  Rankings are widely collected in various real-life scenarios, leading to the
leakage of personal information such as users' preferences on videos or news.
To protect rankings, existing works mainly develop privacy protection on a
single ranking within a set of ranking or pairwise comparisons of a ranking
under the $\epsilon$-differential privacy. This paper proposes a novel notion
called $\epsilon$-ranking differential privacy for protecting ranks. We
establish the connection between the Mallows model (Mallows, 1957) and the
proposed $\epsilon$-ranking differential privacy. This allows us to develop a
multistage ranking algorithm to generate synthetic rankings while satisfying
the developed $\epsilon$-ranking differential privacy. Theoretical results
regarding the utility of synthetic rankings in the downstream tasks, including
the inference attack and the personalized ranking tasks, are established. For
the inference attack, we quantify how $\epsilon$ affects the estimation of the
true ranking based on synthetic rankings. For the personalized ranking task, we
consider varying privacy preferences among users and quantify how their privacy
preferences affect the consistency in estimating the optimal ranking function.
Extensive numerical experiments are carried out to verify the theoretical
results and demonstrate the effectiveness of the proposed synthetic ranking
algorithm.
