Information Measures in Statistical Privacy and Data Processing Applications

Abstract

In statistical privacy, utility refers to two concepts: information preservation, how much statistical information is retained by a sanitizing algorithm, and usability, how (and with how much difficulty) one extracts this information to build statistical models, answer queries, and so forth. Some scenarios incentivize a separation between information preservation and usability, so that the data owner first chooses a sanitizing algorithm to maximize a measure of information preservation, and, afterward, the data consumers process the sanitized output according to their various individual needs [Ghosh et al. 2009;Williams and McSherry 2010].We analyze the information-preserving properties of utility measures with a combination of two new and three existing utility axioms and study how violations of an axiom can be fixed. We show that the average (over possible outputs of the sanitizer) error of Bayesian decision makers forms the unique class of utility measures that satisfy all of the axioms. The axioms are agnostic to Bayesian concepts such as subjective probabilities and hence strengthen support for Bayesian views in privacy research. In particular, this result connects information preservation to aspects of usability-if the information preservation of a sanitizing algorithm should be measured as the average error of a Bayesian decision maker, shouldn't Bayesian decision theory be a good choice when it comes to using the sanitized outputs for various purposes? We put this idea to the test in the unattributed histogram problem where our decision-theoretic postprocessing algorithm empirically outperforms previously proposed approaches.

Axioms for Information Leakage

“…One interpretation for this axiom is that by observing the output of a channel an adversary cannot lose information about the secret; in the worst case, the output can be ignored if it is not useful. 9 A direct consequence of this axiom is that, since posterior vulnerabilities are always greater than the corresponding prior vulnerabilities, additive and multiplicative versions of leakage as defined in Equations (2) and (3) are always non-negative.…”

“…On the other hand, ′ only knows and ′ , and in general the decomposition of ′ into a cascade of two channels is not unique (i.e., there may be several pairs , of matrices satisfying ′ = ), so it is not always possible for ′ to uniquely recover from ′ and compute [ , ]. 9 This axiom is a generalization of Shannon-entropy's "information can't hurt" property [16]: ( | ) ≤ ( ), for all random variables , . Averaging (AVG).…”

“…Kifer and Lin's work is the one most closely related to ours. In a series of papers [9], [32]- [34], these authors proposed an axiomatic characterization of "good" properties that sanitization mechanisms should provide, focusing in particular on privacy and utility measures. They considered utility as information preservation, which captures how "faithful" the output of the mechanism is to its input, 11 and as such is closely related to our notion of vulnerability.…”

“…We consider a set of axioms that characterize intuitively-reasonable properties that vulnerability measures might satisfy, separately considering axioms for prior vulnerability (Section IV) and axioms for posterior vulnerability and for the relationship between prior and posterior vulnerability (Section V). Addressing this relationship is an important novelty of our axiomatization, as compared with previous axiomatizations of entropy (such as [2], [7], [8]), which considered only prior entropy, or the axiomatization of utility by Kifer and Lin [9], which considers posterior utility without investigating its relation to prior utility. As a result, our axiomatization is able to consider properties of leakage, usually defined in terms of comparison between the posterior and prior vulnerabilities.…”

Privacy and the Price of Data

“…The quantification of utility needs to be application-specific [6]. In this talk we discuss the connections between arbitrage-free query prices and utility measures and show how the formalization of commonsense utility properties can provide meaningful statistical interpretations of utility measures [7].…”