数据分析中隐私与实用的界限
The Boundary Between Privacy and Utility in Data Anonymization
摘要：
我们考虑了数据发布中的隐私问题：给定一个包含敏感信息的关系I，将其“匿名化”以获得视图V，使得一方面攻击者无法从V学习任何敏感信息，另一方面合法用户可以使用V来计算I上的有用统计信息。这些是相互冲突的目标。我们使用从文献中现有的隐私定义导出的隐私定义，其将给定元组t的先验概率Pr（t）与后验概率Pr（t）相关联|V），并提出了一个新颖的和相当实用的定义的效用。我们的主要结果如下。表示n为I的大小，m为从中提取I的域的大小（即n < m），则：当先验概率为Pr（t）= Omega（n/sqrt（m））时，对于某个t，不存在有用的匿名化算法，而当Pr（t）= O（n/m）时，对于所有元组t，则我们给出了一个既私密又有用的具体匿名化算法。我们的算法与文献中深入研究的k-匿名化算法有很大的不同，并且是基于对I的随机删除和插入。
英文摘要：
We consider the privacy problem in data publishing: given a relation I containing sensitive information 'anonymize' it to obtain a view V such that, on one hand attackers cannot learn any sensitive information from V, and on the other hand legitimate users can use V to compute useful statistics on I. These are conflicting goals. We use a definition of privacy that is derived from existing ones in the literature, which relates the a priori probability of a given tuple t, Pr(t), with the a posteriori probability, Pr(t | V), and propose a novel and quite practical definition for utility. Our main result is the following. Denoting n the size of I and m the size of the domain from which I was drawn (i.e. n < m) then: when the a priori probability is Pr(t) = Omega(n/sqrt(m)) for some t, there exists no useful anonymization algorithm, while when Pr(t) = O(n/m) for all tuples t, then we give a concrete anonymization algorithm that is both private and useful. Our algorithm is quite different from the k-anonymization algorithm studied intensively in the literature, and is based on random deletions and insertions to I.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
