Privacy Filters Research Articles

Answering Private Linear Queries Adaptively Using the Common Mechanism

When analyzing confidential data through a privacy filter, a data scientist often needs to decide which queries will best support their intended analysis. For example, an analyst may wish to study noisy two-way marginals in a dataset produced by a mechanism M 1 . But, if the data are relatively sparse, the analyst may choose to examine noisy one-way marginals, produced by a mechanism M 2 , instead. Since the choice of whether to use M 1 or M 2 is data-dependent, a typical differentially private workflow is to first split the privacy loss budget ρ into two parts: ρ 1 and ρ 2 , then use the first part ρ 1 to determine which mechanism to use, and the remainder ρ 2 to obtain noisy answers from the chosen mechanism. In a sense, the first step seems wasteful because it takes away part of the privacy loss budget that could have been used to make the query answers more accurate. In this paper, we consider the question of whether the choice between M 1 and M 2 can be performed without wasting any privacy loss budget. For linear queries, we propose a method for decomposing M 1 and M 2 into three parts: (1) a mechanism M * that captures their shared information, (2) a mechanism M′1 that captures information that is specific to M 1 , (3) a mechanism M′2 that captures information that is specific to M 2 . Running M * and M′ 1 together is completely equivalent to running M 1 (both in terms of query answer accuracy and total privacy cost ρ ). Similarly, running M * and M′ 2 together is completely equivalent to running M 2 . Since M * will be used no matter what, the analyst can use its output to decide whether to subsequently run M ′ 1 (thus recreating the analysis supported by M 1 )or M′ 2 (recreating the analysis supported by M 2 ), without wasting privacy loss budget.

A Model Randomization Approach to Statistical Parameter Privacy

In this article, we study a privacy filter design problem for a sequence of sensor measurements whose joint probability density function (p.d.f.) depends on a private parameter. To ensure parameter privacy, we propose a filter design framework which consists of two components: a randomizer and a nonlinear transformation. The randomizer takes the private parameter as input and randomly generates a pseudo parameter. The nonlinear mapping transforms the measurements such that the joint p.d.f. of the filter's output depends on the pseudo parameter rather than the private parameter. It also ensures that the joint p.d.f. of the filter's output belongs to the same family of distributions as that of the measurements. The design of the randomizer is formulated as an optimization problem subject to a privacy constraint, in terms of mutual information, and it is shown that the optimal randomizer is the solution of a convex optimization problem. Using information-theoretic inequalities, we show that the performance of any estimator of the private parameter, based on the output of the privacy filter, is limited by the privacy constraint. The structure of the nonlinear transformation is studied in the special cases of independent and identically distributed, Markovian, and Gauss-Markov measurements. Our results show that the privacy filter in the Gauss-Markov case can be implemented as two one-step ahead Kalman predictors and a set of minimum mean square error predictors. A numerical example on occupancy privacy in a building automation system illustrates the approach.

A review of the application of digital identity in the Metaverse

The development of the internet has immensely expanded people’s social scope, which has necessitated the utilization of digital identity. In regard to social networks, the utilization of anonymity or pseudonyms increases the attractiveness of the network. Nevertheless, because online payments, online transactions, and online assets are becoming prevalent features, virtualization is gradually exhibiting highly negative impacts. With respect to the Metaverse, digital identity is potentially a key factor, which can influence the balance that affects the association between anonymity and pseudonyms. To enhance the contemporary scenario and to facilitate the potential utilization of digital identity, this study considers the application of digital identity in the Metaverse, and it utilizes the “Enterprise IA” miniature model (Morey et al.). With regard to the current debate on digital identity, we analyzed the most prominent topic; thus, we explored the application rules pertaining to digital identity. We propose that the Metaverse is primarily characterized by its ability to digitalize the physical world. Furthermore, with respect to digital identity, the power of ownership still represents the fundamental issue. Using technologies such as blockchain and privacy filters, we can not only alter the governance logic and methods, but we can also balance the correlation between private rights and public interests. Thus, to solve the burgeoning identity trust crisis, individual competition for identity authorization rights, and privacy problems that characterize the Metaverse, we explore novel governance approaches.

