mathbabe

The theme of the day yesterday here at the IMA in Minnesota was privacy. There was a talk on privacy and information as well as a discussion later in the afternoon with the participants.

The talk, given by Vitaly Shmatikov, was pretty bad news for anyone who is still hoping to keep private info out of the hands of random internet trolls. Vitaly explained how de-identifying data is a relatively hopeless task, at least if you want to retain useful information in the data, because of the sparseness of most human data.

An example he gave was that the average Netflix user rates 200 films but can be identified on just 4 ratings, at least if you include timestamps. He also pointed out that, even though Netflix doesn’t directly expose its users’ movie preferences, you can infer quite a bit just by looking at how recommendations by Netflix (of the form “people who like House also like Friends”) evolve over time.

And never mind Facebook or other social media, which he explained people can crawl directly and infer the graph structure of; even without any labels for the nodes, which refer to people, one can infer an outrageous amount if you have a separate, labeled graph with overlap on the first.

Conclusion: when people think they’ve de-identified data they haven’t, because other people can collect lots of such data sets, and on top of that some small amount of partial private, identified information about individual users, and piece it together to get creep amounts of stuff.

An example I heard later that day is that someone has figured out how to take pictures of people and give them a large part of their social security number.

The conversation later that day focused more on how companies should protect their client data (through a de-indentifying algorithm), and how for the most part they do absolutely nothing right now. This is perhaps because the problem “isn’t solved” so people don’t see the reason to do something that’s not a perfect solution even though some basic procedures would make it a lot harder. My suspicion is that if they do nothing they are betting they’re more protected from litigation than if they do something that turns out to be too weak. Call me a skeptic but it’s always about litigation.

My contribution to both the talk and the conversation was this: why don’t we stop worrying about data getting out, since it’s kind of a done deal (no data ever disappears and our algorithms are only getting better). Why don’t we assume that all historical information about everyone is out there.

So, besides how to get into my bank account (I haven’t sorted that one out yet, maybe I’ll just have to carry all my money in physical form) I’ll assume everyone knows everything about me, including my DNA.

Then the question becomes, how can we live in a reasonable world given that? How can we, for example, prevent private insurance companies from looking up someone’s DNA or HIV status in order to deny coverage?

This is not an idle concern. As someone pointed out yesterday, 15 years ago nobody would have believed someone who described how much information about the average Facebook user is available now. We have no idea what it will look like in another 15 years.

So I’ve been thinking about how to forecast a continuous event. In other words, I don’t want to forecast a “yes” or a “no”, which is something you might do in face recognition using logistic regression, and I don’t want to split the samples into multiple but finite bins, which is something you may want to do in handwriting recognition using neural networks or decision trees or recommender systems.

I want essentially a score, in fact an expected value of something, where the answers could range over the real numbers (but will probably just range over a pretty small subset but I don’t know exactly what smallish subset).

What happens when you look around is that you realize machine learning algorithms pretty much all do the former, except for various types of regression (adding weights, adding prior, nonlinear terms), which I already know about from my finance quant days. So I’m using various types of regression, but it would be fun to also use a new kind of machine learning algorithm to compare the two. But it looks like there’s nothing out there to compare with.

It’s something I hadn’t noticed til now, and I’d love to be wrong about it, so tell me if I’m wrong.

I’ve been having fun collecting creepy data-driven models for your enjoyment. My first installment was here, with additional models added by my dear commenters. I’ve got three doozies to add today.

1. Girls Around Me. This is a way to find out if you know any girls in your immediate vicinity, which is perfect for my stalker friends, using Foursquare data. My favorite part is that the title of this article about it actually uses the word “creepy”.
2. Zestcash is a cash lending, payday-like service that data mines their customers, with a stated APR of up to 350%. On of my favorite misleading quotes in this article about the model: “Better accuracy should translate into lower interest rates for consumers.” Ummmm… yeah for some of them. And I guess the idea goes, those other losers deserve what they get because they’re already poor?
3. The creepiest of all by far (because it is so painfully scalable and I could imagine it being everywhere in 2 years) is this one which proposes to embody the “best practices” of medicine into a data science model. Look, we desperately need a good model in health and medicine to do some of the leg-work for us, namely come up with a list of reasonable treatments that your doctor can take a look at and discuss with you. But we definitely don’t need a model which comes up with that list and then decides for you and your doctor which one you should undergo. Decisions like that, which often come down to things like how we care about quality of life, cannot and should not be turned into an algorithm.

By the way, just to balance the creepy models a bit, I also wanted to mention a few cool ideas:

1. What about having a Reckoner General, like a surgeon general? That person could answer basic questions to explain how models are being used and to head off creepy models. Proposed by my pal Jordan Ellenberg.
2. What about having an F.D.A.-like regulator for financial products? They would be in charge of testing the social utility of a proposed instrument class before it went to market. Can we do the same for data-driven models? Can the regulator be kick-ass and reasonably funded?
3. What about having a creep model auditing board that brings together a bunch of nerds from technology and ethics and looks through the new models and formally reprimands creepiness, using the power of social pressure to fend it off? They could publicize a list of creeps who made these models to call people out and shame them. That really doesn’t happen enough, it’s like the modelers are invisible.
4. How about a law that, if you add a cookie to your digital signature that says, “don’t track me for reals”, then if you find someone tracking you, as in saving and selling your information, you can sue for $100K in damages and win?

