MU-MAP: Privacy-Preserving Utility Mining

• MU-MAP is a privacy-preserving periodic utility mining algorithm that hides sensitive high-utility itemsets by modifying transactions based on sensitive utility and maxPer values.
• It employs a two-stage selection rule by first prioritizing sensitive itemsets through their current utility and then selecting the victim item with the highest maxPer value to promptly increase periodic gaps.
• The algorithm minimizes side effects like Hiding Failure, Missing Cost, and Artificial Cost while maintaining utility similarity measures, ensuring minimal impact on the sanitized database.

Maximum sensitive Utility-MAximum maxPer item (MU-MAP) is a privacy-preserving periodic utility mining algorithm for hiding sensitive periodic high-utility itemsets (PHUIs) by modifying a transactional database into a sanitized database $D'$. Its defining selection rule is two-stage: it first prioritizes a sensitive itemset through its current sensitive utility, then, inside the most consequential supporting transaction, it chooses the item with the largest recorded $\maxPer$ value. The stated objective is to ensure that no user-designated sensitive PHUI remains discoverable after sanitization while minimizing Hiding Failure (HF), Missing Cost (MC), and Artificial Cost (AC), and while preserving utility-oriented similarity measures such as Database Utility Similarity (DUS) (Zhou et al., 19 Sep 2025). In a broader interpretive usage, the same phrase has also been applied to sensitivity-aware maximization under differential privacy and to best-item identification under Random Utility Models (RUMs), although those papers do not introduce MU-MAP as the name of their original algorithms (Chaudhuri et al., 2014, Saha et al., 2020).

1. Formal setting in periodic high-utility itemset hiding

MU-MAP is formulated on a time-ordered transactional database $D=\{T_1,T_2,\dots,T_m\}$ with transaction identifiers $id \in \{1,\dots,m\}$ and item universe $I=\{i_1,i_2,\dots,i_n\}$. For an itemset $X \subseteq I$, the transaction-id set is defined as

$$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$

with $\ell \le |D|$. Periodicity is computed from the boundary-anchored sequence

$P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$

where $tid_0=0$ and $\maxPer$0. From this sequence, the paper defines

$\maxPer$1

and

$\maxPer$2

where $\maxPer$3 is the support. The exclusion of the first and last gaps in $\maxPer$4 follows PHM.

An itemset $\maxPer$5 is a PHUI when it simultaneously satisfies the periodicity and utility thresholds: $\maxPer$6 Utility is defined from internal quantity $\maxPer$7 and external utility $\maxPer$8. The item utility in a transaction is

$\maxPer$9

the within-transaction utility of an itemset is

$D=\{T_1,T_2,\dots,T_m\}$0

and aggregate utility is

$D=\{T_1,T_2,\dots,T_m\}$1

The database owner first mines the set $D=\{T_1,T_2,\dots,T_m\}$2 of all PHUIs under the chosen thresholds and then selects a subset $D=\{T_1,T_2,\dots,T_m\}$3 of sensitive periodic high-utility itemsets (SPHUIs) to be hidden. MU-MAP takes $D=\{T_1,T_2,\dots,T_m\}$4 and $D=\{T_1,T_2,\dots,T_m\}$5 as input and seeks a sanitized database $D=\{T_1,T_2,\dots,T_m\}$6 in which no $D=\{T_1,T_2,\dots,T_m\}$7 remains a PHUI, while minimizing side effects and preserving as much database utility and structure as possible (Zhou et al., 19 Sep 2025).

