Differentially Private Histogram Publication

Abstract

Abstract-Differential privacy (DP) is a promising scheme for releasing the results of statistical queries on sensitive data, with strong privacy guarantees against adversaries with arbitrary background knowledge. Existing studies on DP mostly focus on simple aggregations such as counts. This paper investigates the publication of DP-compliant histograms, which is an important analytical tool for showing the distribution of a random variable, e.g., hospital bill size for certain patients. Compared to simple aggregations whose results are purely numerical, a histogram query is inherently more complex, since it must also determine its structure, i.e., the ranges of the bins. As we demonstrate in the paper, a DP-compliant histogram with finer bins may actually lead to significantly lower accuracy than a coarser one, since the former requires stronger perturbations in order to satisfy DP. Moreover, the histogram structure itself may reveal sensitive information, which further complicates the problem.Motivated by this, we propose two novel algorithms, namely NoiseFirst and StructureFirst, for computing DP-compliant histograms. Their main difference lies in the relative order of the noise injection and the histogram structure computation steps. NoiseFirst has the additional benefit that it can improve the accuracy of an already published DP-complaint histogram computed using a naïve method. Going one step further, we extend both solutions to answer arbitrary range queries. Extensive experiments, using several real data sets, confirm that the proposed methods output highly accurate query answers, and consistently outperform existing competitors.

Difference Privacy Histogram Release Based on Isotonic Regression

“…In the process of histogram reconstruction, the intermediate result of dynamic programming algorithm M(s, t), key to obtaining the optimal structure, is the minimum error when histogram sequences x1 to xs are reconstructed to t groups [10]. The matrix form of the intermediate results of the histogram based on dynamic programming in Fig.…”

Differentially Private Real-Time Data Publishing over Infinite Trajectory Streams

“…Approximation strategies have been investigated in earlier research, such as histogram publishing [31], [32], and statistics on data stream publishing [5], [14]. Instead of directly adding noise to real data, they function by transformation of original data or a query structure to achieve better overall utility.…”

Utility-preserving differentially private data releases via individual ranking microaggregation

“…The usual approach to releasing differentially private data sets is based on histogram queries [31,32], that is, on approximating the data distribution by partitioning the data domain and counting the number of records in each partition set. To prevent the counts from leaking too much information they are computed in a differentially private manner.…”

“…Moreover, since many works on differential privacy focus on preserving the utility of counting queries [35,31,32,27,28,29,30], we measured how the methods preserve the data distribution by building histograms of each attribute and comparing the distribution between the original and masked values according to the well-known Jensen-Shannon divergence (JSD) [56], which is symmetric and bounded in the 0..1 range. At a data set level, we averaged the divergence of all the attributes.…”

“…In [35] a wavelet transform is performed on the data and noise is added in the frequency domain. In [32,36] the histogram bins are adjusted to the actual data. In [37], the authors consider differential privacy of attributes whose domain is ordered and has moderate to large cardinality (e.g.…”