Personalized Privacy Preservation Research Articles

Crowdsourced Federated Learning Architecture with Personalized Privacy Preservation

Crowdsourced Federated Learning Architecture with Personalized Privacy Preservation

Privacy preservation network with global-aware focal loss for Interactive Personal Visual Privacy Preservation

Existing visual privacy preservation methods often encounter the challenge of over-protection, which usually fails to accurately protect a specified person in an image. This paper introduces a novel task called “Interactive Personal Visual Privacy Preservation (IPVPP)”, with the objective of safeguarding a desired individual in an image based on user-click prompts. We propose a new framework, Privacy Preservation Network (PPNet) with Global-aware Focal Loss, tailored for IPVPP task. To address the sample imbalance issue in IPVPP, we present a Global-aware Focal Loss (GFL), which introduces global and local difficulty balance weights to dynamically adjust the overall decision boundary, thereby mitigating the sample imbalance problem for better optimization of models. Furthermore, to tackle the insufficient fusion between click and visual features, we propose a Click-Image Fusion (CIF) module, which effectively emphasizes the interaction between click and image features, providing robust query inputs to the model. We finally employ generative adversarial networks to ensure the reusability of privacy images, striking a balance between privacy preservation and image value. Experimental results on the DAVIS dataset demonstrate the effectiveness of PPNet, achieving improvements measured in NoC 90, IS, SSIM, F-1, and DIR, with 0.22, 0.19, 0.009, 4.23, and 2.15 improvements, respectively.

Adaptive personalized privacy-preserving data collection scheme with local differential privacy

Local differential privacy (LDP) is a state-of-the-art privacy notion that enables terminal participants to share their private data safely while controlling the privacy disclosure at the source. In most recent works, it is assumed that the privacy parameter is determined solely by collectors and then dispatched to all participants. However, it is inelegant and unpromising for all participants to accept the same level of privacy preservation due to their personalized preferences. Here, an adaptive data collection scheme is proposed to realize personalized privacy preservation while achieving higher data utility, in which two different LDP perturbation methods are adaptively chosen by data participants according to their personalized privacy preferences. The adaptive boundary based on the minimum mean square error (MSE) is theoretically and accurately derived to allow participants to adaptively choose the best perturbation method. Then, a weighted combination method is demonstrated to do effective data aggregation from multiple privacy groups. Moreover, an expanded data strategy (EDS) with multiple privacy perturbations is presented to equivalently increase the sample size without harming others privacy, thereby further improving the accuracy of statistics. Finally, the experiments show that the proposed scheme performs better than the previous proposal in terms of MSE and average error rate (AER), especially using the EDS method.

APLDP: Adaptive personalized local differential privacy data collection in mobile crowdsensing

Local differential privacy (LDP) enables terminal participants to share their private data safely while controlling the privacy disclosure at the source. In the majority of current works, they assumed that the privacy preservation parameter is totally determined by the data collector and then dispatched to all participants in mobile crowdsensing. However, in the real world, due to different privacy preferences of participants, it is inelegant and unpromising for all participants to accept the same privacy preservation level during data collection. To address such issue, an adaptive personalized local differential privacy (APLDP) data collection scheme is proposed to realize personalized privacy preservation while achieving higher data utility, in which two different LDP perturbation methods (basic RAPPOR and k-RR) are adaptively chosen by the participants according to their different privacy preferences, as well as the best perturbation probability is adaptively adopted by the participants to perturb their private data. In such case, the adaptive boundary based on the minimum mean square error (MSE) is theoretically derived to allow the participant to adaptively choose the best perturbation method, and meanwhile, it allows the participant to adaptively choose the best perturbation probability. Then, two estimation mergence methods named the direct combination (DC) and the weighted combination (WC) are demonstrated to do efficient data aggregation. Experiments on both synthetic and real data sets show that the proposed APLDP scheme performs better than previous non-personalized proposals in terms of the MSE and the average error rate (AER), especially using WC estimation method.

