Frequency Estimation under Local Differential Privacy [Experiments, Analysis and Benchmarks]

Towards Practical Differential Privacy for SQL Queries

Differential privacy promises to enable general data analytics while protecting individual privacy, but existing differential privacy mechanisms do not support the wide variety of features and databases used in real-world SQL-based analytics systems. This paper presents the first practical approach for differential privacy of SQL queries. Using 8.1 million real-world queries, we conduct an empirical study to determine the requirements for practical differential privacy, and discuss limitations of previous approaches in light of these requirements. To meet these requirements we propose elastic …

DuetSGX: Differential Privacy with Secure Hardware

Differential privacy offers a formal privacy guarantee for individuals, but many deployments of differentially private systems require a trusted third party (the data curator). We propose DuetSGX, a system that uses secure hardware (Intel's SGX) to eliminate the need for a trusted data curator. Data owners submit encrypted data that can be decrypted only within a secure enclave running the DuetSGX system, ensuring that sensitive data is never available to the data curator. Analysts submit queries written in the Duet language, which is specifically designed for verifying that programs satisfy d…

On the `Semantics' of Differential Privacy: A Bayesian Formulation

Differential privacy is a definition of "privacy'" for algorithms that analyze and publish information about statistical databases. It is often claimed that differential privacy provides guarantees against adversaries with arbitrary side information. In this paper, we provide a precise formulation of these guarantees in terms of the inferences drawn by a Bayesian adversary. We show that this formulation is satisfied by both "vanilla" differential privacy as well as a relaxation known as (epsilon,delta)-differential privacy. Our formulation follows the ideas originally due to Dwork and McSherry…

SoK: Chasing Accuracy and Privacy, and Catching Both in Differentially Private Histogram Publication

Histograms and synthetic data are of key importance in data analysis. However, researchers have shown that even aggregated data such as histograms, containing no obvious sensitive attributes, can result in privacy leakage. To enable data analysis, a strong notion of privacy is required to avoid risking unintended privacy violations. Such a strong notion of privacy is differential privacy, a statistical notion of privacy that makes privacy leakage quantifiable. The caveat regarding differential privacy is that while it has strong guarantees for privacy, privacy comes at a cost of accuracy. Desp…

改进差分隐私和k-匿名中的数据效用

Improving data utility in differential privacy and k-anonymity

本文重点研究了两种主流的隐私模型：k-匿名和差分隐私。一旦选择了一个隐私模型，目标是在尽可能多地保留数据效用的同时实施它。本论文的主要目的是提高k-匿名和差异隐私数据发布中的数据效用。k-匿名性有几个缺点。在披露限制方面，缺乏对属性披露和知情入侵者的保护。在数据实用程序方面，处理大量的准标识符属性是有问题的。我们建议放宽k-匿名处理这些问题。差分隐私通过噪声添加来限制披露风险。拉普拉斯分布通常用于随机噪声。我们发现，拉普拉斯分布是不是最佳的：相同的披露限制保证可以通过增加更少的噪音。最佳的单变量和多变量噪声的特征和构造。实现差分隐私的常见机制不考虑用户的先验知识;它们隐含地假设关于查询响应的初始知识为零。我们提出了一种机制，专注于限制知识增益超过先验知识。基于微聚合的k-匿名和差分隐私可以结合起来，以产生具有差分隐私的强隐私保证和改进的数据准确性的微数据发布。最后一个贡献是深入研究了t-贴近度和差分隐私之间的关系。我们看到，对于一个特定的距离，并在一些合理的假设下，入侵者的知识，t-接近导致差分隐私。

时间相关下的差分隐私位置保护

Protecting Locations with Differential Privacy under Temporal Correlations

随着GPS设备和基于位置的应用程序的快速发展，对位置隐私的担忧经常出现。虽然空间变换技术，如位置扰动或泛化已被广泛研究，大多数技术依赖于语法隐私模型没有严格的隐私保证。它们中的许多只考虑静态场景或在单个时间戳处扰动位置，而不考虑移动用户位置的时间相关性，因此容易受到各种推断攻击。虽然差分隐私已经被接受为隐私保护的标准，但是在基于位置的应用中应用差分隐私提出了新的挑战，因为保护需要针对单个用户即时地实施，并且需要结合用户位置之间的时间相关性。在本文中，我们提出了一个系统的解决方案，以保护位置隐私，严格的隐私保证。首先，我们提出了一个新的定义，“$δ$ -位置集”为基础的差分隐私，占在位置数据的时间相关性。其次，我们证明了著名的$\ell_1$ -范数敏感性不能捕捉多维空间中的几何敏感性，并提出了一个新的概念，敏感性壳，基于该概念，差分隐私的误差是有界的。第三，为了获得最佳效用，我们提出了一个平面各向同性机制（PIM）的位置扰动，这是第一个机制实现的差分隐私的下限。在真实数据集上的实验也表明，PIM在数据效用上明显优于基线方法。