Honeycrisp: large-scale differentially private aggregation without a trusted core

By Edo Roth, Daniel Noble, Brett Hemenway Falk, Andreas Haeberlen. 2019

74 citations recorded by the source corpus.

Recently, a number of systems have been deployed that gather sensitive statistics from user devices while giving differential privacy guarantees. One prominent example is the component in Apple's macOS and iOS devices that collects information about emoji usage and new words. However, these systems have been criticized for making unrealistic assumptions, e.g., by creating a very high "privacy budget" for answering queries, and by replenishing this budget every day, which results in a high worst-case privacy loss. However, it is not obvious whether such assumptions can be avoided if one requires a strong threat model and wishes to collect data periodically, instead of just once. In this paper, we show that, essentially, it is possible to have one's cake and eat it too. We describe a system called Honeycrisp whose privacy cost depends on how often the data changes, and not on how often a query is asked. Thus, if the data is relatively stable (as is likely the case, e.g., with emoji and word usage), Honeycrisp can answer periodic queries for many years, as long as the underlying data does not change too often. Honeycrisp accomplishes this by using a) the sparse-vector technique, and b) a combination of cryptographic techniques to enable global differential privacy without a trusted party. Using a prototype implementation, we show that Honeycrisp is efficient and can scale to large deployments.

Subfields: Artificial Intelligence, Sociology and Political Science, Federated & Distributed Learning, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

In Federated & Distributed Learning

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, methodology): “, [341]) into the model that is known to the clients and trusted to not collude with the server.”
Encode, Shuffle, Analyze Privacy Revisited: Formalizations and Empirical Evaluation (2020, background): “Simultaneously, many systems have been developed for anonymous communication and messaging [8], [9], many of which are designed to gather aggregate statistics with privacy [2], [10], [11], [12].”
Improving utility and security of the shuffler-based differential privacy (2019, background): “More recently, researchers in [48] introduce several security features including verification and malice detection.”
Practical and Robust Privacy Amplification with Multi-Party Differential Privacy (2019, background): “More recently, researchers in [42] introduce several security features including verification and malice detection.”