Acknowledgements. Today s Lecture. Attacking k-anonymity. Ahem Homogeneity. Data Privacy in Biomedicine: Lecture 18

Transcription

1 Acknowledgeents Data Privacy in Bioedicine Lecture 18: Fro Identifier to Attribute Disclosure and Beyond Bradley Malin, PhD Professor of Bioedical Inforatics, Biostatistics, and Coputer Science Vanderbilt University March 19, 218 Soe of the slides in this lecture are adapted fro the lecture notes of: Cynthia Dwork (Microsoft Research / Harvard) Murat Kantarcioglu (University of Texas, Dallas) Ada Sith (Penn State University) Vitaly Shatikov (Cornell) 218 Bradley Malin 2 Attacking k-anonyity Copleentary Release Attack Different releases can be linked together to coproise k-anonyity Solution: Consider all of the released tables before release the new one, and try to avoid linking. Other data holders ay release soe data that can be used in this kind of attack This type of attack is difficult to itigate copletely Identity vs. Attribute L-Diversity T-Closeness Differential Privacy Today s Lecture 218 Bradley Malin Bradley Malin 4 Recall k-anonyity Ahe Hoogeneity Record Race Birthdate Sex Zip r 1 Black 9/2/65 M 3723 r 2 Black 2/14/65 M 3723 r 3 Black 1/23/65 F r 4 Black 8/24/65 F r 5 Black 11/7/65 F r 6 Black 12/1/64 F r 7 White 1/23/64 M r 8 White 3/15/64 F r 9 White 8/13/64 M r 1 White 5/5/64 M r 11 White 2/13/67 M r 12 White 3/21/67 M Original Race Birthdate Sex Zip Black 1965 M 3723 Black 1965 M 3723 Black 1965 F Black 1965 F Black 1964 F Black 1964 F * * * * * * * * White 1964 M White 1964 M White 1967 M White 1967 M anonyous Race Birthdate Sex Zip Priary Diagnosis Black 1965 M 3723 Black 1965 M 3723 Black 1965 F Black 1965 F Black 1964 F Black 1964 F * * * * * * * * White 1964 M White 1964 M White 1967 M White 1967 M anonyous 218 Bradley Malin Bradley Malin 6 1

2 Ahe Hoogeneity So Conditional Attack Race Birthdate Sex Zip Priary Diagnosis Black 1965 M 3723 HIV Black 1965 M 3723 HIV White 1967 M Broken Left toenail White 1967 M Myocardial Infarction 2-anonyous Race Birthdate Sex Zip Priary Diagnosis Black 1965 M 3723 HIV Black 1965 M 3723 HIV White 1967 M Broken Left toenail White 1967 M Myocardial Infarction 2-anonyous P (HIV) =? 218 Bradley Malin Bradley Malin 8 Ahe Conditional Attack Ahe Conditional Attack Race Birthdate Sex Zip Priary Diagnosis Race Birthdate Sex Zip Priary Diagnosis Black 1965 M 3723 HIV Black 1965 M 3723 HIV Black 1965 M 3723 HIV P (HIV) = 4 / 12 =.33 Black 1965 M 3723 HIV P (HIV) = 4 / 12 =.33 White 1967 M Broken Left toenail White 1967 M Broken Left toenail P (HIV Black, 1965, M, 3723) =? White 1967 M Myocardial Infarction White 1967 M Myocardial Infarction 2-anonyous 2-anonyous 218 Bradley Malin Bradley Malin 1 Ahe Conditional Attack Race Birthdate Sex Zip Priary Diagnosis Black 1965 M 3723 HIV Black 1965 M 3723 HIV White 1967 M Broken Left toenail White 1967 M Myocardial Infarction P (HIV) = 4 / 12 =.33 P (HIV Black, 1965, M, 3723) = 1 Identity vs. Attribute L-Diversity T-Closeness Differential Privacy Today s Lecture 2-anonyous 218 Bradley Malin Bradley Malin 12 2

