Pan-private algorithms via statistics on sketches

Abstract

Consider fully dynamic data, where we track data as it gets inserted and deleted. There are well developed notions of private data analyses with dynamic data, for example, using differential privacy. We want to go beyond privacy, and consider privacy together with security, formulated recently as pan-privacy by Dwork et al. (ICS 2010). Informally, pan-privacy preserves differential privacy while computing desired statistics on the data, even if the internal memory of the algorithm is compromised (say, by a malicious breakin or insider curiosity or by fiat by the government or law).We study pan-private algorithms for basic analyses, like estimating distinct count, moments, and heavy hitter count, with fully dynamic data. We present the first known panprivate algorithms for these problems in the fully dynamic model. Our algorithms rely on sketching techniques popular in streaming: in some cases, we add suitable noise to a previously known sketch, using a novel approach of calibrating noise to the underlying problem structure and the projection matrix of the sketch; in other cases, we maintain certain statistics on sketches; in yet others, we define novel sketches. We also present the first known lower bounds explicitly for pan privacy, showing our results to be nearly optimal for these problems. Our lower bounds are stronger than those implied by differential privacy or dynamic data streaming alone and hold even if unbounded memory and/or unbounded processing time are allowed. The lower bounds use a noisy decoding argument and exploit a connection between pan-private algorithms and data sanitization.

Differentially private real-time data release based on the moving average strategy

“…The moving average method is suitable for near-term forecasting. The moving average of the published noise data is defined as follows: (6) where the parameter k is the length of the backward searching. The key condition for triggering our strategy is the distance between the moving average and the statistical value to be published.…”

“…The literature related to DP provides rich results including application of DP to streaming data [3,4,5,6]. In the setting of streaming data, differential privacy comes with two privacy definitions: user-level and eventlevel privacy [3], [4].…”

Differentially Private Real-Time Data Publishing over Infinite Trajectory Streams

“…Previous work mainly focuses on event-level privacy on finite or infinite streams [14], [16], [17], and user-level privacy on finite streams [5], [7], [15]. Chan et al [16] proposed scheme of p-sum to construct a full binary tree on the sequential data, where each node contains the sum of the sequential data in its subtree, plus noise with scale logarithmic in the length of the sequence.…”

“…Bolot et al proposed a scheme of decayed privacy [17], which consider past data is not as sensitive as current data. Mir et al [15] considers counters that may also decrease. Fan and Xiong [5], [7] proposed FAST framework for publishing time-series data in a user-level private way.…”

Differentially Private Continual Monitoring of Heavy Hitters from Distributed Streams

“…In this paper, we use event-level differential privacy as our privacy notion. Mir et al [17] also considered the problem of private streaming algorithms to return the counts of heavy hitters, not the heavy hitters themselves. However, they consider a more general setting in which in each update, the counter of an item can be increased or decreased arbitrarily, as long as the counter remains non-negative.…”