Local Differential Privacy

Transcription

1 Local Differential Privacy Peter Kairouz Department of Electrical & Computer Engineering University of Illinois at Urbana-Champaign Joint work with Sewoong Oh (UIUC) and Pramod Viswanath (UIUC) / 33

2 Wireless Communication The fundamental limits of digital communication are well understood 2 / 33

3 Rise of the Planet of the Apps! 3 / 33

4 Rise of the Planet of the Apps! 3 / 33

5 Rise of the Planet of the Apps! 3 / 33

6 Rise of the Planet of the Apps! we study the fundamental trade-off between privacy and utility 3 / 33

7 Does Privacy Matter? [Greenwald 204] If you re doing something that you don t want other people to know, maybe you shouldn t be doing it in first place Privacy is no longer a social norm! 4 / 33

8 Recent Privacy Leaks from anonymous faces to social security numbers 5 / 33

9 Recent Privacy Leaks deanonymizing Netflix data 5 / 33

10 Recent Privacy Leaks deanonymizing Netflix data, identifying personal genomes, etc. 5 / 33

11 Privacy is a fundamental human right! 6 / 33

12 The Ultimate Protection The future of privacy is lying randomizing = systematic lying 7 / 33

13 Privacy via Plausible Deniability [Warner 965] Have you ever used illegal drugs? say yes answer truthfully 8 / 33

14 Privacy via Plausible Deniability [Warner 965] Q: privatization mechanism instead of X = x, share Y = y w.p. Q (y x) Q : X Y stochastic mapping 8 / 33

15 The Local Privacy Model [Duchi, et. al., 202] X Privatization Q Y Clients Data Analyst X 2 Privatization Q Y 2 clients receive a service if they share their data clients do not trust data analysts 9 / 33

16 Inference of Information X X = {0, } Privatization Q Y Y X : input alphabet Y: output alphabet Given Y = y and Q, detect whether X = 0 or X = 0 / 33

17 Inference of Information given Y and Q, detect whether X = 0 or X = two types of error: false alarm and missed detection S 0 : ˆX = 0 S : ˆX = Y: output alphabet P FA = P (Y S X = 0) and P MD = P (Y S 0 X = ) 0 / 33

18 Inference of Information Case : Q P FA R P MD 0 / 33

19 Inference of Information Case 2: Q 2 P FA R P MD 0 / 33

20 Inference of Information P FA P FA R R 2 P MD P MD if R 2 R, Q 2 guarantees more privacy 0 / 33

21 Local Differential Privacy (Binary Data) P FA 0.5 e R (ε,δ) e P MD / 33

22 Local Differential Privacy (Binary Data) P FA 0.5 e R (ε,δ) R Q e P MD Q is (ε, δ)-differentially private if R Q R (ε,δ) / 33

23 Local Differential Privacy Q is ε-locally differentially private iff for all x, x X and y Y e ε Q(y x) Q(y x ) eε ε controls the level of privacy ε = more private ε = less private 2 / 33

24 Local Differential Privacy Q is ε-locally differentially private iff for all x, x X P FA P FA + e ε P MD e ε P FA + P MD +e ε R ε R Q +e ε P MD Q is ε-dp iff R Q R ε for all x, x X 2 / 33

25 Privacy vs. Utility the more private you want to be, the less utility you get there is a fundamental trade-off between privacy and utility maximize Q subject to U(Q) Q D ε U(Q): application dependent utility function D ε : set of all ε-locally differentially private mechanisms 3 / 33

26 Summary of Results Binary data: X = 2 The Binary Randomized Response optimal for all ε w.p. +e ε lie w.p. e ε +e ε answer truthfully optimal for all U(Q) obeying the data processing inequality 4 / 33

27 Summary of Results k-ary data: X = k > 2 Binary Mechanism (BM) Randomized Response (RM) Staircase Mechanisms Locally Differentially Private Mechanisms staircase mechanisms are optimal for all ε and a rich class of utilities BM and RR are optimal in the high and low privacy regimes 4 / 33

28 CASE : BINARY DATA 5 / 33

29 Utility Functions U X X Q U (Q) Y Y W U (QW ) Z Z utility functions obeying the data processing inequality: U (QW ) U (Q) U further randomization can only reduce utility note: Q D ε = QW D ε 6 / 33

30 Main Result [Kairouz, et. al., 204] The binary randomized response is optimal P FA 0 e ε +e ε 0 +e ε +e ε e ε +e ε +e ε R QBRR = R ε +e ε P MD = U obeying the data processing inequality: U(Q) U(Q RR ) 7 / 33

31 CASE 2: k-ary DATA 8 / 33

32 Information Theoretic Utility Functions X = k > 2 focus on a rich set of convex utility functions maximize Q subject to U (Q) Q D ε includes all f-divergences, mutual information, etc. 9 / 33

33 Statistical Data Model X ~ P Privatization Q Y ~ M Clients X2 ~ P Privatization Q Y2 ~ M Data Analyst ˆ analyst interested in statistics of data rather than individual samples privatized data: Y i M ν (Y = y) = x X Q(Y = y x)p ν(x = x) 20 / 33

