Context-Aware Local Information Privacy

In this paper, we propose a new class of local differential privacy (LDP) schemes based on combinatorial block designs for a discrete distribution estimation. This class not only recovers many known LDP schemes in a unified framework of combinatorial block design, but also suggests a novel way of finding new schemes achieving the optimal (or near-optimal) privacy-utility trade-off with lower communication costs. Indeed, we find many new LDP schemes that achieve both the optimal privacy-utility trade-off and the minimum communication cost among all the unbiased schemes for a certain set of input data size and LDP constraint. Furthermore, to partially solve the sparse existence issue of block design schemes, we consider a broader class of LDP schemes based on regular and pairwise-balanced designs, called RPBD schemes, which relax one of the symmetry requirements on block designs. By considering this broader class of RPBD schemes, we can find LDP schemes achieving near-optimal privacy-utility trade-off with reasonably low communication costs for a much larger set of input data size and LDP constraint.

When collecting information, local differential privacy (LDP) alleviates privacy concerns of users because their private information is randomized before being sent it to the central aggregator. LDP imposes large amount of noise as each user executes the randomization independently. To address this issue, recent work introduced an intermediate server with the assumption that this intermediate server does not collude with the aggregator. Under this assumption, less noise can be added to achieve the same privacy guarantee as LDP, thus improving utility for the data collection task. This paper investigates this multiple-party setting of LDP. We analyze the system model and identify potential adversaries. We then make two improvements: a new algorithm that achieves a better privacy-utility tradeoff; and a novel protocol that provides better protection against various attacks. Finally, we perform experiments to compare different methods and demonstrate the benefits of using our proposed method.

Local Differential Privacy (LDP) has been widely recognized as a powerful tool for providing a strong theoretical guarantee of data privacy to data contributors against an untrusted data collector. Under a typical LDP scheme, each data contributor independently randomly perturbs their data before submitting them to the data collector, which in turn infers valuable statistics about the original data from received perturbed data. Common to existing LDP mechanisms is an inherent trade-off between the level of privacy protection and data utility in the sense that strong data privacy often comes at the cost of reduced data utility. Frequency estimation based on Randomized Response (RR) is a fundamental building block of many LDP mechanisms. In this paper, we propose a novel Joint Randomized Response (JRR) mechanism based on correlated data perturbations to achieve locally differentially private frequency estimation. JRR divides data contributors into disjoint groups of two members and lets those in the same group jointly perturb their binary data to improve frequency-estimation accuracy and achieve the same level of data privacy by hiding the group membership information in contrast to the classical RR mechanism. Theoretical analysis and detailed simulation studies using both real and synthetic datasets show that JRR achieves the same level of data privacy as the classical RR mechanism while improving the frequency-estimation accuracy in the overwhelming majority of the cases by up to two orders of magnitude.

K-means clustering has been heavily employed to mine valuable insights from interval data. Nevertheless, serious privacy leakage concerns are stumbling blocks impeding its widespread application. To quantify the privacy of small and large-scale interval data, we introduce two notions of α-Condensed Local Differential Privacy and ϵ-Local Differential Privacy, and propose two distance-aware perturbation mechanisms of α-exponential and square wave mechanisms. Rigorous theoretical analysis proves that our proposed mechanisms satisfy these two privacy notions. The experimental results built on multiple synthesized and real datasets show that our proposed mechanisms can provide more accurate clustering results than prior work, such as Randomized Response, Generalized Randomized Response, and Optimized Local Hash.

: Calculating the amount of information about a random function contained in another random function has important uses in communication theory. An expression for the mutual information for continuous time random processes has been given by Gelfand and Yaglom, Chiang, and Perez by generalizing Shannon's result in a natural way. Under a condition of absolute continuity of measures the continuous time expression has the same form as Shannon's result. For two Gaussian processes Gelfand and Yaglom express the mutual information in terms of a mean square estimation error. We generalize this result to diffusion processes and express the solution in a different form which is more naturally related to a corresponding filtering problem. We also use these results to calculate some information rates.

