Locally Differentially Private Truth Discovery for Sparse Crowdsensing

Mobile crowdsensing enables convenient sensory data collection from a large number of mobile devices and has found various applications. In the real practice, however, the sensory data collected from various mobile devices are usually unreliable. To extract truthful information from the unreliable sensory data in mobile crowdsensing, the topic of truth discovery has received wide attention recently, which essentially operates by estimating user reliability degrees and performing reliability-aware truthful aggregation. Despite the effectiveness, applying truth discovery in mobile crowdsensing faces several privacy and security challenges. First, the sensory data and reliability degrees of users may reveal privacy-sensitive information and, thus, demand strong protection. Second, the requester that initiates a crowdsensing application usually needs to have monetary investment, so the inferred truths can be the requester's proprietary information and should be protected as well. In this paper, we propose a new system architecture enabling encrypted truth discovery in mobile crowdsensing. We focus on general and realistic mobile crowdsensing scenarios with varying levels of user participation, and our security design is built on the confidence-aware truth discovery (CATD) approach for its state-of-the-art accuracy in such scenarios. In our system architecture, users send encrypted sensory data to the cloud, where CATD is then conducted in the encrypted domain. The final encrypted inferred truths are sent to the requester for decryption. Along the whole workflow, the sensory data and reliability degrees of users, as well as the inferred truths of the requester, are kept private. Extensive experiments over real-world mobile crowdsensing dataset show that our design achieves practical performance on mobile devices.

This chapter considers the participation of data requesters in mobile crowdsensing (MCS) data truth discovery scenarios and discusses how to achieve privacy-preserving truth discovery with truth hiding. In most MCS scenarios, the data requesters submit the sensing task to the mobile crowdsensing platform for publication, and the mobile crowdsensing platform collects the sensory data of sensing users. In this case, the data requesters want to obtain the task’s truth, but the sensory data and the outputs of truth discovery may contain sensitive information and cause serious privacy concerns. Although existing privacy-preserving truth discovery schemes adopt several effective technologies to preserve the privacy of data and weights, most schemes do not consider the truth privacy. To this end, this chapter proposes a privacy-preserving truth discovery scheme SATE with truth hiding. Specifically, we build a mobile crowdsensing platform with two non-colluding servers, adopting the public-key cryptosystem supporting distributed decryption (PCDD) and using its homomorphic properties so users do not need to participate in the iterative process of privacy-preserving truth discovery. Security analysis proves that SATE effectively preserves the privacy of sensory data, weights, and truth. Performance evaluation and analysis prove that SATE has high computing and communication efficiency.

When collecting information, local differential privacy (LDP) alleviates privacy concerns of users because their private information is randomized before being sent it to the central aggregator. LDP imposes large amount of noise as each user executes the randomization independently. To address this issue, recent work introduced an intermediate server with the assumption that this intermediate server does not collude with the aggregator. Under this assumption, less noise can be added to achieve the same privacy guarantee as LDP, thus improving utility for the data collection task. This paper investigates this multiple-party setting of LDP. We analyze the system model and identify potential adversaries. We then make two improvements: a new algorithm that achieves a better privacy-utility tradeoff; and a novel protocol that provides better protection against various attacks. Finally, we perform experiments to compare different methods and demonstrate the benefits of using our proposed method.

Trajectory data collection is a common task with many applications in our daily lives. Analyzing trajectory data enables service providers to enhance their services, which ultimately benefits users. However, directly collecting trajectory data may give rise to privacy-related issues that cannot be ignored. Local differential privacy (LDP), as the de facto privacy protection standard in a decentralized setting, enables users to perturb their trajectories locally and provides a provable privacy guarantee. Existing approaches to private trajectory data collection in a local setting typically use relaxed versions of LDP, which cannot provide a strict privacy guarantee, or require some external knowledge that is impractical to obtain and update in a timely manner. To tackle these problems, we propose a novel trajectory perturbation mechanism that relies solely on an underlying location set and satisfies pure ε-LDP to provide a stringent privacy guarantee. In the proposed mechanism, each point's adjacent direction information in the trajectory is used in its perturbation process. Such information serves as an effective clue to connect neighboring points and can be used to restrict the possible region of a perturbed point in order to enhance utility. To the best of our knowledge, our study is the first to use direction information for trajectory perturbation under LDP. Furthermore, based on this mechanism, we present an anchor-based method that adaptively restricts the region of each perturbed trajectory, thereby significantly boosting performance without violating the privacy constraint. Extensive experiments on both real-world and synthetic datasets demonstrate the effectiveness of the proposed mechanisms.

