Differential Privacy for Relational Algebra: improving the sensitivity bounds via constraint systems Marco Stronati Catuscia Palamidessi Universit` a di Pisa, Italy INRIA and LIX, Ecole Polytechnique, France marco@stronati.org catuscia@lix.polytechnique.fr Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 1 / 30
Introduction Statistical Disclosure Control Revealing accurate statistics vs Preserving the privacy of individuals. Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 2 / 30
Introduction Statistical Disclosure Control Revealing accurate statistics vs Preserving the privacy of individuals. How many people have cancer? Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 2 / 30
Introduction Statistical Disclosure Control Revealing accurate statistics vs Preserving the privacy of individuals. How many people have cancer? Does John Doe have cancer? Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 2 / 30
Background Quantitative approach Information Hiding Dalenius’ ad omnia privacy desideratum (’77): nothing about an individual should be learnable from the database that could not be learned without access to the database. Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 3 / 30
Background Quantitative approach Information Hiding Dalenius’ ad omnia privacy desideratum (’77): nothing about an individual should be learnable from the database that could not be learned without access to the database. Trade off between privacy and utility Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 3 / 30
Background Quantitative approach Information Hiding Dalenius’ ad omnia privacy desideratum (’77): nothing about an individual should be learnable from the database that could not be learned without access to the database. Trade off between privacy and utility Quantitative Approach Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 3 / 30
Differential Privacy Differential Privacy - Dwork, McSherry, Smith, Nissim A randomized function H : R → R satisfies ǫ -differential privacy if for all pairs R , R ′ ∈ R , with R ∼ R ′ , and all X ⊆ R : Pr [ H ( R ) ∈ X ] ≤ Pr [ H ( R ′ ) ∈ X ] · e ǫ Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 4 / 30
Differential Privacy Differential Privacy - Dwork, McSherry, Smith, Nissim A randomized function H : R → R satisfies ǫ -differential privacy if for all pairs R , R ′ ∈ R , with R ∼ R ′ , and all X ⊆ R : e − ǫ ≤ Pr [ H ( R ) ∈ X ] Pr [ H ( R ′ ) ∈ X ] ≤ e ǫ Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 4 / 30
Differential Privacy Differential Privacy - Dwork, McSherry, Smith, Nissim A randomized function H : R → R satisfies ǫ -differential privacy if for all pairs R , R ′ ∈ R , with R ∼ R ′ , and all X ⊆ R : e − ǫ ≤ Pr [ H ( R ) ∈ X ] Pr [ H ( R ′ ) ∈ X ] ≤ e ǫ ǫ -indistinguishability Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 4 / 30
Differential Privacy Overview (oblivious case) Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 5 / 30
Differential Privacy Noise addition Noise addition Laplacian distribution Lap ( x | b ) = 1 � −| x | � 2 b exp b Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 6 / 30
Differential Privacy Noise addition Noise addition Laplacian distribution Lap ( x | b ) = 1 � −| x | � 2 b exp b Theorem (Dwork06) For Q : R → R , the randomized mechanism H that adds noise with distribution Lap (∆ Q /ǫ ) enjoys ǫ -differential privacy. Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 6 / 30
Differential Privacy Noise addition Noise addition Laplacian distribution Lap ( x | b ) = 1 � −| x | � 2 b exp b Theorem (Dwork06) For Q : R → R , the randomized mechanism H that adds noise with distribution Lap (∆ Q /ǫ ) enjoys ǫ -differential privacy. ↑ ∆ Q ↓ ǫ Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 6 / 30
Differential Privacy Sensitivity Sensitivity Definition (Sensitivity Dwork06) Given a query Q : R → R , the sensitivity of Q , denoted by ∆ Q , is defined as: R ∼ R ′ | Q ( R ) − Q ( R ′ ) | ∆ Q = sup Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 7 / 30
