Privacy Preserving OLAP Rakesh Agrawal, IBM Almaden Ramakrishnan
Privacy Preserving OLAP Rakesh Agrawal, IBM Almaden Ramakrishnan Srikant, IBM Almaden Dilys Thomas, Stanford University Horizontally Partitioned Personal Information Client C2 Original Row r2 Perturbed p2 Table T for analysis
Client C1 at server Original Row r1 Perturbed p1 p1 p2 EXAMPLE: What number of children in this Client Cn county go to college? pn
Original Row r n Perturbed p Vertically Partitioned Enterprise Information ID C1 ID C1
John 1 5 18 John 1 7 18 Alice
Bob Alice Bob Original Relation D1 ID C2 C3 ID
C1 C2 C3 John 1 7 35 53
9 7 Alice Perturbed Relation D1 ID C2 Perturbed Joined Relation D C3
John 35 27 9 9 Alice 53 Alice 53 6 7 EXAMPLE: What fraction of United customers to Original Relation D2 Perturbed Relation D2 New York fly Virgin Atlantic to travel to London? John
Compute select count(*) from T where P1 and P2 and P3 and . Pk i.e. COUNTT( P1 and P2 and P3 and . Pk ) We need to provide error bounds to analyst. provide privacy guarantees to data sources. scale to larger # of attributes.
BIAS=0.2 3 1 3 HEADS: RETAIN TAILS: REPLACE U.A.R FROM [1-5] Retention Replacement Perturbation Done for each column The replacing pdf need not be uniform Different columns can have different biases
for retention Talk Outline Motivation Problem Definition Query Reconstruction Inversion method Single attribute Multiple attributes Iterative method Privacy Guarantees Experiments
Single Attribute Example What is the fraction of people in this building with age 30-50? Assume age between 0-100 Whenever a person enters the building flips a coin of bias p=0.2 for heads say. Heads -- report true age Tails -- random number uniform in 0-100 reported Totally 100 randomized numbers collected. Of these 22 are 30-50. How many among the original are 30-50?
64 Perturbed , NOT Age[30-50] 20% of the 80 randomized rows, i.e. 16 of them satisfy Age[30-50]. The remaining 64 dont. 6 Analysis Contd. 16 Retained, Age[30-50] Perturbed, Age[30-50]
14 Retained , NOT Age[30-50] 64 Perturbed, NOT Age[30-50] Since there were 22 randomized rows in [30-50]. 22-16=6 of them come from the 20 retained rows. Scaling up Total Rows 20
Age[30-50] 6 30 ? 100 Thus 30 people had age 30-50 in expectation. Multiple Attributes (k=2) Query Estimated on T
Evaluated on T` count(P 1P2) x0 y0 count(P 1P2) x1
y1 count(P 1P2) x2 y2 count(P 1P2) x3 y3
Architecture Formally : Select count(*) from R where P p = retention probability (0.2 in example) 1-p = probability that an element is replaced by replacing p.d.f. b = probability that an element from the replacing p.d.f. satisfies predicate P a ( = 1-b
in example) Transition matrix CountT(: P) CountT( P) (1-p)a + p (1-p)b (1-p)a
(1-p)b+p = CountT(: P) CountT(P) i.e. Solve xA=y A00 = probability that original element satisfies : P and after perturbation satisfies : P
p = probability it was retained (1-p)a = probability it was perturbed and satisfies : P A00 = (1-p)a+p Multiple Attributes For k attributes, x, y are vectors of size 2k x=y A-1 Where A=A1 A2 .. Ak [Tensor Product]
Error Bounds In our example, we want to say when estimated answer is 30, the actual answer lies in [28-32] with probability greater than 0.9 Given T ! T , with n rows f(T) is (n,,) reconstructible by g(T) if f(T) g(T)| < max (, f(T)) with probability greater than (1- ). f(T) =2, =0.1 in above example | Results
Fraction, f, of rows in [low,high] in the original table estimated by matrix inversion on the table obtained after uniform perturbation is a (n, , ) estimator for f if n > 4 log(2/)(p )-2 , by Chernoff bounds Vector, x, obtained by matrix inversion is the MLE (maximum likelihood estimator), by using Lagrangian Multiplier method and showing that the Hessian is negative Talk Outline Motivation Problem Definition Query Reconstruction
Inversion method Iterative method Privacy Guarantees Experiments Iterative Algorithm [AS00] Initialize: x0=y Iterate: xpT+1 = q=0t yq (apqxpT / (r=0t arq xrT)) [ By Application of Bayes Rule] Stop Condition: Two consecutive x iterates do not differ
much Iterative Algorithm RESULT [AA01]: The Iterative Algorithm gives the MLE with the additional constraint that 0 < xi , 8 0 < i < 2k-1 Talk Outline