PGAN framework for synthesizing sensor data privately

Some credible third parties collect and share mobile sensor data with users to enhance scientific innovation. However, since the sensor data contains sensitive attributes, it may lead to an unexpected privacy leak. Despite privacy filtering, differential privacy, and inferential privacy techniques that attempt to address this problem, the preservation of greater privacy results in a considerable loss of utility and vice versa. In this research, we tackle the privacy-preserving for sensor-based activity recognition data-sharing issue via balancing between (1) data quality perspective and (2) privacy-preserving perspective. Two novel private generative adversarial approaches, namely PGAN1 and PGAN2, are proposed, whereby we generate filtered data to be shared before revealing the raw data to a data analyst. PGAN1 and PGAN2 differ in the privacy mechanism of raw data filtering. Therefore, PGAN1 relies on a transformation algorithm, while PGAN2 relies on a synthesis algorithm. We theoretically characterize the problem and formulate new objective functions, each one as an analogy of minimax formulation among more than two networks. We evaluate the utility performance by different classifiers while the privacy is checked by overcoming the attacks. Experimental results show that PGAN1 and PGAN2 improve utility and effectively prevent privacy leaks better than previous works.

A Randomized Filtering Strategy Against Inference Attacks on Active Steering Control Systems

In this paper, we develop a framework against inference attacks aimed at inferring the values of the controller gains of an active steering control system (ASCS). We first show that an adversary with access to the shared information by a vehicle, via a vehicular ad hoc network (VANET), can reliably infer the values of the controller gains of an ASCS. This vulnerability may expose the driver as well as the manufacturer of the ASCS to severe financial and safety risks. To protect controller gains of an ASCS against inference attacks, we propose a randomized filtering framework wherein the lateral velocity and yaw rate states of a vehicle are processed by a filter consisting of two components: a nonlinear mapping and a randomizer. The randomizer randomly generates a pair of pseudo gains which are different from the true gains of the ASCS. The nonlinear mapping performs a nonlinear transformation on the lateral velocity and yaw rate states. The nonlinear transformation is in the form of a dynamical system with a feedforward-feedback structure which allows real-time and causal implementation of the proposed privacy filter. The output of the filter is then shared via the VANET. The optimal design of randomizer is studied under a privacy constraint that determines the protection level of controller gains against inference attacks, and is in terms of mutual information. It is shown that the optimal randomizer is the solution of a convex optimization problem. By characterizing the distribution of the output of the filter, it is shown that the statistical distribution of the filter’s output depends on the pseudo gains rather than the true gains. Using information-theoretic inequalities, we analyze the inference ability of an adversary in estimating the control gains based on the output of the filter. Our analysis shows that the performance of any estimator in recovering the controller gains of an ASCS based on the output of the filter is limited by the privacy constraint. The performance of the proposed privacy filter is compared with that of an additive noise privacy mechanism. Our numerical results show that the proposed privacy filter significantly outperforms the additive noise mechanism, especially in the low distortion regime.

A Cloud Framework Design for A Disease Symptom Self-inspection Service

The establishment of a symptom self-inspection service faces will face many challenges related to how to best acquire, store, and analyze the available data. In view of the problems, a cloud framework symptom self-inspection service model is proposed in this article. A Hadoop cluster is set up to store massive medical data and provide indexing so as to produce acceptable electronic medical record search response times. A cluster of the distributed search nodes based on Lucene can be used for real-time retrieval, data analysis, and privacy filtering from a massive collection of electronic medical records. The implementation of symptom check-up services is discussed, including the selection of search nodes, the establishment of medical records index files, the ranking and sorting of medical records similarity. Experimental results demonstrate that our proposed cloud framework model serves as a scalable and effective self-inspection health symptom service.

