Differential Privacy Mechanism Research Articles

Finding ε and δ of Traditional Disclosure Control Systems

This paper analyzes the privacy of traditional Statistical Disclosure Control (SDC) systems under a differential privacy interpretation. SDCs, such as cell suppression and swapping, promise to safeguard the confidentiality of data and are routinely adopted in data analyses with profound societal and economic impacts. Through a formal analysis and empirical evaluation of demographic data from real households in the U.S., the paper shows that widely adopted SDC systems not only induce vastly larger privacy losses than classical differential privacy mechanisms, but, they may also come at a cost of larger accuracy and fairness.

Fed-MPS: Federated learning with local differential privacy using model parameter selection for resource-constrained CPS

In Cyber-Physical Systems (CPS), distributed learning is essential for efficiently handling complex tasks when sufficient resources are available. However, when resources are limited, traditional distributed learning struggles to complete even simple tasks and presents a risk of privacy leakage. As a promising distributed learning paradigm, federated learning only requires the client to send the trained model to the server instead of private data, thereby preserving the client’s privacy to some extent. However, with the rapid development of artificial intelligence technology, attack methods such as inference attacks still cause privacy leakage for clients participating in federated learning. Moreover, due to its distributed learning nature, federated learning cannot escape the dilemma of model accuracy being constrained by resources. To address the aforementioned problems, this paper proposes a Federated local differential privacy scheme using Model Parameter Selection, named Fed-MPS, for resource-constrained CPS. Specifically, to resolve the issue of limited CPS resources, Fed-MPS adopts an update direction consistency-based parameter selection algorithm in federated learning to extract parameters that enhance model accuracy for subsequent training, thereby improving the final model accuracy and reducing communication overhead. Furthermore, Fed-MPS applies the local differential privacy mechanism to further enhance clients’ privacy. By adding noise only to the chosen parameters, the privacy budget is significantly reduced while ensuring model accuracy. Through privacy analysis, we prove that the proposed Fed-MPS scheme satisfies (ϵ,δ)−DP. Additionally, convergence analysis guarantees that Fed-MPS will converge to the global optimum with a convergence ratio of O(1T2) within T rounds of federated learning. Extensive experiments on prominent benchmark datasets Cifar10, Mnist, and FashionMNIST demonstrate that, compared with baseline schemes, the proposed Fed-MPS provides higher model accuracy for CPS under resource constraints.

Proof-of-authority-based secure and efficient aggregation with differential privacy for federated learning in industrial IoT

The industrial internet of things (IIoT) uses connected devices and sensors to improve efficiency in industry, but increased reliance on these systems makes them prone to faults. To ensure the reliability of IIoT systems, robust fault detection is necessary, which can be provided by artificial intelligence (AI). The current state-of-the-art approach for AI in IIoT is mainly focused on centralized learning, which is inefficient due to its high communication cost. Federated learning (FL) addresses this limitation by enabling distributed training without exposing individual information. In order to provide secure and efficient FL for the IIoT environment, several research studies have investigated the use of blockchain networks. However, most of these studies ignore the processing time metric, which is crucial for IIoT networks. In this paper, we propose a secure and efficient parameter aggregation technique that enhances trust, security, and privacy for IIoT. We use a lightweight smart contract deployed with a proof-of-authority (PoA)-based blockchain in combination with a Gaussian differential privacy mechanism. We evaluate our proposed system using a real bearing fault dataset and demonstrate that it is able to provide a secure aggregation process with an accuracy of 94.00% and a processing time of 1.54 s, which is suitable for the IIoT environment with a private blockchain network.

