SafePub: A Truthful Data Anonymization Algorithm With Strong Privacy Guarantees

Abstract

Methods for privacy-preserving data publishing and analysis trade off privacy risks for individuals against the quality of output data. In this article, we present a data publishing algorithm that satisfies the differential privacy model. The transformations performed are truthful, which means that the algorithm does not perturb input data or generate synthetic output data. Instead, records are randomly drawn from the input dataset and the uniqueness of their features is reduced. This also offers an intuitive notion of privacy protection. Moreover, the approach is generic, as it can be parameterized with different objective functions to optimize its output towards different applications. We show this by integrating six well-known data quality models. We present an extensive analytical and experimental evaluation and a comparison with prior work. The results show that our algorithm is the first practical implementation of the described approach and that it can be used with reasonable privacy parameters resulting in high degrees of protection. Moreover, when parameterizing the generic method with an objective function quantifying the suitability of data for building statistical classifiers, we measured prediction accuracies that compare very well with results obtained using state-ofthe-art differentially private classification algorithms.

Development and Analysis of Deterministic Privacy-Preserving Policies Using Non- Stochastic Information Theory

“…Randomized, or stochastic, privacy-preserving policies have been shown to cause problems, such as un-truthfulness [33], which can be undesirable in practice [34]. This is perhaps one of the reason behind low popularity of randomized privacy-2 Popularity of these methods is somehwat evident from the sheer number of available toolboxes for implementation https://arx.deidentifier.org/overview/related-software/ preserving policies, such as differential privacy, within the financial or health sectors [33]. For instance, randomized privacy-preserving policies in financial auditing have been criticized for complicating fraud detection [35], [36].…”

A comprehensive tool for creating and evaluating privacy-preserving biomedical prediction models

“…The methods for creating privacypreserving prediction models presented in this article are compatible with all privacy models currently implemented by ARX (an overview is provided on the project website [22]). In this paper, we will use the following models to showcase our solution: (1) k-anonymity, which protects records from re-identification by requiring that each transformed record is indistinguishable from at least k − 1 other records regarding attributes that could be used in linkage attacks [15], (2) differential privacy which guarantees that the output of the anonymization procedure is basically independent of the contribution of individual records to the dataset, which protects output data from a wide range of risks [23,24], and (3) a gametheoretic model which employs an economic perspective on data re-identification attacks and assumes that adversaries will only attempt re-identification in case there is a tangible economic benefit [25,26].…”

“…Values of the attributes "age" and "sex" are transformed using level 2 and level 0, respectively, of their associated hierarchies overcome these limitations we had to rewrite major parts of the internals of the software and the resulting utility model is now the most complex model supported. Finally, we also had to develop and implement a specialized score function with proven mathematical properties to support differential privacy [24].…”

RON-Gauss: Enhancing Utility in Non-Interactive Private Data Release

“…Primarily, these models utilize the differential privacy guarantee of the Exponential mechanism [84], which defines a distribution to synthesize the data based on the input database and the pre-defined quality function. Various methods -both application-specific and application-independent -have been proposed [10,16,31,52,56,57,74,77,83,84,89,98,124,127]. Our approach contrasts these works in two ways.…”