UniTraX: Protecting Data Privacy with Discoverable Biases

Abstract

Abstract. An ongoing challenge with differentially private database systems is that of maximizing system utility while staying within a certain privacy budget. One approach is to maintain per-user budgets instead of a single global budget, and to silently drop users whose budget is depleted. This, however, can lead to very misleading analyses because the system cannot provide the analyst any information about which users have been dropped. This paper presents UniTraX, the first differentially private system that allows per-user budgets while providing the analyst information about the budget state. The key insight behind UniTraX is that it tracks budget not only for actual records in the system, but at all points in the domain of the database, including points that could exist but do not. UniTraX can safely report the budget state because the analyst does not know if the state refers to actual records or not. We prove that UniTraX is differentially private. UniTraX is compatible with existing differentially private analyses and our implementation on top of PINQ shows only moderate runtime overheads on a realistic workload.

DDUO: General-Purpose Dynamic Analysis for Differential Privacy

“…ProPer [21] is a system (based on PINQ) designed to maintain a privacy budget for each individual in a database system, and operates by silently dropping records from queries when their privacy budget is exceeded. UniTrax [37] follows up on ProPer: this system allows per-user budgets but gets around the issue of silently dropping records by tracking queries against an abstract database as opposed to the actual database records. These approaches are limited to an embedded DSL for expressing relational database queries, and do not support general purpose programming.…”