Cardinality Estimators do not Preserve Privacy

Abstract

Cardinality estimators like HyperLogLog are sketching algorithms that estimate the number of distinct elements in a large multiset. Their use in privacysensitive contexts raises the question of whether they leak private information. In particular, can they provide any privacy guarantees while preserving their strong aggregation properties?We formulate an abstract notion of cardinality estimators, that captures this aggregation requirement: one can merge sketches without losing precision. We propose an attacker model and a corresponding privacy definition, strictly weaker than differential privacy: we assume that the attacker has no prior knowledge of the data. We then show that if a cardinality estimator satisfies this definition, then it cannot have a reasonable level of accuracy. We prove similar results for weaker versions of our definition, and analyze the privacy of existing algorithms, showing that their average privacy loss is significant, even for multisets with large cardinalities. We conclude that strong aggregation requirements are incompatible with any reasonable definition of privacy, and that cardinality estimators should be considered as sensitive as raw data. We also propose risk mitigation strategies for their real-world applications.

Federated queries of clinical data repositories: balancing accuracy and privacy

“…As an aside, our privacy risk analysis differs considerably from Desfontaines, et al (2018), who argue that "cardinality estimators do not preserve privacy." However, their threat model includes an adversary who has incremental access to the sketches as they are being generated, rather than only a single sketch per hospital for a query.…”

Security of HyperLogLog (HLL) Cardinality Estimation: Vulnerabilities and Protection

“…To the authors' best knowledge, there is no previous work on the security of HLL. The closest works focus on the privacy implications of HLL [11] or on attacks on data structures like Bloom filters or the Count-Min sketch [12].…”

“…This would make harder for the attacker to identify which elements modify the cardinality estimation. However, it seems that the attacker could still get that information [11]. This can be done by testing different combinations of elements repeatedly.…”

Differentially-Private Multi-Party Sketching for Large-Scale Statistics

“…Recently, Desfontaines et al [18] considered privacy of cardinality estimators from a different angle. In particular, they assumed an insider risk scenario where the adversary has access to the actual sketch (rather than the output statistic) and showed that no noiseless sketch can be differentially private.…”

“…Recently, a seemingly contradictory result has been published. In particular, Desfontaines et al [18] showed that the LogLog sketch does not protect privacy from the inside attacker who has access to the sketch. Their result is not in conflict with our result in this section, since they assumed that the inside attacker also knows the hash key whereas our result assumes the private hash function.…”