CAN’t track us: Adaptable privacy for ISOBUS controller area networks

Modern information technologies have revolutionized agriculture in many ways. Today, positioning systems along with Internet of Things technologies enable Smart Faming with site-specific applications and interconnected machinery. Current machines and implements are equipped with multiple sensors and actors that are embedded in the machine’s Controller Area Network (CAN) using ISOBUS. In operation, such components continuously produce and exchange internal and environmental sensor information. However, CAN communication is not secure and privacy issues arise whenever different actors are involved in collaborative tasks. In this paper, we present CAN’t, a modular privacy framework for collaborative Smart Farming. The core of the framework is a special proxy that allows to apply privacy filters to selected CAN/ISOBUS data streams. Moreover, it allows to agree on the accessible level of information content for each actor. We implemented a proof-of-concept prototype based on low-cost commercial off-the-shelf hardware. Its evaluation comprises technical and privacy aspects. By using real-world ISOBUS traces as well as a commercial CAN hardware simulator, the feasibility of our approach is shown.

A Privacy-Preserving Filter for Oblique Face Images Based on Adaptive Hopping Gaussian Mixtures

Photographs taken in public places often contain faces of bystanders thus leading to a perceived or actual violation of privacy. To address this issue, we propose to pseudo-randomly modify the appearance of face regions in the images using a privacy filter that prevents a human or a face recogniser from inferring the identity of people. The filter, which is applied only when the resolution is high enough for a face to be recognisable, adaptively distorts the face appearance as a function of its resolution. Moreover, the proposed filter locally changes the values of its parameters to counter attacks that attempt to estimate them. The filter exploits both global adaptiveness to reduce distortion and local parameter hopping to make their estimation difficult for an attacker. In order to evaluate the efficiency of the proposed approach, we consider an important scenario of oblique face images: photographs taken with low altitude Micro Aerial Vehicles (MAVs). We use a state-of-the-art face recognition algorithm and synthetically generated face data with 3D geometric image transformations that mimic faces captured from an MAV at different heights and pitch angles. Experimental results show that the proposed filter protects privacy while reducing distortion, and is also robust against attacks.

The purpose driven privacy preservation for accelerometer-based activity recognition

Accelerometer-based activity recognition (AAR) attracted a lot of attentions due to the wide spread of smartphones with energy-efficiency. However, since accelerometer data contains individual characteristics; AAR might raise privacy concerns. Although numerous privacy preservation approaches, such as ”privacy filtering, differential privacy, and inferential privacy”, have been proposed to conceal sensitive information, unfortunately they cannot address the privacy problem associated with AAR. In this paper, we report our efforts to control the use of the AAR while preserving the privacy. To achieve this task, our method leverages a connection to agglomerative information bottleneck, through which the amount of disclosed data can be compressed so that irrelevant private information can be reduced, and a connection to general privacy statistical inference framework, where both of the privacy leakage and utility accuracy are considered as mutual information. Our experimental results have shown that the proposed solution can greatly reduce privacy leakage while maintaining a relative good utility.

Private Filtering for Hidden Markov Models

Consider a hidden Markov model describing a system with two types of states: a monitored state and a private state. The two types of states are dependent and evolve jointly according to a Markov process with a stationary transition probability. It is desired to reveal the monitored states to a receiver but hide the private states. For this purpose, a privacy filter is necessary which suitably perturbs the monitored states before communication with the receiver. Our objective is to design the privacy filter to optimize the tradeoff between the monitoring accuracy and privacy, measured through a time-invariant distortion measure and Shannon's equivocation, respectively. As the optimal privacy filter is difficult to compute using the dynamic programming, we adopt a suboptimal greedy approach through which the privacy filter can be computed efficiently. Here, the greedy approach has the additional advantage of not being restricted to the finite time horizon setups. Simulations show the superiority of the approach compared to a privacy filter which only adds independent noise to the observations.

Ego-Surfing: Person Localization in First-Person Videos Using Ego-Motion Signatures.

We envision a future time when wearable cameras are worn by the masses and recording first-person point-of-view videos of everyday life. While these cameras can enable new assistive technologies and novel research challenges, they also raise serious privacy concerns. For example, first-person videos passively recorded by wearable cameras will necessarily include anyone who comes into the view of a camera-with or without consent. Motivated by these benefits and risks, we developed a self-search technique tailored to first-person videos. The key observation of our work is that the egocentric head motion of a target person (i.e., the self) is observed both in the point-of-view video of the target and observer. The motion correlation between the target person's video and the observer's video can then be used to identify instances of the self uniquely. We incorporate this feature into the proposed approach that computes the motion correlation over densely-sampled trajectories to search for a target individual in observer videos. Our approach significantly improves self-search performance over several well-known face detectors and recognizers. Furthermore, we show how our approach can enable several practical applications such as privacy filtering, target video retrieval, and social group clustering.