Trajectory personalization privacy preservation method based on multi-sensitivity attribute generalization and local suppression

Fast-developing mobile location-aware services generate an enormous volume of trajectory data while adding value to people’s lives. However, trajectory data contains not only location information, but also sensitive personal information. If the original trajectory data is published directly, it could result in serious privacy leaks. Most of the existing privacy-preserving trajectory publishing methods only protect the location information or set the same privacy preservation levels for all moving objects. To meet the users’ personalized privacy requirements and ensure the utility of trajectory location and sensitive information, we propose a trajectory personalized privacy preservation method based on multi-sensitivity attribute generalization and local suppression. First, we set different security levels for each trajectory by calculating the correlation between sensitive attributes to establish a sensitive attribute classification tree. Second, we generalized sensitive attributes based on privacy preservation levels for each trajectory, the trajectory data still at risk of privacy leakage after generalization was locally suppressed. Finally, an anonymized trajectory dataset was generated. Experimental results on real datasets demonstrated that our method could improve data availability while preserving privacy.

Personalized Privacy Preservation in Consumer Mobile Trajectories

The use of mobile technologies to collect and analyze consumer location data has created a multi-billion-dollar ecosystem with various stakeholders. However, this ecosystem also presents privacy risks to consumers. To address this issue, data aggregators can implement a privacy preserving framework that balances privacy risks to consumers with data utilities for advertisers. The proposed framework is personalized and flexible, allowing for quantification of personalized privacy risks and data obfuscation to reduce these risks. It can accommodate a variety of risks, utilities, and trade-offs between the two. The framework was validated on one million consumer location trajectories, revealing potential privacy risks in the absence of data obfuscation. Machine learning methods are used to demonstrate the effectiveness of the proposed framework which outperformed ten baselines from the latest literature, significantly reducing each consumer’s privacy risk while preserving advertiser utility. As the use of location big data continues to grow, this research offers a necessary framework to balance privacy risks and data utilities, sustain a secure and self-governing ecosystem, and ensure the protection of consumers’ personal data.

A Personalized Privacy Preserving Mechanism for Crowdsourced Federated Learning

In this paper, we focus on the privacy preserving mechanism design for crowdsourced Federated Learning (FL), where a requester can outsource its model training task to some workers via an FL platform. A potential way to preserve the privacy of workers' local data is to leverage Differential Privacy (DP) mechanisms on local models. However, most of these studies cannot allow workers to dominate their own privacy protection levels by themselves. Thus, we propose a Personalized Privacy Preserving Mechanism, called P3M, to satisfy the heterogeneous privacy needs of workers, which consists of two parts. The first part includes a personalized privacy budget determination problem. We model it as a two-stage Stackelberg game, derive the personalized privacy budget for each worker and the optimal payment for the requester, and prove that they form a unique Stackelberg equilibrium. Second, we design a dynamic perturbation scheme to perturb model parameters. Through the theoretical analysis, we prove that P3M satisfies the desired DP property, and derive the bounds of the variance of average perturbed parameters and the convergence upper bound. This demonstrates that the global model accuracy can be controllable and P3M is endowed with the satisfactory convergence performance. In addition, we extend our problem to the scenario where the total privacy budget of all workers is limited, so as to prevent some workers from setting exorbitant privacy budgets. Under the privacy constraint, we re-determine the personalized privacy budget for each worker. Finally, exhaustive simulations of P3M are conducted based on real-world datasets, and the experimental results corroborate its effectiveness and practicability.

