The broadcast channel (BC) with one common and two private messages with leakage constraints is studied, where leakage rate refers to the normalized mutual information between a message and a channel symbol string. Each private message is destined for a different user and the leakage rate to the other receiver must satisfy a constraint. This model captures several scenarios concerning secrecy, i.e., when both, either or neither of the private messages are secret. Inner and outer bounds on the leakage-capacity region are derived when the eavesdropper knows the codebook. The inner bound relies on a Marton-like code construction and the likelihood encoder. A Uniform Approximation Lemma is established that states that the marginal distribution induced by the encoder on each of the bins in the Marton codebook is approximately uniform. Without leakage constraints the inner bound recovers Marton's region and the outer bound reduces to the UVW-outer bound. The bounds match for semi-deterministic (SD) and physically degraded (PD) BCs, as well as for BCs with a degraded message set. The leakage-capacity regions of the SD-BC and the BC with a degraded message set recover past results for different secrecy scenarios. A Blackwell BC example illustrates the results and shows how its leakage-capacity region changes from the capacity region without secrecy to the secrecy-capacity regions for different secrecy scenarios.
Using a broadcast channel to transmit clients' data requests may impose privacy risks. In this paper, we address such privacy concerns in the index coding framework. We show how a malicious client can infer some information about the requests and side information of other clients by learning the encoding matrix used by the server. We propose an information-theoretic metric to measure the level of privacy and show how encoding matrices can be designed to achieve specific privacy guarantees. We then consider a special scenario for which we design a transmission scheme and derive the achieved lev…
In this paper, we investigate the robust beamforming schemes for a multi-user multiple-input-single-output (MU-MISO) system with per-antenna power constraints and quantized channel direction information (CDI) feedback. Our design objective is to maximize the expectation of the weighted sum-rate performance by means of controlling the interference leakage and properly allocating the power among user equipments (UEs).First, we prove the optimality of the non-robust zero-forcing (ZF) beamforming scheme in the sense of generating the minimum amount of average inter-UE interference under quantized …
The problem of publishing privacy-guaranteed data for hypothesis testing is studied using the maximal leakage (ML) as a metric for privacy and the type-II error exponent as the utility metric. The optimal mechanism (random mapping) that maximizes utility for a bounded leakage guarantee is determined for the entire leakage range for binary datasets. For non-binary datasets, approximations in the high privacy and high utility regimes are developed. The results show that, for any desired leakage level, maximizing utility forces the ML privacy mechanism to reveal partial to complete knowledge abou…
Machine learning models are known to memorize the unique properties of individual data points in a training set. This memorization capability can be exploited by several types of attacks to infer information about the training data, most notably, membership inference attacks. In this paper, we propose an approach based on information leakage for guaranteeing membership privacy. Specifically, we propose to use a conditional form of the notion of maximal leakage to quantify the information leaking about individual data entries in a dataset, i.e., the entrywise information leakage. We apply our p…
We study a statistical signal processing privacy problem, where an agent observes useful data $Y$ and wants to reveal the information to a user. Since the useful data is correlated with the private data $X$, the agent employs a privacy mechanism to generate data $U$ that can be released. We study the privacy mechanism design that maximizes the revealed information about $Y$ while satisfying a strong $\ell_1$-privacy criterion. When a sufficiently small leakage is allowed, we show that the optimizer vectors of the privacy mechanism design problem have a specific geometry, i.e., they are perturb…
The design of privacy mechanisms for two scenarios is studied where the private data is hidden or observable. In the first scenario, an agent observes useful data $Y$, which is correlated with private data $X$, and wants to disclose the useful information to a user. A privacy mechanism is employed to generate data $U$ that maximizes the revealed information about $Y$ while satisfying a privacy criterion. In the second scenario, the agent has additionally access to the private data. To this end, the Functional Representation Lemma and Strong Functional Representation Lemma are extended relaxing…
