Information-theoretic Privacy Research Articles

Private outsourced model predictive control via secure multi-party computation

Protecting data privacy is essential in developing practical cloud-based control systems to benefit from remote and distributed computation while avoiding the risks of disclosing sensitive information to potentially untrusted parties. This paper proposes a privacy-preserving framework to outsource the computation of model predictive control law to several untrusted cloud-based servers. A secret sharing scheme is employed to maintain the privacy of the system’s data in all the stages of the control loop in a secure multi-party computation environment. In this regard, a privacy-preserving algorithm is derived to securely implement a projected gradient method to solve the underlying optimization problem, without revealing private data to external eavesdroppers and curious cloud-based servers. The proposed method is solely based on secret sharing, and all computations can be performed securely by cloud servers without the need to designate target nodes or engage the system’s actuator in computing the intermediate steps. Therefore, the proposed method is less computationally demanding than the existing results based on homomorphic encryption and is applicable to systems with limited computing resources. Information-theoretic privacy assessments based on mutual information measures are provided. The efficacy of the proposed method is investigated on the cruise control problem of a freight train system.

Information-theoretic privacy in federated submodel learning

We consider information-theoretic privacy in federated submodel learning, where a global server has multiple submodels. Compared to the privacy considered in the conventional federated submodel learning where secure aggregation is adopted for ensuring privacy, information-theoretic privacy provides the stronger protection on submodel selection by the local machine. We propose an achievable scheme that partially adopts the conventional private information retrieval (PIR) scheme that achieves the minimum amount of download. With respect to computation and communication overhead, we compare the achievable scheme with a naïve approach for federated submodel learning with information-theoretic privacy.

Bottlenecks CLUB: Unifying Information-Theoretic Trade-Offs Among Complexity, Leakage, and Utility

Bottleneck problems are an important class of optimization problems that have recently gained increasing attention in the domain of machine learning and information theory. They are widely used in generative models, fair machine learning algorithms, design of privacy-assuring mechanisms, and appear as information-theoretic performance bounds in various multi-user communication problems. In this work, we propose a general family of optimization problems, termed as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">complexity-leakage-utility bottleneck (CLUB)</i> model, which (i) provides a unified theoretical framework that generalizes most of the state-of-the-art literature for the information-theoretic privacy models, (ii) establishes a new interpretation of the popular generative and discriminative models, (iii) constructs new insights for the generative compression models, and (iv) can be used to obtain fair generative models. We first formulate the CLUB model as a complexity-constrained privacy-utility optimization problem. We then connect it with the closely related bottleneck problems, namely information bottleneck (IB), privacy funnel (PF), deterministic IB (DIB), conditional entropy bottleneck (CEB), and conditional PF (CPF). We show that the CLUB model generalizes all these problems as well as most other information-theoretic privacy models. Then, we construct the deep variational CLUB (DVCLUB) models by employing neural networks to parameterize variational approximations of the associated information quantities. Building upon these information quantities, we present unified objectives of the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">supervised</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">unsupervised</i> DVCLUB models. Leveraging the DVCLUB model in an unsupervised setup, we then connect it with state-of-the-art generative models, such as variational auto-encoders (VAEs), generative adversarial networks (GANs), as well as the Wasserstein GAN (WGAN), Wasserstein auto-encoder (WAE), and adversarial auto-encoder (AAE) models through the optimal transport (OT) problem. We then show that the DVCLUB model can also be used in fair representation learning problems, where the goal is to mitigate the undesired bias during the training phase of a machine learning model. We conduct extensive quantitative experiments on colored-MNIST and CelebA datasets.

Answering Count Queries for Genomic Data With Perfect Privacy

In this paper, we consider the problem of answering count queries for genomic data subject to perfect privacy constraints. Count queries are often used in applications that collect aggregate (population-wide) information from biomedical Databases (DBs) for analysis, such as Genome-wide association studies. Our goal is to design mechanisms for answering count queries of the following form: <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">How many users in the database have a specific set of genotypes at certain locations in their genome?</i> At the same time, we aim to achieve perfect privacy (zero information leakage) of the sensitive genotypes at a pre-specified set of secret locations. The sensitive genotypes could indicate rare diseases and/or other health traits one may want to keep private. We present both local and central count-query mechanisms for the above problem that achieves perfect information-theoretic privacy for sensitive genotypes while minimizing the expected absolute error (or per-user error probability, depending on the setting) of the query answer. We also derived a lower bound of the per-user probability of error for an arbitrary query-answering mechanism that satisfies perfect privacy. We show that our mechanisms achieve error close to the lower bound, and match the lower bound for some special cases. We numerically show that the performance of each mechanism depends on the data prior distribution, the intersection between the queried and sensitive genotypes, and the strength of the correlation in the genomic data sequence.