The Bounded Gaussian Mechanism for Differential Privacy

The Gaussian mechanism is one differential privacy mechanism commonly used to protect numerical data. However, it may be ill-suited to some applications because it has unbounded support and thus can produce invalid numerical answers to queries, such as negative ages or human heights in the tens of meters. One can project such private values onto valid ranges of data, though such projections lead to the accumulation of private query responses at the boundaries of such ranges, thereby harming accuracy. Motivated by the need for both privacy and accuracy over bounded domains, we present a bounded Gaussian mechanism for differential privacy, which has support only on a given region. We present both univariate and multivariate versions of this mechanism and illustrate a significant reduction in variance relative to comparable existing work.

May the privacy be with us: Correlated differential privacy in location data for ITS

With the development of Intelligent Transportation Systems (ITS), a vast amount of location data is being generated from various IoT devices equipped with location positioning sensors. Preserving the privacy of location data release is a critical concern, as the publication of aggregated data often reveals private information about the users. Differential Privacy (DP) has recently emerged as a robust framework to guarantee privacy in this context. However, conventional DP mechanisms commonly make no assumption about the distribution of the input data, which could lead to unexpected privacy leakage if the data are correlated. In this paper, we investigate the complex simultaneous impact of user correlation, spatial–temporal correlation and prior knowledge of an adversary on the privacy leakage of a DP mechanism, which has not been addressed in prior work. We derive several closed-form expressions that demonstrate and quantify the privacy leakage under correlated location data, followed by the design of efficient algorithms to compute such privacy leakage. Then, we propose a Δ-CDP (Correlated Differential Privacy) to provide a formal privacy guarantee against the additional privacy leakage incurred by these factors. Extensive comparisons, theoretical analysis, and experimental simulations are presented to validate the correctness and efficiency of the proposed work.

Private bipartite consensus control for multi-agent systems: A hierarchical differential privacy scheme

This paper addresses the differentially private bipartite consensus control problem for general linear discrete-time multi-agent systems (MASs), where the initial states of the agents are the sensitive data to be protected from potential eavesdroppers. In response to the cooperative–competitive relationship among the agents, a novel hierarchical differential privacy mechanism (HDPM) is proposed, which consists of a classifier and a pair of input and output noise injectors. The HDPM and the bipartite consensus controller are co-designed to ensure the ultimate mean-square bipartite consensus while preserving differential privacy. Finally, numerical simulations are conducted to illustrate the effectiveness of the proposed algorithm.

GeoPM-DMEIRL: A deep inverse reinforcement learning security trajectory generation framework with serverless computing

Vehicle trajectory data is essential for traffic management and location-based services. However, the release of trajectories raises serious privacy concerns because they contain sensitive information, such as home addresses and workplaces, etc, making it indispensable to consider privacy protection when releasing trajectory data. It is urgent to reconcile data utility with privacy in trajectory generation calls for advanced methods that adhere to real-world traffic rules. Leveraging serverless computing for deep learning provides an efficient solution, bypassing infrastructure complexities to handle the scale trajectory data. In this paper, a Geo-Piecewise Mechanism Deep Maximum Entropy Inverse Reinforcement Learning (GeoPM-DMEIRL) is proposed for secure trajectory generation, which consists of three key components, namely GeoPM, A2C reinforcement learning and DMEIRL. Firstly, GeoPM is a novel local differential privacy mechanism that incorporates Geo-aware gridding techniques. The Piecewise Mechanism is used to perturb the user trajectory while ensuring that the perturbed trajectory conforms to real-world traffic rules. Secondly, an A2C reinforcement learning network is refined to train the optimal trajectory generation strategy. Thirdly, Deep Maximum Entropy Inverse Reinforcement Learning is improved to train the weights of the A2C reward function. Finally, real-world data are collected in the experiments and the serverless computing platform AWS Lambda is used for training the reinforcement learning models. Experimental results show that our proposed GeoPM-DMEIRL framework can effectively resist user re-identification attacks, which can improve the utility by an average of 54.605% and enhance the privacy by an average of 30.678%. Meanwhile, GeoPM-DMEIRL is able to maintain the utility of the data while protecting the privacy of the user’s trajectories.

