Understanding hierarchical methods for differentially private histograms

Qardaji, Wahbeh; Yang, Weining; Li, Ninghui

doi:10.14778/2556549.2556576

Cited by 140 publications

(184 citation statements)

References 20 publications

(56 reference statements)

Supporting

Mentioning

182

Contrasting

Order By: Relevance

“…Both approaches promise error that scales only logarithmically with the length of the range. These results were refined by Qardaji et al [21], who compared the two approaches and optimized parameter settings. The conclusion there was that a hierarchical approach with moderate fan-out (of 16) was preferable, more than halving the error from the Haar approach.…”

Section: Related Workmentioning

confidence: 99%

Answering range queries under local differential privacy

2019

View full text Add to dashboard Cite

Counting the fraction of a population having an input within a specified interval i.e. a range query, is a fundamental data analysis primitive. Range queries can also be used to compute other interesting statistics such as quantiles, and to build prediction models. However, frequently the data is subject to privacy concerns when it is drawn from individuals, and relates for example to their financial, health, religious or political status. In this paper, we introduce and analyze methods to support range queries under the local variant of differential privacy [18], an emerging standard for privacy-preserving data analysis.The local model requires that each user releases a noisy view of her private data under a privacy guarantee. While many works address the problem of range queries in the trusted aggregator setting, this problem has not been addressed specifically under untrusted aggregation (local DP) model even though many primitives have been developed recently for estimating a discrete distribution. We describe and analyze two classes of approaches for range queries, based on hierarchical histograms and the Haar wavelet transform. We show that both have strong theoretical accuracy guarantees on variance. In practice, both methods are fast and require minimal computation and communication resources. Our experiments show that the wavelet approach is most accurate in high privacy settings, while the hierarchical approach dominates for weaker privacy requirements.• In Section 4.3, we consider hierarchical approaches, generalizing the idea of a binary tree. We show that the variance grows only logarithmically with the length of the range. Post-processing of the noisy observations can remove inconsistencies, and reduces the

show abstract

Section: Related Workmentioning

confidence: 99%

Answering range queries under local differential privacy

2019

View full text Add to dashboard Cite

show abstract

“…Several works have applied differential privacy to sanitize histograms [2,18,31,34,56,76,84]. A straightforward way to achieve this is by adding noise to the frequency of each bin of the histogram, according to the Laplace mechanism [19].…”

Section: Histogram Privacymentioning

confidence: 99%

“…Thus, the methods in [2,18,31,34,56,76,84] cannot be used to deal with the problems we consider. In fact, applying any of the methods in [2,18,31,34,56,76,84] to a histogram that represents the locations of a single user would simply prevent the inference of the exact frequencies (counts) of locations in the user's histogram. It would not protect against the disclosure of visits to sensitive locations (i.e., it cannot solve the SLH problem), nor against the disclosure of the fact that the histogram is similar/dissimilar to a target histogram (i.e., it cannot solve the T A/T R problem).…”

Section: Histogram Privacymentioning

confidence: 99%

Location histogram privacy by Sensitive Location Hiding and Target Histogram Avoidance/Resemblance

Loukides

Theodorakopoulos

2019

Knowl Inf Syst

View full text Add to dashboard Cite

A location histogram is comprised of the number of times a user has visited locations as they move in an area of interest, and it is often obtained from the user in the context of applications such as recommendation and advertising. However, a location histogram that leaves a user's computer or device may threaten privacy when it contains visits to locations that the user does not want to disclose (sensitive locations), or when it can be used to profile the user in a way that leads to price discrimination and unsolicited advertising (e.g. as "wealthy" or "minority member"). Our work introduces two privacy notions to protect a location histogram from these threats: sensitive location hiding, which aims at concealing all visits to sensitive locations, and target avoidance/resemblance, which aims at concealing the similarity/dissimilarity of the user's histogram to a target histogram that corresponds to an undesired/desired profile. We formulate an optimization problem around each notion: Sensitive Location Hiding (SLH), which seeks to construct a histogram that is as similar as possible to the user's histogram but associates all visits with nonsensitive locations, and Target Avoidance/Resemblance (T A/T R), which seeks to construct a histogram that is as dissimilar/similar as possible to a given target histogram but remains useful for getting a good response from the application that analyzes the histogram. We develop an optimal algorithm for each notion, which operates on a notion-specific search space graph and finds a shortest or longest path in the graph that corresponds to a solution histogram. In addition, we develop a greedy heuristic for the T A/T R problem, which operates directly on a user's histogram. Our experiments demonstrate that all algorithms are effective at preserving the distribution of locations in a histogram and the quality of location recommendation. They also demonstrate that the heuristic produces near-optimal solutions while being orders of magnitude faster than the optimal algorithm for T A/T R.

show abstract

“…We use the general version of the technique. Constrained inference [7] can be dissected into two steps: Weighted Averaging, and Mean Consistency.…”

Section: Post-processing Of Query Sequencementioning

confidence: 99%

Efficient e-health data release with consistency guarantee under differential privacy

Lin

2015

2015 17th International Conference on E-Health Networking, Application &Amp; Services (HealthCom)

View full text Add to dashboard Cite

E-health data release, which answers the statistical queries of the Electronic Health Records (EHRs), has been widely adopted in modern health care services. However, since the EHRs contain sensitive information of the patients, the data release procedure may lead to the leakage of the privacy of patients if it is done without necessary protection measures in place. On addressing this, existing research literature introduces differential privacy to provide the necessary privacy guarantee. However, it is not suitable in sensitive e-health environments because it lacks the efficiency for data processing and updating. In this paper, we propose an efficient e-health data release scheme with consistency guarantee under differential privacy. Specifically, we improve the performance of the previous work by designing a new private partition algorithm of histogram and also proposing a heuristic hierarchical query method. We conduct real experiments and compare our scheme with the existing one to show that the proposal is more efficient in terms of data processing and updating. Moreover, we increase the accuracy of data release through consistency and give proof of privacy to show that the proposed algorithm is under -differential privacy.

show abstract

Understanding hierarchical methods for differentially private histograms

Cited by 140 publications

References 20 publications

Answering range queries under local differential privacy

Answering range queries under local differential privacy

Location histogram privacy by Sensitive Location Hiding and Target Histogram Avoidance/Resemblance

Efficient e-health data release with consistency guarantee under differential privacy

Contact Info

Product

Resources

About