Contribution Contribution ◮ a compositional method to compute a bound on the sensitivity of a query expressed in relational algebra Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 8 / 30
Contribution Contribution ◮ a compositional method to compute a bound on the sensitivity of a query expressed in relational algebra ◮ constraints used to obtain the exact sensitivity Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 8 / 30
Differential Privacy for Relational Algebra Differential Privacy for Relational Algebra Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 9 / 30
Differential Privacy for Relational Algebra Relational Algebra Relational Algebra - A Formal SQL Definition (Relation Schema) ◮ T : universe of tuples ◮ Relation R: a set of tuples ◮ R : universe of relations name ( a 1 : D 1 , a 2 : D 2 , . . . , a n : D n ) Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 10 / 30
Differential Privacy for Relational Algebra Relational Algebra Relational Algebra - A Formal SQL Definition (Relation Schema) ◮ T : universe of tuples ◮ Relation R: a set of tuples ◮ R : universe of relations name ( a 1 : D 1 , a 2 : D 2 , . . . , a n : D n ) Example Items { Item : String, Item Price Cost Price : Int, Oil 100 10 Cost : Int } Salt 50 11 Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 10 / 30
Differential Privacy for Relational Algebra Constraints Constraints CREATE TABLE products ( product no integer, name text, price numeric CHECK (price > 0) ); Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 11 / 30
Differential Privacy for Relational Algebra Constraints Constrained Schema R ( C ) = 2 T ( C ) T ( C ) { Item : String, { 0 Cost ≤ 1000 < Items Price : Int, Cost ≤ Price ≤ 1000 } } Cost : Int c-schema: schema + set of constraints C Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 12 / 30
Differential Privacy for Relational Algebra Constraints Constrained Schema R ( C ) = 2 T ( C ) T ( C ) { Item : String, { 0 Cost ≤ 1000 < Items Price : Int, Cost ≤ Price ≤ 1000 } } Cost : Int c-schema: schema + set of constraints C Transformation from c-schema to c-schema Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 12 / 30
Differential Privacy for Relational Algebra Sensitivity Constrained Sensitivity Constrained Definition (Sensitivity constrained) Given f : ( X , d X ) → ( Y , d Y ), set of constraints C on X d Y ( f ( x ) , f ( x ′ )) ∆ f ( C ) = sup d X ( x , x ′ ) x , x ′ ∈ sol ( C ) x � = x ′ Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 13 / 30
Differential Privacy for Relational Algebra Metric Spaces Metric Spaces Adjacency relation ( R , ∼ ) − − − − − − − − − − − − − − ∼ − − − − − − − − − − − − − − − − − − − − − Hamming Graph Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 14 / 30
Differential Privacy for Relational Algebra Metric Spaces Metric Spaces Adjacency relation ( R , ∼ ) − − − − − − − − − − − − − − ∼ − − − − − − − − − − − − − − − − − − − − − Hamming Graph Definition (Hamming distance d H ) Given R , R ′ ∈ R d H ( R , R ′ ) = | R ⊖ R ′ | = | ( R \ R ′ ) ∪ ( R ′ \ R ) | Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 14 / 30
Differential Privacy for Relational Algebra Metric Spaces Metric Spaces Definition ( n -Hamming Distance d nH ) ′ ∈ R n : Given R , R ′ ) = max ( d H ( R 1 , R ′ 1 ) , . . . , d H ( R n , R ′ d nH ( R , R n )) Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 15 / 30
Differential Privacy for Relational Algebra Metric Spaces Metric Spaces Definition ( n -Hamming Distance d nH ) ′ ∈ R n : Given R , R ′ ) = max ( d H ( R 1 , R ′ 1 ) , . . . , d H ( R n , R ′ d nH ( R , R n )) Definition (Euclidean Distance d E ) Given x , x ′ ∈ R d E ( x , x ′ ) = | x − x ′ | Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 15 / 30
Operators Structure of a Query Op Op ( R n , d nH ) → ( R n , d nH ) − → . . . − Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 16 / 30
Operators Structure of a Query Op Op A γ F ( R n , d nH ) → ( R n , d nH ) − → . . . − − − → ( R , d E ) Marco Stronati (APVP’12) Differential Privacy for Relational Algebra 16 / 30
Recommend
More recommend
