Differentially Private Spatial Decompositions

Abstract

Differential privacy has recently emerged as the de facto standard for private data release. This makes it possible to provide strong theoretical guarantees on the privacy and utility of released data. While it is well-understood how to release data based on counts and simple functions under this guarantee, it remains to provide general purpose techniques that are useful for a wider variety of queries. In this paper, we focus on spatial data, i.e., any multidimensional data that can be indexed by a tree structure. Directly applying existing differential privacy methods to this type of data simply generates noise.We propose instead the class of "private spatial decompositions": these adapt standard spatial indexing methods such as quadtrees and kd-trees to provide a private description of the data distribution. Equipping such structures with differential privacy requires several steps to ensure that they provide meaningful privacy guarantees. Various basic steps, such as choosing splitting points and describing the distribution of points within a region, must be done privately, and the guarantees of the different building blocks must be composed into an overall guarantee. Consequently, we expose the design space for private spatial decompositions, and analyze some key examples. A major contribution of our work is to provide new techniques for parameter setting and post-processing of the output to improve the accuracy of query answers. Our experimental study demonstrates that it is possible to build such decompositions efficiently, and use them to answer a variety of queries privately and with high accuracy.

Understanding hierarchical methods for differentially private histograms

“…Hay et al [14] also introduced novel constrained inference techniques to improve over the basic hierarchical method, which exploits the observation that query results at different levels should satisfy certain consistency relationships to obtain improved estimates. This hierarchical method with constrained inference has been adopted by other researchers [5,4].…”

Differential Privacy in Practice

“…DP-tree, proposed by Peng et al [43], builds a nested tree structure with consistency enforcement and adaptive privacy budget assignment. The work improves the asymptotic error bound and query accuracy compared to the approach by Cormode et al [23].…”

“…Cormode et al [23] focused on spatial data indexing for range queries while not revealing data points. Their method, private spatial decomposition, addresses both data-dependent (e.g., quadtree) and data-independent (e.g., kd-tree) tree structures with geometric privacy budget allocation.…”

“…As examples, both compositions are usually used in building partitioning trees for data summary under differential privacy [9,17,23,24].…”

Utility-preserving differentially private data releases via individual ranking microaggregation

“…In [32,36] the histogram bins are adjusted to the actual data. In [37], the authors consider differential privacy of attributes whose domain is ordered and has moderate to large cardinality (e.g. numerical attributes); the attribute domain is represented as a tree, which is decomposed in order to increase the accuracy of answers to count queries (multi-dimensional range queries).…”