Local generalization and bucketization technique for personalized privacy preservation

Anonymization technique has been extensively studied and widely applied for privacy-preserving data publishing. In most previous approaches, a microdata table consists of three categories of attributes, namely explicit-identifier, quasi-identifier (QI), and sensitive attribute. In general, individuals may have different views on the sensitivity of different attributes. Therefore, there is another type of attribute that contains both QI values and sensitive values, termed semi-sensitive attribute. In this paper, we propose a new anonymization technique, called Local Generalization and Bucketization, to prevent identity disclosure and protect the sensitive values on each semi-sensitive attribute and sensitive attribute. The rationale is to use local generalization and local bucketization to divide the tuples into local equivalence groups and partition the sensitive values into local buckets, respectively. The protections of local generalization and local bucketization are independent, so that they can be implemented by appropriate algorithms without weakening other protection. Besides, the protection of local bucketization for each semi-sensitive attribute and sensitive attribute is also independent. Consequently, local bucketization can comply with various principles in different attributes according to the actual requirements of anonymization. We conducted extensive experiments to illustrate the effectiveness of the proposed approach.

Enhanced Privacy Preserving for Social Networks Relational Data Based on Personalized Differential Privacy

With the popularization and development of social software, more and more people join the social network, which produces a lot of valuable information, but also contains plenty of sensitive privacy information. To achieve the personalized privacy protection of massive social network relational data, a privacy enhancement method for social networks relational data based on personalized differential privacy is proposed. And a dimensionality reduction segmentation sampling (DRS-S) algorithm is proposed to implement this method. First, in order to solve the problem of inefficiency caused by the excessive amount of data in social networks, dimension reduction and segmentation are carried out to divide the data into groups. According to the privacy protection requirements of different users, we adopt sampling method to protect users with different privacy requirements at different levels, so as to realize personalized different privacy. After that, the noise is added to the protected data to satisfy the privacy budget. Then publish the social network data. Finally, the proposed algorithm is compared with the traditional personalized differential privacy (PDP) algorithm and privacy preserving approach based on clustering and noise (PBCN) in real data set, the experimental results demonstrate that the quality of privacy protection and data availability of DRS-S are better than that of PDP algorithm and PBCN algorithm.

Neural Network-based Game Theory Approach for Personalized Privacy Preservation in Data Publishing

Neural Network-based Game Theory Approach for Personalized Privacy Preservation in Data Publishing

Privacy Recommendation Based on Bhattacharyya Coefficient

In the era of big data, how to achieve the trade-off between recommendation accuracy and privacy protection has become a hot topic in the field of recommendation. In this work, a recommendation scheme with personal privacy preservation is designed. Besides, it does not depend on co-ratings. In order to solve the problem of excessive sensitivity when the Laplace noise is introduced directly, the Bhattacharyya coefficient that is used as the similarity metric is normalized. Moreover, a personalized privacy protection scheme that considering the difference of users is used for the recommendation system. Experimental results show that, compared with the traditional differential privacy collaborative filtering scheme, the RMSE and MAE of the proposed scheme are significantly improved. The proposed scheme not only ensures the accuracy of the prediction results but also effectively guarantees the privacy protection of user data. It also provides an insight into the design of recommendation services considering privacy protection.

Light-Weight Selective Image Encryption for Privacy Preservation

To protect personal privacy and confidential preservation, access control is used to authorize legal users for safe browsing the authorized contents on photos. The access control generates an authorization rule according to each permission assignment. However, the general access control is inappropriate to apply in some social services (e.g., photos posted on Flickr and Instagram, personal image management in mobile phone) because of the increasing popularity of digital images being stored and managed. With low maintenance loads, this paper integrates the data hiding technique to propose an access control mechanism for privacy preservation. The proposed scheme changes the partial regions of a given image as random pads (called selective image encryption) and only allows the authorized people to remedy the random pads back to meaningful ones which are with similar visual qualities of original ones.

