The Big Picture
A coordinated group on one side of a matching market can infer a lot of private preference info from repeated runs: they can recover every honest participant's top choice within n rounds and often learn the top 20% of rankings in real datasets.
ON THIS PAGE
The Evidence
Coordinated dishonest agents who control one side and can change their preferences across repeated matchings can extract substantial private preference information from only the published stable matchings. If every honest participant has identical rankings the attacker can recover full preference lists in n rounds; in general they can always recover each honest agent's top choice within n rounds. Practical experiments on real-world data show attackers often learn about the top 20% of honest agents' rankings, and some common matching procedures (when the dishonest side initiates proposals or when matching is peer-to-peer) are especially vulnerable. stable matchings
Data Highlights
1Top choice recovery: the attacker can learn every honest agent's first preference within n matching rounds (n = number of agents per side).
2Full-list worst case: if all honest agents share identical rankings, the attacker can reconstruct the entire preference ordering in n rounds.
3Empirical leakage: on real datasets the attack often reveals roughly the top 20% of each honest agent's ranking.
What This Means
Engineers and product leads building two-sided marketplaces (college admission, residency match, job platforms, project assignment) should care because repeated public match outputs can leak sensitive ranking data. Privacy and security teams, and regulators overseeing matching markets, should treat repeated matching runs as a potential vector for inference attacks and consider mitigations or privacy-preserving designs.
Not sure where to start?Get personalized recommendations
Key Figures
Fig 2: Figure 2 . Results for brute-forcing all possible preferences for the honest agents using all possible preferences for the dishonest agents.
Fig 3: Figure 3 . Uncertainty for 64 × 64 64\times 64 preference matrices with varying dissimilarity. The error bars show the minimum and maximum among 50 samples.
Fig 4: Figure 4 . Learned preference information for mapel datasets. The y-axes denote the agents, and the x-axis denotes the preferences. The colors indicate the size of the possible preference sets at the positions in the preference matrices after applying the Targeted-Propose strategy. Three subgroups of data from the dataset have been selected for which we computed the element-wise median of the set sizes in the matrices, and additionally the median over all 1006 instances in the dataset was taken (bottom right). Before the aggregation with the median, the agents are sorted according to how much was learned for them.
Fig 5: Figure 5 . Learned student preferences for the academic years 2007 to 2010 (left to right) using Targeted-Propose. The students are on the y-axis and the preferences are on the x-axis, starting with top preferences on the left side. The colors indicate the size of the preference possibility sets.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreLimitations
Results assume a strong adversary that fully coordinates the dishonest side and can change its reported preferences between rounds; weaker attackers will learn less. Leakage depends heavily on the structure of honest participants' preferences—if everyone's top choices differ, leakage is much smaller. Existing privacy-preserving techniques could prevent these leaks but are often computationally costly or impractical for large markets. privacy-preserving techniques
Methodology & More
Model and attack idea: consider a two-sided market with n honest agents and n dishonest agents; dishonest agents share information and can choose how to report preferences across repeated runs. Each run publishes a stable matching (the final pairs) only. By carefully choosing their reported rankings and observing who they get matched with, dishonest agents derive logical constraints on where honest agents must have placed certain partners, gradually shrinking the set of possibilities for each rank position.
Main findings and implications: theoretically, an attacker can always learn every honest agent's top-ranked partner within n runs, and in the extreme case where all honest agents have identical preference lists, the attacker can reconstruct full preference orders in n runs. Several commonly used matching modes are vulnerable—when the dishonest side does the proposing or when matching is done in a decentralized peer-to-peer manner, leakage is larger. Simulations on synthetic and real-world preference data show practical attacks reveal meaningful information (often the top ~20% of preferences). The work highlights a real privacy gap: publishing only final matchings repeatedly is not enough to prevent inference, so designers of matching markets should consider stronger privacy mechanisms or restrict repeated, adversary-controlled runs to reduce information leakage. logical constraints decentralized peer-to-peer
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
All authors have low h-indexes, no affiliations listed and arXiv-only venue with zero citations — an emerging/limited-info profile.