洗牌模型中重识别攻击的贝叶斯优势
Bayesian Advantage of Re-Identification Attack in the Shuffle Model
AI总结：
本文首次系统研究洗牌模型下重识别攻击的贝叶斯优势，推导出成功概率的精确解析表达式与渐近刻画，建立其与总变差距离的紧致互界，并首次给出洗牌差分隐私中攻击成功概率至多为 $e^{\varepsilon}/n$ 的上界。
摘要：
洗牌模型通过随机置换用户消息来匿名化数据，已在密码学和差分隐私领域被广泛采用。本文首次系统研究了洗牌模型下重识别用户消息的贝叶斯优势。我们从一个基本设定开始：一个样本从分布 $P$ 中抽取，$n - 1$ 个样本从分布 $Q$ 中抽取，之后所有 $n$ 个样本被随机洗牌。我们将 $β_n(P, Q)$ 定义为贝叶斯最优敌手识别来自 $P$ 的样本的成功概率，并将加性和乘性贝叶斯优势分别定义为 $\mathsf{Adv}_n^{+}(P, Q) = β_n(P,Q) - \frac{1}{n}$ 和 $\mathsf{Adv}_n^{\times}(P, Q) = n \cdot β_n(P,Q)$。我们推导出 $β_n(P, Q)$ 的精确解析表达式和渐近刻画，并在若干代表性场景中进行了评估。此外，我们建立了加性贝叶斯优势与总变差距离之间的（近乎）紧致互界。最后，我们将分析扩展到基本设定之外，首次给出了洗牌差分隐私中贝叶斯攻击成功概率的上界。具体而言，当 $n$ 个用户的输出——每个输出都经过一个 $\varepsilon$-差分隐私本地随机化器处理——被洗牌后，攻击者成功重识别任意目标用户消息的概率至多为 $e^{\varepsilon}/n$。
英文摘要：
The shuffle model, which anonymizes data by randomly permuting user messages, has been widely adopted in both cryptography and differential privacy. In this work, we present the first systematic study of the Bayesian advantage in re-identifying a user's message under the shuffle model. We begin with a basic setting: one sample is drawn from a distribution $P$, and $n - 1$ samples are drawn from a distribution $Q$, after which all $n$ samples are randomly shuffled. We define $β_n(P, Q)$ as the success probability of a Bayes-optimal adversary in identifying the sample from $P$, and define the additive and multiplicative Bayesian advantages as $\mathsf{Adv}_n^{+}(P, Q) = β_n(P,Q) - \frac{1}{n}$ and $\mathsf{Adv}_n^{\times}(P, Q) = n \cdot β_n(P,Q)$, respectively. We derive exact analytical expressions and asymptotic characterizations of $β_n(P, Q)$, along with evaluations in several representative scenarios. Furthermore, we establish (nearly) tight mutual bounds between the additive Bayesian advantage and the total variation distance. Finally, we extend our analysis beyond the basic setting and present, for the first time, an upper bound on the success probability of Bayesian attacks in shuffle differential privacy. Specifically, when the outputs of $n$ users -- each processed through an $\varepsilon$-differentially private local randomizer -- are shuffled, the probability that an attacker successfully re-identifies any target user's message is at most $e^{\varepsilon}/n$.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
