Privacy Trade-off Research Articles

Joint Optimization of Offloading Utility and Privacy for Edge Computing Enabled IoT

Currently, edge computing (EC), emerging as a burgeoning paradigm, is powerful in handling real-time resource provision for Internet of Things (IoT) applications. However, due to the spatial distribution of geographically sparse IoT devices and the resource limitations of EC units (ECUs), the resource utilization of corresponding edge servers is relatively insufficient and the execution performance is ineffective to some extent. A privacy leakage, including personal information, location, media data, etc., during the transmission process from IoT devices to edge servers severely restricts the application of ECUs in IoT. To address these challenges, a two-phase offloading optimization strategy is put forward for joint optimization of offloading utility and privacy in EC enabled IoT. Technically, a utility-aware task offloading method, named UTO, is devised first to obtain the goal of maximizing the resource utilization of ECUs and minimizing the implementation time cost. Then a joint optimization method, named JOM, for utility and privacy tradeoffs is designed to balance the privacy preservation and execution performance. Eventually, the experimental evaluations are designed to illustrate the efficiency and reliability of UTO and JOM.

An investigation of a dynamic model of privacy trade-off in use of mobile social network applications: A longitudinal perspective

This study examines the dynamic relationship between perceived privacy concerns and use behaviors of a new social networking application (SNA) over time. By integrating the theory of belief updating and an extended privacy trade-off model from a longitudinal perspective as the basis for theoretical underpinning, this study proposes a privacy trade-off model showing the role of initial use and initial self-disclosure on updating users' pre-perceptions of using a new SNA to initial perceptions of using it. The trade-off between pre-privacy concern and pre-perceived benefit determines the initial SNA usage and self-disclosure behaviors. Then, initial privacy trade-off determines the continued use behavior and continued self-disclosure. Using an empirical data collected three phases from actual mobile app users, this study validates the proposed model and hypotheses. Including the proposed dynamic model of privacy trade-off, this study provides important contributions to theory and practice in the privacy literature.

A Survey on Facebook Users and Information Privacy

This paper investigates how Facebook users perceive information privacy against the benefits of being a member. Inspired by the privacy calculus model, we created a Norwegian online survey (n=188) in spring 2018 and offer the following insights: The largest benefit of being on Facebook is maintaining contact with friends, and the largest concern is the misuse of identity, not necessarily by Facebook but by third parties. The self-disclosure involved is a privacy trade-off based on awareness, and we argue that our respondents are making an informed decision. The scenario of paying a monthly monetary sum for using Facebook if it means securing their personal data seemed to puzzle our respondents. This study should be interesting for social media users and researchers studying information privacy. While our research mainly confirms existing research, we suggest that this subject could be repeated continuously due to the rapid development and change in both technology and its users.

Privacy-Preserving Monotonicity of Differential Privacy Mechanisms

Differential privacy mechanisms can offer a trade-off between privacy and utility by using privacy metrics and utility metrics. The trade-off of differential privacy shows that one thing increases and another decreases in terms of privacy metrics and utility metrics. However, there is no unified trade-off measurement of differential privacy mechanisms. To this end, we proposed the definition of privacy-preserving monotonicity of differential privacy, which measured the trade-off between privacy and utility. First, to formulate the trade-off, we presented the definition of privacy-preserving monotonicity based on computational indistinguishability. Second, building on privacy metrics of the expected estimation error and entropy, we theoretically and numerically showed privacy-preserving monotonicity of Laplace mechanism, Gaussian mechanism, exponential mechanism, and randomized response mechanism. In addition, we also theoretically and numerically analyzed the utility monotonicity of these several differential privacy mechanisms based on utility metrics of modulus of characteristic function and variant of normalized entropy. Third, according to the privacy-preserving monotonicity of differential privacy, we presented a method to seek trade-off under a semi-honest model and analyzed a unilateral trade-off under a rational model. Therefore, privacy-preserving monotonicity can be used as a criterion to evaluate the trade-off between privacy and utility in differential privacy mechanisms under the semi-honest model. However, privacy-preserving monotonicity results in a unilateral trade-off of the rational model, which can lead to severe consequences.

