Collecting Telemetry Data Privately

By Bolin Ding, Janardhan Kulkarni, Sergey Yekhanin. 2017

791 citations recorded by the source corpus.

The collection and analysis of telemetry data from users' devices is routinely performed by many software companies. Telemetry collection leads to improved user experience but poses significant risks to users' privacy. Locally differentially private (LDP) algorithms have recently emerged as the main tool that allows data collectors to estimate various population statistics, while preserving privacy. The guarantees provided by such algorithms are typically very strong for a single round of telemetry collection, but degrade rapidly when telemetry is collected regularly. In particular, existing LDP algorithms are not suitable for repeated collection of counter data such as daily app usage statistics. In this paper, we develop new LDP mechanisms geared towards repeated collection of counter data, with formal privacy guarantees even after being executed for an arbitrarily long period of time. For two basic analytical tasks, mean estimation and histogram estimation, our LDP mechanisms for repeated data collection provide estimates with comparable or even the same accuracy as existing single-round LDP collection mechanisms. We conduct empirical evaluation on real-world counter datasets to verify our theoretical results. Our mechanisms have been deployed by Microsoft to collect telemetry across millions of devices.

Subfields: Artificial Intelligence, Computer Science Applications, Management Science and Operations Research, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Science Applications

In Management Science and Operations Research

In Privacy & Security

Citations in the corpus

Foundation Models and Fair Use (2023, background): “, Smart Compose, telemetry collection) (Miraglia, 2019; Erlingsson et al., 2014; Ding et al., 2017; Bittau et al., 2017; Cheu et al., 2019).”
Advances and Open Problems in Federated Learning (2019, methodology): “LDP has been deployed effectively to gather statistics on popular items across large user bases by Google, Apple and Microsoft [156, 135, 136].”
On Distributed Differential Privacy and Counting Distinct Elements (2020, background): “Diﬀerential privacy (DP) [20, 19] has become a leading framework for private-data analysis, with several recent practical deployments [25, 39, 28, 3, 16, 1].”
Privacy Amplification via Random Check-Ins (2020, methodology): “For this reason, DP has been adopted by companies including Google [20, 10, 18], Apple [2], Microsoft [13], and LinkedIn [31], as well as the US Census Bureau [26].”
Private Counting from Anonymous Messages: Near-Optimal Accuracy with Vanishing Communication Overhead (2020, background): “…candidate, leading to several real-world deployments at companies such as Google (Erlingsson et al., 2014; Shankland, 2014), Apple (Greenberg, 2016; Apple Differential Privacy Team, 2017), and Microsoft (Ding et al., 2017), and in government agencies such as the U.S. Census Bureau (Abowd, 2018).”
Pure Differentially Private Summation from Anonymous Messages (2020, background): “This has led to practical deployments at companies such as Apple [Gre16, App17], Google [EPK14, Sha14], and Microsoft [DKY17], and in government agencies such as the United States Census Bureau [Abo18].”
The power of synergy in differential privacy: Combining a small curator with local randomizers (2019, background): “…of local di ﬀ erential privacy protocols by Google, Apple, and Microsoft demonstrate that the local di ﬀ erential privacy model is a viable approach in certain applications, without requiring trust in the companies or incurring risks from hackers and intelligence agencies [28, 55, 35, 1, 22].”
Secure Federated Submodel Learning (2019, background): “, in Google [46], [47], Apple [48], and Microsoft [49]), as well as lasting academic”
The Privacy Blanket of the Shuffle Model (2019, methodology): “Nevertheless, the local model has been the model of choice for recent implementations of differentially private protocols by Google [15], Apple [24], and Microsoft [12].”
Federated Heavy Hitters Discovery with Differential Privacy (2019, methodology): “Diﬀerential privacy (DP) is a rigorous privacy notion that has been carefully studied over the last decade (Dwork et al., 2006b,a; Dwork, 2008; Dwork and Roth, 2014) and widely adopted in industry (Ding et al., 2017; Apple, 2017; Kenthapadi and Tran, 2018; Erlingsson et al., 2014).”
The Power of the Hybrid Model for Mean Estimation (2018, methodology): “, 2018] and [Ding et al., 2017] show that the Laplace mechanism is optimal for the problem of one-dimensional mean estimation in the local model, so wlog, we assume the samples are submitted after addition of properly calibrated Laplace noise [Dwork et al.”
Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity (2018, background): “However, our protocol can be extended to the collection of multi-valued data or even data strings by building on existing techniques [EPK14, App17, BNST17].”
Marginal Release Under Local Differential Privacy (2017, methodology): “Microsoft telemetry data collection involves rounding and memoization technique for periodic measurement of app usage statistics under LDP [11].”
Collecting and Analyzing Multidimensional Data with Local Differential Privacy (2019, methodology): “Local differential privacy (LDP), which has been used in well-known systems such as Google Chrome [18], Apple iOS and macOS [36], and Microsoft Windows Insiders [12], is a rigorous privacy protection scheme for collecting and analyzing sensitive data from individual users.”
Understanding Unintended Memorization in Federated Learning (2020, background): “DP) [DMNS06, DKM+06a], which has become the standard for performing learning tasks over sensitive data. DP has been adopted by companies like Google [EPK14, BEM +17, EFM 20], Apple [App17], Microsoft [DKY17], and LinkedIn [RSP+20], as well as the US Census Bureau [KCK+18]. Intuitively, DP prevents a”
Communication Complexity in Locally Private Distribution Estimation and Heavy Hitters (2019, methodology): “DP has been adopted by companies including Google, Apple and Microsoft [14, 15, 16].”
Differentially Private Assouad, Fano, and Le Cam (2020, methodology): “Differential privacy has been adopted by the US Census Bureau for the 2020 census and several large technology companies, including Google, Apple, and Microsoft (Erlingsson et al., 2014; Differential Privacy Team, Apple, 2017; Ding et al., 2017).”
CALM: Consistent Adaptive Local Marginal for Marginal Release under Local Differential Privacy (2018, methodology): “LDP techniques have been deployed by companies like Google [16, 17], Apple [1], Microsoft [12] and Samsung [9].”