On the Fundamental Limits of Device-to-Device Private Caching Under Uncoded Cache Placement and User Collusion

In the coded caching problem, as originally formulated by Maddah-Ali and Niesen, a server communicates via a noiseless shared broadcast link to multiple users that have local storage capability. In order for a user to decode its demanded file from the coded multicast transmission, the demands of all the users must be globally known, which may violate the privacy of the users. To overcome this privacy problem, Wan and Caire recently proposed several schemes that attain coded multicasting gain while simultaneously guarantee information theoretic privacy of the users’ demands. In Device-to-Device (D2D) networks, the demand privacy problem is further exacerbated by the fact that each user is also a transmitter, which appears to be needing the knowledge of the files demanded by the remaining users in order to form its coded multicast transmission. This paper shows how to solve this seemingly infeasible problem. The main contribution of this paper is the development of new achievable and converse bounds for D2D coded caching that are to within a constant factor of one another when privacy of the users’ demands must be guaranteed even in the presence of colluding users (i.e., when some users share cached contents and demanded file indices). First, a D2D private caching scheme is proposed, whose key feature is the addition of virtual users in the system in order to “hide” the demands of the real users. By comparing the achievable D2D private load with an existing converse bound for the shared-link model without demand privacy constraint, the proposed scheme is shown to be order optimal, except for the very low memory size regime with more files than users. Second, in order to shed light into the open parameter regime, a new achievable scheme and a new converse bound under the constraint of uncoded cache placement (i.e., when each user stores directly a subset of the bits of the library) are developed for the case of two users, and shown to be to within a constant factor of one another for all system parameters. Finally, the two-user converse bound is extended to any number of users by a cut-set type argument. With this new converse bound, the virtual users scheme is shown to be order optimal in all parameter regimes under the constraint of uncoded cache placement and user collusion.

Privacy-utility trades in crowdsourced signal map obfuscation

Cellular providers and data aggregating companies crowdsource cellular signal strength measurements from user devices to generate signal maps, which can be used to improve network performance. Recognizing that this data collection may be at odds with growing awareness of privacy concerns, we consider obfuscating such data before the data leaves the mobile device. The goal is to increase privacy such that it is difficult to recover sensitive features from the obfuscated data (e.g. user ids and user whereabouts), while still allowing network providers to use the data for improving network services (i.e. create accurate signal maps). To examine this privacy-utility tradeoff, we identify privacy and utility metrics and threat models suited to signal strength measurements. We then obfuscate the measurements using several preeminent techniques, spanning differential privacy, generative adversarial privacy, and information-theoretic privacy techniques, in order to benchmark a variety of promising obfuscation approaches and provide guidance to real-world engineers who are tasked to build signal maps that protect privacy without hurting utility. Our evaluation results, based on multiple, diverse, real-world signal map datasets, demonstrate the feasibility of concurrently achieving adequate privacy and utility, with obfuscation strategies which use the structure and intended use of datasets in their design, and target average-case, rather than worst-case, guarantees.

A Generalized Information-Theoretic Framework for the Emergence of Hierarchical Abstractions in Resource-Limited Systems.

In this paper, a generalized information-theoretic framework for the emergence of multi-resolution hierarchical tree abstractions is developed. By leveraging ideas from information-theoretic signal encoding with side information, this paper develops a tree search problem which considers the generation of multi-resolution tree abstractions when there are multiple sources of relevant and irrelevant, or possibly confidential, information. We rigorously formulate an information-theoretic driven tree abstraction problem and discuss its connections with information-theoretic privacy and resource-limited systems. The problem structure is investigated and a novel algorithm, called G-tree search, is proposed. The proposed algorithm is analyzed and a number of theoretical results are established, including the optimally of the G-tree search algorithm. To demonstrate the utility of the proposed framework, we apply our method to a real-world example and provide a discussion of the results from the viewpoint of designing hierarchical abstractions for autonomous systems.