Motivation Problem Definition Query Reconstruction Privacy Guarantees Experiments Privacy Guarantees Say initially know with probability < 0.3 that Alices age > 25 After seeing perturbed value can say that with probability > 0.95 Then we say there is a (0.3,0.95) privacy breach
Privacy Guarantees (1, (s, Privacybreach breach 2)2)Privacy 1, Let X, Y be random variables where X = original value, Y= perturbed value. Let Q, S be subsets of their domains Apriori Probability P[ X 2 Q] = Pq 1 Posteriori Probability P[X 2 Q | Y 2Q
S ] 2 where 0 < 1 < 2 < 1 and P[Y 2 Q S] > 0 Where pq/mq < s, i.e. Q is a rare set (m = probability of Q under replacing pdf) (s, 1, 2) vs (1,2) metric Provides more privacy to rare sets e.g. : in market basket data, medicines are rarer than bread, so we provide more privacy for medicines than for bread For multiple columns, s expresses correlations Works for retention replacement perturbation on numeric attributes
(s,1,2) Guarantees The median value of s is 1 There is no (s,1,2) privacy breach for s < f(1,2,p) for retention replacement perturbation on single as well as multiple columns Application to Classification[AS00] For the first split to compute split criterion/gini index Count(age[0-30] and class-var=-)
Count(age[0-30] and class-var=+) Count(: age[0-30] and class-var=-) Count(: age[0-30] and class-var=+) Talk Outline Motivation Problem Definition Query Reconstruction
Privacy Guarantees Experiments Experiments Real data: Census data from the UCI Machine Learning Repository having 32000 rows Synthetic data: Generated multiple columns of Zipfian data, number of rows varied between 1000 and 1000000 Error metric: l1 norm of difference between x and y. Eg for 1-dim queries |x1 y1| + | x0 y0|
Inversion vs Iterative Reconstruction 2 attributes: Census Data 3 attributes: Census Data Iterative algorithm (MLE on constrained space) outperforms Inversion (global MLE) Privacy Obtained Privacy as a function of retention probability on
3 attributes of census data Error vs Number of Columns: Census Data Inversion Algorithm Iterative Algorithm Error increases exponentially with increase in number of columns Error as a function of number of Rows
Error has square root n dependence on number of rows Conclusion Possible to run OLAP on data across multiple servers so that probabilistically approximate answers are obtained and data privacy is maintained The techniques have been tested experimentally on real and synthetic data. More experiments in the paper. PRIVACY PRESERVING OLAP is PRACTICAL
References [AS00] Agrawal, Srikant: Privacy Preserving Data Mining [AA01] Agarwal, Aggarwal: On the Quantification of [W65] Randomized Response.. [EGS] Evfimievski, Gehrke, Srikant: Limiting Privacy Breaches.. Others in the paper.. Error vs Number of Columns: Iterative Algorithm: Zipf Data The error in the iterative algorithm flattens
out as its maximum value is bounded by 2 Supported by Privacy Group at Stanford: Rajeev and Hector
Introduced to Crete during the early Minoan period (3000-2100 BCE) Tin was rare and more expensive, probably coming fro Turkey. Bronze was a tough, but malleable metal with a reasonably low melting point, ideal for producing sharp knives and spear...
Purdue . Computer Center in April, 1970. Rita Luptowski signed me up for 3 courses - I was hooked - all on a Saturday in mid April, 1970. THE BOOK was a major influence in my decision to attend Purdue....
Arial Times New Roman Default Design Statistics (AKA: Sadistics) Made Easy Show of Hands Types of data What type of statistical test do I want to do? Continuous Data Ordinal Data Categorical Data Words we use to describe statistics Mean...
Our definition of how many members in a small, medium, large branch - arbitrary and each branch decides what programs they can do as branch size is just a guideline, most programs any size branch can implement if they have...
Stramenopila Other Characteristics Motile spores formed in a sporangium Sexual reproduction by gametangial contact Diploid through most of the life cycle Somatic structures are unicellular and holocarpic, or rhizoidal, or coenocytic.
ASPIRE was an International multicenter, randomized, double-blind, placebo-controlled trial. 23 countries participated in the study. The Primary Endpoint was Change in LVESV (baseline to week 36). For this endpoint we had 80% power to detect a 3.1ml difference in reduction...
Ready to download the document? Go ahead and hit continue!