Efficient Private Statistics with Succinct Sketches

Melis, Luca; Danezis, George; Cristofaro, Emiliano De

doi:10.14722/ndss.2016.23175

Cited by 66 publications

(82 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to execute queries and compute statistics on distributed datasets, multiple decentralized solutions [10], [12], [14], [22], [23], [24], [25] rely on techniques that have a high expressive power, such as secret sharing and garbled circuits. These solutions are often flexible in the computations they offer but usually assume (a) honest-but-curious computing parties and (b) no collusion or a 2-party model.…”

Section: Related Workmentioning

confidence: 99%

“…In this context, decentralized data-sharing systems [10], [11], [12], [13], [14], [15] have raised considerable interest and are key enablers for privacy-conscious big-data analysis. By distributing the storage and the computation, thus avoiding single points of failure, these systems enable data sharing and minimize the risks incurred by centralized solutions.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Drynx: Decentralized, Secure, Verifiable System for Statistical Queries and Machine Learning on Distributed Datasets

Froelicher

Troncoso-Pastoriza

Sousa

et al. 2020

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Data sharing has become of primary importance in many domains such as big-data analytics, economics and medical research, but remains difficult to achieve when the data are sensitive. In fact, sharing personal information requires individuals' unconditional consent or is often simply forbidden for privacy and security reasons. In this paper, we propose Drynx, a decentralized system for privacy-conscious statistical analysis on distributed datasets. Drynx relies on a set of computing nodes to enable the computation of statistics such as standard deviation or extrema, and the training and evaluation of machine-learning models on sensitive and distributed data. To ensure data confidentiality and the privacy of the data providers, Drynx combines interactive protocols, homomorphic encryption, zero-knowledge proofs of correctness, and differential privacy. It enables an efficient and decentralized verification of the input data and of all the system's computations thus provides auditability in a strong adversarial model in which no entity has to be individually trusted. Drynx is highly modular, dynamic and parallelizable. Our evaluation shows that it enables the training of a logistic regression model on a dataset (12 features and 600,000 records) distributed among 12 data providers in less than 2 seconds. The computations are distributed among 6 computing nodes, and Drynx enables the verification of the query execution's correctness in less than 22 seconds.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Drynx: Decentralized, Secure, Verifiable System for Statistical Queries and Machine Learning on Distributed Datasets

Froelicher

Troncoso-Pastoriza

Sousa

et al. 2020

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Tschorsch and Scheuermann [41] proposed a noiseadding mechanism for use in such a distributed context. In [32], each party encrypts their sketch, and sends it encrypted to a tally process, which aggregates them using homomorphic encryption. Ashok et al [5] propose a multiparty computation protocol based on Bloom filters to estimate cardinality without the need for homomorphic encryption, while Egert et al [20] show that Ashok et al's approach is vulnerable to attacks and propose a more secure variant of the protocol.…”

Section: Previous Workmentioning

confidence: 99%

Cardinality Estimators do not Preserve Privacy

Desfontaines

Lochbihler²,

Basin

2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Cardinality estimators like HyperLogLog are sketching algorithms that estimate the number of distinct elements in a large multiset. Their use in privacysensitive contexts raises the question of whether they leak private information. In particular, can they provide any privacy guarantees while preserving their strong aggregation properties?We formulate an abstract notion of cardinality estimators, that captures this aggregation requirement: one can merge sketches without losing precision. We propose an attacker model and a corresponding privacy definition, strictly weaker than differential privacy: we assume that the attacker has no prior knowledge of the data. We then show that if a cardinality estimator satisfies this definition, then it cannot have a reasonable level of accuracy. We prove similar results for weaker versions of our definition, and analyze the privacy of existing algorithms, showing that their average privacy loss is significant, even for multisets with large cardinalities. We conclude that strong aggregation requirements are incompatible with any reasonable definition of privacy, and that cardinality estimators should be considered as sensitive as raw data. We also propose risk mitigation strategies for their real-world applications.

show abstract

“…There are two main privacy-enhancing strategies to collect location data and compute aggregate time-series. (1) Cryptographic protocols for private aggregation can let a server obtain aggregates without learning users' individual records [36,37,31], but make no consideration about the privacy loss from learning and/or releasing exact statistics. We have evaluated this scenario in Section 4.…”

Section: Related Workmentioning

confidence: 99%

What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy

Pyrgelis

Troncoso

Cristofaro

2017

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

Information about people's movements and the locations they visit enables an increasing number of mobility analytics applications, e.g., in the context of urban and transportation planning, In this setting, rather than collecting or sharing raw data, entities often use aggregation as a privacy protection mechanism, aiming to hide individual users' location traces. Furthermore, to bound information leakage from the aggregates, they can perturb the input of the aggregation or its output to ensure that these are differentially private. In this paper, we set to evaluate the impact of releasing aggregate location time-series on the privacy of individuals contributing to the aggregation. We introduce a framework allowing us to reason about privacy against an adversary attempting to predict users' locations or recover their mobility patterns. We formalize these attacks as inference problems, and discuss a few strategies to model the adversary's prior knowledge based on the information she may have access to. We then use the framework to quantify the privacy loss stemming from aggregate location data, with and without the protection of differential privacy, using two real-world mobility datasets. We find that aggregates do leak information about individuals' punctual locations and mobility profiles. The density of the observations, as well as timing, play important roles, e.g., regular patterns during peak hours are better protected than sporadic movements. Finally, our evaluation shows that both output and input perturbation offer little additional protection, unless they introduce large amounts of noise ultimately destroying the utility of the data.

show abstract

Efficient Private Statistics with Succinct Sketches

Cited by 66 publications

References 49 publications

Drynx: Decentralized, Secure, Verifiable System for Statistical Queries and Machine Learning on Distributed Datasets

Drynx: Decentralized, Secure, Verifiable System for Statistical Queries and Machine Learning on Distributed Datasets

Cardinality Estimators do not Preserve Privacy

What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy

Contact Info

Product

Resources

About