Rappor

Abstract

Randomized Aggregatable Privacy-Preserving Ordinal Response, or RAPPOR, is a technology for crowdsourcing statistics from end-user client software, anonymously, with strong privacy guarantees. In short, RAPPORs allow the forest of client data to be studied, without permitting the possibility of looking at individual trees. By applying randomized response in a novel manner, RAPPOR provides the mechanisms for such collection as well as for efficient, high-utility analysis of the collected data. In particular, RAPPOR permits statistics to be collected on the population of client-side strings with strong privacy guarantees for each client, and without linkability of their reports.This paper describes and motivates RAPPOR, details its differential-privacy and utility guarantees, discusses its practical deployment and properties in the face of different attack models, and, finally, gives results of its application to both synthetic and real-world data.

UniTraX: Protecting Data Privacy with Discoverable Biases

“…4 is also based on ProPer's formal model. Google's RAPPOR [11] likewise provides differential privacy guarantees based on user-provided parameters, but the system model is significantly different from ours and the privacy guarantee holds only when certain crossquery correlations do not occur. In contrast, we (and ProPer) need no such assumptions.…”

“…ProPer would privately deduct the appropriate amount from the individual remaining budget of all users in that age range. By contrast, UniTraX publicly records that a certain amount of budget was consumed for the age range [10][11][12][13][14][15][16][17][18][19][20]. Because the consumed budget is public, the analyst can calculate how much initial budget any given point in the data parameter space would need in order to still have enough remaining budget for some specific query the analyst may wish to make.…”

Revisiting Private Stream Aggregation: Lattice-Based PSA

“…The RAPPOR technique that was first introduced by Erlingsson et al [17] uses randomized response techniques in order to provide local differential privacy for frequency estimation. More concretely, the goal is to compute the number of occurrences of certain statistical attributes over a population of users, e.g.…”

“…Observe that RAPPOR's attack model (see Section 6 in [17]) considers the privacy implications of information that is leaked from a user's report. Our construction eliminates the concern of information leakage from users' outputs as each user data point is encrypted.…”

“…For instance, randomized response was specifically chosen over other privacy mechanisms, such as the Laplace mechanism, due to this application focus as indicated in [17]. As a result, the input has to be a binary vector representing predicates.…”