Block Design-Based Local Differential Privacy Mechanisms

When collecting information, local differential privacy (LDP) alleviates privacy concerns of users because their private information is randomized before being sent it to the central aggregator. LDP imposes large amount of noise as each user executes the randomization independently. To address this issue, recent work introduced an intermediate server with the assumption that this intermediate server does not collude with the aggregator. Under this assumption, less noise can be added to achieve the same privacy guarantee as LDP, thus improving utility for the data collection task. This paper investigates this multiple-party setting of LDP. We analyze the system model and identify potential adversaries. We then make two improvements: a new algorithm that achieves a better privacy-utility tradeoff; and a novel protocol that provides better protection against various attacks. Finally, we perform experiments to compare different methods and demonstrate the benefits of using our proposed method.

Many real-world social networks are decentralized in nature, and the only way to analyze such a network is to collect local views of the social graph from individual participants. Since local views may contain sensitive information, it is often desirable to apply differential privacy in the data collection process, which provides strong and rigorous privacy guarantees. In many practical situations, the local view of a participant contains not only her own connections, but also those of her neighbors, which are private and sensitive for the neighbors, but not directly so for the participant herself. We call such information beyond direct connections an extended local view (ELV), and study two fundamental problems related to ELVs: first, how do we correctly enforce differential privacy for all participants in the presence of ELVs? Second, how can the data collector utilize ELVs to obtain accurate estimates of global graph properties? This paper points out that when collecting ELVs, it is insufficient to apply a straightforward adaptation of local differential privacy (LDP), a commonly used scheme in practice, to protect the privacy of all network participants. The main problem is that an adversarial data collector can accumulate private information on a specific victim from multiple neighbors of the victim; even though the data collected from each neighbor is perturbed under LDP, their aggregate can still violate the victim's privacy. To prevent this attack, we formulate a novel decentralized differential privacy (DDP) scheme, which requires that each participant consider not only her own privacy, but also that of her neighbors involved in her ELV. The stringent privacy requirement of DDP, however, makes it challenging to design an effective mechanism for data collection. Towards this goal, we design a novel multi-phase framework under DDP that enables an analyst to accurately estimate subgraph counts, an important property of social graphs. The main idea is that instead of collecting subgraph counts directly, which would require excessively noise, the analyst first asks individuals about their respective minimum noise scale, which is private information since it depends on the local graph structure, and, thus, must be performed under DDP. For some types of subgraphs, this process is applied recursively, i.e., the analyst asks about the necessary noise to be injected into the private information on the minimum local noise scale required to protect subgraph counts under DDP. As case studies, we instantiate the proposed framework for three common subgraph patterns: triangles, three-hop paths, and k-cliques. Extensive experiments using real data demonstrate that the proposed scheme leads to accurate estimates of global subgraph counts, whereas baseline solutions fail to obtain meaningful result utility.

Frequent itemset mining is a basic data mining task and has many applications in other data mining tasks. However, it is likely that the user's personal privacy information may be leaked in the mining process. In recent years, applying the local differential privacy protection model to mine all frequent itemsets is a relatively reliable and secure protection method. In local differential privacy, users first perturb the original data then send it to the aggregator, which prevents the aggregator leaking user's private information throughout the process. There are two major problems with data mining using local differential privacy, one is that the accuracy of the results is relatively low after mining, and the other is that the user transmits too much data to the server, which results in higher communication costs. In this paper, we use Hadamard response algorithm to improve the accuracy of the results while reduce the communication cost. Finally, we use FP-tree for frequent itemset mining to compare the Hadamard response with previous algorithms.