LPTD: Achieving lightweight and privacy-preserving truth discovery in CIoT

Incentive mechanisms are essential for stimulating adequate worker participation to achieve good truth discovery performance in mobile crowdsensing (MCS) systems. However, most of existing incentive mechanisms only consider compensating workers’ sensing cost, while the cost incurred by potential privacy leakage has been largely neglected. Moreover, none of existing privacy-preserving incentive mechanisms has incorporated workers’ different privacy preferences to provide personalized payments for them. In this paper, we propose a contract-based personalized privacy-preserving incentive mechanism for truth discovery in MCS systems, named Paris-TD, which provides personalized payments for workers as a compensation for privacy cost while achieving accurate truth discovery. The basic idea is that the platform offers a set of different contracts to workers with different privacy preferences, and each worker chooses to sign a contract which specifies a privacy-preserving degree (PPD) and the corresponding payment the worker will receive if she submits perturbed data with that PPD. Specifically, we respectively design a set of optimal contracts analytically under both full and incomplete information models, which maximize the truth discovery accuracy under a given budget, while satisfying the individual rationality and incentive compatibility properties. The feasibility and effectiveness of Paris-TD are validated through experiments on both synthetic and real-world datasets.

In crowd sensing, truth discovery (TD) refers to finding reliable information from noisy/biased data collected from different providers. To protect providers' data while enabling truth distillation, privacy-preserving truth discovery (PPTD) has received wide attention recently. However, all existing approaches require iterative interaction between server(s) and individual providers, which inevitably demand all providers to be always online. Otherwise, the protocol would fail or expose extra provider information. In this paper, we design and implement the first non-interactive PPTD system that completely removes the online requirement with strong privacy guarantees. Our framework follows the same two-server model from the best-known prior solution, and leverages Yao's Garbled Circuit (GC). Yet, we devise non-trivial speedup techniques for TD-optimized implementation. Firstly, we identify reusable computations in TD to accelerate the circuit generation. Secondly, we securely evaluate the burdensome non-linear functions in TD via customized approximation with accuracy and improved efficiency. Thirdly, we reduce the online execution time by bridging together latest advancements of component-based GC and various computations needed in TD. Unlike prior arts, our framework does not reveal any intermediate results, and further supports "late-join" providers without protocol suspension/restart. The practical performance of our proof-of-concept implementation is verified through extensive evaluations.

Spam phone calls have been rapidly growing from nuisance to an increasingly effective scam delivery tool. To counter this increasingly successful attack vector, a number of commercial smartphone apps that promise to block spam phone calls have appeared on app stores, and are now used by hundreds of thousands or even millions of users. However, following a business model similar to some online social network services, these apps often collect call records or other potentially sensitive information from users' phones with little or no formal privacy guarantees. In this paper, we study whether it is possible to build a practical collaborative phone blacklisting system that makes use of local differential privacy (LDP) mechanisms to provide clear privacy guarantees. We analyze the challenges and trade-offs related to using LDP, evaluate our LDP-based system on real-world user-reported call records collected by the FTC, and show that it is possible to learn a phone blacklist using a reasonable overall privacy budget and at the same time preserve users' privacy while maintaining utility for the learned blacklist.

High-dimensional crowdsourced data is pervasive in crowdsensing systems and with the development of IoTs it can produce rich knowledge for the society. However, it also creates serious privacy threats for crowdsourcing participants. To mitigate the privacy concerns in crowdsensing systems, local differential privacy has been derived from the de facto standard of differential privacy in order to achieve strong privacy guaranteed in distributed systems. However, directly achieving local differential privacy on high-dimensional crowdsourced data may lead not only to a prohibitive computational burden but also low data utility. Therefore, in this paper, we propose a local private high-dimensional data publication scheme for crowdsensing systems. In particular, on the participants side, high-dimensional records are locally perturbed to protect privacy, while on the servers side, the probability distribution of original data is recovered by taking advantage of both the expectation maximization algorithm and the theory of the Bayesian network. Extensive experiments on real-world datasets demonstrated the effectiveness of the proposed scheme that can synthesize approximate datasets with local differential privacy.

Mobile crowdsensing leverages the power of a vast group of participants to collect sensory data, thus presenting an economical solution for data collection. However, due to the variability among participants, the quality of sensory data varies significantly, making it crucial to extract truthful information from sensory data of differing quality. Additionally, given the fixed time and monetary costs for the participants, they typically only perform a subset of tasks. As a result, the datasets collected in real-world scenarios are usually sparse. Current truth discovery methods struggle to adapt to datasets with varying sparsity, especially when dealing with sparse datasets. In this article, we propose an adaptive Hypergraph-based EM truth discovery method, HGEM. The HGEM algorithm leverages the topological characteristics of hypergraphs to model sparse datasets, thereby improving its performance in evaluating the reliability of participants and the true value of the event to be observed. Experiments based on simulated and real-world scenarios demonstrate that HGEM consistently achieves higher predictive accuracy.

