1. Post-Modern Private Data Analysis
(Cynthia Dwork, Sergey Yekhanin)
Threats facing data curators:
— mission creep
— pressure by foreign governments
— insiders
— hacker attacks
Our technology ensures differential privacy to encourage participation. Our algorithms never store the data and remain private even if their internal states become visible to an adversary (“pan-privacy”).

2. Data is a stream of items, each item belongs to a user
Data is a stream of items, each item belongs to a user. Algorithm sees each item and updates internal state, generates output at end of stream.
state
state
state
output
Pan-Privacy: for any two adjacent streams, at any single point in time, internal state has (essentially) the same distribution.

3. D0 D1 Pan private stream density estimator: Universe Algorithm:X
Algorithm:
For each x in X: store a single bit bx drawn from D0 or D1
Initially: for every x in X, bx is (0,1) w.p. (½,½) - dist. D0
When encountering x in data stream, update bx to be (0,1) w.p. (½-ε,½+ε) - dist. D1
Estimate fraction of “real” 1’s in the table: (y-|X|/2) / ε
Privacy of internal state:
If user x never appeared: entry drawn from D0,
If user x appeared (any # of times): entry drawn from D1
D0 D1
Pan-private streaming algorithms for: t-cropped mean, fraction of items appearing exactly k times, fraction of heavy-hitters.