In this paper, we study Local Information Privacy (LIP). As a context-aware privacy notion, LIP relaxes the de facto standard privacy notion of local differential privacy (LDP) by incorporating prior knowledge and therefore achieving better utility. We study the relationships between LIP and some of the representative privacy notions including LDP, mutual information and maximal leakage. We show that LIP provides strong instance-wise privacy protection compared to other context-aware privacy notions. Moreover, we present some useful properties of LIP, including post-processing, linkage, composability, transferability and robustness to imperfect prior knowledge. Then we study a general utility-privacy tradeoff framework, under which we derive LIP based privacy-preserving mechanisms for both discrete and continuous-valued data. Three types of perturbation mechanisms are studied in this paper: 1) randomized response (RR), 2) random sampling (RS) and 3) additive noise (AN) (e.g., Gaussian mechanism). Our privacy mechanisms incorporate the prior knowledge into the perturbation parameters so as to enhance utility. Finally, we present a comprehensive set of experiments on real datasets to illustrate the advantage of context-awareness and compare the utility-privacy tradeoffs provided by different mechanisms.

Differential privacy has emerged as a gold standard in privacy-preserving data analysis. A popular variant is local differential privacy, where the data holder is the trusted curator. A major barrier, however, towards a wider adoption of this model is that it offers a poor privacy-utility trade-off. In this work, we address this problem by introducing a new variant of local privacy called profile-based privacy. The central idea is that the problem setting comes with a graph G of data generating distributions, whose edges encode sensitive pairs of distributions that should be made indistinguishable. This provides higher utility because unlike local differential privacy, we no longer need to make every pair of private values in the domain indistinguishable, and instead only protect the identity of the underlying distribution. We establish privacy properties of the profile-based privacy definition, such as post-processing invariance and graceful composition. Finally, we provide mechanisms that are private in this framework, and show via simulations that they achieve higher utility than the corresponding local differential privacy mechanisms.

Federated analytics (FA) over spatial data with local differential privacy (LDP) has attracted considerable research attention recently. Existing solutions for this problem mostly employ a uniform grid (UG) structure, which recursively decomposes the whole spatial domain into fine‐grained regions in the distributed setting. In each round, the sampled clients perturb their locations using a random response mechanism with a fixed probability. This approach, however, cannot encode the client’s location effectively and will lead to ill‐suited query results. To address the deficiency of existing solutions, we propose LDP‐FSRQ, a spatial range query algorithm that relies on a hybrid spatial structure composed of the UG and quad‐tree with nonuniform perturbation (NUP) probability to encode and perturb clients’ locations. In each iteration of LDP‐FSRQ, each client adopts the quad‐tree to encode his/her location into a binary string and uses four local perturbation mechanisms to protect the encoded string. Then, the collector prunes the quad‐tree of the current round according to the clients’ reports and shares the pruned tree with the clients of the next round. We demonstrate the application of LDP‐FSRQ on Beijing, Landmark, Check‐in, and NYC datasets, and the experimental results show that our approach outperforms its competitors in terms of queries’ utility.

In recent years, new industrial forms has continuously been generated with the rapid development of big data technology. However, the problem of data privacy and security has become increasingly prominent. In numerous geographically related applications, location trajectory data which involve sen- sitive personal privacy need more stringent protection measures. Thus a method has been proposed before that combining hidden Markov model with local differential privacy mechanism, for training and generating a biased trajectory dataset. Nevertheless, this method did not take into account the spatial correlation between track coordinates, which causes a large deviation be- tween the disturbed trajectory and the real trajectory. Aiming at this problem, this paper brings forward a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(\varepsilon,\delta)$</tex> -local differential privacy mechanism based on trajectory coordinate correlation. On the basis of existing schemes, it emphasizes the spatial correlation of trajectory coordinates. Furthermore, it may ensure the availability of track data by reasonably setting the dynamic parameter of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\delta$</tex> . Finally, we conduct experiments on data sets of Taxi trajectory prediction. The results show that our Correlation Multivariate Random Response (CMRR) algorithm presents significantly better performance than Generalized Randomized Response (GRR) in data availability. In the meanwhile, it strictly meets the privacy protection requirements.