2. Selection rule and sanitization workflow

The phrase “Maximum sensitive Utility–MAximum maxPer item” encodes the algorithm’s two decision dimensions. Sensitive itemsets are processed in descending order of itemset length, so longer sensitive itemsets are handled first. For a selected sensitive itemset $D=\{T_1,T_2,\dots,T_m\}$8, the victim transaction $D=\{T_1,T_2,\dots,T_m\}$9 is chosen as the transaction contributing the maximum utility of that itemset: $id \in \{1,\dots,m\}$0 The current sensitive-utility slack is then

$id \in \{1,\dots,m\}$1

where $id \in \{1,\dots,m\}$2 is the current total utility recorded in the Sensitive Itemset List. The paper also defines

$id \in \{1,\dots,m\}$3

and derives a minimum support threshold from the average-period constraint,

$id \in \{1,\dots,m\}$4

The hiding loop continues while

$id \in \{1,\dots,m\}$5

Within the selected transaction, MU-MAP chooses the victim item by the “maximum maxPer” rule: $id \in \{1,\dots,m\}$6 where $id \in \{1,\dots,m\}$7 is the per-item $id \in \{1,\dots,m\}$8 value stored in the Sensitive Item List for items of $id \in \{1,\dots,m\}$9. Operationally, this is intended to increase inter-occurrence gaps quickly, thereby pushing $I=\{i_1,i_2,\dots,i_n\}$0 beyond $I=\{i_1,i_2,\dots,i_n\}$1, or reducing $I=\{i_1,i_2,\dots,i_n\}$2 below $I=\{i_1,i_2,\dots,i_n\}$3, or reducing utility below $I=\{i_1,i_2,\dots,i_n\}$4 (Zhou et al., 19 Sep 2025).

Sanitization proceeds by one of two actions. If the selected item’s transaction-level utility does not exceed the current slack,

$I=\{i_1,i_2,\dots,i_n\}$5

MU-MAP deletes the item from the selected transaction. The updates include

$I=\{i_1,i_2,\dots,i_n\}$6

$I=\{i_1,i_2,\dots,i_n\}$7

if the itemset no longer appears in that transaction, and

$I=\{i_1,i_2,\dots,i_n\}$8

The algorithm then refreshes SISL, SIL, and $I=\{i_1,i_2,\dots,i_n\}$9.

Otherwise, it performs quantity reduction. The quantity decrement is

$X \subseteq I$0

followed by

$X \subseteq I$1

and

$X \subseteq I$2

As soon as

$X \subseteq I$3

the sensitive itemset is removed from $X \subseteq I$4. The algorithm terminates when $X \subseteq I$5, at which point the sanitized database $X \subseteq I$6 is returned.

The running example in the paper uses a database with $X \subseteq I$7 transactions, thresholds $X \subseteq I$8, $X \subseteq I$9, $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$0, $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$1, and $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$2, and sensitive PHUIs $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$3, $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$4, and $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$5. After sorting by length, MU-MAP processes $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$6 first, computes $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$7, selects $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$8 because $$ID(X)=\{id \mid X \subseteq T_{id}\}=\{id_1,id_2,\dots,id_\ell\},$$9 is highest, chooses item $\ell \le |D|$0 because it has the largest recorded $\ell \le |D|$1, and deletes it since $\ell \le |D|$2. The example then updates support and periodicity information and continues until all sensitive PHUIs are hidden (Zhou et al., 19 Sep 2025).

3. Data structures, evaluation metrics, and computational profile

MU-MAP relies on two auxiliary data structures. The Sensitive Itemset List (SISL) for a sensitive itemset $\ell \le |D|$3 stores the itemset identifier, total utility $\ell \le |D|$4, a $\ell \le |D|$5 list for transactions containing $\ell \le |D|$6, the current $\ell \le |D|$7, and support $\ell \le |D|$8. SISL therefore supports direct access to the victim transaction, the current periodicity state, and the support count.

The Sensitive Item List (SIL) is maintained per sensitive itemset and per supporting transaction. For each transaction $\ell \le |D|$9 containing $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$0, SIL stores 5-tuples

$P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$1

where $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$2 is the transaction identifier, $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$3 the items of $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$4 present in the transaction, $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$5 the utility per item in the transaction, $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$6 the internal quantity for each such item, and $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$7 the item-level $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$8. This supports rapid implementation of the “maximum maxPer” victim selection rule and localized updates to quantities and utilities (Zhou et al., 19 Sep 2025).