This paper investigates the relation between three different notions of privacy: identifiability, differential privacy, and mutual-information privacy. Under a unified privacy-distortion framework, where the distortion is defined to be the expected Hamming distance between the input and output databases, we establish some fundamental connections between these three privacy notions. Given a maximum allowable distortion $D$ , we define the privacy-distortion functions $\epsilon _{\mathrm{ i}}^{*}(D)$ , $\epsilon _{\mathrm{ d}}^{*}(D)$ , and $\epsilon _{\mathrm{ m}}^{*}(D)$ to be the smallest (most private/best) identifiability level, differential privacy level, and mutual information between the input and the output, respectively. We characterize $\epsilon _{\mathrm{ i}}^{*}(D)$ and $\epsilon _{\mathrm{ d}}^{*}(D)$ , and prove that $\epsilon _{\mathrm{ i}}^{*}(D)-\epsilon _{X}\le \epsilon _{\mathrm{ d}}^{*}(D)\le \epsilon _{\mathrm{ i}}^{*}(D)$ for $D$ within certain range, where $\epsilon _{X}$ is a constant determined by the prior distribution of the original database $X$ , and diminishes to zero when $X$ is uniformly distributed. Furthermore, we show that $\epsilon _{\mathrm{ i}}^{*}(D)$ and $\epsilon _{\mathrm{ m}}^{*}(D)$ can be achieved by the same mechanism for $D$ within certain range, i.e., there is a mechanism that simultaneously minimizes the identifiability level and achieves the best mutual-information privacy. Based on these two connections, we prove that this mutual-information optimal mechanism satisfies $\epsilon $ -differential privacy with $\epsilon _{\mathrm{ d}}^{*}(D)\le \epsilon \le \epsilon _{\mathrm{ d}}^{*}(D)+2\epsilon _{X}$ . The results in this paper reveal some consistency between two worst case notions of privacy, namely, identifiability and differential privacy, and an average notion of privacy, mutual-information privacy.

Local differential privacy (LDP) is a state-of-the-art technique for privacy preservation. In this paper, we provide upper bounds for mutual information, a common information-theoretic metric, under pure LDP and approximate LDP constraints. Compared to existing results, our results have the advantage of holding for any discrete distribution and any privacy budget, and are tighter over some regions of the distribution and privacy budget.

Set-valued data is extremely important and widely used in sensor technology and application. Recently, privacy protection for set-valued data under differential privacy (DP) has become a research hotspot. However, the DP model assumes that the data center is trustworthy, consequently, increasingly attention has been paid to the application of the local differential privacy model (LDP) for set-valued data. Constrained by the local differential privacy model, most methods randomly respond to the subset of set-valued data, and the data collector conducts statistics on the received data. There are two main problems with this kind of method: one is that the utility function used in the random response loses too much information; the other is that the privacy protection of the set-valued data category is usually ignored. To solve these problems, this paper proposes a set-valued data collection method (SetLDP) based on the category hierarchy under the local differential privacy model. The core idea is to first make a random response to the existence of the category, continue to disturb the item count if the category exists, and finally randomly respond to a candidate itemset based on the new utility function. Theory analysis and experimental results show that the SetLDP can not only preserve more information, but also protect the category private information in set-valued data.

In recent years, new industrial forms has continuously been generated with the rapid development of big data technology. However, the problem of data privacy and security has become increasingly prominent. In numerous geographically related applications, location trajectory data which involve sen- sitive personal privacy need more stringent protection measures. Thus a method has been proposed before that combining hidden Markov model with local differential privacy mechanism, for training and generating a biased trajectory dataset. Nevertheless, this method did not take into account the spatial correlation between track coordinates, which causes a large deviation be- tween the disturbed trajectory and the real trajectory. Aiming at this problem, this paper brings forward a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(\varepsilon,\delta)$</tex> -local differential privacy mechanism based on trajectory coordinate correlation. On the basis of existing schemes, it emphasizes the spatial correlation of trajectory coordinates. Furthermore, it may ensure the availability of track data by reasonably setting the dynamic parameter of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\delta$</tex> . Finally, we conduct experiments on data sets of Taxi trajectory prediction. The results show that our Correlation Multivariate Random Response (CMRR) algorithm presents significantly better performance than Generalized Randomized Response (GRR) in data availability. In the meanwhile, it strictly meets the privacy protection requirements.

It is predicted that the global mobile data traffic will increase nearly eightfold in the next five years, and the cloud applications will consist of 90 percent of total mobile data traffic by the end of 2019. There is no doubt that the increasing high quality video requirements and huge similar information stored in cloud servers enforce to setup a new communication paradigm. In this paper, we will take a brief review over the knowledge-enhanced mobile video broadcasting (KMV-Cast) framework, and analyze its performance with imperfect prior knowledge, which means that the prior knowledge will be transmitted through Gaussian channel. The simulation results have shown that KMV-Cast with imperfect prior knowledge performs the worst compared with the other two schemes in terms of PSNR. It indicates that the prior knowledge is very important for the video reconstruction in KMV-Cast. Meanwhile, with the SNR increasing for prior knowledge transmission, the performance still performs poor and has an optimum point.