Quantifying the Utility--Privacy Tradeoff in the Internet of Things

The Internet of Things (IoT) promises many advantages in the control and monitoring of physical systems from both efficacy and efficiency perspectives. However, in the wrong hands, the data might pose a privacy threat. In this article, we consider the tradeoff between the operational value of data collected in the IoT and the privacy of consumers. We present a general framework for quantifying this tradeoff in the IoT, and focus on a smart grid application for a proof of concept. In particular, we analyze the tradeoff between smart grid operations and how often data are collected by considering a realistic direct-load control example using thermostatically controlled loads, and we give simulation results to show how its performance degrades as the sampling frequency decreases. Additionally, we introduce a new privacy metric, which we call inferential privacy. This privacy metric assumes a strong adversary model and provides an upper bound on the adversary’s ability to infer a private parameter, independent of the algorithm he uses. Combining these two results allows us to directly consider the tradeoff between better operational performance and consumer privacy.

Concerns and tradeoffs in privacy and safety of sensor-based monitoring of older people living at home

Concerns and tradeoffs in privacy and safety of sensor-based monitoring of older people living at home

The users’ perspective on the privacy-utility trade-offs in health recommender systems

Privacy is a major good for users of personalized services such as recommender systems. When applied to the field of health informatics, privacy concerns of users may be amplified, but the possible utility of such services is also high. Despite availability of technologies such as k-anonymity, differential privacy, privacy-aware recommendation, and personalized privacy trade-offs, little research has been conducted on the users' willingness to share health data for usage in such systems. In two conjoint-decision studies (sample size n=521), we investigate importance and utility of privacy-preserving techniques related to sharing of personal health data for k-anonymity and differential privacy. Users were asked to pick a preferred sharing scenario depending on the recipient of the data, the benefit of sharing data, the type of data, and the parameterized privacy. Users disagreed with sharing data for commercial purposes regarding mental illnesses and with high de-anonymization risks but showed little concern when data is used for scientific purposes and is related to physical illnesses. Suggestions for health recommender system development are derived from the findings.

The privacy trade-off for mobile app downloads: The roles of app value, intrusiveness, and privacy concerns

Today, mobile app users regularly “pay” for various mobile services, such as social networking or entertainment apps, by accepting app permission requests, thereby sharing personal data with apps. Privacy calculus theory has established that individuals disclose personal information based on a cost-benefit trade-off. In the mobile app context, however, this notion needs more support, because existing studies have only measured costs and benefits or forced a trade-off. Conducting two online experiments among Western European app users (N1=183; N2=687), this study replicates earlier findings and provides more-profound insights into the boundary conditions of the privacy calculus by showing that app value (i.e., benefits) trumps the costs (i.e., intrusiveness, privacy concerns) in the privacy trade-off.

Two Is Not Enough: Privacy Assessment of Aggregation Schemes in Smart Metering

Abstract The widespread deployment of smart meters that frequently report energy consumption information, is a known threat to consumers’ privacy. Many promising privacy protection mechanisms based on secure aggregation schemes have been proposed. Even though these schemes are cryptographically secure, the energy provider has access to the plaintext aggregated power consumption. A privacy trade-off exists between the size of the aggregation scheme and the personal data that might be leaked, where smaller aggregation sizes leak more personal data. Recently, a UK industrial body has studied this privacy trade-off and identified that two smart meters forming an aggregate, are sufficient to achieve privacy. In this work, we challenge this study and investigate which aggregation sizes are sufficient to achieve privacy in the smart grid. Therefore, we propose a flexible, yet formal privacy metric using a cryptographic game based definition. Studying publicly-available, real world energy consumption datasets with various temporal resolutions, ranging from minutes to hourly intervals, we show that a typical household can be identified with very high probability. For example, we observe a 50% advantage over random guessing in identifying households for an aggregation size of 20 households with a 15-minutes reporting interval. Furthermore, our results indicate that single appliances can be identified with significant probability in aggregation sizes up to 10 households.