Mechanisms for Hiding Sensitive Genotypes with Information-Theoretic Privacy.

Motivated by the growing availability of personal genomics services, we study an information-theoretic privacy problem that arises when sharing genomic data: a user wants to share his or her genome sequence while keeping the genotypes at certain positions hidden, which could otherwise reveal critical health-related information. A straightforward solution of erasing (masking) the chosen genotypes does not ensure privacy, because the correlation between nearby positions can leak the masked genotypes. We introduce an erasure-based privacy mechanism with perfect information-theoretic privacy, whereby the released sequence is statistically independent of the sensitive genotypes. Our mechanism can be interpreted as a locally-optimal greedy algorithm for a given processing order of sequence positions, where utility is measured by the number of positions released without erasure. We show that finding an optimal order is NP-hard in general and provide an upper bound on the optimal utility. For sequences from hidden Markov models, a standard modeling approach in genetics, we propose an efficient algorithmic implementation of our mechanism with complexity polynomial in sequence length. Moreover, we illustrate the robustness of the mechanism by bounding the privacy leakage from erroneous prior distributions. Our work is a step towards more rigorous control of privacy in genomic data sharing.

Algorithm-Level Confidentiality for Average Consensus on Time-Varying Directed Graphs

Average consensus plays a key role in distributed networks, with applications ranging from time synchronization, information fusion, load balancing, to decentralized control. Existing average consensus algorithms require individual agents to exchange explicit state values with their neighbors, which leads to the undesirable disclosure of sensitive information in the state. In this paper, we propose a novel average consensus algorithm for time-varying directed graphs that can protect the confidentiality of a participating agent against other participating agents. The algorithm injects randomness in interaction to obfuscate information on the algorithm-level and can ensure information-theoretic privacy without the assistance of any trusted third party or data aggregator. By leveraging the inherent robustness of consensus dynamics against random variations in interaction, our proposed algorithm can also guarantee the accuracy of average consensus. The algorithm is distinctly different from differential-privacy based average consensus approaches which enable confidentiality through compromising accuracy in obtained consensus value. Numerical simulations confirm the effectiveness and efficiency of our proposed approach.

Efficient transformation capabilities of single database private block retrieval

Private information retrieval (PIR) is one of the promising techniques to preserve user privacy in the presence of trusted-but-curious servers. The information theoretically private query construction assures the highest user privacy over curious and unbounded computation servers. Therefore, the need for information-theoretic private retrieval was fulfilled by various schemes in a variety of PIR settings. But, there is a lack of efficient encryption switching scheme which supports efficient switching between information-theoretic to/from computationally bounded PIRs. We propose a combination of new bit connection methods called rail-shape and signal-shape and new quadratic residuosity assumption based family of trapdoor functions for generic single database private block retrieval (PBR). The main goal of this work is to show that the possibility of mapping from computationally bounded privacy to information theoretic privacy or vice-versa in a single database setting using newly constructed bit connection and trapdoor function combinations. Notably, the proposed schemes are single round, memoryless and plain database schemes (at their basic constructions).

Semantic-Aware Privacy-Preserving Online Location Trajectory Data Sharing

Although users can obtain various services by sharing their location information online with location-based service providers, it reveals sensitive information about users. However, existing privacy-preserving techniques in the online scenario suffer from the following shortcomings. First, they model the correlations between the real trajectory and the distorted trajectory as undirected, which makes them unable to accurately quantify the data privacy leakage caused by sharing the distorted trajectory. Second, they are unable to protect semantic privacy, i.e., attackers can obtain the victims&#x2019; visit purpose by using the Point of Interest information without knowing the real location data. Additionally, they fail to balance semantic-aware data utility and privacy protection. To make the case even worse, compared to the offline scenario, sharing trajectory online in real time does not have access to the overall location trajectory. In this paper, we propose a novel semantic-aware privacy-preserving online location trajectory sharing mechanism, called SEmantic-aware Information-Theoretic Privacy (SEITP), to protect both data privacy and semantic privacy while the semantic-aware data utility can be preserved. In particular, we put forward two new metrics of privacy to capture data privacy leakage and semantic privacy leakage, respectively. Besides, to quantify the semantic-aware trajectory data utility, we propose a semantic-aware utility metric. With those metrics, the shortcoming of failing to guarantee the data utility is avoided naturally through structuring a multi-objective optimization problem. Then, we theoretically prove that the new construction can protect both data and semantic privacy. Finally, the experimental evaluations based on the real-world private vehicle trajectory dataset demonstrate that SEITP outperforms existing mechanisms.