Mobile Semantic-Aware Trajectory for Personalized Location Privacy Preservation

Synthesizing a fake trajectory with consistent lifestyle and meaningful mobility as the actual one is the most popular way to protect the location privacy in trajectory sharing. Recent location privacy preservation shows a strong personalized requirement from the mobile semantics between users and locations. However, the existing techniques cannot fully satisfy such personalized requirements, resulting in either overprotection or underprotection. It remains open to characterize and quantify the personalized requirement for location privacy preservation. In this article, we propose a mobile semantic-aware privacy model, named MSP. Specifically, we first characterize a new kind of user-related mobile semantic on-location set by constructing a hierarchical semantic tree, according to the user’s roles at locations. Then, a dedicated approach is proposed to evaluate the location’s privacy sensitivity and integrate it into the user-related mobile semantic. Finally, an adaptive privacy-preserving mechanism, MSP, is developed, fully considering the personalized requirement from both the user and the location. With this model in place, mobile semantic-aware synthetic trajectories are constructed adaptively. Extensive experiments with a real-world data set demonstrate that our MSP model can achieve an effective and flexible balance between the personalized privacy preservation and the data availability of synthetic trajectories.

Green Personalized Privacy Preservation of E-Health Data through Multi-Objective Weighted Clustering and Optimal Item Set Mining

Green Personalized Privacy Preservation of E-Health Data through Multi-Objective Weighted Clustering and Optimal Item Set Mining

Motion Detection to Preserve Personal Privacy from Surveillance Data using Contrary Motion

Internet of Things network today naturally is one of the huge quantities of devices from sensors linked through the communication framework to give value added service to the society and mankind. That allows equipment to be connected at anytime with anything rather using network and service. By 2020 there will be 50 to 100 billion devices connected to Internet and will generate heavy data that is to be analyzed for knowledge mining is a forecast. The data collected from individual devices of IoT is not going to give sufficient information to perform any type of analysis like disaster management, sentiment analysis, and smart cities and on surveillance. Privacy and Security related research increasing from last few years. IoT generated data is very huge, and the existing mechanisms like k- anonymity, l-diversity and differential privacy were not able to address these personal privacy issues because the Internet of Things Era is more vulnerable than the Internet Era [10][20]. To solve the personal privacy related problems researchers and IT professionals have to pay more attention to derive policies and to address the key issues of personal privacy preservation, so the utility and trade off will be increased to the Internet of Things applications. Personal Privacy Preserving Data Publication (PPPDP) is the area where the problems are identified and fixed in this IoT Era to ensure better personal privacy.

Enhanced anonymous models for microdata release based on sensitive levels partition

Depending on the inherent characteristic of sensitive attributes, even those existing enhanced anonymous models still permit the private information to be disclosed or have other limitations so far, such as skewness attacks or sensitive attacks. Based on this, three novel enhanced anonymous models, i.e., (p,αisg)-sensitive k-anonymity model, (p+,αisg)-sensitive k-anonymity model and (pi+,αisg)-sensitive k-anonymity model, are proposed to improve the privacy preservation by fully considering the sensitivity of different sensitive values on the sensitive attribute so as to realize better personalized privacy preservation. Different from the traditional methods, which basically quantify the sensitive level of the specific sensitive value focusing on user-defined classification approaches, the sensitivity of different sensitive values based on self-information is fully considered to obtain sensitive levels partition (SLP) so as to achieve better privacy by designing SLP from qualitative status towards quantitative status in our models. The conception of identical sensitive group (ISG), which is generated from the idea of hierarchical clustering method by using SLP algorithm, is introduced to design the anonymous models for better defending against sensitive attacks. In this case, the sensitive values with the most similar sensitivity are most likely clustered in the same ISG. Moreover, the frequency of each ISG is confined to no more than the specific personalized threshold αisg in any equivalence class without ending up with “one size for all” restrictions. Here, higher sensitive of ISG should be assigned a lower frequency constraint for resisting sensitive attacks so as to achieve better privacy. Then, two clustering algorithms are devised by using the idea of bottom-up greedy methods. Experiment results based on two real-world datasets show that our three anonymous models can effectively protect data privacy and enhance data security and practicality with certain information loss.

