacy. As a sample application, we show that the anonymized data can be used effectively to build a decision tree induction classifier. Experimental results demonstrate that the proposed non-interactive anonymization algorithm is scalable and performs better than the existing solutions for classification analysis. Privacy is a serious concern when microdata need to be released for ad hoc analyses. The privacy goals of existing privacy protection approaches (e.g., k-anonymity and l-diversity) are suitable only for categorical sensitive attributes. Since applying them directly to numerical sensitive attributes (e.g., salary) may result in undesirable information leakage, we propose privacy goals to better capture the need of privacy protection for numerical sensitive attributes. Complementing the desire for privacy is the need to support ad hoc aggregate analyses over microdata. Existing generalization-based anonymization approaches cannot answer aggregate queries with reasonable accuracy. We present a general framework of permutation-based anonymization to support accurate answering of aggregate queries and show that, for the same grouping, permutation-based techniques can always answer aggregate queries more accurately than generalization-based approaches. We further propose several criteria to optimize permutations for accurate answering of aggregate queries, and develop efficient algorithms for each criterion. Suppose that party A collects private information about its users, where each user's data is represented as a bit vector. Suppose that party B has a proprietary data mining algorithm that requires estimating the distance between users, such as clustering or nearest neighbors. We ask if it is possible for party A to publish some information about each user so that B can estimate the distance between users without being able to infer any private bit of a user. Our method involves projecting each user's representation into a random, lower-dimensional space via a sparse Johnson-Lindenstrauss transform and then adding Gaussian noise to each entry of the lower-dimensional representation. We show that the method preserves differential privacy---where the more privacy is desired, the larger the variance of the Gaussian noise. Further, we show how to approximate the true distances between users via only the lower-dimensional, perturbed data. Finally, we consider other perturbation methods such as randomized response and draw comparisons to sketch-based methods. While the goal of releasing user-specific data to third parties is more broad than preserving distances, this work shows that distance computations with privacy is an achievable goal.