Highly transparent privacy filter film with image distortion.

We present a novel privacy filter film with transparent micro-cuboid arrays. The privacy filter film, which does not include any opaque materials, rarely affects the normal transparency, whereas it obscures personal information by distorting paths of oblique light rays. The effects of the cuboid size and a gap between the privacy filter and a display are analyzed using a ray-tracing program. The analysis is consistent with the experimental results carried out using the poly-dimethylsiloxane (PDMS) micro-cuboid (100 μm × 100 μm × 200 μm) arrays, which are fabricated by lithography and transfer molding.

A standardised graphic method for describing data privacy frameworks in primary care research using a flexible zone model

PurposeTo develop a model describing core concepts and principles of data flow, data privacy and confidentiality, in a simple and flexible way, using concise process descriptions and a diagrammatic notation applied to research workflow processes. The model should help to generate robust data privacy frameworks for research done with patient data. MethodsBased on an exploration of EU legal requirements for data protection and privacy, data access policies, and existing privacy frameworks of research projects, basic concepts and common processes were extracted, described and incorporated into a model with a formal graphical representation and a standardised notation. The Unified Modelling Language (UML) notation was enriched by workflow and own symbols to enable the representation of extended data flow requirements, data privacy and data security requirements, privacy enhancing techniques (PET) and to allow privacy threat analysis for research scenarios. ResultsOur model is built upon the concept of three privacy zones (Care Zone, Non-care Zone and Research Zone) containing databases, data transformation operators, such as data linkers and privacy filters. Using these model components, a risk gradient for moving data from a zone of high risk for patient identification to a zone of low risk can be described. The model was applied to the analysis of data flows in several general clinical research use cases and two research scenarios from the TRANSFoRm project (e.g., finding patients for clinical research and linkage of databases). The model was validated by representing research done with the NIVEL Primary Care Database in the Netherlands. ConclusionsThe model allows analysis of data privacy and confidentiality issues for research with patient data in a structured way and provides a framework to specify a privacy compliant data flow, to communicate privacy requirements and to identify weak points for an adequate implementation of data privacy.

Student Acceptability of High‐Stakes e‐Assessment in Dental Education: Using Privacy Screen Filters to Control Cheating

Acceptability is a required quality for a sound assessment. For students, acceptability of a test is strongly influenced by perception of fairness. Computer-based assessment has been reported to be preferred by students provided that strict controls to prevent cheating are in place. This may be difficult to achieve as e-assessments are often taken in learning environments where computer screens are close together. In this study, 138 Year 5 dental students completed an e-assessment followed by an onscreen post-assessment questionnaire about the acceptability, fairness, and effectiveness of using privacy screen filters installed in front of their monitors to prevent cheating. Ninety-one percent of students in this study considered that taking a summative e-assessment with privacy screen filters was acceptable, 86 percent expressed the view that filters contributed to a fairer test, and 54 percent reported the filters made it easier or did not make any difference to read the screen. In addition, 60 percent gave positive comments and feedback, mainly focused on prevention of cheating. These findings suggest that privacy filters, originally developed for data protection in banks, medicine, and business, have potential in e-assessment in higher education. They provide an effective way of hampering cheating and improve student acceptability and confidence in the fairness of computer-delivered assessments.