Most methods for publishing data with privacy guarantees introduce randomness into datasets which reduces the utility of the published data. In this paper, we study the privacy-utility tradeoff by taking maximal leakage as the privacy measure and the expected Hamming distortion as the utility measure. We study three different but related problems. First, we assume that the data-generating distribution (i.e., the prior) is known, and we find the optimal privacy mechanism that achieves the smallest distortion subject to a constraint on maximal leakage. Then, we assume that the prior belongs to s…
An information theoretic privacy mechanism design problem for two scenarios is studied where the private data is either hidden or observable. In each scenario, privacy leakage constraints are considered using two different measures. In these scenarios the private data is hidden or observable. In the first scenario, an agent observes useful data $Y$ that is correlated with private data $X$, and wishes to disclose the useful information to a user. A privacy mechanism is designed to generate disclosed data $U$ which maximizes the revealed information about $Y$ while satisfying a per-letter privac…
We study the problem of data disclosure with privacy guarantees, wherein the utility of the disclosed data is ensured via a \emph{hard distortion} constraint. Unlike average distortion, hard distortion provides a deterministic guarantee of fidelity. For the privacy measure, we use a tunable information leakage measure, namely \textit{maximal $α$-leakage} ($α\in[1,\infty]$), and formulate the privacy-utility tradeoff problem. The resulting solution highlights that under a hard distortion constraint, the nature of the solution remains unchanged for both local and non-local privacy requirements. …
This paper proposes a measurement approach for estimating the privacy leakage from Intrusion Detection System (IDS) alarms. Quantitative information flow analysis is used to build a theoretical model of privacy leakage from IDS rules, based on information entropy. This theoretical model is subsequently verified empirically both based on simulations and in an experimental study. The analysis shows that the metric is able to distinguish between IDS rules that have no or low expected privacy leakage and IDS rules with a significant risk of leaking sensitive information, for example on user behavi…
Providing a provable privacy guarantees while maintaining the utility of data is a challenging task in many real-world applications. Recently, a new framework called One-Sided Differential Privacy (OSDP) was introduced that extends existing differential privacy approaches. OSDP increases the utility of the data by taking advantage of the fact that not all records are sensitive. However, the previous work assumed that all records are statistically independent from each other. Motivated by occupancy data in building management systems, this paper extends the existing one-sided differential priva…
We introduce a tunable measure for information leakage called maximal alpha-leakage. This measure quantifies the maximal gain of an adversary in inferring any (potentially random) function of a dataset from a release of the data. The inferential capability of the adversary is, in turn, quantified by a class of adversarial loss functions that we introduce as $α$-loss, $α\in[1,\infty]$. The choice of $α$ determines the specific adversarial action and ranges from refining a belief (about any function of the data) for $α=1$ to guessing the most likely value for $α=\infty$ while refining the $α^{th…
Network Oblivious Transfer via Noisy Broadcast Channels
Institute for Communications Technology, Technische Universität Braunschweig（不伦瑞克工业大学通信技术研究所）；Technische Universität München（慕尼黑工业大学）；Munich Quantum Valley (MQV)（慕尼黑量子谷）；Munich Center for Quantum Science and Technology (MCQST)（慕尼黑量子科学与技术中心）
The total variation distance is proposed as a privacy measure in an information disclosure scenario when the goal is to reveal some information about available data in return of utility, while retaining the privacy of certain sensitive latent variables from the legitimate receiver. The total variation distance is introduced as a measure of privacy-leakage by showing that: i) it satisfies the post-processing and linkage inequalities, which makes it consistent with an intuitive notion of a privacy measure; ii) the optimal utility-privacy trade-off can be solved through a standard linear program …
We study an information theoretic privacy mechanism design problem for two scenarios where the private data is either observable or hidden. In each scenario, we first consider bounded mutual information as privacy leakage criterion, then we use two different per-letter privacy constraints. In the first scenario, an agent observes useful data $Y$ that is correlated with private data $X$, and wishes to disclose the useful information to a user. A privacy mechanism is designed to generate disclosed data $U$ which maximizes the revealed information about $Y$ while satisfying a bounded privacy leak…