3 Enter L-diversity (Machanavajjhala et al, 26) Based on belief of the adversary Positive Disclosure Given published dataset, adversary can learn value of a sensitive attribute with high probability Given < 1: this occurs when posterior probability of inference is 1 -, quasi-id corresponds to known person And sensitive attribute is a specific value Negative Disclosure Given published dataset, adversary can rule out a value of a sensitive attribute with high probability Enter L-diversity For an equivalence class on QID, an attacker would need L 1 sensitive values to infer assigned sensitive value So, an equivalence class is L-diverse when there are L sufficiently represented values in the class A. Machanavajjhala, J. Gehrke, D. Kifer, and M. Venkitasubraania. L-diversity: Privacy beyond k-anonyity. Proceedings Data Privacy of in the Bioedicine: 22nd IEEE International Lecture 18Conference on Data Engineering. 218 Bradley 26; 24. Malin Bradley Malin 14 L-Diverse Metrics: Entropy L-Diverse Metrics: Recursive (c,l) Table is L-Diverse when, for every QID class q ss q, slog pq, s logl p Where S is the set of sensitive values In other words: the entropy of the entire table ust be at least log(l) {s 1,, s } is the set of possible values of sensitive attribute S for a qid class Sort the counts n(q, s 1 ),..., n(q, s ) in descending order with the resulting sequence r 1,, r. QID class is recursive (c, l)-diverse if r 1 < c(r r ) for a prespecified constant c. Can partition into positive and negative disclosure scenarios as well n(q, s 1 ) n(q, s 2 ) n(q, s ) 218 Bradley Malin Bradley Malin 16 L-Diversity Drawbacks May be difficult to achieve A single sensitive attribute Two values: HIV positive (1%) and HIV negative (99%) Very different degrees of sensitivity L-diversity is unnecessary to achieve 2-diversity is unnecessary for an equivalence class that contains only negative values L-diversity is difficult to scale Iagine there are 1, records in total To achieve distinct 2-diversity, there can be at ost 1, * 1% = 1 equivalence classes 218 Bradley Malin 17 More Liits to L-Diversity L-diversity is insufficient to prevent attribute disclosure Siilarity attack Bob Zip Conclusions: Age Bob s salary in [2K, 4K] on the low end Bob has a stoach-related disease Zip Age Salary Diagnosis 372** 2* 2K Gastric Ulcer 372** 2* 3K Gastritis 372** 2* 4K Stoach Cancer 371** >4 5K Gastritis 371** >4 1K Flu 371** >4 7K Bronchitis 372** 3* 6K Bronchitis 372** 3* 8K Pneuonia 372** 3* 9K Stoach Cancer L-diversity does not consider the seantic eanings of sensitive values 218 Bradley Malin 18 3

4 Identity vs. Attribute L-Diversity T-Closeness Differential Privacy Today s Lecture T-closeness (Li et al, 27) k-anonyity prevents identity disclosure but not attribute disclosure l-diversity: each equivalence class has at least l values for each sensitive attribute t-closeness : distribution of a sensitive attribute in any equivalence class is close to the distribution of a sensitive attribute in the overall database N. Li, T. Li, S. Venkatasubraanian: t-closeness: privacy beyond k-anonyity and l-diversity. Proceedings of the 23 rd IEEE International Conference on Data Engineering. 27: Bradley Malin Bradley Malin 2 More on T-closeness Privacy is easured by the inforation gain of an observer Inforation Gain = Posterior Belief Prior Belief Q = the distribution of the sensitive attribute in the whole table P = the distribution of the sensitive attribute in the equivalence class T-closeness Principle An equivalence class is said to have t-closeness if the distance between the distribution of a sensitive attribute in this class and the distribution of the attribute in the whole table is no ore than a threshold t A table is said to satisfy t-closeness if all equivalence classes have t-closeness 218 Bradley Malin Bradley Malin 22 Measuring the Distance Between Two Probabilistic Distributions Given two distributions P = (p 1, p 2,..., p ) Q = (q 1, q 2,..., q ) Two well-known distance easures are as follows 1. The variational distance is defined as: D[ P, Q] i1 1 p i q i 2 2. Earth Movers Distance (EMD) WORK ( P, Q, F ) i1 j1 d ij f ij Subject to the following constraints fij 1 i, 1 j (1) p i f ij j1 j1 i1 j1 f ji f i1 ji p q i i i1 q i 1 i (2) 1 (3) 218 Bradley Malin Bradley Malin 24 4