Privacy-Utility Trades in Crowdsourced Signal Map Obfuscation

Cellular providers and data aggregating companies crowdsource celluar signal strength measurements from user devices to generate signal maps, which can be used to improve network performance. Recognizing that this data collection may be at odds with growing awareness of privacy concerns, we consider obfuscating such data before the data leaves the mobile device. The goal is to increase privacy such that it is difficult to recover sensitive features from the obfuscated data (e.g. user ids and user whereabouts), while still allowing network providers to use the data for improving network services (i.e. create accurate signal maps). To examine this privacy-utility tradeoff, we identify privacy and utility metrics and threat models suited to signal strength measurements. We then obfuscate the measurements using several preeminent techniques, spanning differential privacy, generative adversarial privacy, and information-theoretic privacy techniques, in order to benchmark a variety of promising obfuscation approaches and provide guidance to real-world engineers who are tasked to build signal maps that protect privacy without hurting utility. Our evaluation results, based on multiple, diverse, real-world signal map datasets, demonstrate the feasibility of concurrently achieving adequate privacy and utility, with obfuscation strategies which use the structure and intended use of datasets in their design, and target average-case, rather than worst-case, guarantees.

A Survey on Statistical, Information, and Estimation—Theoretic Views on Privacy

Privacy has become an emerging challenge in both information theory and computer science due to massive (centralized) collection of user data. In this article, we overview privacy-preserving mechanisms and metrics from the lenses of information theory, and unify different privacy metrics, including f-divergences, Rényi divergences, and differential privacy (DP), in terms of the probability likelihood ratio (and its logarithm). We review recent progress on the design of privacy-preserving mechanisms according to the privacy metrics in computer science, where DP is the standard privacy notion which controls the output shift given small input perturbation, and information theory, where the privacy is guaranteed by minimizing information leakage. In particular, for DP, we include its important variants (e.g., Rényi DP, Pufferfish privacy) and properties, discuss its connections with information-theoretic quantities, and provide the operational interpretations of its additive noise mechanisms. For information-theoretic privacy, we cover notable frameworks, including the privacy funnel, originated from rate-distortion theory and information bottleneck, to privacy guarantee against statistical inference/guessing, and information obfuscation on samples and features. Finally, we discuss the implementations of these privacy-preserving mechanisms in current data-driven machine learning scenarios, including deep learning, information obfuscation, federated learning, and dataset sharing.

Medical imaging deep learning with differential privacy

The successful training of deep learning models for diagnostic deployment in medical imaging applications requires large volumes of data. Such data cannot be procured without consideration for patient privacy, mandated both by legal regulations and ethical requirements of the medical profession. Differential privacy (DP) enables the provision of information-theoretic privacy guarantees to patients and can be implemented in the setting of deep neural network training through the differentially private stochastic gradient descent (DP-SGD) algorithm. We here present deepee, a free-and-open-source framework for differentially private deep learning for use with the PyTorch deep learning framework. Our framework is based on parallelised execution of neural network operations to obtain and modify the per-sample gradients. The process is efficiently abstracted via a data structure maintaining shared memory references to neural network weights to maintain memory efficiency. We furthermore offer specialised data loading procedures and privacy budget accounting based on the Gaussian Differential Privacy framework, as well as automated modification of the user-supplied neural network architectures to ensure DP-conformity of its layers. We benchmark our framework’s computational performance against other open-source DP frameworks and evaluate its application on the paediatric pneumonia dataset, an image classification task and on the Medical Segmentation Decathlon Liver dataset in the task of medical image segmentation. We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance. Our framework compares favourably to related work with respect to memory consumption and computational performance. Our work presents an open-source software framework for differentially private deep learning, which we demonstrate in medical imaging analysis tasks. It serves to further the utilisation of privacy-enhancing techniques in medicine and beyond in order to assist researchers and practitioners in addressing the numerous outstanding challenges towards their widespread implementation.

