Blowfish privacy: tuning privacy-utility trade-offs using policies

By Xi He, Ashwin Machanavajjhala, Bolin Ding. 2013

212 citations recorded by the source corpus.

Privacy definitions provide ways for trading-off the privacy of individuals in a statistical database for the utility of downstream analysis of the data. In this paper, we present Blowfish, a class of privacy definitions inspired by the Pufferfish framework, that provides a rich interface for this trade-off. In particular, we allow data publishers to extend differential privacy using a policy, which specifies (a) secrets, or information that must be kept secret, and (b) constraints that may be known about the data. While the secret specification allows increased utility by lessening protection for certain individual properties, the constraint specification provides added protection against an adversary who knows correlations in the data (arising from constraints). We formalize policies and present novel algorithms that can handle general specifications of sensitive information and certain count constraints. We show that there are reasonable policies under which our privacy mechanisms for k-means clustering, histograms and range queries introduce significantly lesser noise than their differentially private counterparts. We quantify the privacy-utility trade-offs for various policies analytically and empirically on real datasets.

Subfields: Artificial Intelligence, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

Citations in the corpus

Dependence Makes You Vulnberable: Differential Privacy Under Dependent Tuples (2016, background): “The fact that dependence (or correlation) among tuples can degrade the expected privacy guarantees of DP mechanisms was first observed by Kifer et al. [24], and later in [8], [21], [25], [40].”
Privacy-preserving Analysis of Correlated Data (2016, background): “However, while a number of Pufferfish mechanisms for specific frameworks are known (Kifer and Machanavajjhala, 2014; He et al., 2014), there is no generic mechanism that applies to any Pufferfish framework.”
PrivateSQL: A Differentially Private SQL Query Engine (2019, methodology): “To capture privacy policies and key constraints, we propose a definition of neighboring tables inspired by Blowfish privacy [23].”
Cardinality Estimators do not Preserve Privacy (2018, background): “Data-generating probability distributions were considered as a source of uncertainty in [13, 26, 28, 35, 41]; in particular, Duan [13] studies the privacy properties of some probabilistic algorithms.”
Heavy Hitter Estimation over Set-Valued Data with Local Differential Privacy (2016, background): “[18] propose a flexible policy where users can specify sensitive information for releasing cumulative histograms.”
Hiding in the Crowd: A Massively Distributed Algorithm for Private Averaging with Malicious Adversaries (2018, background): “We take a Bayesian, semantic view of privacy promoted by several recent papers (Kasiviswanathan and Smith, 2014; Li et al., 2013; Kifer and Machanavajjhala, 2014; He et al., 2014).”
Utility Cost of Formal Privacy for Releasing National Employer-Employee Statistics (2017, methodology): “He et al. [30] propose the Blowﬁsh framework, which also generalizes differential privacy and is inspired by Pufferﬁsh, and Haney et al. [29] give a general method for creating algorithms for any Blowﬁsh policy graph.”
Differential Privacy in the Wild: A Tutorial on Current Practices & Open Challenges (2016, background): “We will discuss the No Free Lunch Theorem in data privacy [25], and present alternate privacy definitions that can be customized to match the structure of the data [16, 21, 26].”
Enabling Privacy-Preserving GWAS in Heterogeneous Human Populations (2016, unknown): “…one coordinate, and for all sets S 3 U, we have PðFðD; yÞ˛SÞ%expðEÞPðFðD; y0Þ˛SÞ: This definition of privacy can be viewed as a specific instantiation of both induced differential privacy (Kifer andMachanavajjhala, 2011) and the Blowfish framework (Kifer and Machanavajjhala, 2014; Hi et al., 2014).”
DEEProtect: Enabling Inference-based Access Control on Mobile Sensing Applications (2017, background): “It is also interesting to note that a threat model similar to usage mode 2 (i.e., protecting against specified inferences) has been explored in Pufferfish privacy [42] and Blowfish privacy [35].”