Differentially private distributed online optimization via push-sum one-point bandit dual averaging

This paper focuses on the distributed online optimization problem in multi-agent systems considering privacy preservation. Each agent exchanges local information with neighboring agents on the strongly connected time-varying directed graphs. Since the process of information transmission is prone to information leakage, a distributed push-sum dual averaging algorithm based on the differential privacy mechanism is proposed to protect the privacy of the data. In addition, to handle situations where the gradient information of the node cost function is unknown, the one-point gradient estimation is designed to calculate the true gradient information and guide the update of the decision variables. With the appropriate choice of the stepsizes and the exploration parameters, the algorithm can effectively protect the privacy of agents while achieving sublinear regret with the convergence rate O(T34). Furthermore, this paper also explores the effect of one-point estimation parameters on the regret in the online setting and investigates the relation between the convergence effect of individual regret and differential privacy levels. Finally, several federated learning experiments were conducted to verify the efficacy of the algorithm.

PKDGAN: Private Knowledge Distillation With Generative Adversarial Networks

The deployment of deep learning applications has to address the increasing privacy concerns when using private and sensitive data for training. A conventional deep learning model is prone to privacy attacks that can recover the sensitive information from either model parameters or accesses to the inference model. Recently, differential privacy (DP) has been proposed to offer provable privacy guarantees by randomizing the training process of neural networks. However, many approaches tend to provide the worst case privacy protection for model publishing, inevitably impairing the accuracy of the trained models. Thus, we present a novel private knowledge transfer strategy, where the private teacher trained on sensitive data is not publicly accessible but the student models can be released with privacy guarantees. In this paper, a three-player (teacher-student-discriminator) learning framework, Private Knowledge Distillation with Generative Adversarial Networks (PKDGAN), is proposed, where the student acquires the distilled knowledge from the teacher and is trained with the discriminator to generate similar outputs as the teacher. Moreover, a cooperative learning strategy is also suggested to support the collective training of multiple students against the discriminator when each student is with insufficient unlabelled training data. To enforce rigorous privacy guarantees, PKDGAN applies a Rényi differential privacy mechanism throughout the training process, and use it with a moment accountant technique to track the privacy cost. PKDGAN allows students to be trained with unlabelled public data and very few epochs, which avoids the exposure of training data while ensuring model performance. In the experiments, PKDGAN is found to have consistently good performance on various datasets (MNIST, SVHN, CIFAR-10, and Market-1501). When compared to prior works [1], [2], PKDGAN exhibits 5-82% accuracy loss improvement without compromising any privacy guarantee.

PUTS: Privacy-Preserving and Utility-Enhancing Framework for Trajectory Synthesization

Vehicle trajectory data is essential for traffic management and location-based services. However, publishing real-life trajectory data has been challenging because vehicle trajectories contain users' sensitive information. Differential privacy addresses such problems by publishing a synthetic version of the input dataset, but existing works always assume the real-world data is absolutely accurate. This assumption no longer holds in trajectory data because it typically contains errors due to inaccurate positioning services, which leads to poor performance of data synthesized by such trajectories. Even worse, existing works may generate unrealistic trajectories due to their coarse data synthesis methods, resulting in low practical utility or even inability to handle complex tasks. In this paper, we propose a <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">P</u> rivacy-preserving and <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">U</u> tility-enhancing framework for <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</u> rajectory <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</u> ynthesization ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PUTS</i> ). Our framework mitigates the impact of data errors in trajectories on differential privacy mechanisms, by exploiting map-matching techniques and real-world road network structure. In <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PUTS</i> , a two-layer approach from path to trajectory synthesis is proposed to not only guarantee the reality of synthetic trajectories, but also scale up <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PUTS</i> in real-world applications. Extensive experiments on real-world datasets show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PUTS</i> significantly outperforms existing methods in terms of utility in a range of real-world applications.