Federated learning is a widely applied distributed machine learning method that effectively protects client privacy by sharing and computing model parameters on the server side, thus avoiding the transfer of data to third parties. However, information such as model weights can still be analyzed or attacked, leading to potential privacy breaches. Traditional federated learning methods often disturb models by adding Gaussian or Laplacian noise, but under smaller privacy budgets, the large variance of the noise adversely affects model accuracy. To address this issue, this paper proposes a Symmetric Partition Mechanism (SPM), which probabilistically perturbs the sign of local model weight parameters before model aggregation. This mechanism satisfies strict ϵ-differential privacy, while introducing a variance constraint mechanism that effectively reduces the impact of noise interference on model performance. Compared with traditional methods, SPM generates smaller variance under the same privacy budget, thereby improving model accuracy and being applicable to scenarios with varying numbers of clients. Through theoretical analysis and experimental validation on multiple datasets, this paper demonstrates the effectiveness and privacy-protection capabilities of the proposed mechanism.

Benefitingfrom the rapid development of communication technology and Internet of Things (IoT) devices, crowdsensing is on the rise. Sensor data from IoT devices can be requested for data analysis and utilization, however, the collected data of an object from multiple devices are usually different. Therefore, how to extract the most reliable data from numerous data has become an important topic, and truth discovery receives great attention. These collected data often contain personal sensitive information, if users’ privacy cannot be protected, many users are unwilling to contribute their data, and the usability of the published data will be greatly reduced. In this article, a robust privacy-preserving truth discovery scheme is proposed to simultaneously achieve the reliability and privacy of data. Specifically, the data are collected and encrypted before it is sent from the user. Compared with the existing works, there are two additional benefits, trusted third party and noncolluding platforms are not necessary anymore, hence the robustness is improved and single-point failure bottlenecks are eliminated. Besides, the proposed RPPTD is secure against many known attacks in open wireless networks, and the human-factor-aware differential aggregation attack. Finally, the performance evaluation indicates that our scheme is efficient and suitable for the practical environment.

Frequency estimation mechanisms are widely applied in domains such as machine learning and cloud computing, where it is desirable to provide statistical information. As a fundamental operation in these domains, frequency estimation utilizes personal data which contains sensitive information while it is necessary to protect sensitive information from others. Motivated by this, we preserve user’s privacy with local differential privacy by obfuscating personal data on the user side. In this paper, we propose frequency estimation mechanisms under utility-optimized local differential privacy (ULDP), which allow the data collector to obtain some non-sensitive values to improve data utility while protecting sensitive values from leaking sensitive information. We propose three frequency estimation mechanisms under <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$(\epsilon ,\delta )$</tex-math></inline-formula> -ULDP (uRFM-GRR, uRFM-RAPPOR, uRFM-OLH) to preserve user’s sensitive information. Our proposed mechanisms protect sensitive data with the same privacy guarantee and they are suitable for different scenarios. Besides, in theory, we compare the estimation errors of our proposed mechanisms with existing LDP based mechanisms and show that ours are lower than theirs. Finally, we conduct experiments on synthetic and real-world datasets to evaluate the performance of the three mechanisms. The experimental results demonstrate that our proposed mechanisms are better than the existing LDP based solutions over the same privacy level, while uRFM-OLH frequently performs the best.

Local Differential Privacy (LDP) provides a formal guarantee of privacy that enables the collection and analysis of sensitive data without revealing any individual's data. While LDP methods have been extensively studied, there is a lack of a systematic and empirical comparison of LDP methods for descriptive statistics. In this paper, we first provide a systematization of LDP methods for descriptive statistics, comparing their properties and requirements. We demonstrate that several mean estimation methods based on sampling from a Bernoulli distribution are equivalent in the one-dimensional case and introduce methods for variance estimation. We then empirically compare methods for mean, variance, and frequency estimation. Finally, we provide recommendations for the use of LDP methods for descriptive statistics and discuss their limitations and open questions.

Privacy concerns hinder the sharing and utilization of trajectory data collected from Internet of Things (IoT) devices. While local differential privacy mitigates leakage risks by perturbing data on mobile devices, existing methods primarily focus on enhancing global-level statistical usability of perturbed trajectories (such as spatial distributions and mobility transition patterns), neglecting individual-level semantic usability (such as road network consistency and traffic rule compliance). The resulting trajectories frequently contain unrealistic behaviors that violate traffic rules, severely limiting their applicability. To overcome this challenge, we propose TPIS, a trajectory protection approach with individual semantic utility under local differential privacy. First, we design a semantic-enhanced hierarchical modeling method (SEHM) that leverages traffic rule semantic information and geospatial information to model the road network as a weighted graph, supported by an R-tree index for efficient coarse-grained and fine-grained trajectory matching. Second, we propose a cascaded perturbation method combining stochastic sampling guided by the hierarchical graph model (SHG) and multi-feature fusion perturbation mechanism based on δ-location set (MFPD). SHG strategically constrains the perturbation space to preserve global-level statistical usability while ensuring rigorous privacy, and MFPD incorporates a comprehensive trajectory difference metric and δ -location set definition to generate perturbed trajectories that maintain individual-level structural integrity of real-world movement patterns. TPIS efficiently balances privacy and utility and ensures high computational efficiency. Theoretical analysis confirms its differential privacy guarantee and upper bound on perturbation error. Experiments conducted on four real-world datasets demonstrate significant improvements over existing methods, with up to 8× higher utility and 14× greater computational efficiency.