Calibrating Noise to Sensitivity in Private Data Analysis

Abstract

Abstract. We continue a line of research initiated in [10, 11] on privacypreserving statistical databases. Consider a trusted server that holds a database of sensitive information. Given a query function f mapping databases to reals, the so-called true answer is the result of applying f to the database. To protect privacy, the true answer is perturbed by the addition of random noise generated according to a carefully chosen distribution, and this response, the true answer plus noise, is returned to the user.Previous work focused on the case of noisy sums, in which f = i g(xi), where xi denotes the ith row of the database and g maps database rows to [0, 1]. We extend the study to general functions f , proving that privacy can be preserved by calibrating the standard deviation of the noise according to the sensitivity of the function f . Roughly speaking, this is the amount that any single argument to f can change its output. The new analysis shows that for several particular applications substantially less noise is needed than was previously understood to be the case.The first step is a very clean characterization of privacy in terms of indistinguishability of transcripts. Additionally, we obtain separation results showing the increased value of interactive sanitization mechanisms over non-interactive.

Differential Privacy and the Risk-Utility Tradeoff for Multi-dimensional Contingency Tables

“…The methodology of differential privacy [6,7] has provided a strong definition of privacy which in some settings, using a mechanism of doubly-exponential noise addition, also allows for extraction of informative statistics from databases. A recent paper by Barak et al [1] extends this approach to the release of a specified set of margins from a multi-way contingency table.…”

Browser Randomisation against Fingerprinting: A Quantitative Information Flow Approach

“…Because differential privacy protects against a class of attackers the security guarantee is formally stronger. For this reason, algorithms for differential privacy [9] would therefore randomise scripts that are already t-private (but not -adversarial private) thus reducing their usability. In our fingerprinting context, we exploit the attacker's a priori knowledge for synthesising a channel that is t-private with minimal randomisation.…”

Limitations of Local Filters of Lipschitz and Monotone Functions

“…The server's goal is to output a value which is close to f (x) but which reveals almost no information about any single individual. Recently, the latter notion has been made precise via the concept of differential privacy [9]. A standard way of obtaining such guarantees is to ask users to submit only Lipschitz functions 4 , and have the server output f (x) plus some random noise depending on the desired privacy guarantee [9].…”

“…Recently, the latter notion has been made precise via the concept of differential privacy [9]. A standard way of obtaining such guarantees is to ask users to submit only Lipschitz functions 4 , and have the server output f (x) plus some random noise depending on the desired privacy guarantee [9]. However, if a malicious user submits a function which is not Lipschitz, the differential privacy guarantee is lost.…”