Aftermath of bustamante attack on genomic beacon service

BackgroundWith the enormous need for federated eco-system for holding global genomic and clinical data, Global Alliance for Genomic and Health (GA4GH) has created an international website called beacon service which allows a researcher to find out whether a specific dataset can be utilized to his or her research beforehand. This simple webservice is quite useful as it allows queries like whether a certain position of a target chromosome has a specific nucleotide. However, the increased integration of individuals genomic data into clinical practice and research raised serious privacy concern. Though the answer of such queries are yes or no in Bacon network, it results in serious privacy implication as demonstrated in a recent work from Shringarpure and Bustamante. In their attack model, the authors demonstrated that with a limited number of queries, presence of an individual in any dataset can be determined.MethodsWe propose two lightweight algorithms (based on randomized response) which captures the efficacy while preserving the privacy of the participants in a genomic beacon service. We also elaborate the strength and weakness of the attack by explaining some of their statistical and mathematical models using real world genomic database. We extend their experimental simulations for different adversarial assumptions and parameters.ResultsWe experimentally evaluated the solutions on the original attack model with different parameters for better understanding of the privacy and utility tradeoffs provided by these two methods. Also, the statistical analysis further elaborates the different aspects of the prior attack which leads to a better risk management for the participants in a beacon service.ConclusionsThe differentially private and lightweight solutions discussed here will make the attack much difficult to succeed while maintaining the fundamental motivation of beacon database network.

Differentially Private Frequent Sequence Mining.

In this paper, we study the problem of mining frequent sequences under the rigorous differential privacy model. We explore the possibility of designing a differentially private frequent sequence mining (FSM) algorithm which can achieve both high data utility and a high degree of privacy. We found, in differentially private FSM, the amount of required noise is proportionate to the number of candidate sequences. If we could effectively prune those unpromising candidate sequences, the utility and privacy tradeoff can be significantly improved. To this end, by leveraging a sampling-based candidate pruning technique, we propose PFS2, a novel differentially private FSM algorithm. It is the first algorithm that supports the general gap-constrained FSM in the context of differential privacy. The gap constraints in FSM can be used to limit the mining results to a controlled set of frequent sequences. In our PFS2 algorithm, the core is to utilize sample databases to prune the candidate sequences generated based on the downward closure property. In particular, we use the noisy local support of candidate sequences in the sample databases to estimate which candidate sequences are potentially frequent. To improve the accuracy of such private estimations, a gap-aware sequence shrinking method is proposed to enforce the length constraint on the sample databases. Moreover, to calibrate the amount of noise required by differential privacy, a gap-aware sensitivity computation method is proposed to obtain the sensitivity of the local support computations with different gap constraints. Furthermore, to decrease the probability of misestimating frequent sequences as infrequent, a threshold relaxation method is proposed to relax the user-specified threshold for the sample databases. Through formal privacy analysis, we show that our PFS2 algorithm is ϵ-differentially private. Extensive experiments on real datasets illustrate that our PFS2 algorithm can privately find frequent sequences with high accuracy.

Let the users tell the truth: Self-disclosure intention and self-disclosure honesty in mobile social networking

Large amounts of customer data present rich business opportunities. Drawing on the privacy calculus model, this study investigates the antecedents of self-disclosure intention and self-disclosure honesty. We extend the privacy calculus model by exploring how the characteristics of service providers and the interpersonal difference of users influence privacy trade-off. An online empirical survey that involves 913 respondents was conducted. We find that both monetary rewards and social rewards positively predict self-disclosure intention, whereas only social rewards positively predict self-disclosure honesty. Moreover, application reputation and flow experience of users weaken the perceptions of privacy concern, and application compatibility and flow experience strengthen the perceptions of social rewards. Our results suggest that users place more weight on social rewards than on monetary rewards. Therefore, service providers are advised to create salient and distinct social rewards. They can also adopt distinct marketing strategies based on their profiles and the interpersonal difference of their users.

