Listener Anonymizer: Camouflaging Play Logs to Preserve User’s Demographic Anonymity (ISMIR 2018)
1. Definition of Anonymity
How can users enjoy music when using an online music service while preserving their demographic anonymity?
We listed up five factors to consider for realizing Listener Anonymizer.
The probability of French
is not the highest.
Top k nationalities have
almost the same probabilities.
2. Method for Predicting Demographics
It is common to use music metadata extracted from the user’s play log
The state-of-the-art method is the one proposed by Krismayer et al.
for artist’s tags
PCA SVM …
 Prediction of User Demographics from Music Listening Habits
T. Krismayer, M. Schedl, P. Knees, R. Rabiser
3. Timing of Anonymization 4. User’s True Demographics 5. Multiple Demographics
When anonymity is no longer satisfied
When a user does not use a smartphone
The system is required to select
as few songs as possible so that
the user can soon resume
listening to her favorite songs.
Some users still hope to play as
few recommended songs as
possible to save on the packet
When the system does not know it
When the system knows it
ALERT Alert is displayed with proper
timing. The user will tell her
true demographic if the system
is a stand-alone application.
In exchange for complete
anonymity, songs will be
this is a heavy burden for her.
30’s 20’s 50’s
When a user tells many
demographics that she
wants to preserve the
anonymity of, alerts may
frequently be displayed.
We are fully aware of the importance and usefulness of music recommendation.
We dared to propose this controversial approach to raise privacy issues in the ISMIR community.
0.21 0.04 0.77 0.89
0.48 0.92 0.25 0.33
0.82 0.29 0.46 0.86
𝑠𝑠1 𝑠𝑠2 𝑠𝑠3 𝑠𝑠𝑚𝑚
Detect the nationality having the second-highest probability (e.g., German)
Collect the top 𝑟𝑟 users in terms of the probability of a user on German
Remove the 𝑙𝑙th song from 𝑢𝑢’s play log and compute the new probability
by using the remaining 𝑚𝑚-1 songs
Collect the top c artists based on the probability gap
32,991 users with ≥ 500 play logs from Last.fm dataset
For each user, use the first 30 songs from the oldest songs
in the play logs (i.e., 𝑚𝑚 = 30)
- Camouflage the play log with as few songs as possible
- The system knows the user’s true demographic
- Single demographic anonymity
Age Gender Nationality
Random 15.34 27.18 17.60
Popularity 24.10 29.44 29.42
Proposed 3.22 9.28 4.36
2. Give a choice to a user 3. User’s Taste in Music
When Listener Anonymizer recommends
songs, if they match the user’s taste in music,
she will not be reluctant to keep listening to
the songs. Reflecting user’s taste would also
be beneficial to satisfy both anonymization
and good recommendation.
Camouflaging Play Logs to Preserve User’s Demographic Anonymity
Kosetsu Tsukuda, Satoru Fukayama, Masataka Goto National Institute of Advanced Industrial Science and Technology (AIST)
𝑚𝑚: #songs in a user’s play log
𝑢𝑢: user 𝑠𝑠: song
It is important to show that preserving users’
demographic attributes is technically possible
Listener Anonymizer gives a choice to a user
It is beneficial to predict users’
It is also important to think about
Technique to leverage play logs
for predicting demographic attr.
Technique to camouflage play logs
for preserving demographic attr.
I can enjoy music while
preserving my demographic
Without Listener Anonymizer With Listener Anonymizer
I do not care about
Compute the effectiveness of each candidate song
to anonymize the user’s demographic attribute
Results: avg numbers of songs for camouflaging play logs
(the smaller, the better)