34 Hypothesis Testing X ~ P X ~ P Clients X2 ~ P X2 ~ P Data Analyst ˆ Given {X i } n i=, detect whether ν = 0 or ν = performance is a function of distance between P 0 from P Chernoff-Stein s lemma: P FA e n D kl(p 0 P ) 2 / 33

35 Private Hypothesis Testing X ~ P Privatization Q Y ~ M Clients X2 ~ P Privatization Q Y2 ~ M Data Analyst ˆ {0,} Given {Y i } n i=, detect whether ν = 0 or ν = performance is a function of distance between M 0 from M Chernoff-Stein s lemma: P FA e n D kl(m 0 M ) 22 / 33

36 f-divergences A rich family of measures of differences between distributions: maximize Q subject to D f ( QP }{{} 0 QP }{{} M 0 Q D ε M ) KL divergence D kl (M 0 M ) total variation M 0 M TV minimax rates and error exponents 23 / 33

37 Staircase Mechanisms Recall that: Q is ε-locally differentially private iff for all x, x X and y Y e ε Q(y x) Q(y x ) eε ε controls the level of privacy ε = more private ε = less private 24 / 33

38 Staircase Mechanisms Q is a staircase mechanism if for all x, x X and y Y: Q(y x) Q(y x ) { e ε,, e ε} Binary Mechanism (BM) Randomized Response (RM) Staircase Mechanisms Locally Differentially Private Mechanisms 24 / 33

39 Main Result [Kairouz, et. al., 204] maximize Q D f ( QP }{{} 0 QP ) = maximize }{{} Q M 0 M D f ( QP }{{} 0 QP }{{} M 0 M ) subject to Q D ε subject to Q S ε S ε : set of all staircase mechanisms with Y X staircase mechanisms are optimal no gain in larger output alphabets there are finitely many staircase mechanisms same result holds for a rich set of convex utility functions 25 / 33

40 Binary Mechanisms e ε +e ε y = 0 +e ε x = maps k-ary inputs to binary outputs 26 / 33

41 Binary Mechanisms A deterministic binary mapping followed by a randomized response 0 e ε +e ε 0 X X X S = Ỹ = 0 X S c = Ỹ = Ỹ +e ε +e ε e ε +e ε a highly quantized version of the original data 26 / 33

42 Optimality of Binary Mechanisms (High Privacy) Q B (0 x) = Q B ( x) = { e ε +e if P ε 0 (x) P (x) +e if P ε 0 (x) < P (x) { e ε +e ε if P 0 (x) < P (x) +e ε if P 0 (x) P (x) P 0,P, ε(p 0, P ) > 0 such that ε ε(p 0, P ), Q B is optimal 27 / 33

43 Randomized Response y = e ε 3+e ε 3+e ε x = maps k-ary inputs to k-ary outputs 28 / 33

44 Randomized Response w.p. X X +e ε lie w.p. e ε X +e ε answer truthfully lie = choose another character in X uniformly at random can be viewed as a k-ary extension to the binary randomized response 28 / 33

45 Optimality of Randomized Response (Low Privacy) Q RR (y x) = { e ε X +e ε if y = x X +e ε if y x P 0,P, ε(p 0, P ) > 0 such that ε ε(p 0, P ), Q RR is optimal note that Q RR does not depend on P 0 and P 29 / 33

46 Numerical Example for KL Divergence X = D kl (QP 0 QP ) D kl (Q optp 0 D kl (Q optp ) 0.2 binary mechanism 0. randomized response random pairs of (P 0, P ) ε 30 / 33

47 Numerical Example for KL Divergence X = D kl (QP 0 QP ) D kl (P 0 P ) optimal mechanism binary mechanism randomized response geometric mechanism averaged over 00 random pairs of (P 0, P ) ε 30 / 33

48 Big Picture local differential privacy is crucial for data collection applications we studied a broad class of information theoretic utilities we provided explicit constructions of optimal mechanisms more results on local privacy: Extremal mechanisms for local differential privacy, NIPS 204 The composition theorem for differential privacy, ICML 205 Optimality of non-interactive randomized response, arxiv: / 33

49 Big Picture local differential privacy is crucial for data collection applications we studied a broad class of information theoretic utilities we provided explicit constructions of optimal mechanisms more results on local privacy: Extremal mechanisms for local differential privacy, NIPS 204 The composition theorem for differential privacy, ICML 205 Optimality of non-interactive randomized response, arxiv: / 33

50 Big Picture local differential privacy is crucial for data collection applications we studied a broad class of information theoretic utilities we provided explicit constructions of optimal mechanisms more results on local privacy: Extremal mechanisms for local differential privacy, NIPS 204 The composition theorem for differential privacy, ICML 205 Optimality of non-interactive randomized response, arxiv: / 33

51 Big Picture local differential privacy is crucial for data collection applications we studied a broad class of information theoretic utilities we provided explicit constructions of optimal mechanisms more results on local privacy: Extremal mechanisms for local differential privacy, NIPS 204 The composition theorem for differential privacy, ICML 205 Optimality of non-interactive randomized response, arxiv: / 33

52 Going Forward private green button private genomic data sharing private RAPPOR 32 / 33

53 Thank You Questions? 33 / 33