Privacy tradeoffs in smartphone applications

We use choice experiments to examine privacy tradeoffs in smartphone applications (“apps”). Results show that the representative consumer is willing to make a one-time payment for each app of about $2.28 to conceal their browser history, $4.05 to conceal their contacts, $1.19 to conceal their location, $1.75 to conceal their phone’s identification number, and $3.58 to conceal their texts. These valuations vary for different segments of society.

Differentially Private Frequent Itemset Mining via Transaction Splitting

Recently, there has been a growing interest in designing differentially private data mining algorithms. Frequent itemset mining (FIM) is one of the most fundamental problems in data mining. In this paper, we explore the possibility of designing a differentially private FIM algorithm which can not only achieve high data utility and a high degree of privacy, but also offer high time efficiency. To this end, we propose a differentially private FIM algorithm based on the FP-growth algorithm, which is referred to as PFP-growth. The PFP-growth algorithm consists of a preprocessing phase and a mining phase. In the preprocessing phase, to improve the utility and privacy tradeoff, a novel smart splitting method is proposed to transform the database. For a given database, the preprocessing phase needs to be performed only once. In the mining phase, to offset the information loss caused by transaction splitting, we devise a run-time estimation method to estimate the actual support of itemsets in the original database. In addition, by leveraging the downward closure property, we put forward a dynamic reduction method to dynamically reduce the amount of noise added to guarantee privacy during the mining process. Through formal privacy analysis, we show that our PFP-growth algorithm is ε-differentially private. Extensive experiments on real datasets illustrate that our PFP-growth algorithm substantially outperforms the state-of-the-art techniques.

Differentially Private Frequent Sequence Mining via Sampling-based Candidate Pruning.

In this paper, we study the problem of mining frequent sequences under the rigorous differential privacy model. We explore the possibility of designing a differentially private frequent sequence mining (FSM) algorithm which can achieve both high data utility and a high degree of privacy. We found, in differentially private FSM, the amount of required noise is proportionate to the number of candidate sequences. If we could effectively reduce the number of unpromising candidate sequences, the utility and privacy tradeoff can be significantly improved. To this end, by leveraging a sampling-based candidate pruning technique, we propose a novel differentially private FSM algorithm, which is referred to as PFS2. The core of our algorithm is to utilize sample databases to further prune the candidate sequences generated based on the downward closure property. In particular, we use the noisy local support of candidate sequences in the sample databases to estimate which sequences are potentially frequent. To improve the accuracy of such private estimations, a sequence shrinking method is proposed to enforce the length constraint on the sample databases. Moreover, to decrease the probability of misestimating frequent sequences as infrequent, a threshold relaxation method is proposed to relax the user-specified threshold for the sample databases. Through formal privacy analysis, we show that our PFS2 algorithm is ε-differentially private. Extensive experiments on real datasets illustrate that our PFS2 algorithm can privately find frequent sequences with high accuracy.

Privacy-preserving distributed collaborative filtering

We propose a new mechanism to preserve privacy while leveraging user profiles in distributed recommender systems. Our mechanism relies on two contributions: (i) an original obfuscation scheme, and (ii) a randomized dissemination protocol. We show that our obfuscation scheme hides the exact profiles of users without significantly decreasing their utility for recommendation. In addition, we precisely characterize the conditions that make our randomized dissemination protocol differentially private. We compare our mechanism with a non-private as well as with a fully private alternative. We consider a real dataset from a user survey and report on simulations as well as planetlab experiments. We dissect our results in terms of accuracy and privacy trade-offs, bandwidth consumption, as well as resilience to a censorship attack. In short, our extensive evaluation shows that our twofold mechanism provides a good trade-off between privacy and accuracy, with little overhead and high resilience.