Privacy Harms and the Effectiveness of the Notice and Choice Framework

In the last fifteen years, the Federal Trade Commission and the White House have promoted notice and choice as the preferred mechanism for protecting consumers’ privacy online. But law and policy scholars doubt the efficacy of this mechanism. Research shows that consumers rarely read website privacy policies, that such policies are often too complex for users to understand, and that website policy statements do not match consumers’ privacy expectations. Efforts to ameliorate theses issues through technological tools, such as privacy filters and do-not-track codes, have been unsuccessful. Further, these tools do not address whether notice and choice theory aligns with the actual privacy harms that consumers experience. This alignment remains unexplored. This article, thus, proposes to examine the relationship between the notice and choice theory and users’ actual privacy concerns. The article takes a novel approach that examines privacy litigation and FTC enforcement actions. This focus on the wrongs litigated in the real world reveals the most important harms that consumers experience and provides a better understanding of the efficacy of the notice and choice framework.The data set compiled to support the research for the article consists of all federal class action complaints alleging online privacy violations filed during the last ten years and the Federal Trade Commission complaints and settlements addressing online privacy. The article next addresses the roles that jurisdiction and competence play in framing claims and identifies a typology of the wrongful acts experienced by consumers. The research shows that four types of claims appear in both private litigation and public enforcement with respect to personal information: (1) unauthorized disclosure, (2) surreptitious collection, (3) failure to secure, and (4) undue retention. The article then applies this typology to map “zones of effectiveness” for the notice and choice regime. The article identifies which wrongs a proper notice and choice regime can and cannot address. The research demonstrates that while some wrongful practices might be avoided by the inclusion of specific statements in a notice, others will be incurable through notice. The latter set of wrongs is, thus, outside the “zone of effectiveness” of a notice and choice regime. Lastly, the article concludes with a discussion of whether and how the harms that consumers experience match the outcomes of litigation and FTC settlement orders.This research is supported by the National Science Foundation grant 1330214 “TWC SBE: Option: Frontier: Collaborative: Towards Effective Web Privacy Notice and Choice: A Multi-Disciplinary Prospective.”

Holistic Privacy Impact Assessment Framework for Video Privacy Filtering Technologies

ABSTRACT In this paper, we present a novel Holistic Framework for Privacy Protection Level Performance Evaluation and Impact Assessment (H-PIA) to support the design and deployment of privacy-preserving filtering techniques as may be co-evolved for video surveillance through user-centred participative engagement and collectively negotiated solution seeking for privacy protection. The proposed framework is based on the UI-REF methodology for Privacy by Co-Design which includes subjective-interpretivist and socio-psycho-cognitively rooted human judgment and decision making analysis. This supports not only the co-design of privacy filters but also the integration of Key Holistic Performance Indicators (KPIs) comprising a number of objective and subjective sub-spaces of the relevant evaluation metrics. For the objective tests, we have proposed five crucial criteria to be evaluated to assess the optimality of the balance of privacy protection and security assurance as may be offered by a given privacy filtering solution. The evaluation is supported by a process of quantitative assessment of some of the KPIs through an automated objective measurement of the functional performance of the given filter. Additionally, a subjective user study has been conducted to correlate with, and cross-validate, the results obtained from the objective assessment of the KPIs. The simulation results have confirmed the sufficiency, necessity and efficacy of the UI-REF-based methodologically-guided framework to enable optimally balanced Privacy Filtering whilst retaining the highest possible video-data intelligence. Insights from this study will serve the process of co-design of privacy-preserving video filtering solutions and other video-analytics privacy risk mitigation technologies.

Preparation and Evaluation of the Bioinspired PS/PDMS Photochromic Films by the Self-Assembly Dip–Drawing Method

Emulsifier-free emulsion polymerization was employed to synthesize polystyrene (PS) microspheres, which were then self-assembled into an ordered periodic structure. A photochromic film was formed by adding polydimethylsiloxane (PDMS) around the self-assembly of PS microspheres on a PDMS substrate. During polymerization, the PS microspheres shrunk depending on the amount of the hydrophilic comonomer, sodium 4-styrenesulfonate (NaSS). Variation in structural color was strongly affected by the size of the PS microspheres. Scanning electron microscopy was used to observe the surface and cross sections of the self-assembled microspheres. Results showed that the order and stacking thickness of microspheres were dependent on the drawing rate of the substrate and suspension concentration. High-transmittance photochromic films could be prepared when the drawing rate was lower than 1 μm/s and the suspension concentration was 20 wt %. PDMS surrounding the vacant space between regularly arranged PS microspheres could not only protect them but also increase the degree of matching between the refractive indices of PS and PDMS. The stability of the reflected structural color increased, and the optical transmittance of the photochromic film approached 95% after PDMS was poured between the PS microspheres. A special pattern could be designed and embedded inside the photochromic film. The PS/PDMS photochromic films can also be applied in decorative painting as well as in security devices, color-changing false nails, and privacy filters.