Lower and Upper Bounds on the Randomness Complexity of Private Computations of AND

We consider multi-party information-theoretic private protocols, and specifically their randomness complexity. The randomness complexity of private protocols is of interest both because random bits are considered a scarce resource, and because of the relation between that complexity measure and other complexity measures of boolean functions such as the circuit size or the sensitivity of the function being computed [12, 17].

On Coded Caching With Private Demands

Caching is an efficient way to reduce network traffic congestion during peak hours by storing some content at the user’s local cache memory without knowledge of later demands. For the shared-link caching model, Maddah-Ali and Niesen (MAN) proposed a two-phase ( placement and delivery ) coded caching strategy, which is order optimal within a constant factor. However, in the MAN coded caching scheme, each user can obtain the information about the demands of other users, i.e., the MAN coded caching scheme is inherently prone to tampering and spying the activity/demands of other users. In this paper, we formulate an information-theoretic shared-link caching model with private demands, where there are ${\mathsf K}$ cache-aided users (which can cache up to ${\mathsf M}$ files) connected to a central server with access to ${\mathsf N}$ files. Each user requests ${\mathsf L}$ files. Our objective is to design a two-phase private caching scheme with minimum load while preserving the information-theoretic privacy of the demands of each user with respect to other users. A trivial solution is the uncoded caching scheme which lets each user recover all the ${\mathsf N}$ files, referred to as baseline scheme . For this problem we propose two novel schemes which achieve the information-theoretic privacy of the users’ demands while also achieving a non-trivial caching gain over the baseline scheme. The general underlying idea is to satisfy the users’ requests by generating a set of coded multicast messages that is symmetric with respect to the library files, such that for each user k, the mutual information between these messages and the demands of all other users given the cache content and the demand of user k is zero. In the first scheme, referred to as virtual-user scheme, we introduce a number of virtual users such that each ${\mathsf L}$ -subset of files is demanded by ${\mathsf K}$ real or virtual (effective) users and use the MAN delivery to generate multicast messages. From the viewpoint of each user, the set of multicast messages is symmetric over all files even if each single multicast message is not. This scheme incurs in an extremely large sub-packetization. Then, we propose a second scheme, referred to as MDS-based scheme, based on a novel MDS-coded cache placement. In this case, we generate multicast messages where each multicast message contains one MDS-coded symbol from each file in the library and thus is again symmetric over all the files from the viewpoint of each user. The sub-packetization level of the MDS-based scheme is exponentially smaller than that needed by the virtual-user scheme. Compared with the existing shared-link coded caching converse bounds without privacy, the virtual-user scheme is proved to be order optimal with a constant factor when ${\mathsf N}\leq {\mathsf L} {\mathsf K} $ , or when ${\mathsf N}\geq {\mathsf L} {\mathsf K} $ and ${\mathsf M}\geq {\mathsf N}/ {\mathsf K}$ . In addition, when ${\mathsf M}\geq {\mathsf N}/2$ , both of the virtual-user scheme and the MDS-based scheme are order optimal within a factor of 2.

Real-Time Privacy-Preserving Data Release for Smart Meters

Smart Meters (SMs) are able to share the power consumption of users with utility providers almost in real-time. These fine-grained signals carry sensitive information about users, which has raised serious concerns from the privacy viewpoint. In this paper, we focus on real-time privacy threats, i.e., potential attackers that try to infer sensitive information from SMs data in an online fashion. We adopt an information-theoretic privacy measure and show that it effectively limits the performance of any attacker. Then, we propose a general formulation to design a privatization mechanism that can provide a target level of privacy by adding a minimal amount of distortion to the SMs measurements. On the other hand, to cope with different applications, a flexible distortion measure is considered. This formulation leads to a general loss function, which is optimized using a deep learning adversarial framework, where two neural networks -- referred to as the releaser and the adversary -- are trained with opposite goals. An exhaustive empirical study is then performed to validate the performance of the proposed approach and compare it with state-of-the-art methods for the occupancy detection privacy problem. Finally, we also investigate the impact of data mismatch between the releaser and the attacker.

