Differential Privacy Xintao Wu Oct 31, 2012 Sanitization approaches Input perturbation Add noise to data Generalize data Summary statistics Means, variances Marginal totals Model parameters Output perturbation Add noise to summary statistics Blending/hiding into a crowd K-anonymity based approaches Adversary may have various background knowledge to breach privacy Privacy models often assume the adversarys background knowledge is given Classic intuition for privacy Privacy means that anything can be learned about a respondent from the statistical database can be learned without access to the database. Security of encryption Anything about the plaintext that can be learned from a ciphertext can be learned without the ciphertext. Prior and posterior views about an individual should not change much Motivation Publicly release statistical information about a dataset without compromising the privacy of any individual Requirement Anything that can be learned about a respondent from a statistical database should be learnable without access to the database Reduce the knowledge gain of joining the database Require that the probability distribution on the public results is essentially the same independent of whether any individual opts in to, or opts out of the dataset Definition Sensitivity function Captures how great a difference must be hidden by the additive noise LAP distribution noise Guassian noise Adding LAP noise Proof sketch Delta_f=1, epsilon varies Delta_f=1 epsilon=0.01 Delta_f=1 epsilon=0.1 Delta_f=1 epsilon=1 Delta_f=1 epsilon=2 Delta_f=1 epsilon=10 Delta_f=2, epsilon varies Delta_f=3, epsilon varies Delta_f=10000, epsilon varies Composition Sequential composition Parallel composition --for disjoint sets, the ultimate privacy guarantee depends only on the worst of the guarantees of each analysis, not the sum. Example Let us assume a table with 1000 customers and each record has attributes: name, gender, city, cancer, salary. For attribute city, we assume the domain size is 10; for attribute cancer, we only record Yes or No for each customer; for attribute salary, the domain range is 0-10k. The privacy threshold \epsilon is a constant 0.1 set by data owner. For one single query How many customers got cancer? The adversary is allowed to ask three times of the query shown the above. Example (continued) How many customers got cancer in each city? For one single query What is the sum of salaries across all customers? Type of computing (query) some are very sensitive, others are not single query vs. query sequence query on disjoint sets or not outcome expected: number vs. arbitrary interactive vs. not interactive Sensitivity Global sensitivity Local sensitivity Smooth sensitivity Different areas of DP PINQ DM with DP Optimizing linear counting queries under differential privacy. -Matrix mechanism for answering a workload of predicate counting queries PPDM interface--PINQ A programmable privacy preserving layer Add calibrated noise to each query Need to assign privacy cost budget Data Mining with DP Previous studyprivacy preserving interface ensures everything about DP Problemsinferior results if the interface is utilized simply during data mining Solutionconsider both together DP ID3 noisy count evaluate all attributes in one exponential mechanism query using entire budget instead of splitting budget among multiple DP in Social Networks Page of pakdd11 tutorialpakdd11 tutorial