Privacy tradeoffs in predictive analytics

Online services routinely mine user data to predict user preferences, make recommendations, and place targeted ads. Recent research has demonstrated that several private user attributes (such as political affiliation, sexual orientation, and gender) can be inferred from such data. Can a privacy-conscious user benefit from personalization while simultaneously protecting her private attributes? We study this question in the context of a rating prediction service based on matrix factorization. We construct a protocol of interactions between the service and users that has remarkable optimality properties: it is privacy-preserving , in that no inference algorithm can succeed in inferring a user's private attribute with a probability better than random guessing; it has maximal accuracy , in that no other privacy-preserving protocol improves rating prediction; and, finally, it involves a minimal disclosure , as the prediction accuracy strictly decreases when the service reveals less information. We extensively evaluate our protocol using several rating datasets, demonstrating that it successfully blocks the inference of gender, age and political affiliation, while incurring less than 5% decrease in the accuracy of rating prediction.

Incentives for Privacy Tradeoff in Community Sensing

Community sensing, fusing information from populations of privately-held sensors, presents a great opportunity to create efficient and cost-effective sensing applications. Yet, reasonable privacy concerns often limit the access to such data streams. How should systems valuate and negotiate access to private information, for example in return for monetary incentives? How should they optimally choose the participants from a large population of strategic users with privacy concerns, and compensate them for information shared? In this paper, we address these questions and present a novel mechanism, SeqTGreedy, for budgeted recruitment of participants in community sensing. We first show that privacy tradeoffs in community sensing can be cast as an adaptive submodular optimization problem. We then design a budget feasible, incentive compatible (truthful) mechanism for adaptive submodular maximization, which achieves near-optimal utility for a large class of sensing applications. This mechanism is general, and of independent interest. We demonstrate the effectiveness of our approach in a case study of air quality monitoring, using data collected from the Mechanical Turk platform. Compared to the state of the art, our approach achieves up to 30% reduction in cost in order to achieve a desired level of utility.

Research Note—Privacy Concerns and Privacy-Protective Behavior in Synchronous Online Social Interactions

Privacy is of prime importance to many individuals when they attempt to develop online social relationships. Nonetheless, it has been observed that individuals' behavior is at times inconsistent with their privacy concerns, e.g., they disclose substantial private information in synchronous online social interactions, even though they are aware of the risks involved. Drawing on the hyperpersonal framework and the privacy calculus perspective, this paper elucidates the interesting roles of privacy concerns and social rewards in synchronous online social interactions by examining the causes and the behavioral strategies that individuals utilize to protect their privacy. An empirical study involving 251 respondents was conducted in online chat rooms. Our results indicate that individuals utilize both self-disclosure and misrepresentation to protect their privacy and that social rewards help explain why individuals may not behave in accordance with their privacy concerns. In addition, we find that perceived anonymity of others and perceived intrusiveness affect both privacy concerns and social rewards. Our findings also suggest that higher perceived anonymity of self decreases individuals' privacy concerns, and higher perceived media richness increases social rewards. Generally, this study contributes to the information systems literature by integrating the hyperpersonal framework and the privacy calculus perspective to identify antecedents of privacy trade-off and predict individuals' behavior in synchronous online social interactions.

Big Data and the 'New' Privacy Tradeoff

Predictions of transformative change surround Big Data. It is routine to read, for example, that the coming of Big Data, we are going to be operating very much out of our old, familiar ballpark. But, as both Niels Bohr and Yogi Berra are reputed to have observed, Prediction is difficult, especially about the future. And, they might have added, especially regarding the effects of major technological change. In the Railroad Mania of nineteenth century England, for example, some made the typical that a communication network meant the end of an old one: namely, that that face-to-face communication over the emerging railroad network would entail a drastic drop in postal mail. In fact, mail volume increased. Given the difficulty of forecasting transformative change, we opt for a prediction about the present: Big Data already presents a new and important privacy challenge. As the scare quotes indicate, the challenge is not truly new. What Big Data does is compel confrontation with a difficult trade-off problem that has been glossed over or even ignored up to now. It does so because both the potential benefits and risks from Big Data analysis are so much larger than anything we have seen before.We confine our inquiry to the private sector. Governmental concerns are critically important, but they require separate treatment.