We consider the secure communication problem for broadcasting of two encrypted sources. The sender wishes to broadcast two secret messages via two common key cryptosystems. We assume that the adversary can use the side-channel, where the side information on common keys can be obtained via the rate constraint noiseless channel. To solve this problem we formulate the post encryption coding system. On the information leakage on two secrete messages to the adversary, we provide an explicit sufficient condition to attain the exponential decay of this quantity for large block lengths of encrypted so…
In this study, we investigate fundamental trade-off among identification, secrecy, template, and privacy-leakage rates in biometric identification systems. Ignatenko and Willems (2015) studied this system assuming that the channel in the enrollment process of the system is noiseless and they did not consider the template rate. In the enrollment process, however, it is highly considered that noise occurs when bio-data is scanned. In this paper, we impose a noisy channel in the enrollment process and characterize the capacity region of the rate tuples. The capacity region is proved by a novel te…
School of Computing and Information Systems, University of Melbourne（墨尔本大学计算与信息系统学院）；Australian Tax Office（澳大利亚税务局）；School of Mathematics and Statistics, University of Melbourne（墨尔本大学数学与统计学院）
Blowfish privacy is a recent generalisation of differential privacy that enables improved utility while maintaining privacy policies with semantic guarantees, a factor that has driven the popularity of differential privacy in computer science. This paper relates Blowfish privacy to an important measure of privacy loss of information channels from the communications theory community: min-entropy leakage. Symmetry in an input data neighbouring relation is central to known connections between differential privacy and min-entropy leakage. But while differential privacy exhibits strong symmetry, Bl…
It is often necessary to disclose training data to the public domain, while protecting privacy of certain sensitive labels. We use information theoretic measures to develop such privacy preserving data disclosure mechanisms. Our mechanism involves perturbing the data vectors in a manner that strikes a balance in the privacy-utility trade-off. We use maximal information leakage between the output data vector and the confidential label as our privacy metric. We first study the theoretical Bernoulli-Gaussian model and study the privacy-utility trade-off when only the mean of the Gaussian distribu…
The inevitable leakage of privacy as a result of unrestrained disclosure of personal information has motivated extensive research on robust privacy-preserving mechanisms. However, existing research is mostly limited to solving the problem in a static setting with disregard for the privacy leakage over time. Unfortunately, this treatment of privacy is insufficient in practical settings where users continuously disclose their personal information over time resulting in an accumulated leakage of the users' sensitive information. In this paper, we consider privacy leakage over a finite time horizo…
A privacy-utility tradeoff is developed for an arbitrary set of finite-alphabet source distributions. Privacy is quantified using differential privacy (DP), and utility is quantified using expected Hamming distortion maximized over the set of distributions. The family of source distribution sets (source sets) is categorized into three classes, based on different levels of prior knowledge they capture. For source sets whose convex hull includes the uniform distribution, symmetric DP mechanisms are optimal. For source sets whose probability values have a fixed monotonic ordering, asymmetric DP m…
A privacy mechanism design problem is studied through the lens of information theory. In this work, an agent observes useful data $Y=(Y_1,...,Y_N)$ that is correlated with private data $X=(X_1,...,X_N)$ which is assumed to be also accessible by the agent. Here, we consider $K$ users where user $i$ demands a sub-vector of $Y$, denoted by $C_{i}$. The agent wishes to disclose $C_{i}$ to user $i$. Since $C_{i}$ is correlated with $X$ it can not be disclosed directly. A privacy mechanism is designed to generate disclosed data $U$ which maximizes a linear combinations of the users utilities while s…
This paper proposes a novel watchdog privatization scheme by generalizing local information privacy (LIP) to enhance data utility. To protect the sensitive features $S$ correlated with some useful data $X$, LIP restricts the lift, the ratio of the posterior belief to the prior on $S$ after and before accessing $X$. For each $x$, both maximum and minimum lift over sensitive features are measures of the privacy risk of publishing this symbol and should be restricted for the privacy-preserving purpose. Previous works enforce the same bound for both max-lift and min-lift. However, empirical observ…