The Internet of Vehicles (IoV) is a promising branch of the Internet of Things. IoV simulates a large variety of crowdsourcing applications, such as Waze, Uber, and Amazon Mechanical Turk, etc. Users of these applications report the real-time traffic information to the cloud server which trains a machine learning model based on traffic information reported by users for intelligent traffic management. However, crowdsourcing application owners can easily infer users' location information, traffic information, motor vehicle information, environmental information, etc., which raises severe sensitive personal information privacy concerns of the users. In addition, as the number of vehicles increases, the frequent communication between vehicles and the cloud server incurs unexpected amount of communication cost. To avoid the privacy threat and reduce the communication cost, in this article, we propose to integrate federated learning and local differential privacy (LDP) to facilitate the crowdsourcing applications to achieve the machine learning model. Specifically, we propose four LDP mechanisms to perturb gradients generated by vehicles. The proposed Three-Outputs mechanism introduces three different output possibilities to deliver a high accuracy when the privacy budget is small. The output possibilities of Three-Outputs can be encoded with two bits to reduce the communication cost. Besides, to maximize the performance when the privacy budget is large, an optimal piecewise mechanism (PM-OPT) is proposed. We further propose a suboptimal mechanism (PM-SUB) with a simple formula and comparable utility to PM-OPT. Then, we build a novel hybrid mechanism by combining Three-Outputs and PM-SUB. Finally, an LDP-FedSGD algorithm is proposed to coordinate the cloud server and vehicles to train the model collaboratively. Extensive experimental results on real-world data sets validate that our proposed algorithms are capable of protecting privacy while guaranteeing utility.

Combinatorial block designs are used in various fields of technology; recently, they have been implemented, for example, as models of computer systems and key distribution schemes. They are defined on the basis of some finite set as satisfying certain conditions the set of its subsets called blocks. In this chapter, we study combinatorial block designs whose order is a prime number or a prime power. The tasks sufficient for the practical use of such block designs are considered: determining the composition of a particular block by its number and determining the numbers of blocks containing given element. It is shown that for their solution, a memory volume linear in the design order is used. Solutions are given with a certain numbering of elements and blocks. The sets on which the designs are defined are initial nonnegative, the blocks are their subsets. Computations are performed by mapping this set into a vector space of a certain dimension over the prime field or its extention. Four algorithms are given: Algorithm 1 and Algorithm 2 for constructing of projective plane and dual projective plane and Algorithms 3 and 4 for constructing of separate blocks of those projective planes.

Most user-generated data in online services are presented as set-valued data, e.g., visited website URLs, recently used Apps by a person, and etc. These data are of great value to service providers, but also bring privacy concerns if collected and analyzed directly. To tackle potential privacy threatens, local differential privacy (LDP) attracts increasing attention nowadays. However, existing approaches only provide sub-optimal error bound for set-valued data distribution estimation with LDP. Besides, it is computational expensive and communication expensive to use for high dimensional set-valued data, considering large domains in real scenarios. Thus, existing approaches are unpractical to use on resource-constrained user-side devices (e.g., smartphones and wearable devices). In this paper, we propose a utility-optimal and efficient set-valued data publication method (i.e., wheel mechanism ). On the user side, each user contributes only one numerical value to represent their privatized data. The computational complexity is O (min{ m log m , me ɛ }) and communication cost is O (log( me ɛ )) bits, while existing approaches usually depend on O ( d ) or O (log d ), where m is the number of items in the set-valued data ( m ≡ 1 for categorical data), d is the domain size (usually d ≫ m ) and ɛ is the privacy budget. On the server side, the estimator takes numerical values from users as input and derives an unbiased distribution estimation. Theoretical results show that estimation error bounds are improved from previously known [EQUATION] to the optimal rate [EQUATION]. Results on extensive experiments demonstrate that our proposed wheel mechanism is 3-100× faster than existing approaches, meanwhile has optimal statistical efficiency.

Sequential change detection is a fundamental problem in statistics and signal processing, with the CUSUM procedure widely used to achieve minimax detection delay under a prescribed false alarm rate when pre- and post-change distributions are fully known. However, in many practical settings, raw observations cannot be shared with a trusted central curator, and privacy must be enforced at the data source, which prevents the computation of exact CUSUM statistics. We therefore introduce a local differentially private (DP) variant called LDP-CUSUM, which first applies a local DP mechanism to transform the raw data into privatized observations and then applies a CUSUM procedure to detect the change. We derive closed-form bounds on the average run length to false alarm and on the worst-case average detection delay, explicitly characterizing the tradeoff among privacy level, false alarm rate, and detection efficiency. Numerical simulations and a real-data case study were conducted to demonstrate the detection efficiency of our proposed LDP-CUSUM across various scenarios.