A Privacy Agreement Negotiation Model in B2C E-Commerce Transactions

This article presents an alternate approach to effectively address the way privacy agreements are initiated through web services. In this new framework, the consumer and the service provider can mutually negotiate on the privacy terms. It contains a privacy model in which the transaction takes place after a negotiation between the service provider and the web user is completed. In addition, this framework would support various negotiation levels of the agreement lifecycle which is an important aspect of the dynamic environment of a B2C e-commerce scenario. A third party trusted agency and a privacy filter are included to handle privacy information of the web user. The author seeks to raise awareness of the issues surrounding privacy transactions and the potential ongoing impact to both service providers and clients as the use of web services accelerates.

Guest editorial: Privacy-aware multimedia surveillance systems

Due to the significant increase in various security threats, safety has become a primary concern for our society. As a result, most of the public places such as airports, train stations, banks, shopping malls, subways and streets are nowadays equipped with state-of-the-art multimedia surveillance systems. These systems are meant to process sensory data to automatically detect suspicious or unusual behavior of people and alert security personnel so that preventive actions can be taken. Although such surveillance infrastructure has proved to be very useful from a security perspective; there has been apprehension among people in regard to their privacy safeguards. Citizens have increasingly begun to object to being watched electronically. Hence, there is a need for preserving privacy of people yet providing them a sense of security through effective surveillance. It is worth mentioning that although there has been a significant progress in the field of surveillance research, the issues related to people’s privacy have often been overlooked in the past and have only begun to attract the attention of researchers very recently. The goal of this special issue is to bring forth the recent advances in the privacy research for multimedia surveillance. We received nine submissions from an open call for papers that address different aspects of privacy-aware multimedia surveillance systems. Although many submissions were of good quality, guest editorial committee recommended to accept only five top quality papers after a careful and highly competitive review process. These papers cover diverse issues, including privacy protection using Chaos-cryptography-based data scrambling and Markov chain algorithms, privacy filters in live surveillance video, preserving privacy in mobile video surveillance, and community-based user-specific and location-aware privacy awareness. The first paper of this special issue ‘‘User centric privacy protection in video surveillance’’ by Thomas Winkler and Bernhard Rinner presents a concept for user-centric privacy awareness in video surveillance. The proposed system follows a community-based approach and empowers monitored persons to actively participate in registering cameras using their conventional smart phones. The collected information is used to warn users of violations of their personal privacy policy. Moreover, the proposed system is scalable in terms of different levels of privacy. The second paper ‘‘A general framework for managing and processing live video data with privacy protection’’ by Alexander J. Aved and Kien A. Hua describes the live video database model with an intrinsic privacy model that provides a level of privacy protection not previously available for real-time streaming video data. The authors present the query language LVSQL, the system architecture, the object recognition and cross-camera tracking P. K. Atrey (&) Department of Applied Computer Science, University of Winnipeg, Winnipeg, Canada e-mail: p.atrey@uwinnipeg.ca

A general framework for managing and processing live video data with privacy protection

Though a large body of existing work on video surveillance focuses on image and video processing techniques, few address the usability of such systems, and in particular privacy issues. This study fuses concepts from stream processing and content-based image retrieval to construct a privacy-preserving framework for rapid development and deployment of video surveillance applications. Privacy policies, instantiated to as privacy filters, may be applied both granularly and hierarchically. Privacy filters are granular as they are applicable to specific objects appearing in the video streams. They are hierarchal because they can be specified at specific objects in the framework (e.g., users, cameras) and are combined such that the disseminated video stream adheres to the most stringent aspect specified in the cascade of all privacy filters relevant to a video stream or query. To support this privacy framework, we extend our Live Video Database Model with an informatics-based approach to object recognition and tracking and add an intrinsic privacy model that provides a level of privacy protection not previously available for real-time streaming video data. The proposed framework also provides a formal approach to implement and enforce privacy policies that are verifiable, an important step towards privacy certification of video surveillance systems through a standardized privacy specification language.