Mahout is an Apache project, which means it’s open source software.

Specifically, Mahout consists of machine learning algorithms that are (typically) map-reducable, and implemented in a map-reduce framework (Hadoop), which means you can either use them on the cloud or on your own personal distributed cluster of machines.

So in other words, if you have a massive amount of data up in the cloud, and you want to apply some machine-learning algorithm to your data, then you may want to consider using Mahout.

Yesterday I learned about a recommendation algorithm and how to map-reduce it (i.e. make it as fast as I want by distributing the work on many machines) by reading Mahout in Action. And the cool thing is that it’s already implemented and optimized, which is good because there’s a big difference between thinking I know how to map-reduce something and making it fast.

So if Netflix ever fails, but their data is miraculously left intact, they can send me and a few other nerds in as a kind of data scientist rescue squad and we can help figure out how to reassemble the recommendations of new movies based on what people have already watched and rated.

If that ever really happens, I hope we’d get t-shirts that say “data scientist rescue squad” on the back.

Update: a mahout is also someone who drives an elephant. And Mahout drives Hadoop, which is the name of Doug Cutting‘s son’s toy elephant. Doug is the guy who started Hadoop at Yahoo! but now he’s at Cloudera.

I recently got annoyed by this New York Times “Bitz” blog, written by Somini Sengupta, about paying for privacy. It correctly pointed out that we get services on the web that seem `free’ to us, but there is an actual price which we pay, namely we are targets of ads and are sometimes forced to hand over personal information. Moreover, when we use `free’ services such as sending invitations to a party, we are subjecting all of our friends to advertising as well. From the post:

It was a perfect microcosm of the bargain we make with the Web every day. Send me ads based on what you know about me (bachelorette party vs. child’s birthday party) or take my money to keep my screen free of ads. That bargain was the topic of a fascinating study that asked how much we are willing to pay to keep our personal data to ourselves.

The article then explained the recent study. Namely, it seems that Germans aren’t willing to pay an extra 50 Euro cents for movie tickets to avoid giving out their cells numbers, but they do claim to care about personal information gathering. If there was no price difference they wanted the less intrusive version. The author seemed to think this is a paradox.

What? That’s kind of like me saying, I like better quality chocolate, but I’m not willing to pay $400 per serving for better chocolate, and then you say I’m a hypocrite and must not like chocolate.

The fact is, it’s all about the price. It’s always all about the price. There is no way, absolutely no way, that a cell phone number, reluctantly given in a situation such as for buying movie tickets, is worth 50 Euro cents to the company collecting the number. Therefore there’s no way you should have to pay that much to avoid giving it.

Here’s another example the blog gave, when explaining sending out a dozen web-based invitations to a party:

Faced with the choice of paying an extra $10 to keep my invitation advertisement-free, I dithered. It would be easy and inexpensive, I thought, to follow Wikipedia’s lead on this (the online encyclopedia is stubbornly ad-free). But then I thought about that little risk that accompanies the ease of digital consumption: Would my credit card information be safe with this online greeting card company? The worrywart in me won out. I did not pay the extra $10. I chose to lob advertisements at my friends.

I’m in internet advertising, and I can tell you right now that a very generous estimate of how much each opportunity to advertise for your guests on an invitation, and presumably the original email and anything you’d click on in receiving the invitation, could be worth up to 10 cents, max. That is to say, the offer of keeping your invitations advertisement free for $10 is an approximately 10x markup, and you’d be a fool to pay that much for something worth so little on the open market.

So here’s what drives me crazy. It’s not that people aren’t willing to pay for privacy. They are. They’re just not willing to overpay by an outrageous amount for privacy. Far from seeming like a paradox, this seems like good intuition for a market price. If there is a web-based company that offers to send out advertisement-free invitations for a dime per guest, I think about my friends and I say, yeah they’re worth a dime each (but actually I just send them an email to come to my party).

Consumers don’t (yet) actually have access to the market price of privacy- that market is dominated for now by large-scale institutional collectors of information, which is why we’re seeing outrageous markups like these for individuals. It will be interesting to see how that changes.

A few days ago I wrote about the idea of having a quant group working for consumers rather than against them. Today I wanted to spell out a few things I think that group could do.

The way I see it, there’s this whole revolution of data and technology and modeling going on right now, but only people with enough dough to pay for the quants are actually actively benefiting from the revolution. So people in finance, obviously, but also internet advertising companies.

The problem with this, besides the lopsidedness of it all, is that the actual models being used are for the most part predatory rather than helpful to the average person.

In other words, most models are answering question of the form:

1. how can we get you to spend money you don’t necessarily want to spend? or
2. how good a credit risk are you? or
3. how likely are you to come back and spend more money? or
4. how can we anticipate the market responding to end-of-month accounting shenanigans? I just threw this one in to give people a sense of how finance models work.

