Revealing information while preserving privacy

Abstract

We examine the tradeoff between privacy and usability of statistical databases. We model a statistical database by an n-bit string d1, .., dn, with a query being a subset q ⊆ [n] to be answered by i∈q di. Our main result is a polynomial reconstruction algorithm of data from noisy (perturbed) subset sums. Applying this reconstruction algorithm to statistical databases we show that in order to achieve privacy one has to add perturbation of magnitude Ω( √ n). That is, smaller perturbation always results in a strong violation of privacy. We show that this result is tight by exemplifying access algorithms for statistical databases that preserve privacy while adding perturbation of magnitudeÕ( √ n). For time-T bounded adversaries we demonstrate a privacypreserving access algorithm whose perturbation magnitude is ≈ √ T .

Calibrating Noise to Sensitivity in Private Data Analysis

“…We continue a line of research initiated in [10,11] on privacy in statistical databases. A statistic is a quantity computed from a sample.…”

“…Their definition is a special case of Definition 1 for input perturbation protocols of a limited form. A similar, more general definition was suggested in [10,11,6]. This was modeled after semantic security of encryptions.…”

“…In particular, the standard measure of statistical difference is not a sufficiently good metric in our setting, and needs to be replaced with a more delicate one. In previous work [10,11,6], the definitions were based on semantic security but the proofs were based on indistinguishability, so our move to -indistinguishability is a simplification. Also, semantic security was proved against informed adversaries.…”

“…It is the same as in [12], adapted to general interactive protocols. An equivalent, semantic-securityflavored formulation is a special case of the definition from [10,11,6]; those definitions allowed a large loss of privacy to occur with negligible probability.…”

“…We continue a line of research initiated in [10, 11] on privacypreserving statistical databases. Consider a trusted server that holds a database of sensitive information.…”