1. Differential Privacy

2. 1977 paper of Dalenius articulated the following desideratum: access to a statistical database should not enable one to learn anything about an individual that could not be learned without access.

3. An adversary who has access to the statistical database and the auxiliary information “Terry Gross is two inches shorter than the average Lithuanian woman” learns Terry Gross’ height
Cynthia Dwork, Moni Naor. On the Difficulties of Disclosure Prevention in Statistical Databases or The Case for Differential Privacy. Journal of Privacy and Confidentiality, 2010

4. Differencing Attack
Participating or not doesn't significantly improve privacy risk
How many people in the database have the sickle cell trait?
Name
Age
Sex
Sickle Cell Trait
Alice 65 M
yes
Bob 35 F no
Cindy 40

5. Definition of Differential Privacy
Let ε be a positive real number
A be a randomized algorithm that takes a dataset as input.
The algorithm A is said to provide ε-differential privacy if, for all datasets D1 and D2 that differ on a single element, and all subsets S of Range(A):

6. DP Algorithms
Randomized response
Laplace mechanism
Gaussian mechanism

7. Randomized Response “Have you engaged in XYZ in the past week?”
Flip a coin.
If tails, then respond truthfully.
If heads, then flip a second coin and respond “Yes” if heads and “No” if tails.
p is the true fraction
the expected number of “Yes” answers is
(1/4)(1−p)+(3/4)p = (1/4)+p/2

8. Randomized Response
Satisfy ln3-differential privacy
S={Yes}
S={No}

9. Laplace Mechanism

10. Laplace Mechanism
f (D1)
f (D2)

11. Laplace Mechanism

12. Gaussian mechanism
| |

13. Gaussian mechanism Let ε be a positive real number
M be a randomized algorithm that takes a dataset as input.
The algorithm M is said to provide (ε, δ)-differential privacy if, for all datasets D1 and D2 that differ on a single element, and all subsets S of Range(M):

14. Gaussian mechanism

15. Gaussian mechanism
σ = cΔf/ε

16. Compare Laplace & Gaussian
Lap: b = Δf/ε
Gau: σ = cΔf/ε
Variance
, σ

17. Discussion Assumption 1: more knowledgeable attacker
Assumption 2: less knowledgeable attacker
Under which assumption should we release less sensitive information
Under assumption 1
Under assumption 2
Daniel Kifer, Ashwin Machanavajjhala No Free Lunch in Data Privacy 2011 SIGMOD

18. Discussion Data are not independently generated
Example Bob and his 9 immediate family members may be afflicted with a genetic disease, A weaker attacker who knows nothing about the family's health can ask the query "how many in Bob's family have this disease?".
The true answer is almost certainly going to be either 0 or 10. Suppose Laplace(1/ε) noise is added to the true answer.
The answer 12 is exp(10) times more likely when the true answer is 10 than when the true answer is 0
Daniel Kifer, Ashwin Machanavajjhala No Free Lunch in Data Privacy 2011 SIGMOD