Profile-based Privacy for Locally Private Computations

Geumlek, Joseph; Chaudhuri, Kamalika

doi:10.1109/isit.2019.8849549

Cited by 13 publications

(8 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The same idea can be formalized by comparing pairs of distributions directly. This is done in [98] via distribution privacy, instantiated in [73] via profile-based DP, in which the attacker tries to distinguish between different probabilistic user profiles.…”

Section: Multidimensional Definitionsmentioning

confidence: 99%

“…Another option is the shuffled model [15], which falls in-between the local and global models. Some definitions we listed actually were presented in the local model, such as d D -privacy [22], geoindistinguishability [6], earth mover's Pr [68], location Pr [60], profile-based DP [73], divergence DP and smooth DP from [9], utility-optimized DP [97], and ex-tended DP, distribution Pr, and extended distribution Pr from [98]. Besides these, a handful of other local DP definitions are mentioned below; a longer discussion can be found in the full version of this work (soon to be uploaded to ArXiv 15 ).…”

Section: Local Modelmentioning

confidence: 99%

See 1 more Smart Citation

SoK: Differential privacies

Desfontaines

Pejó

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Shortly after it was first introduced in 2006, differential privacy became the flagship data privacy definition. Since then, numerous variants and extensions were proposed to adapt it to different scenarios and attacker models. In this work, we propose a systematic taxonomy of these variants and extensions. We list all data privacy definitions based on differential privacy, and partition them into seven categories, depending on which aspect of the original definition is modified.These categories act like dimensions: variants from the same category cannot be combined, but variants from different categories can be combined to form new definitions. We also establish a partial ordering of relative strength between these notions by summarizing existing results. Furthermore, we list which of these definitions satisfy some desirable properties, like composition, postprocessing, and convexity by either providing a novel proof or collecting existing ones.

show abstract

Section: Multidimensional Definitionsmentioning

confidence: 99%

Section: Local Modelmentioning

confidence: 99%

SoK: Differential privacies

Desfontaines

Pejó

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…parameters θ and θ of two distributions, which aims at protecting the privacy of the distribution parameters but is defined in a Bayesian style (unlike DP and DistP) to satisfy that for any output sequence y, p(θ|y) ≤ e ε p(θ |y). After a preliminary version of this paper appeared in arXiv [31], a notion generalizing DistP, called profile based privacy, is proposed in [32].…”

Section: Related Workmentioning

confidence: 99%

Local Obfuscation Mechanisms for Hiding Probability Distributions

Kawamoto

Murakami²

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We introduce a formal model for the information leakage of probability distributions and define a notion called distribution privacy as the local differential privacy for probability distributions. Roughly, the distribution privacy of a local obfuscation mechanism means that the attacker cannot significantly gain any information on the distribution of the mechanism's input by observing its output. Then we show that existing local mechanisms can hide input distributions in terms of distribution privacy, while deteriorating the utility by adding too much noise. For example, we prove that the Laplace mechanism needs to add a large amount of noise proportionally to the infinite Wasserstein distance between the two distributions we want to make indistinguishable. To improve the tradeoff between distribution privacy and utility, we introduce a local obfuscation mechanism, called a tupling mechanism, that adds random dummy data to the output. Then we apply this mechanism to the protection of user attributes in location based services. By experiments, we demonstrate that the tupling mechanism outperforms popular local mechanisms in terms of attribute obfuscation and service quality.

show abstract

“…Given a target probability of recovering a piece of information (the task) from the privatized data, the fundamental limit of the error probability of inferring the raw data at the adversary was derived. In [14], the so-called profile-based differential privacy is proposed to protect the identity of source distribution instead of data itself. A higher utility is achieved by only obscuring those information related to the identify of the distribution.…”

Section: Introductionmentioning

confidence: 99%

Robust Privatization with Non-Specific Tasks and the Optimal Privacy-Utility Tradeoff

Liu,

Wang

2020

Preprint

View full text Add to dashboard Cite

Privacy-preserving data release mechanisms aiming to minimize the privacy leakage under utility constraints of nonspecific tasks are studied through the lens of information theory. An information theoretic framework extending Sankar et al. [1] is proposed. While the private feature to be protected is typically determined and known by the users who release their data, the specific task where the release data is utilized is usually unknown. To address the lack of information of the specific task, utility constraints laid on a set of multiple possible tasks are considered.The mechanism protects the privacy of a given feature of the to-be-released data while satisfying utility constraints of all possible tasks in the set. First, the single-letter characterization of the privacy-utility tradeoff region is derived.Characterization of the minimum privacy under log-loss utility constraints turns out to be a non-convex optimization problem involving mutual information in the objective function and the constraints. Second, focusing on the case where the raw data consists of multiple independent components, we show that the above optimization problem can be decomposed into multiple parallel privacy funnel (PF) problems [2] with different weightings, each of which includes only a single utility constraint. We explicitly derive the optimal solution to each PF problem when the private feature is a deterministic function of a data component. The solution is characterized by the leakage-free threshold, and the minimum leakage is zero while the utility constraint is below the threshold. Once the utility requirement is above the threshold, the privacy leakage increases linearly. Finally, we show that the optimal weighting of each privacy funnel problem can be found by solving a linear program (LP). Numerical results are shown to illustrate the robustness of our approach.

show abstract

Profile-based Privacy for Locally Private Computations

Cited by 13 publications

References 17 publications

SoK: Differential privacies

SoK: Differential privacies

Local Obfuscation Mechanisms for Hiding Probability Distributions

Robust Privatization with Non-Specific Tasks and the Optimal Privacy-Utility Tradeoff

Contact Info

Product

Resources

About