We examine Euclidean distance-preserving data perturbation as a tool for privacy-preserving data mining. Such perturbations allow many important data mining algorithms e.g. hierarchical and k-means clustering), with only minor modification, to be applied to the perturbed data and produce exactly the same results as if applied to the original data. However, the issue of how well the privacy of the original data is preserved needs careful study. We engage in this study by assuming the role of an attacker armed with a small set of known original data tuples (inputs). Little work has been done examining this kind of attack when the number of known original tuples is less than the number of data dimensions. We focus on this important case, develop and rigorously analyze an attack that utilizes any number of known original tuples. The approach allows the attacker to estimate the original data tuple associated with each perturbed tuple and calculate the probability that the estimation results in a privacy breach. On a real 16-dimensional dataset, we show that the attacker, with 4 known original tuples, can estimate an original unknown tuple with less than 7 error with probability exceeding 0.8.
To assess the security of traditional multiplicative perturbation together with additive perturbation, Trottini @cite_7 proposed a Bayesian intruder model that considers both prior and posterior knowledge of the data. Their overall strategy of attacking the privacy of perturbed data using prior knowledge is the same as ours. However, they particularly focused on linkage privacy breaches, where an intruder tries to identify the identity (of a person) linked to a specific record; while we are primarily interested in data record recovery. Moreover, they did not consider Euclidean distance preserving perturbation as we do.
@cite_7
1925467533 2547253982 50268958 1995219511
This paper focuses on a combination of two disclosure limitation techniques, additive noise and multiplicative bias, and studies their efficacy in protecting confidentiality of continuous microdata. A Bayesian intruder model is extensively simulated in order to assess the performance of these disclosure limitation techniques as a function of key parameters like the variability amongst profiles in the original data, the amount of users prior information, the amount of bias and noise introduced in the data. The results of the simulation offer insight into the degree of vulnerability of data on continuous random variables and suggests some guidelines for effective protection measures. We provide a general framework for privacy-preserving variational Bayes (VB) for a large class of probabilistic models, called the conjugate exponential (CE) family. Our primary observation is that when models are in the CE family, we can privatise the variational posterior distributions simply by perturbing the expected sufficient statistics of the complete-data likelihood. For widely used non-CE models with binomial likelihoods, we exploit the P 'o lya-Gamma data augmentation scheme to bring such models into the CE family, such that inferences in the modified model resemble the private variational Bayes algorithm as closely as possible. The iterative nature of variational Bayes presents a further challenge since iterations increase the amount of noise needed. We overcome this by combining: (1) a relaxed notion of differential privacy, called concentrated differential privacy, which provides a tight bound on the privacy cost of multiple VB iterations and thus significantly decreases the amount of additive noise; and (2) the privacy amplification effect of subsampling mini-batches from large-scale data in stochastic learning. We empirically demonstrate the effectiveness of our method in CE and non-CE models including latent Dirichlet allocation, Bayesian logistic regression, and sigmoid belief networks, evaluated on real-world datasets. We focus primarily on the use of additive and matrix multiplicative data perturbation techniques in privacy preserving data mining (PPDM). We survey a recent body of research aimed at better understanding the vulnerabilities of these techniques. These researchers assumed the role of an attacker and developed methods for estimating the original data from the perturbed data and any available prior knowledge. Finally, we briefly discuss research aimed at attacking k-anonymization, another data perturbation technique in PPDM. Summary In this paper we propose, survey and compare some classes of probability densities that may be used to represent partial prior information, to model either prior ignorance or Bayesian sensitivity analysis. We distinguish two types of models appropriate for two different situations: near ignorance models which are suitable in problems where there is little prior information, and neighbourhood models, which can be used to 'robustify' a strict Bayesian analysis in problems where there is substantial prior information about location. We argue that, especially for the first situation, a reasonable class of prior densities is not the same as a class of reasonable prior densities. We discuss various desiderata for a 'reasonable' class, including coherence and sensible dependence of inferences on sample size. The translation invariant models studied here are classes of conjugate priors, classes of double exponential densities and a neighbourhood of the uniform prior. Of the neighbourhood models we examine examples of E-contamination neighbourhoods (previously studied by Huber, Berger and Berliner) and intervals of measures (DeRobertis and Hartigan). We illustrate the models in the simple problem of constructing credible intervals for an unknown normal mean. Of the models studied in detail, a translation-invariant class of double exponential priors is favoured for modelling little prior information, and a type of interval of measures seems most suitable for robust Bayesian analysis.