Multiple Sensitive Values-Oriented Personalized Privacy Preservation Based on Randomized Response

In the case where the private data is not equally important, personalized local privacy preservation based on randomized response (RR) is studied in the collection of sensitive data. So far, the existing RR mechanisms for multiple discrete private sources, which are termed as conventional randomized response (CRR) mechanisms, focus on a universal approach that exerts the same amount of privacy preservation for all sensitive values, without catering for their concrete privacy requirements. An immediate consequence is that they may be offering insufficient protection to a subset of data contributors with relatively higher privacy requirements, while applying excessive privacy control to another subset with relatively lower privacy requirements. Motivated by this, a novel perturbation framework, which is termed as personalized randomized response (PRR) mechanism, is proposed to achieve personalized privacy preservation (Personalized-PP) by designing the statistical privatization mechanism for multiple sensitive values. The proposed PRR technique introduces the weights for different sensitive values according to their sensitivity, and then introduces the weights into the decision of PRR by considering the concrete requirements for privacy, and thus, attains a higher data utility with respect to the quality of statistics while guaranteeing Personalized-PP. The estimate error of the private distribution is used to measure the quality of statistics for the two RR mechanisms. Theoretical study shows that the estimate error of PRR mechanism is smaller than that of the CRR mechanism for a certain same subjective privacy leakage degree. In particular, simulation results reveal the circumstances where CRR mechanism fails to provide Personalized-PP, and then establish the superiority of PRR mechanism.

A generalization model for multi-record privacy preservation

Privacy preservation becomes a more and more serious problem in data publication, which has drawn dramatic attention in research and development. Recently, several privacy preservation models and algorithms have been proposed for publishing data. However, most of the previous methods suffer from more than one drawback as follows: (i) Could not be used on multi-record datasets. (ii) Only guarantee one-way generalization. (iii) User privacy preferences are ignored. In order to satisfy higher privacy requirements and make it suitable for multi-record publishing datasets, a bidirectional personalized generalization (BP-generalization) model is proposed as a new solution in this paper. The rational is to focus anonymous objects on both relational and set-valued information. First, we merge tuples with the same attribute values in multi-record datasets to ensure the validity of quasi-identifier anonymity. Second, by enforcing l-diversity on equivalence groups and k-anonymity on fingerprint buckets respectively, privacy preservation model may resist bi-directional chain attack. Finally, a new hierarchical generalization strategy is also proposed for personal privacy preservation of sensitive attributes, then different generalization rules can be adopted for different levels of sensitive values. Extensive experimental results on two datasets show that the performance of our method is better than state-of-art techniques in terms of efficiency and information loss.

Fine-grained Image Authorization Mechanism for Image Management Systems

To protect personal privacy and confidential preservation, access control is used to authorize legal users for safe browsing the authorized contents on photos. The access control generates an authorization rule according to each permission assignment. With low maintenance loads, this paper integrates the PM-tree compression and access control technique to propose a fine-grained access control model for digital image systems. The proposed scheme enables users to have different views of an image after they login to the system. The authorization unit for the image can be parts of the image, such as a pixel, a block, several blocks or the whole image. The experiments implement this model on the Blueprint Collaboration System (BCS) provided the positive data to confirm its feasibility.

A Novel Approach for Personalized Privacy Preserving Data Publishing with Multiple Sensitive Attributes

The Personalized Privacy has drawn a lot of attention from diverse magnitudes of the public and various functional units like bureau of statistics, and hospitals. A large number of data publishing models and methods have been proposed and most of them focused on single sensitive attribute. A few research papers marked the need for preserving privacy of data consisting of multiple sensitive attributes. Applying the existing methods such as k-anonymity, l-diversity directly for publishing multiple sensitive attributes would minimize the utility of the data. Moreover, personalization has not been studied in this dimension. In this paper, we present a publishing model that manages personalization for publishing data with multiple sensitive attributes. The model uses slicing technique supported by deterministic anonymization for quasi identifiers; generalization for categorical sensitive attributes; and fuzzy approach for numerical sensitive attributes based on diversity. We cap the belief of an adversary inferring a sensitive value in a published data set to as high as that of an inference based on public knowledge. The experiments were carried out on census dataset and synthetic datasets. The results ensure that the privacy is being safeguarded without any compromise on the utility of the data.