Crowd-Blending Privacy

Abstract

Abstract.We introduce a new definition of privacy called crowdblending privacy that strictly relaxes the notion of differential privacy. Roughly speaking, k-crowd blending private sanitization of a database requires that each individual i in the database "blends" with k other individuals j in the database, in the sense that the output of the sanitizer is "indistinguishable" if i's data is replaced by j's.We demonstrate crowd-blending private mechanisms for histograms and for releasing synthetic data points, achieving strictly better utility than what is possible using differentially private mechanisms. Additionally, we demonstrate that if a crowd-blending private mechanism is combined with a "pre-sampling" step, where the individuals in the database are randomly drawn from some underlying population (as is often the case during data collection), then the combined mechanism satisfies not only differential privacy, but also the stronger notion of zero-knowledge privacy. This holds even if the pre-sampling is slightly biased and an adversary knows whether certain individuals were sampled or not. Taken together, our results yield a practical approach for collecting and privately releasing data while ensuring higher utility than previous approaches.

BangA: An Efficient and Flexible Generalization-Based Algorithm for Privacy Preserving Data Publication

“…Due to its inability of achieving practical implementation, there is a surge of works nowadays that tend to combine the practicalness of syntactic approaches with the effectiveness of DP. Since BangA performs very efficient multidimensional partitioning to achieve high quality generalization, inspired by Gehrke et al [26] DP relaxation, as a future work, we may adopt the following framework for achieving DP:…”

“…Quite recently, there is an encouraging trend of combining DP style privacy with generalization based approaches. Specifically, the works in [25][26][27] provide interesting directions to achieve DP for k-anonymity based generalization approaches since Differentially Private k-anonymous release has an effective privacy vs. utility trade-off.…”

Differential Privacy with Bounded Priors

“…Works on Differential-Privacy under Sampling [13], Crowd-Blending Privacy [8], Coupled-Worlds Privacy [2] or Outlier Privacy [15] have shown that if sufficiently many users are indistinguishable by a mechanism, and this mechanism operates on a dataset obtained through a robust sampling procedure, differential privacy can be satisfied with only little data perturbation. Our work differs in that we make no assumptions on the indistinguishability of different entities, and that our aim is to guarantee membership privacy rather than differential privacy.…”

“…Previous works mainly focus on the unbounded-DP case, and thus are not directly applicable to situations where the size of the dataset is public. Furthermore, previously considered adversarial priors are either uniform [13,2] or only allow for a fixed number of known entities [8,15]. Finally, very few results are known on how to design general mechanisms satisfying distributional variants of DP.…”

“…The relevance of such a strong adversarial setting has been put into question because it seems unlikely, in a practical data setting, for an adversary to have such a high certainty about all entities. Alternative privacy definitions such as differential-privacy under sampling [13], crowdblending privacy [8], coupled-worlds privacy [2], outlier privacy [15], -privacy [16], or differential identifiability [12] relax the adversarial setting of DP, with the goal of achieving higher utility.…”