Differential privacy has emerged as a gold standard in privacy-preserving data analysis. A popular variant is local differential privacy, where the data holder is the trusted curator. A major barrier, however, towards a wider adoption of this model is that it offers a poor privacy-utility trade-off. In this work, we address this problem by introducing a new variant of local privacy called profile-based privacy. The central idea is that the problem setting comes with a graph G of data generating distributions, whose edges encode sensitive pairs of distributions that should be made indistinguishable. This provides higher utility because unlike local differential privacy, we no longer need to make every pair of private values in the domain indistinguishable, and instead only protect the identity of the underlying distribution. We establish privacy properties of the profile-based privacy definition, such as post-processing invariance and graceful composition. Finally, we provide mechanisms that are private in this framework, and show via simulations that they achieve higher utility than the corresponding local differential privacy mechanisms.

Federated analytics (FA) over spatial data with local differential privacy (LDP) has attracted considerable research attention recently. Existing solutions for this problem mostly employ a uniform grid (UG) structure, which recursively decomposes the whole spatial domain into fine‐grained regions in the distributed setting. In each round, the sampled clients perturb their locations using a random response mechanism with a fixed probability. This approach, however, cannot encode the client’s location effectively and will lead to ill‐suited query results. To address the deficiency of existing solutions, we propose LDP‐FSRQ, a spatial range query algorithm that relies on a hybrid spatial structure composed of the UG and quad‐tree with nonuniform perturbation (NUP) probability to encode and perturb clients’ locations. In each iteration of LDP‐FSRQ, each client adopts the quad‐tree to encode his/her location into a binary string and uses four local perturbation mechanisms to protect the encoded string. Then, the collector prunes the quad‐tree of the current round according to the clients’ reports and shares the pruned tree with the clients of the next round. We demonstrate the application of LDP‐FSRQ on Beijing, Landmark, Check‐in, and NYC datasets, and the experimental results show that our approach outperforms its competitors in terms of queries’ utility.

With the rapid development of big data technology, the issue of preserving personal privacy has attracted more and more attention. It has been shown that protecting the published graph with the differential privacy can ensure not only the quantitative privacy, but also the data usability. In this paper, we first put forward an optimized randomized response algorithm for generating synthetic graph, which dose not depend on a trusted third party in charge of collecting data. Furthermore, based on multi-party computation clustering, we propose a generated graph model under local differential privacy (LDPGM). The experiment indicates that LDPGM can effectively control the density of the synthetic graph so that significantly reduce the error between the synthetic graph and the original graph. Therefore, it maintains the properties of the original graph well and ensures high usability.

In the context of the Internet of Things (IoT), the large-scale generation and collection of data can greatly improve the quality of service provided, but they also raise significant concerns about privacy breaches. However, existing privacy-preserving data collection solutions based on local differential privacy (LDP) often struggle to balance security and accuracy when handling composite data types. To address this challenge, in this paper, we propose CSKV, a high-precision and privacy-preserving key-value data collection scheme. Specifically, we first design a padding and sampling protocol to improve data utility. Then, we propose two randomized response mechanisms to safely perturb keys and values in a cohesive and segmented manner. After that, by leveraging the sampling protocol and key-value correlation perturbation, we demonstrate that CSKV can provide secondary privacy amplification. Detailed theoretical analysis verifies the security and effectiveness of CSKV. In addition, extensive performance evaluations are conducted on synthetic and real-world datasets, and the results indicate that our proposed scheme outperforms existing schemes in terms of hit rate and estimation variance.

Local differential privacy is one of the most effective methods for privacy protection data publishing, whose theoretical basis is the randomised response. However, the existing models assume that data attributes are independent of each other, which might result in excessive information loss. To solve this issue, we present a local differentially private method for releasing association data. First, to find the relationship between attributes, we constructed a Bayesian network with a greedy algorithm base on mutual information for the given dataset. Second, to ensure local differential privacy, we perturbed each dependent attribute pair according to weak or robust association attribute set. Third, to achieve the local differential privacy with the noisy marginal, we constructed an approximation distribution for the given dataset. Finally, we experimentally evaluated our method on real data, and the extensive results show that our method better balances data utility and privacy disclosure.