Toward Answering Federated Spatial Range Queries Under Local Differential Privacy

Geographic Information Systems (GIS) are increasingly managing very large sets of data and hence a centralized data repository may not always provide the most scalable solution. Here we introduce a novel approach to manage spatial data by leveraging structured Peer-to-Peer (P2P) systems based on Distributed Hash Tables (DHTs). DHT algorithms provide efficient exact-match object search capabilities without requiring global indexing and as a result they are extremely scalable. Furthermore, the adoption of uniform hash functions ensures excellent load balancing. However, range queries -- which are very common with spatial data -- cannot be executed efficiently because the hash functions unfortunately destroy any existing data locality. Here we report on the design of an Adaptive Spatial Peer-to-pEer Network (ASPEN) that extends Content Addressable Networks (CAN) to preserve spatial locality information while also retaining many of the load balancing properties of DHT systems. We introduce the concept of scatter regions, which are spatial data distribution units that optimize both load balancing and spatial range query processing at the same time. We present a data object key generation function and algorithms for spatial range queries. We rigorously evaluate our technique with both synthetic and real world data sets and the results demonstrate the efficient execution of spatial range queries in the ASPEN system.

With the advent of the era of big data, privacy issues have been becoming a hot topic in public. Local differential privacy (LDP) is a state-of-the-art privacy preservation technique that allows to perform big data analysis (e.g., statistical estimation, statistical learning, and data mining) while guaranteeing each individual participant’s privacy. In this paper, we present a comprehensive survey of LDP. We first give an overview on the fundamental knowledge of LDP and its frameworks. We then introduce the mainstream privatization mechanisms and methods in detail from the perspective of frequency oracle and give insights into recent studied on private basic statistical estimation (e.g., frequency estimation and mean estimation) and complex statistical estimation (e.g., multivariate distribution estimation and private estimation over complex data) under LDP. Furthermore, we present current research circumstances on LDP including the private statistical learning/inferencing, private statistical data analysis, privacy amplification techniques for LDP, and some application fields under LDP. Finally, we identify future research directions and open challenges for LDP. This survey can serve as a good reference source for the research of LDP to deal with various privacy-related scenarios to be encountered in practice.

Many countries and organizations have been sharing a vast amount of remote sensing (RS) images across the Internet via their portals to promote the flourishing development of RS applications. These portals provide the data discovery ability to the public with necessary ways. Spatial range query is one of them to enable data discovery on RS images by their spatial extents. This article first analyzes the technical challenges in building a spatial index based on the key-value model. Then, this article presents how our proposed adaptive geographic meshing and coding method solves these challenges. The proposed method transforms the spatial extent of RS images to key-value-based indexing records to ensure spatial proximity as well as a low ratio of data duplication in indexing records. This article also shows how the proposed query selectivity strategy improves the performance of spatial range queries on indexing records. The strategy determines the order of two essential operations in a spatial range query, namely, the data deduplication and the spatial relationship computation. Finally, we implement a prototype system based on HBase and develop two MapReduce-based algorithms to speedup the process of the index construction and the spatial range query. Extensive experiments on a real dataset demonstrate that our proposed method owns a better query performance as well as a lower space overhead than competitors to handle spatial range queries on RS images.

In local differential privacy (LDP), each user perturbs her data locally before sending the noisy data to a data collector. The latter then analyzes the data to obtain useful statistics. Unlike the setting of centralized differential privacy, in LDP the data collector never gains access to the exact values of sensitive data, which protects not only the privacy of data contributors but also the collector itself against the risk of potential data leakage. Existing LDP solutions in the literature are mostly limited to the case that each user possesses a tuple of numeric or categorical values, and the data collector computes basic statistics such as counts or mean values. To the best of our knowledge, no existing work tackles more complex data mining tasks such as heavy hitter discovery over set-valued data. In this paper, we present a systematic study of heavy hitter mining under LDP. We first review existing solutions, extend them to the heavy hitter estimation, and explain why their effectiveness is limited. We then propose LDPMiner, a two-phase mechanism for obtaining accurate heavy hitters with LDP. The main idea is to first gather a candidate set of heavy hitters using a portion of the privacy budget, and focus the remaining budget on refining the candidate set in a second phase, which is much more efficient budget-wise than obtaining the heavy hitters directly from the whole dataset. We provide both in-depth theoretical analysis and extensive experiments to compare LDPMiner against adaptations of previous solutions. The results show that LDPMiner significantly improves over existing methods. More importantly, LDPMiner successfully identifies the majority true heavy hitters in practical settings.