Differential private knowledge trading in vehicular federated learning using contract theory

In vehicular differentially private federated learning, the personalized differential privacy mechanism allows vehicles to customize their local privacy budget. However, it leads to uneven utility across datasets. Therefore, model owners must consider the unevenness in utility within the incentive mechanisms to enhance learning performance. Due to limitations in system resources, servers in the Internet of Vehicles should prioritize the selection of high-utility datasets before initiating the learning process. Since existing utility evaluation schemes are costly and inefficient, we propose a knowledge trading framework based on prior utility evaluation and contract theory. Specifically, we first derive a utility evaluation function that captures the functional relationship between utility and privacy elements, such as privacy cost, sensitivity, and learning rounds. These elements are shared as hyperparameters among vehicles and servers for utility evaluation. In the presence of information asymmetry, we utilize the self-revealing property of contract theory to mitigate dishonest behavior. The learning process is modeled as an optimization function that incorporates utility and privacy costs. The complexity is further reduced by utilizing the monotonicity of the utility function. Experimental results based on multiple models and datasets illustrate that our scheme outperforms existing schemes in terms of convergence and accuracy.

Differentially private trajectory event streams publishing under data dependence constraints

Differential Privacy (DP), as a de facto privacy-preserving paradigm, can be widely applied in numerous event streams publishing schemes to protect private events (i.e., trajectory points of users). However, most existing schemes assume these events are independent, which is a vulnerable assumption that can lead to unforeseeable privacy degradation. The privacy-preserving for event streams publishing under data dependence is still challenging because existing dependence quantify models cannot dynamically measure the degree of dependent relationships between events. In this paper, we investigate the privacy degradation issue of trajectory event streams publishing and propose (Θ,ϵ)-dependent privacy mechanism to mitigate this issue. Specifically, we introduce spatial dependence to model the dependent relationship between events in trajectory data and extend it to quantify the influence of multiple dependent events on the target event. We define the notion of max dissimilarity to formalize the privacy level of DP mechanisms in trajectory event streams publishing. The proposed notion of global dependent coefficient helps the private mechanism to provide the expected privacy level by calibrating the added noise. We further achieve ω-event privacy protection over trajectory event streams under data dependence constraints with (Θ,ϵ)-dependent privacy mechanism. Theoretical analysis proves our scheme provides the expected privacy guarantee under data dependence constraints. Extensive experiments validate our scheme is efficient and effective.

Differential privacy scheme using Laplace mechanism and statistical method computation in deep neural network for privacy preservation

Mountainous amounts of information are now available in hospitals, finance, counter-terrorism, education and many other sectors. Those information can offer a rich source for analysis and decision making. Such information contains user's sensitive and personal data as well. This emanates direct conflict with the user's privacy. Individual's privacy is their right. The existing privacy preserving algorithms works mainly on the numerical data and doesn't care about the categorical data. In addition, there is a heavy trade-off between privacy preservation and data utility. To overcome these issues, a deep neural network - statistical differential privacy (DNN−SDP) algorithm is proposed as the solution to disguise the individual's private and sensitive data. Both the numerical and categorical based human-specific data are considered and fed to the input layer of the neural network. The statistical methods weight of evidence and information value is applied in the hidden layer along with the random weight (wi) to get the initial perturbed data. This initially perturbed data is taken by Laplace computation based differential privacy mechanism as the input and provides the final perturbed data. Census income, bank marketing and heart disease datasets are used for experimentation. While comparing with the state-of-the-art methods, DNN−SDP algorithm provides 97.4% of accuracy with 98.2% of precision, 99% of recall rate and 98.7% of F-measure value. In addition, the fall-out rate, miss rate and false omission rate of the proposed algorithm are less than 4.1%. The DNN−SDP algorithm guarantees the privacy preservation along with data utility.