This paper introduces a multi-round interaction problem with privacy constraints between two agents that observe correlated data. The agents alternately share data with one another for a total of K rounds such that each agent initiates sharing over K/2 rounds. The interactions are modeled as a collection of K random mechanisms (mappings), one for each round. The goal is to jointly design the K private mechanisms to determine the set of all achievable distortion-leakage pairs at each agent. Arguing that a mutual information-based leakage metric can be appropriate for streaming data settings, th…
This paper studies the problem of secure communication over the broadcast channel with receiver side information under the lens of individual secrecy constraints. That is, the transmitter wants to send two independent messages to two receivers which have, respectively, the desired message of the other receiver as side information, while keeping the eavesdropper ignorant of each message (i.e., the information leakage from each message to the eavesdropper is made vanishing). Building upon one-time pad, secrecy coding, and broadcasting schemes, achievable rate regions are investigated, and the ca…
On Privacy Mechanism Design Under a Bounded $α$-Lift Leakage Constraint with $χ^2$-Utility
Department of Information Science and Engineering, KTH Stockholm（瑞典皇家理工学院信息与工程学院）；Telstra Sydney（澳大利亚电信悉尼分公司）；School of Engineering and Technology, UNSW Canberra（新南威尔士大学堪培拉校区工程与技术学院）
We study the information leakage to a guessing adversary in index coding with a general message distribution. Under both vanishing-error and zero-error decoding assumptions, we develop lower and upper bounds on the optimal leakage rate, which are based on the broadcast rate of the subproblem induced by the set of messages the adversary tries to guess. When the messages are independent and uniformly distributed, the lower and upper bounds match, establishing an equivalence between the two rates.
A basic model for key agreement with biometric or physical identifiers is extended to include measurements of a hidden source through a general broadcast channel (BC). An inner bound for strong secrecy, maximum key rate, and minimum privacy-leakage and database-storage rates is proposed. The inner bound is shown to be tight for physically-degraded and less-noisy BCs.
In this paper, we first introduce the notion of channel leakage as the minimum mutual information between the channel input and channel output. As its name indicates, channel leakage quantifies the minimum information leakage to the malicious receiver. In a broad sense, it can be viewed as a dual concept of channel capacity, which characterizes the maximum information transmission to the targeted receiver. We obtain explicit formulas of channel leakage for the white Gaussian case, the colored Gaussian case, and the fading case. We then utilize this notion to investigate the fundamental limitat…
Differential privacy is a notion of privacy that has become very popular in the database community. Roughly, the idea is that a randomized query mechanism provides sufficient privacy protection if the ratio between the probabilities that two adjacent datasets give the same answer is bound by e^epsilon. In the field of information flow there is a similar concern for controlling information leakage, i.e. limiting the possibility of inferring the secret information from the observables. In recent years, researchers have proposed to quantify the leakage in terms of Rényi min mutual information, a …
The 2-receiver broadcast channel is studied: a network with three parties where the transmitter and one of the receivers are the primarily involved parties and the other receiver considered as third party. The messages that are determined to be communicated are classified into public, private and confidential based on the information they convey. The public message contains information intended for both parties and is required to be decoded correctly by both of them, the private message is intended for the primary party only, however, there is no secrecy requirement imposed upon it meaning tha…
The key-leakage-storage region is derived for a generalization of a classic two-terminal key agreement model. The additions to the model are that the encoder observes a hidden, or noisy, version of the identifier, and that the encoder and decoder can perform multiple measurements. To illustrate the behavior of the region, the theory is applied to binary identifiers and noise modeled via binary symmetric channels. In particular, the key-leakage-storage region is simplified by applying Mrs. Gerber's lemma twice in different directions to a Markov chain. The growth in the region as the number of …
