We propose a protocol to construct privacy-preserving publish-subscribe overlays.
Two extensions, probabilistic forwarding and the shell game protect anonymity.
The construction protects against malicious insiders and global observers.
Simulation results show effective privacy-protection.