University of Texas at El Paso Privacy in Statistical Databases Dr. Luc Longpré Computer Science Department DCFS 2006 UTEP Computer Science Dept.

Database with Confidential Information Examples: census data medical information Privacy: protect the confidentiality of individuals Usefulness: want to derive meaningful statistics UTEP Computer Science Dept.

The Need for Privacy Safeguards Per person available disk space: 1983: 0.02Mb 1996: 28Mb 2000: 472Mb 2006: ? UTEP Computer Science Dept.

The Need for Privacy Safeguards Misuse of personal health information Misuse of financial information Misuse of identification information UTEP Computer Science Dept.

Approaches Access control, encryption: Problem Only fixes who has access to what Does not protect disclosures based on inference Problem Sometimes it may be possible to derive confidential information from voluntarily released information UTEP Computer Science Dept.

Examples Salary database Query: what’s the average salary of white male professors with 2 children living El Paso Texas since 1994 and in Boston from 1987 to 1994? UTEP Computer Science Dept.

Examples 87% of population of the US are unique under ID made of: 5 digit ZIP, gender, date of birth UTEP Computer Science Dept.

Linking to Re-Identify Data Medical database: Ethnicity, visit date, diagnosis, procedure, medication, ZIP, Birth date, Gender Voter list: Name, address, date registered, ZIP, Birth date, Gender UTEP Computer Science Dept.

Approaches to solutions Sample size K-anonymity Noise Query restrictions Static Dynamic (general problem NP-hard) Cell suppression UTEP Computer Science Dept.

Previous Work (defining privacy) Denning (1982) Medical data (Sweeny 1996) Privacy Preserving Data Mining (since about 2000) Privacy based on estimations (AS2000) Interval computations (KL2003) Game theoretical setting (DN2003) Blending in a crowd (CDMSW2005) UTEP Computer Science Dept.

A simple case Assume a 1 dimensional database (salary) Only allow queries of the type: # of records where salary < x? where x is selected from a finite set. Asking all possible queries provides an interval for each salary. UTEP Computer Science Dept.

Example $64,000 $80,000 $80,000 $90,000 $96,000 $122,000 $124,000 $144,000 $150,000 $150,000 Allow queries of type “# <$x” for x multiple of $10,000 UTEP Computer Science Dept.

Perfect privacy Perfect privacy is maintained if the answer to queries does not allow to narrow any interval for a given salary UTEP Computer Science Dept.

Example $64,000 $80,000 $80,000 $90,000 $96,000 $122,000 $124,000 $144,000 $150,000 $150,000 Queries: #<$100,000 is ... #<$120,000 is ... know: Leung’s salary is < $120,000 UTEP Computer Science Dept.

Proposition For perfect privacy, between 2 allowed queries, there must be at least one salary. Result: asking all the possible queries, we get an interval for each salary. UTEP Computer Science Dept.

Interval computations How can we derive statistics from intervals instead of values? Problem: given n intervals for values x1…xn, compute the intervals a and s of possible values for the average and variance. UTEP Computer Science Dept.

Interval computations Average: computing the interval of possible values for the average easy Variance: computing the interval of possible values for the variance Computing the lower bound: O(n2) Computing the upper bound is NP-hard UTEP Computer Science Dept.

UB for variance is NP-hard Reduction from subset sum: given x1,…,xn,can we split into two sets with the same sum? Take all intervals [-xi,xi]. Max variance occurs at interval extremities Variance is Sxi2-E2 Need to minimize E UTEP Computer Science Dept.

UB for variance in db Restriction: all intervals are either disjoint or coincide. In this case, the upper bound can be computed in O(n2) UTEP Computer Science Dept.

Quantifying Information Many definitions only describe whether or not privacy loss occurred. Need a formal model to measure loss of privacy Could measure in bits or in percentage. UTEP Computer Science Dept.

Kolmogorov Complexity K(x): the size of the smallest program that can generate x K(x/y): complexity of x relative to y A way to measure quantity of information UTEP Computer Science Dept.

Kolmogorov Complexity to measure privacy loss? K(r): Quantity of information in a record K(r/s): Quantity of information relative to the statistical release Privacy of the record: K(r) – K(r/s) Maximize over records UTEP Computer Science Dept.

Problem with this definition Suppose the released average salary happens to coincide with a record. Cannot measure fractions of bits. Subject to additive constants. Does provide an asymptotic upper bound. UTEP Computer Science Dept.

Shannon entropy Set of events E = {e1, e2, …, en} Source S Entropy of S: H(S) = Σi pi log2(1/pi) A measure of amount of information in bits contained in each output symbol generated by S. UTEP Computer Science Dept.

Shannon first theorem Suppose one wants to encode n consecutive symbols output by S. Let Ln be the minimum expected number of bits of the encoding. Then, nH(s) ≤ Ln ≤ nH(s) + 1 UTEP Computer Science Dept.

Defining privacy loss with entropy Assume a database is generated according to some known probability distribution D. Induces a probability distribution on each record. Statistical release modifies the probability distribution. Privacy loss is H(r) – H’(r), maximized over all records. UTEP Computer Science Dept.

Example 100 records database with membership field 0: non member 1: member If average is 0, total loss (1 bit) If average is 0.5, no loss If average is 0.25, loss of about 0.2 bit. Expected loss is 0.008 bits. UTEP Computer Science Dept.

Considerations Some data is more sensitive than others Example: bits in salary Common knowledge, information from other databases Could define entropy conditional to available information Very impractical in applications Some people know some of the records UTEP Computer Science Dept.

Properties of definition Privacy loss is non additive Depends on prior distribution Can model partial knowledge Makes this less practical Statistical release may actually cause gain in privacy! Does not incorporate computational resources restrictions UTEP Computer Science Dept.

Future work Incorporate data sensitivity measure In a value, differentiate lower and higher order bits Some fields may have one sided sensitivity UTEP Computer Science Dept.

Future work Gauge privacy loss of existing privacy preserving algorithms Use effective entropy (Yao 2002) to deal with computational resources Incorporate privacy robustness UTEP Computer Science Dept.

Summary Needs for studying privacy in databases Methods for preserving privacy Interval computations Definition of measure of privacy loss based on entropy Analysis of definition and notions not yet captured Suggestions on how improve this definition UTEP Computer Science Dept.