In this paper, we propose a new class of local differential privacy (LDP) schemes based on combinatorial block designs for a discrete distribution estimation. This class not only recovers many known LDP schemes in a unified framework of combinatorial block design, but also suggests a novel way of finding new schemes achieving the optimal (or near-optimal) privacy-utility trade-off with lower communication costs. Indeed, we find many new LDP schemes that achieve both the optimal privacy-utility trade-off and the minimum communication cost among all the unbiased schemes for a certain set of input data size and LDP constraint. Furthermore, to partially solve the sparse existence issue of block design schemes, we consider a broader class of LDP schemes based on regular and pairwise-balanced designs, called RPBD schemes, which relax one of the symmetry requirements on block designs. By considering this broader class of RPBD schemes, we can find LDP schemes achieving near-optimal privacy-utility trade-off with reasonably low communication costs for a much larger set of input data size and LDP constraint.

Local differential privacy (LDP) provides a way for an untrusted data collector to aggregate users' data without violating their privacy. Various privacy-preserving data analysis tasks have been studied under the protection of LDP, such as frequency estimation, frequent itemset mining, and machine learning. Despite its privacy-preserving properties, recent research has demonstrated the vulnerability of certain LDP protocols to data poisoning attacks. However, existing data poisoning attacks are focused on basic statistics under LDP, such as frequency estimation and mean/variance estimation. As an important data analysis task, the security of LDP frequent itemset mining has yet to be thoroughly examined. In this paper, we aim to address this issue by presenting novel and practical data poisoning attacks against LDP frequent itemset mining protocols. By introducing a unified attack framework with composable attack operations, our data poisoning attack can successfully manipulate the state-of-the-art LDP frequent itemset mining protocols and has the potential to be adapted to other protocols with similar structures. We conduct extensive experiments on three datasets to compare the proposed attack with four baseline attacks. The results demonstrate the severity of the threat and the effectiveness of the proposed attack.

Estimating spatial distributions is important in data analysis, such as traffic flow forecasting and epidemic prevention. To achieve accurate spatial distribution estimation, the analysis needs to collect sufficient user data. However, collecting data directly from individuals could compromise their privacy. Most previous works focused on private distribution estimation for one-dimensional data, which does not consider spatial data relation and leads to poor accuracy for spatial distribution estimation. In this paper, we address the problem of private spatial distribution estimation, where we collect spatial data from individuals and aim to minimize the distance between the actual distribution and estimated one under Local Differential Privacy (LDP). To leverage the numerical nature of the domain, we project spatial data and its relationships onto a one-dimensional distribution. We then use this projection to estimate the overall spatial distribution. Specifically, we propose a reporting mechanism called Disk Area Mechanism (DAM), which projects the spatial domain onto a line and optimizes the estimation using the sliced Wasserstein distance. Through extensive experiments, we show the effectiveness of our DAM approach on both real and synthetic data sets, compared with the state-of-the-art methods, such as Multi-dimensional Square Wave Mechanism (MDSW) and Subset Exponential Mechanism with Geo-I (SEM-Geo-I). Our results show that our DAM always performs better than MDSW and is better than SEM-Geo-I when the data granularity is fine enough.

In this paper, we tackle the problem of answering multi-dimensional range queries under local differential privacy. There are three key technical challenges: capturing the correlations among attrib...

High-dimensional crowdsourced data is pervasive in crowdsensing systems and with the development of IoTs it can produce rich knowledge for the society. However, it also creates serious privacy threats for crowdsourcing participants. To mitigate the privacy concerns in crowdsensing systems, local differential privacy has been derived from the de facto standard of differential privacy in order to achieve strong privacy guaranteed in distributed systems. However, directly achieving local differential privacy on high-dimensional crowdsourced data may lead not only to a prohibitive computational burden but also low data utility. Therefore, in this paper, we propose a local private high-dimensional data publication scheme for crowdsensing systems. In particular, on the participants side, high-dimensional records are locally perturbed to protect privacy, while on the servers side, the probability distribution of original data is recovered by taking advantage of both the expectation maximization algorithm and the theory of the Bayesian network. Extensive experiments on real-world datasets demonstrated the effectiveness of the proposed scheme that can synthesize approximate datasets with local differential privacy.

Differential privacy has emerged as a gold standard in privacy-preserving data analysis. A popular variant is local differential privacy, where the data holder is the trusted curator. A major barrier, however, towards a wider adoption of this model is that it offers a poor privacy-utility trade-off. In this work, we address this problem by introducing a new variant of local privacy called profile-based privacy. The central idea is that the problem setting comes with a graph G of data generating distributions, whose edges encode sensitive pairs of distributions that should be made indistinguishable. This provides higher utility because unlike local differential privacy, we no longer need to make every pair of private values in the domain indistinguishable, and instead only protect the identity of the underlying distribution. We establish privacy properties of the profile-based privacy definition, such as post-processing invariance and graceful composition. Finally, we provide mechanisms that are private in this framework, and show via simulations that they achieve higher utility than the corresponding local differential privacy mechanisms.