Privacy-Aware Multiagent Deep Reinforcement Learning for Task Offloading in VANET

Offloading task to roadside units (RSUs) provides a promising solution for enhancing the real-time data processing capacity and reducing energy consumption of vehicles in the vehicular ad-hoc network (VANET). Recently, multi-agent deep reinforcement learning (MADRL)-based offloading approaches have been widely used for task offloading in VANET. However, existing MADRL-based approaches suffer from offloading preference inference (OPI) attack, which utilizes the vulnerability in the policy learning process of MADRL to mislead vehicles to offload tasks to malicious RSUs. In this paper, we first formulate a joint optimization of offloading action and transmitting power with the objective of minimizing the system cost, including local and edge costs, under the privacy requirement of protecting offloading preference during offloading policy learning process in VANET. Despite the non-convexity and centralized of this joint optimization problem, we propose a privacy-aware MADRL (PA-MADRL) approach to solve it, which can allow the offload decision of each vehicle to reach the Nash Equilibrium (NE) without leaking offloading preference. The key to resisting the OPI attack is to protect the offloading preference by 1)elaborately constructing the noise based on ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\beta,\Phi$</tex-math> </inline-formula> )-differential privacy mechanism and 2) adding it to the action selection and policy updating process of vanilla MADRL. We conduct a detailed theoretical analysis of the convergence and privacy guarantee of the proposed PA-MADRL, and extensive simulations are conducted to demonstrate the effectiveness, privacy-protecting capacity, and cost-efficiency of PA-MADRL approach.

Optimizing the Numbers of Queries and Replies in Convex Federated Learning With Differential Privacy

Federated learning (FL) empowers distributed clients to collaboratively train a shared machine learning model through exchanging parameter information. Despite the fact that FL can protect clients' raw data, malicious users can still crack original data with disclosed parameters. To amend this flaw, differential privacy (DP) is incorporated into FL clients to disturb original parameters, which however can significantly impair the accuracy of the trained model. In this work, we study an imperative question which has been vastly overlooked by existing works: what are the optimal numbers of queries and replies in FL with DP so that the final model accuracy is maximized. In FL, the parameter server (PS) needs to query participating clients for multiple global iterations to complete training. Each client responds a query from the PS by conducting a local iteration. We consider FL that will uniformly and randomly select participating clients to conduct local iterations with the FedSGD algorithm. Our work investigates how many times the PS should query clients and how many times each client should reply the PS by incorporating two most extensively used DP mechanisms (i.e., the Laplace mechanism and Gaussian mechanisms). Through conducting convergence rate analysis, we can determine the optimal numbers of queries and replies in FL with DP so that the final model accuracy can be maximized. Finally, extensive experiments are conducted with publicly available datasets: MNIST and FEMNIST, to verify our analysis and the results demonstrate that properly setting the numbers of queries and replies can significantly improve the final model accuracy in FL with DP.

Secure Federated Learning in Quantum Autonomous Vehicular Networks

With rapid developments of artificial intelligence (AI) and wireless communication technologies, autonomous vehicular networks (AVNs) have emerged to provide convenient, comfortable, and safe driving services. Especially, due to the provable and unconditional security, quantum communication technology is increasingly being applied to promote the security of data delivery in AVNs, which forms the promising quantum AVNs (QAVNs). Federated learning (FL) is essential in QAVNs to implement intelligent and autonomous driving, where extensive distributed data is utilized to cooperatively train AI models, preserve user privacy, and reduce resource consumption. However, the FL unavoidably faces several possible privacy and security problems as a result of the intricate interconnections between several autonomous vehicles or infrastructures. In this article, we investigate the security and privacy of FL in QAVNs. Specifically, we first establish the system architecture, including quantum key distribution protocol, space-air-ground integrated network (SAGIN)-enabled QAVNs model, and FL framework in QAVNs. Furthermore, we describe the privacy and security threats to FL in QAVNs, i.e., inference attack, eavesdropping attack, and sybil attack. Following that, we give a case study for designing a secure FL scheme using the local differential privacy mechanism and the homomorphic encryption mechanism. Finally, we suggest several potential future research directions in QAVNs.