5 Earth Mover s Constraints The previous constraints guarantee that P is transfored to Q by the ass flow F Once the transportation proble is solved, the EMD is defined to be total work; i.e., WORK ( P, Q, F ) i1 j1 d ij f ij T-closeness Exaple Zip Age Salary Diagnosis 372** 4 3K Gastric Ulcer 372** 4 5K Stoach Cancer 372** 4 9K Pneuonia 371** >4 6K Gastritis 371** >4 11K Flu 371** >4 8K Bronchitis 372** 4 4K Gastritis 372** 4 7K Bronchitis 372** 4 1K Stoach Cancer Table has.167-closeness w.r.t. Salary Table has.278-closeness w.r.t. Diagnosis 218 Bradley Malin Bradley Malin 26 Oh Joy! T-closeness protects against attribute disclosure but not identity disclosure Identity vs. Attribute L-Diversity T-Closeness Differential Privacy Today s Lecture T-closeness requires that the distribution of a sensitive attribute in an eq. class is close to the distribution of a sensitive attribute in the overall table 218 Bradley Malin Bradley Malin 28 itization of Databases Real Database (RDB) Add noise, delete naes, etc. itized Database (SDB) x 3-1 Basic Setting Users (governent, researchers, arketers, ) Health records Protect privacy Census data Provide useful inforation (utility) 218 Bradley Malin Bradley Malin 3 5

6 Exaples of itization Methods Input perturbation Add rando noise to database, release Suary statistics Means, variances Marginal totals Regression coefficients Output perturbation Suary statistics with noise Interactive versions of the above ethods Auditor decides which queries are OK, type of noise Differential Privacy (inforal) If there is already soe risk of revealing a Output is siilar whether any single secret individual s of C by cobining record auxiliary inforation is included in the database or not and soething learned fro DB C is no worse off because her record is included in the coputation 218 Bradley Malin Bradley Malin 32 Differential Privacy (inforal) If there is already soe risk of revealing a Output is siilar whether any single secret individual s of C by cobining record auxiliary inforation is included in the database or not and soething learned fro DB, then that risk is still there Differential Privacy (inforal) If there is already soe risk of revealing a Output is siilar whether any single secret individual s of C by cobining record auxiliary inforation is included in the database or not and soething learned fro DB, then that risk is still there but not increased by C s participation in the database C is no worse off because her record is included in the coputation C is no worse off because her record is included in the coputation 218 Bradley Malin Bradley Malin 34 Differential Privacy is a guarantee about statistical confidentiality The behavior of the syste -- probability distribution on outputs -- is essentially unchanged, independent of whether any individual opts in or opts out of the dataset a type of indistinguishability of behavior on neighboring inputs Suggests other applications: Approxiate truthfulness as an econoics solution concept (e.g., echanis design) As alternative to functional (or syntactic) privacy (e.g., k, l, t, etc.) useless without utility guarantees Typically, one size fits all easure of utility Siultaneously optial for different priors, loss functions Exaples of itization Methods Input perturbation Add rando noise to database, release Suary statistics Means, variances Marginal totals Regression coefficients Output perturbation Suary statistics with noise Interactive versions of the above ethods Auditor decides which queries are OK, type of noise 218 Bradley Malin Bradley Malin 36 6

7 Strawan Definition Assue,, are drawn i.i.d. fro an unknown distribution Candidate definition: sanitization is safe if it only reveals the distribution Iplied approach: Learn the distribution Release description of distribution or resaple points Challenges with Classic Intuition Popular interpretation: prior and posterior views about an individual shouldn t change too uch What if y (incorrect) prior is that every Vanderbilt graduate student has three ars? How uch is too uch? Can t achieve sall levels of disclosure and keep the data useful Adversarial user is supposed to learn unpredictable things about the database 218 Bradley Malin Bradley Malin 38 Ipossibility Result [Dwork] Differential Privacy (1) Privacy: for soe definition of privacy breach, distribution on databases, adversaries A, A such that Pr(A()=breach) Pr(A()=breach) For reasonable breach, if (DB) contains inforation about DB, then soe adversary breaks this definition x 3-1 Exaple Brad knows that Bill is 2 inches taller than the average Male DB allows coputing average height of a Male This DB breaks Bills s privacy according to this definition even if his record is not in the database! Exaple with Males and Bill Adversary learns Bill s height even if he is not in the database Intuition: Whatever is learned would be learned regardless of whether or not Bill participates Dual: Whatever is already known, situation won t get worse 218 Bradley Malin Bradley Malin 4 Differential Privacy (2) Differential Privacy (2) -1-1 Define n+1 gaes Define n+1 gaes Gae : Adv. interacts with (DB) 218 Bradley Malin Bradley Malin 42 7