The principal side-effect metrics are set-based. If $P(X)=\{tid_{j+1}-tid_j \mid j=0,1,\dots,\ell\},$9 denotes the PHUIs in $tid_0=0$0, $tid_0=0$1 the sensitive PHUIs selected by the user, and $tid_0=0$2 the PHUIs in $tid_0=0$3, then

$tid_0=0$4

$tid_0=0$5

$tid_0=0$6

The paper also uses Itemset Utility Similarity (IUS), Database Utility Similarity (DUS), and Database Structure Similarity (DSS). DUS is defined as

$tid_0=0$7

where $tid_0=0$8 is the transaction utility. DSS is given as a cosine similarity between transaction-frequency vectors of $tid_0=0$9 and $\maxPer$00.

The stated asymptotic complexity has three phases. Building SISL and SIL for $\maxPer$01 sensitive itemsets, each with $\maxPer$02 items, costs $\maxPer$03 time and space. Sorting the sensitive itemsets costs $\maxPer$04 time and $\maxPer$05 space. The hiding loop has outer complexity $\maxPer$06, while the inner while-loop can in the worst case scan $\maxPer$07 transactions with selection costs $\maxPer$08 per iteration, giving worst-case time

$\maxPer$09

best-case time

$\maxPer$10

and $\maxPer$11 extra space for victim variables. Overall time is reported as

$\maxPer$12

and overall space as

$\maxPer$13

MU-MIP is reported to share the same asymptotic complexities (Zhou et al., 19 Sep 2025).

4. Empirical behavior and comparison with related hiding strategies

The reported experiments use six real datasets: kosarak, retail, mushroom, liquor, chainstore, and foodmart. Internal utilities are randomized in $\maxPer$14, external utilities in $\maxPer$15, and periodicity thresholds are set per dataset. Sensitive PHUIs are chosen randomly from the discovered PHUIs, and the sensitive percentage $\maxPer$16 controls the fraction marked sensitive (Zhou et al., 19 Sep 2025).

Across the tested settings, MU-MAP and MU-MIP are reported to achieve

$\maxPer$17

systematically on all datasets. HF is also reported as consistently $\maxPer$18, meaning that all selected sensitive PHUIs are hidden under the tested configurations. MU-MAP maintains DUS above $\maxPer$19 and often above $\maxPer$20 on sparse datasets such as chainstore and foodmart. The results therefore associate MU-MAP with low global utility loss while eliminating the designated sensitive patterns.

The comparison with MU-MIP isolates the effect of the victim-item rule. MU-MIP selects the item with the smallest $\maxPer$21,

$\maxPer$22

whereas MU-MAP uses the largest $\maxPer$23. According to the reported explanation, MU-MAP tends to increase periodic gaps more quickly, which can violate periodicity constraints faster and reduce the number of required modifications. Empirically, MU-MAP generally shows lower MC than MU-MIP on several datasets and is often faster, although the paper notes that data characteristics can reverse the runtime trend in some cases.

The contrast with traditional non-periodic privacy-preserving utility mining methods is central. Classical PPUM algorithms such as SMAU, SMIU, and SMSE optimize under utility-centric criteria but do not explicitly control periodicity. In periodic settings, the reported result is that such methods frequently produce non-zero AC, because changes that ignore inter-occurrence gaps can generate spurious PHUIs in the sanitized database. MU-MAP avoids this outcome, in the reported experiments, by jointly controlling utility, support, and periodicity rather than utility alone (Zhou et al., 19 Sep 2025).