Private Streaming With Convolutional Codes

Recently, information-theoretic private information retrieval (PIR) from coded storage systems has gained a lot of attention, and a general star product PIR scheme was proposed. In this paper, the star product scheme is adopted, with appropriate modifications, to the case of private ( e.g. , video) streaming. It is assumed that the files to be streamed are stored on $n$ servers in a coded form, and the streaming is carried out via a convolutional code. The star product scheme is defined for this special case, and various properties are analyzed for two channel models related to straggling and Byzantine servers, both in the baseline case as well as with colluding servers. The achieved PIR rates for the given models are derived and, for the cases where the capacity is known, the first model is shown to be asymptotically optimal, when the number of stripes in a file is large. The second scheme introduced in this work is shown to be the equivalent of block convolutional codes in the PIR setting. For the Byzantine server model, it is shown to outperform the trivial scheme of downloading stripes of the desired file separately without memory.

Developing Non-Stochastic Privacy-Preserving Policies Using Agglomerative Clustering

We consider a non-stochastic privacy-preserving problem in which an adversary aims to infer sensitive information $S$ from publicly accessible data $X$ without using statistics. We consider the problem of generating and releasing a quantization $\hat{X}$ of $X$ to minimize the privacy leakage of $S$ to $\hat{X}$ while maintaining a certain level of utility (or, inversely, the quantization loss). The variables $S$ and $S$ are treated as bounded and non-probabilistic, but are otherwise general. We consider two existing non-stochastic privacy measures, namely the maximum uncertainty reduction $L_0(S \rightarrow \hat{X})$ and the refined information $I_*(S; \hat{X})$ (also called the maximin information) of $S$. For each privacy measure, we propose a corresponding agglomerative clustering algorithm that converges to a locally optimal quantization solution $\hat{X}$ by iteratively merging elements in the alphabet of $X$. To instantiate the solution to this problem, we consider two specific utility measures, the worst-case resolution of $X$ by observing $\hat{X}$ and the maximal distortion of the released data $\hat{X}$. We show that the value of the maximin information $I_*(S; \hat{X})$ can be determined by dividing the confusability graph into connected subgraphs. Hence, $I_*(S; \hat{X})$ can be reduced by merging nodes connecting subgraphs. The relation to the probabilistic information-theoretic privacy is also studied by noting that the G{\'a}cs-K{\"o}rner common information is the stochastic version of $I_*$ and indicates the attainability of statistical indistinguishability.

Towards Efficient Information-Theoretic Function Secret Sharing

A $(t,r)$ -function secret sharing ( $(t,r)$ -FSS) scheme allows a dealer to secret-share a function $f$ among $r$ parties as $r$ secret keys $k_{1},\ldots,k_{r}$ such that for any input $x$ the parties can compute $r$ output shares that allow the reconstruction of $f(x)$ but any $\leq t$ of the parties cannot learn any information about $f$ . FSS schemes for point functions have been constructed under the name of distributed point functions (DPFs). The existing DPFs are computationally secure and based on the existence of PRGs or OWFs. As a result, the protocols where DPFs work as building blocks are computationally secure as well. In this paper, we study information-theoretically secure $(t,r)$ -FSS (called $(t,r)$ -itFSS) and propose a generic transformation from information-theoretic private information retrieval (PIR) schemes to itFSS schemes for point functions. We measure the efficiency of itFSS with its communication complexity, which can be defined as the total length of the secret keys and the output shares, maximized over the choices of $f$ and $x$ . By instantiating the generic transformation, we obtain $(t,r)$ -itFSS schemes for a variety of choices of $(t,r)$ , which have sublinear (in the functions’ domain size) communication complexity. How to make sure that the parties’ shares of $f(x)$ do not reveal more information than what needed to compute $f(x)$ is an interesting problem. An itFSS with this property is called function-private. In this paper, we also define a parameter called the mutual rate of itFSS in order to measure the amount of information that will be leaked by the parties’ output shares. We calculate the mutual rates for several specific itFSS schemes. We also define computational function privacy and propose a 2-party itFSS scheme with computational function privacy.