Abstract
How should systems that infer relationships from incomplete data decide what to reveal so that people can act, while privacy, trust, and safety remain intact? I examine this question in networked settings where information is powerful and risky to share: a campus social game that turns private interactions into public guessing, and an early warning system that must turn forecasts into protective behavior during a disaster.
In 2024, an anonymous web service released on Valentine’s Day at the University of Virginia enabled students to send valentines by email while withholding sender identity. Recipients were prompted to guess who sent each message, such that each person guessed was sent another valentine from the guesser, turning a simple message-sending tool into a viral campus-wide social game. Midway through the 2024 run, a new “hint” mechanic was introduced that rewarded senders with additional clues for each valentine they sent. The resulting incentives created a design problem: generate hints that are engaging and informative while avoiding clues that simply reveal the observed interaction edges (for example, naming people the sender directly contacted). This work formalizes hint generation as neighborhood retrieval on an interaction-derived proximity graph and compares three approaches: a deliberately leaky baseline that returns direct neighbors, an unmodified diffusion method based on Personalized PageRank, and a diffusion method with an explicit “no direct out-neighbor” constraint. Offline evaluation on the Year 1 dataset (12,821 nodes, 40,803 directed edges) quantifies a clear tradeoff. Unmodified diffusion yields highly proximal hints but frequently surfaces direct neighbors, while censored diffusion eliminates direct-neighbor leakage at a measurable cost in proximity and identifiability. The results motivate practical product guidance for clue systems in sparse, incentive-shaped social graphs.
I also examine why many residents in the 2021 floods never received alerts or did not grasp their severity. I show how the systems in place imagined ideal, well-connected users that differed greatly from actual residents. Fragmented authority, uneven communication infrastructure, and vague messaging prevented escalation from forecasts to clear protective guidance. The exploration uncovers principles for designing warning systems that better align target and real users, informing how systems, including but certainly not limited to FloodWatch, can support practical action rather than only accurate sensing.