It all makes sense: these are businesses that are essentially bloodthirsty, making their money off your clicks and purchases. They are not going away.

Then there are some models that are already out there trying to make the user experience more enjoyable. They answer questions of the form:

1. If you like that, what else may you like? (Pandora, Netflix, Google)
2. If you bought that last week, maybe you’d like to buy it again this week?
3. If you bought that, maybe you’d like to buy this now?

The problem, as you can see, is that these second, helpfulish kinds of things quickly devolve into the first, predatory kinds of things. In other words, you’re being bombarded by ads and suggestions for spending more money than you actually want to spend.

What about stuff that you actually don’t want to do but that is probably not directly profitable to anyone? I’d love to see technology used to tackle some of these chores:

1. Figuring out what the best deal is on loans (credit card, student loans or mortgages), without becoming a lawyer. Here I’m not just saying they should all be clear about their terms- that’s a job for the CFPB. I mean there should be a website that asks me a few questions about what I need a loan for and points me to the best deal available.
2. Finding the best price for something. I discussed this briefly here.
3. Warnings about weird conditions and agreements, like mandatory arbitration.
4. Help finding a good doctor or a good plumber etc.
5. Help knowing when to go to the DMV or other public services building so the lines are bearable, or even better a way to do stuff on your computer or phone and avoid the trip altogether.
6. Getting your kids’ medical records to their schools and camps safely and efficiently.

Some of these things already exist (like the doctor thing) but aren’t well-known or well-publicized, so wouldn’t it be cool if this quant group also provided an app that would aggregate all these services into one place?

And for the things like #4, where you want to be warned before you buy, it’s too much work to go back to a webpage to check everything before buying. Instead, the app could follow you around the web when you’re shopping and overlay a “bullshit warning” icon on the potential purchase in situations where people have complained about unreasonable terms and conditions.

Let’s use technology in our favor. Instead of the companies collecting information about us, let’s collect information about them. Come to think of it, the CFPB should start this quant group today.

I recently read a Bloomberg article (via Naked Capitalism) about wine critics and how they have better powers of taste than we normal people do.

One of the things I love about this article is how it’s both completely dead obvious and at the same time totally outrageous when you think about it.

Obvious because when we see wine experts going on and on about what they can discern in their tiny sip, we know they either have magical powers or they’re lying, and since some of them can do this shit blindfolded we will assume they aren’t lying.

Outrageous because if you think about it, that means we follow the advice of people whose taste is provably different from ours. In other words, the word of experts is fundamentally irrelevant to us, and yet we care about it anyway.

My question is, why do we care?

Just to go over a couple of ground rules. First, yes, let’s assume that the wine experts really do have powers of discernment that are incredible and unusual, even though we have to trust an expert on that, which may seem contradictory. The truth is, this isn’t the first study that’s shown that, and I for one have hung out with these guys and they really do taste that minerally soil in the wine. I’m not even jealous.

Second, I’m not saying you care about wine experts’ opinions, but lets face it, lots of people do. And you could say it’s because of the performance that the experts give when they smell the wine and describe it, and I’ll agree that some of them can be poets, and that’s nice to see. But the truth is they also rate the wines with a number, and these numbers are printed in books, and lots of people carry these books around to wine shops and devote themselves to only buying wines with sufficiently high numbers, even though those people probably don’t themselves have the mouth smarts to tell the difference.

Now that we’ve framed the question, we can go ahead and make guesses as to why. Here are mine:

1. People are hoping that they themselves are also supertasters. This kind of seems like the most obvious one, but I can’t help think that true supertasters would not need other people’s opinions at all.
2. People think experts’ opinion of “good”, even if not completely the same as theirs, will be highly correlated, and so is better than nothing.
3. People want to be seen drinking wine that supertasters would drink, as a sort of cachet thing.

I think #3 above is pretty much the definition of snob, and I think it exists but is not the major reason people do things (but I could be wrong). I’m guessing it’s more typically #2, but even so it doesn’t explain the really expensive high-end wine market’s huge appeal, unless there are way more supertasters than I thought out there.

I think this question, of why people listen to expert advice even when it’s mostly irrelevant, is an important one, because it happens so much in our culture, and clearly not just about wine.

I for one am attracted to the idea of going one step further and ignoring expert advice. I see a natural progression: first, people are ignorant, second, they learn what experts think, and third, they ignore experts and go with their gut.

But even sexier is the idea of never listening to experts at all: skip step two. Am I the only person who thinks that’s sexy? I mean, I guess it mostly means you’re wasting your time, but it also comes out in the end with less herd mentality.

I think this desire I have of skipping the expert advice is very tied into why I despise the echo chamber of the web and how we are profiled online and how our environment is constantly updated and tailored to our profile. It’s in some sense an expert opinion on what we’d like, given our behavior, and I hate the finiteness of that concept, possibly in part because I’ve designed models like that and I know how dumb they are.

Anyway, I’d love to hear your thoughts, and if I’ve missed any reasons why people like to hear partially relevant expert opinion.