8 Differential Privacy (2) Differential Privacy (2) -1-1 Define n+1 gaes Gae : Adv. interacts with (DB) Gae i: Adv. interacts with (DB -i ); Define n+1 gaes Gae : Adv. interacts with (DB) Gae i: Adv. interacts with (DB -i ); DB -i = (,,x i-1,,x i+1,, ) 218 Bradley Malin Bradley Malin 44 Differential Privacy (2) Differential Privacy (2) -1-1 Define n+1 gaes Gae : Adv. interacts with (DB) Gae i: Adv. interacts with (DB -i ); DB -i = (,,x i-1,,x i+1,, ) Given S and prior p() on DB, define n+1 posterior distrib s Define n+1 gaes Gae : Adv. interacts with (DB) Gae i: Adv. interacts with (DB -i ); DB -i = (,,x i-1,,x i+1,, ) Given S and prior p() on DB, define n+1 posterior distrib s 218 Bradley Malin Bradley Malin 46 Differential Privacy (2) Differential Privacy (3) -1-1 Define n+1 gaes Gae : Adv. interacts with (DB) Gae i: Adv. interacts with (DB -i ); DB -i = (,,x i-1,,x i+1,, ) Given S and prior p() on DB, define n+1 posterior distrib s Definition: is safe if 218 Bradley Malin Bradley Malin 48 8

9 Differential Privacy (3) Differential Privacy (3) -1-1 Definition: is safe if prior distributions p( ) on DB, Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n 218 Bradley Malin Bradley Malin 5 Differential Privacy (3) Indistinguishability -1 Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) Differ in 1 row DB = x 3-1 y 3-1 transcript S transcript S Distance between distributions is at ost 218 Bradley Malin Bradley Malin 52 Which Distance to Use? Proble: ust be large Any two databases induce transcripts at distance n To get utility, need > 1/n Statistical difference 1/n is not eaningful! Exaple: release rando point in database (,, ) = ( j, x j ) for rando j For every i, changing x i induces statistical difference 1/n (re)foralizing Indistinguishability transcript 1 Definition: is -indistinguishable if A, DB, DB which differ in 1 row, sets of transcripts S? transcript answer S 1 p( (DB) S ) (1 ± ) p( (DB ) S ) Equivalently, S: p( (DB) = S ) p( (DB )= S ) 1 ± 218 Bradley Malin Bradley Malin 54 9

10 Indistinguishability Diff. Privacy Indistinguishability Diff. Privacy Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) 218 Bradley Malin Bradley Malin 56 Indistinguishability Diff. Privacy Indistinguishability Diff. Privacy Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) For every S and DB, indistinguishability iplies For every S and DB, indistinguishability iplies 218 Bradley Malin Bradley Malin 58 Indistinguishability Diff. Privacy Indistinguishability Diff. Privacy Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) Definition: is safe if prior distributions p( ) on DB, transcripts S, i =1,,n StatDiff( p ( S), p i ( S) ) For every S and DB, indistinguishability iplies For every S and DB, indistinguishability iplies This iplies StatDiff( p ( S), p i ( S) ) 218 Bradley Malin Bradley Malin 6 1

11 Diff. Privacy in Output Perturbation Sensitivity with Laplace Noise User Tell e f(x) f(x)+noise Database xn Intuition: f(x) can be released accurately when f is insensitive to individual entries,, Global sensitivity GS f = aeighbors x,x f(x) f(x) 1 Exaple: GS average = 1/n for sets of bits Theore: f(x) + Lap(GS f / ) is -indistinguishable Noise generated fro Laplace distribution 218 Bradley Malin Bradley Malin 62 Sensitivity with Laplace Noise Sensitivity with Laplace Noise 218 Bradley Malin Bradley Malin 64 Sensitivity with Laplace Noise Sensitivity with Laplace Noise 218 Bradley Malin Bradley Malin 66 11

12 Sensitivity with Laplace Noise Sensitivity with Laplace Noise 218 Bradley Malin Bradley Malin 68 Differential Privacy: Suary gives -differential privacy if for all values of DB and Me and all transcripts t: Pr( (DB - Me) = t) Pr( (DB + Me) = t) e 1 Pr (t) Differential Privacy No perceptible risk is incurred by joining DB Anything adversary can do to e, it could do without e (y data) Neutralizes all linkage attacks. Coposes unconditionally and autoatically: Σ i i Pr [response] ratio bounded Response Diff: X X X 218 Bradley Malin Bradley Malin 7 12