RPIFL: Reliable and Privacy-Preserving Federated Learning for the Internet of Things

Federated Learning for the Internet of Things(FL for IoT) contributes to the enhancement of security in smart cities. However, the privacy disclosure attacks within the FL for IoT framework exposes user’s local data . Although differential privacy mechanism (DP) ensures the privacy of IoT data, one crucial issue is DP affects model accuracy and reduces model reliability. Besides, DP cannot provide comprehensive privacy preservation in the IoT environment. To tackle the above problems, we propose reliable federated learning with privacy-preserving for IoT(RPIFL). Our approach comprises three key components. First, we leverage a lightweight network to hide the private data locally, then use the output to perform the next model training. Second, we propose a multi-modal fine-grained model optimization, which significantly improves the accuracy of the IoT model. Third, we implement adaptive differential privacy mechanisms tailored to dynamic privacy requirements, thereby safeguarding the confidentiality of IoT data. To empirically validate our framework, we conducted a simulation experiment on an image classification dataset. Our methodology concurrently ensures privacy protection and achieves superior accuracy compared to the baseline model with an average accuracy increase of 1.1% over the two prevailing federated privacy protection methods, coupled with an average reduction in convergence time of over 9%.

Correlated differential privacy based logistic regression for supplier data protection

As a crucial participant in the supply chain, the supplier's every action affects the supply chain's status, making predictions about whether a supplier will be listed or not essential. However, the large amount of sensitive data used in machine learning generates the problem of privacy leakage. Due to the data relevance, traditional differential privacy is prone to leakage of information of correlated data. To effectively tackle this problem, in the scenario of supplier listing prediction, we introduce the correlated differential privacy mechanism for the logistic regression model, propose the feature selection scheme DC-FBFS, and further explore different noise addition methods. The experiments show that the proposed scheme can improve the utility of data, increase the prediction accuracy, and reduce the error in data query while effectively protecting data.

Disclosure Risk From Homogeneity Attack in Differentially Privately Sanitized Frequency Distribution

Differential privacy (DP) provides a robust model to achieve privacy guarantees for released information. We examine the protection potency of sanitized multi-dimensional frequency distributions via DP randomization mechanisms against homogeneity attack (HA). HA allows adversaries to obtain the exact values on sensitive attributes for their targets without having to identify them from the released data. We propose measures for disclosure risk from HA and derive closed-form relationships between the privacy loss parameters in DP and the disclosure risk from HA. The availability of the closed-form relationships assists understanding the abstract concepts of DP and privacy loss parameters by putting them in the context of a concrete privacy attack and offers a perspective for choosing privacy loss parameters when employing DP mechanisms in information sanitization and release in practice. We apply the closed-form mathematical relationships in real-life datasets to demonstrate the assessment of disclosure risk due to HA on differentially private sanitized frequency distributions at various privacy loss parameters.

A privacy-preserving trajectory data synthesis framework based on differential privacy

Trajectory data contains spatio-temporal information about a large number of moving objects, and analysis of this data can yield a lot of valuable information to support a variety of application requirements related to moving objects. However, publishing unprotected trajectory data carries the risk of revealing personal privacy. In the existing approaches, the utility of published trajectory data is sacrificed for privacy protection. In this paper, we propose a differential privacy mechanism DP-Std for data publication in synthetic trajectory databases. first, the DP-Std mechanism constructs a density- and distance-aware adaptive grid structure for discrete geographic regions, and adds noise in the process to satisfy differential privacy. Second, DP-Std extracts feature distributions to ensure the utility of synthetic trajectories. Third, DP-Std constructs a mobility model that samples intermediate location points. And then the trajectory dataset is synthesized by differential privacy distribution and mobility model. Finally, we conduct experiments on two datasets to evaluate our framework. The results show that DP-Std outperforms other feature-based trajectory synthesis methods in terms of data utility and achieves a trade-off between privacy and utility with strict privacy protection.