This paper presents a comprehensive methodology for assessing the measure of rotatability for response surface design in second-order through the use of suitably chosen pairs of dissimilar incomplete block designs. The proposed framework incorporates multiple combinations of block structures, including symmetrically unequal block arrangements (SUBA) with two unequal block sizes combined with balanced incomplete block designs (BIBD), pairwise balanced designs (PBD) combined with BIBD, and PBD combined with SUBA with two unequal block sizes. By integrating these complementary block designs, the study aims to generate second-order designs that achieve improved precision and enhanced rotatability properties. To demonstrate the applicability of the method, several worked examples are constructed, highlighting the steps involved in deriving the design points and computing the corresponding measures of rotatability. Furthermore, three-dimensional response surface plots are provided to visually examine the geometric and variance characteristics of the resulting designs. These graphical representations support the interpretation of the theoretical results and illustrate the advantages of the proposed approach in constructing efficient rotatable second-order designs.

Kim and Ko proposed second type second order slope rotatable designs (SOSRD) utilizing central composite designs (CCD) wherein the two digits   1 2 a , a denotes the position of star points. In this study, we propose SOSRD of second type utilizing balanced incomplete block designs (BIBD) with unequal block sizes. In specific cases, the recommended procedure results in fewer design points than SOSRD of second type acquired through pairwise balanced designs (PBD), symmetrical unequal block arrangements (SUBA) with two unequal block sizes and balanced incomplete block designs (BIBD).

Partially Balanced Incomplete Block (PBIB) designs are the primary subject of this investigation of independent dominance in block designs. In the combinatorial structure of PBIB-designs, where treatments and blocks are depicted as vertices and edges, respectively, the graph-theoretic parameter known as independent dominance is applied. Within the framework of PBIB-designs defined by different association schemes, the study delves into the theoretical foundations, computation, and consequences of independent domination. Finding autonomous dominating sets that effectively represent all treatments while minimizing redundancy is the goal of the study, which offers a paradigm for doing so by examining the links between blocks and treatments. Experiment design optimization using independent dominating parameters is demonstrated in case studies of 2-associate and 3-associate PBIB-designs. This study sheds light on the structural features of PBIB-designs by demonstrating the interaction between graph theory and combinatorial design theory. In situations where resources are limited, it highlights the value of independent dominance as a method for assessing and improving block designs’ efficiency. Our current understanding of block designs and how to optimize them for use in experimental planning, data analysis, and resource allocation is enhanced by these findings.

Sensor networks (SNETs) for monitoring spatial phenomena has emerged as an area of significant practical interest. We focus on the important problem of detection of distributed events, sources, or abnormalities that are localized, i.e., only a small number of sensors in the vicinity of the phenomena are in the field of observation. This problem complements the standard decentralized detection problem, where noisy information about an event is measured by the entire network. For localized phenomena the main difficulty arises from the coupling of: a) noisy sensor observations that lead to local false positives/negatives; and b) limited energy, which constrains communication among sensor nodes. Together these difficulties call for reaching a decentralized statistical ordering based on limited collaboration. We are then led to the following fundamental problem: determine the most probable event locations while minimizing communication cost. Our objective in this paper is to characterize the fundamental trade offs between global performance (false alarms and miss rate) and communication cost. We develop a framework to minimize the communication cost subject to worst-case misclassification constraints by making use of the false discovery rate (FDR) concept along with an optimal local measure transformation at each sensor node. The preliminary results show that the FDR concept applied in a sensor networks context leads to significant reduction in the communication cost of the system. A very interesting implication of this work is that the detection performance of a wireless sensor network is comparable to that of a wired network of sensors.