  Recommendation systems are information-filtering systems that tailor
information to users on the basis of knowledge about their preferences. The
ability of these systems to profile users is what enables such intelligent
functionality, but at the same time, it is the source of serious privacy
concerns. In this paper we investigate a privacy-enhancing technology that aims
at hindering an attacker in its efforts to accurately profile users based on
the items they rate. Our approach capitalizes on the combination of two
perturbative mechanisms---the forgery and the suppression of ratings. While
this technique enhances user privacy to a certain extent, it inevitably comes
at the cost of a loss in data utility, namely a degradation of the
recommendation's accuracy. In short, it poses a trade-off between privacy and
utility.
  The theoretical analysis of said trade-off is the object of this work. We
measure privacy as the Kullback-Leibler divergence between the user's and the
population's item distributions, and quantify utility as the proportion of
ratings users consent to forge and eliminate. Equipped with these quantitative
measures, we find a closed-form solution to the problem of optimal forgery and
suppression of ratings, and characterize the trade-off among privacy, forgery
rate and suppression rate. Experimental results on a popular recommendation
system show how our approach may contribute to privacy enhancement.