When collecting information, local differential privacy (LDP) alleviates privacy concerns of users because their private information is randomized before being sent it to the central aggregator. LDP imposes large amount of noise as each user executes the randomization independently. To address this issue, recent work introduced an intermediate server with the assumption that this intermediate server does not collude with the aggregator. Under this assumption, less noise can be added to achieve the same privacy guarantee as LDP, thus improving utility for the data collection task. This paper investigates this multiple-party setting of LDP. We analyze the system model and identify potential adversaries. We then make two improvements: a new algorithm that achieves a better privacy-utility tradeoff; and a novel protocol that provides better protection against various attacks. Finally, we perform experiments to compare different methods and demonstrate the benefits of using our proposed method.

To protect privacy for data-collection-based services, local differential privacy (LDP) is widely adopted due to its rigorous theoretical bound on privacy loss.However, mistakes in complex theoretical analysis or subtle implementation errors may undermine its practical guarantee.To address this, auditing is crucial to confirm that LDP protocols truly protect user data.However, existing auditing methods, though, mainly target machine learning and federated learning tasks based on centralized differentially privacy (DP), with limited attention to LDP.Moreover, the few studies on LDP auditing focus solely on simple frequency estimation task for discrete data, leaving correlated key-value data -which requires both discrete frequency estimation for keys and continuous mean estimation for values -unexplored.To bridge this gap, we propose KV-Auditor, a framework for auditing LDP-based key-value estimation mechanisms by estimating their empirical privacy lower bounds.Rather than traditional LDP auditing methods that relies on binary output predictions, KV-Auditor estimates this lower bound by analyzing unbounded output distributions, supporting continuous data.Specifically, we classify state-of-the-art LDP key-value mechanisms into interactive and non-interactive types.For non-interactive mechanisms, we propose horizontal KV-Auditor for small domains with sufficient samples and vertical KV-Auditor for large domains with limited samples.For interactive mechanisms, we design a segmentation strategy to capture incremental privacy leakage across iterations.Finally, we perform extensive experiments to validate the effectiveness of our approach, offering insights for optimizing LDP-based key-value estimators. CCS Concepts Security and privacy Data anonymization and sanitiza-

The performance of the spatial range query algorithms based on Brute-Force method, R-tree, VA-file and NB-tree suffers greatly in high-dimensional space. So the reduction of the dimensionality is the key to the spatial range query in high-dimensional space. The paper uses the parallel technique to present a spatial range query parallel algorithm in high-dimensional space. The algorithm transforms d-dimensional spatial range query to the linear space on d slave node processors. The d slave node processors run parallel. The master node processor only need calculate the union of d results which d slave node processors return. The experimental results indicate that its performance is better than that of the spatial range query algorithms based on Brute-Force method, R-tree, VA-file, NB-tree.

SummaryIn big data mining, the K‐prototypes has become a popular clustering method for mixed data owing to its simplicity and efficiency. However, the data clustering process of the K‐prototypes method will cause the risk of user privacy leakage because user data usually contain sensitive information. To address this issue, general solutions introduce a trusted third‐party model for privacy protection in clustering analysis, but it is difficult to find a fully trusted entity in reality. In this article, we propose a local differential privacy K‐prototypes (LDPK) mechanism, which does not require any trusted third party to perform privacy preprocessing on user data. Our mechanism first uses local differential privacy to disturb user data, then completes the clustering through the interaction between server and user. Furthermore, we propose a privacy protection enhancement mechanism (ELDPK) by extending the LDPK mechanism, which disturbs the user's clustering information in each iteration to protect user privacy further. Theoretical analysis proves the privacy and feasibility of our proposed scheme, and the experimental results prove that our proposed scheme can guarantee the quality of the clustering results under the premise of satisfying the local differential privacy.

Frequent itemset mining is a basic data mining task and has many applications in other data mining tasks. However, it is likely that the user's personal privacy information may be leaked in the mining process. In recent years, applying the local differential privacy protection model to mine all frequent itemsets is a relatively reliable and secure protection method. In local differential privacy, users first perturb the original data then send it to the aggregator, which prevents the aggregator leaking user's private information throughout the process. There are two major problems with data mining using local differential privacy, one is that the accuracy of the results is relatively low after mining, and the other is that the user transmits too much data to the server, which results in higher communication costs. In this paper, we use Hadamard response algorithm to improve the accuracy of the results while reduce the communication cost. Finally, we use FP-tree for frequent itemset mining to compare the Hadamard response with previous algorithms.