5. Sensitivity-aware maximization beyond periodic utility mining

A broader, interpretive use of MU-MAP treats it as a generic “maximum sensitive utility” paradigm in which maximization is constrained by a sensitivity parameter. In differential privacy, this reading is supplied by the Large Margin Mechanism (LMM) for the private maximization problem over a finite universe $\maxPer$24. There, one seeks an item $\maxPer$25 maximizing a data-dependent utility $\maxPer$26 under differential privacy, with per-item sensitivity

$\maxPer$27

The paper’s canonical model assumes

$\maxPer$28

for all neighboring datasets, equivalently $\maxPer$29. LMM privately certifies the number $\maxPer$30 of near-maximizers using a noisy maximum and a sparse-vector search, then runs a restricted Exponential Mechanism over the top-$\maxPer$31 items. Its privacy guarantee is $\maxPer$32-approximate differential privacy, and its utility guarantee depends on $\maxPer$33 rather than $\maxPer$34, where $\maxPer$35. Theorem 2 states that if the dataset satisfies an $\maxPer$36-margin condition with

$\maxPer$37

then, with probability at least $\maxPer$38,

$\maxPer$39

The same synthesis notes that, for general sensitivity $\maxPer$40, one replaces $\maxPer$41 by $\maxPer$42 throughout, and the utility loss becomes

$\maxPer$43

This establishes a sensitivity-aware maximization rule whose loss depends on $\maxPer$44, privacy parameters, and the number of near-maximizers rather than the full universe size (Chaudhuri et al., 2014).

A second interpretive extension appears in best-item learning under RUMs. Here each item $\maxPer$45 has latent utility $\maxPer$46, random utility $\maxPer$47, and pairwise win probability

$\maxPer$48

The key sensitivity quantity is the pairwise advantage

$\maxPer$49

together with the minimum advantage ratio $\maxPer$50. Under a linear lower bound

$\maxPer$51

the paper derives

$\maxPer$52

and denotes $\maxPer$53. This constant $\maxPer$54 depends only on the noise distribution and controls sample complexity. The winner-feedback algorithm is $\maxPer$55-PAC with

$\maxPer$56

rounds, while top-$\maxPer$57 ranking feedback improves this to

$\maxPer$58

For iid Gumbel noise, the paper gives

$\maxPer$59

hence

$\maxPer$60

This is not the PPPUM algorithm, but it is a closely related sensitivity-aware maximization formulation in which identification of the best item is governed by how strongly observed outcomes respond to utility gaps (Saha et al., 2020).

Taken together, these two interpretive extensions suggest that MU-MAP can denote a family resemblance rather than a single formalism: in each case, utility maximization is modulated by a sensitivity term—periodicity-aware side effects in PPPUM, per-item sensitivity under differential privacy, or pairwise-response sensitivity in RUM learning.

6. Limitations, assumptions, and scope conditions

Within privacy-preserving periodic utility mining, MU-MAP assumes a static, time-ordered database and fixed periodicity thresholds. The reported limitations note that if periodic behavior drifts or windows slide, recomputing SISL, SIL, and periodicity can become costly. The method is also user-driven in its choice of sensitive PHUIs, so the observed trade-offs in MC and DUS depend on which PHUIs are designated sensitive and on how strongly they overlap with non-sensitive patterns. Dense datasets with many overlapping periodic itemsets may require more modifications, increasing MC or runtime (Zhou et al., 19 Sep 2025).

A common misconception is to treat MU-MAP as a generic privacy mechanism with a single semantics across all cited works. The explicit algorithm introduced under that name is the PPPUM method for sanitizing databases against disclosure of sensitive PHUIs. The differential privacy and RUM settings instead provide broader sensitivity-aware interpretations of “maximum sensitive utility” selection. This distinction matters because the guarantees are different in kind: MU-MAP in PPPUM is evaluated through hiding and side-effect metrics such as HF, MC, AC, DUS, and DSS; LMM is evaluated by $\maxPer$61-differential privacy and margin-dependent utility guarantees; RUM best-item learning is evaluated by PAC sample complexity and distribution-dependent sensitivity constants.

The stated directions for future work in the PPPUM setting include refined victim selection that combines periodicity and utility side-effect modeling, dynamic or streaming settings with incremental SISL/SIL maintenance, distributed implementations for large-scale datasets with ultra-long periodicities, and sharper theoretical analysis of side-effect bounds, including conditions ensuring $\maxPer$62 and tighter guarantees on MC and DUS under particular distributions (Zhou et al., 19 Sep 2025).