Anatomy: Simple and Effective Privacy Preservation

1. Anatomy: Simple and Effective Privacy Preservation Israel Chernyak DB Seminar (winter 2009)

2. Example • Hospital wants to release patients’ medical records • Attribute Disease is sensitive. • Age, Sex, and Zipcode are the quasi-identifier (QI) attributes.

3. Generalization • A widely-used technique for preserving privacy. • Tuples are divided into QI-groups. • QI-values are transformed into less specific forms. • Tuples in the same QI-group cannot be distinguished by their QI-values.

4. Introduction • Anatomy – a technique for publishing sensitive data. • Protects privacy. • Allows effective data analysis. • More effective than the conventional generalization. • Permits aggregate reasoning with average error below 10%. • Lower than the errors produced by generalization by orders of magnitude.

5. Measuring the degree of privacy preservation • Two notions, k-anonymityand l-diversity, have been proposed to measure the degree of privacy preservation.

6. K-anonymity • A table is k-anonymous if each QI-group involves at least k tuples • The next table is 4-anonymous. • Even with a large k, k-anonymity may still allow an adversary to infer the sensitive value of an individual with extremely high confidence.

7. Where k-anonymity fails • 4-anonymous table • Last group has no privacy • Background knowledge attacks are still possible.

8. L-diversity • A table is l-diverse if, in each QI-group, at most 1/l of the tuples possess the most frequent sensitive value.

9. Defects of Generalization in Analysis • Generalization helps preserve privacy. • In terms of l-diversity. • A trade-off exists between: • Keeping the sensitive data private. • Publishing records for research and analysis.

10. Defects of Generalization in Analysis – an example • A researcher wants to estimate the result of the following query:

11. Defects of Generalization in Analysis – an example (cont.)

12. Defects of Generalization in Analysis – an example (cont.) • Recall that the answer we got was 0.1, which, however, is 10 times smaller than actual query result. • Caused by the fact that the data distribution in R1 significantly deviates from uniformity. • Nevertheless, given only the generalized table, we cannot justify any other distribution assumption. • This is an inherent problem of generalization • preventing an analyst from correctly understanding the data distribution inside each QI-group.

13. Anatomy

14. Anatomy vs. Generalization • Anatomy announces the QI values directly. • Permits more effective analysis than generalization.

15. Anatomy vs. Generalization – example (cont.) • Given the previous query: • We proceed to calculate the probability p that a tuple in the QI-group falls in Q.

16. Anatomy vs. Generalization – example (cont.) Actual answer • No assumption about the data distribution is necessary • Because the distribution is precisely released.

17. Privacy Preservation • Anatomy provides a convenient way for the data publisher to find out for each tuple t: • The sensitive values that an adversary can associate with t. • The probability of association. Pneumonia ? p1=0.5 Dyspepsia ? p2=0.5 flu ?

18. Conclusion • Given a pair of QIT and ST, an adversary can correctly reconstruct any tuple with a probability at most 1/l. • Therefore, the adversary can correctly infer the sensitive value of any individual with probability at most 1/l.

19. Anatomy vs. Generalization • Anatomy, isn’t an all-around winner: • Anatomy releases the QI-values directly. • Intuitively, it may provide a higher probability breach than generalization. • Nevertheless, such probability is always bounded by 1/l • As long as the background knowledge of an adversary isn’t stronger than the level allowed by the l-diversity model.

20. Assumptions we’ve made so far • Assumption 1: • The adversary has the QI-values of the target individual. • Assumption 2: • The adversary knows that the individual is definitely involved in the data. • In fact, usually both assumptions are satisfied in practical privacy-attacking processes.

21. Assumptions - conclusion • In general, if both assumptions are true, anatomy provides as much privacy control as generalization • The privacy of a person is breached with a probability at most 1/l.

22. Anatomy – where its privacy fails • An adversary that can make the first assumption (knowing the QI-values) • But not the second (existence of target in database) • The overall breach probability:

23. Anatomy – where its privacy fails (cont.) Each member can be involved with equal likelihood P(Alice is in the table) = 4/5 P(Alice is in the table) = 1 Nevertheless, the upper bound for this is still 1/l

24. Privacy in generalization vs privacy in anatomy - conclusion • Although generalization has the above advantage over anatomy, theadvantage cannot be leveraged in computing the published data. • This is because the publisher cannot predict or control the externaldatabase to be utilized by an adversary, and therefore, must guardagainst an “accurate” external source that does not involve any personabsent in the published data.

25. Anatomizing Algorithm – group creation phase

26. Anatomizing Algorithm – hashing tuples 23, M, 11000, pneumonia 27, M, 13000, dyspepsia 35, M, 59000, dyspepsia 59, M, 12000, pneumonia 61, F, 54000, flu 65, F, 25000, gastritis 65, F, 25000, flu 70, F, 30000, bronchitis pneumonia dyspepsia gastritis flu bronchitis

27. Anatomizing Algorithm – group creation phase • Property 1: At the end of the group creation phase each non-empty bucket has only one tuple. • Only if at most n/l tuples are associated with the same As value.

28. QI4 QI2 QI1 QI3 Anatomizing Algorithm – group creation (l=2) 35, M, 59000, dyspepsia 59, M, 12000, pneumonia 65, F, 25000, flu 65, F, 25000, gastritis 23, M, 11000, pneumonia 27, M, 13000, dyspepsia 70, F, 30000, bronchitis 61, F, 54000, flu pneumonia dyspepsia gastritis flu bronchitis

29. Anatomizing Algorithm – residue-assignment phase • Property 2: the set S’ (computed at line 11) always includes at least one QI-group. • Property 3: after the residue-assignment phase, each QI-group has at least l tuples, and all tuples in each QI-group have distinct As values.

30. Anatomizing Algorithm – populating the tables

31. Reconstruction error • We model each tuple t as a probability density function: • Note that both x and t are tuples, so x=t means x[i]=t[i] for all i.

32. Reconstruction error (cont.) • Given an approximation probability density function , the error from the actual probability density function is: • A good publication method should minimize the following reconstruction error (RCE):

33. Algorithm error bounds • If the cardinality n of T (the original table) is a multiple of l, theQIT and ST computed by Anatomizeachieve the lower bound ofRCE. • n(1-1/l) • Otherwise, the RCE of the anatomized tablesis higher than the lower bound by a factor at most 1 + 1/n .

34. Summary • Privacy vs publication for research – a serious concern. • Existing method (generalization) allows privacy, but doesn’t allow very accurate research. • Anatomy – a method that provides both good privacy (in terms of l-diversity) and allows for accurate research.

35. Summary (cont.) • A nearly-optimal algorithm for anatomizing tables. • Achieves the minimal possible error (or close to it). • Complexity is linear. • Simple and can be implemented easily. • Experiments have shown that Anatomy has an average error of below 10%, as opposed to over 100% error of generalization. • Only the case with a single sensitive attribute is investigated (the rest is left to future work). • Background knowledge of attacker is neglected.