Differentially Private Histogram Publication

Transcription

1 Differentially Private Hitogram Publication Jia Xu, Zhenjie Zhang, Xiaokui Xiao, Yin Yang, Ge Yu College of Information Science & Engineering, Northeatern Univerity, China Advanced Digital Science Center, Illinoi at Singapore Pte., Singapore School of Computer Engineering, Nanyang Technological Univerity, Singapore Abtract Differential privacy DP i a promiing cheme for releaing the reult of tatitical querie on enitive data, with trong privacy guarantee againt adverarie with arbitrary background knowledge. Exiting tudie on DP motly focu on imple aggregation uch a count. Thi paper invetigate the publication of DP-compliant hitogram, which i an important analytical tool for howing the ditribution of a random variable, e.g., hopital bill ize for certain patient. Compared to imple aggregation whoe reult are purely numerical, a hitogram query i inherently more complex, ince it mut alo determine it tructure, i.e., the range of the bin. A we demontrate in the paper, a DP-compliant hitogram with finer bin may actually lead to ignificantly lower accuracy than a coarer one, ince the former require tronger perturbation in order to atify DP. Moreover, the hitogram tructure itelf may reveal enitive information, which further complicate the problem. Motivated by thi, we propoe two novel algorithm, namely NoieFirt and StructureFirt, for computing DP-compliant hitogram. Their main difference lie in the relative order of the noie injection and the hitogram tructure computation tep. NoieFirt ha the additional benefit that it can improve the accuracy of an already publihed DP-complaint hitogram computed uing a naïve method. Going one tep further, we extend both olution to anwer arbitrary range querie. Extenive experiment, uing everal real data et, confirm that the propoed method output highly accurate query anwer, and conitently outperform exiting competitor. I. INTRODUCTION Digital technique ha enabled variou organization to eaily gather vat amount of peronal information, uch a medical record, web earch hitory, etc. Analyi on uch data can potentially lead to valuable inight, including new undertanding of a dieae and typical conumer behavior in a community. However, currently privacy concern i a major hurdle for uch analyi, in two apect. Firt, it increae the difficulty for third-party data analyzer to acce their input data. For intance, medical reearcher are routinely required to obtain the approval of their repective intitutional review board, which i tediou and time-conuming, before they can even look at the data they need. Second, privacy concern complicate the publication of analyi reult. A notable example i the dbgap databae, which contain reult of genetic tudie. Such reult ued to be publicly available, until a recent paper [] decribe an attack that infer whether a peron ha participated in a certain tudy e.g., on patient with Name Age HIV+ Alice Ye Bob Ye Carol Ye Dave 6 No Ellen Ye Frank Ye Grace 6 Ye a Example enitive data Fig.. 5 # of HIV+ patient if we remove Alice b Unperturbed hitogram Example enitive dataet and it correponding hitogram diabete from it reult; thereafter, acce to uch reult i trictly controlled. Furthermore, a trengthened verion of thi attack [] threaten the publication of any reearch paper on genome-wide aociation tudie, which currently i an active field in biomedical reearch. The recently propoed concept of differential privacy DP [] [8] addree the above iue by injecting a mall amount of random noie into tatitical reult. DP i rapidly gaining popularity, becaue it provide rigorou privacy guarantee againt adverarie with arbitrary background information. Thi work focue on the computation of DP-compliant hitogram, which i a common tool for preenting the ditribution of a random variable. Fig. a how ample record in an imaginary enitive dataet about HIV-poitive patient, and Fig. b illutrate it hitogram howing the age ditribution of uch patient. Such hitogram are commonly found, e.g., in the publihed tatitic by Singapore Minitry of Health. The application of DP to uch hitogram guarantee that changing or removing any record from the databae ha negligible impact on the output hitogram. Thi mean that the adverary cannot infer whether a pecific patient ay, Alice i infected by HIV, even if /he know the HIV tatu of all the remaining patient in the databae. A hitogram with a given tructure reduce to a et of dijoint range-count querie, one for each bin. The tate-ofthe-art method [] called the Laplace Mechanim, or LM for perturbing the output of uch count to atify DP work a follow. Firt, LM determine the enitivity of thee count, which i the maximum poible change in the query Age

2 reult if we remove one record from or add one into the databae. In our example, we have =, ince each patient affect the value of exactly one bin in the hitogram by at mot. For intance, removing Alice decreae the number of HIV+ patient aged -5 by. Then, LM add to every bin a random value following the Laplace ditribution with mean and cale /ɛ, where ɛ i a parameter indicating the level of privacy. For intance, when ɛ =, the noie added to each bin ha a variance of [9], which intuitively cover the impact i.e., of any individual in the databae. A key obervation made in thi paper i that the accuracy of a DP-compliant hitogram depend heavily on it tructure. In particular, a coarer hitogram can ometime lead to higher accuracy than a finer one, becaue the former reduced noie cale required to atify DP. Fig. a exhibit another hitogram of the dataet in Fig. a with bin 5-, - 5 and 5-6, repectively. In the following, we ue the term unit-length range to mean the range correponding to a bin in the hitogram in Fig. b, e.g., 5-. In the hitogram in Fig. a, each bin cover multiple unit-length range, and the number on top of each bin correpond to the average count of each unit-length range, e.g.,. above range 5- i calculated by dividing the total number of patient i.e., in the bin 5- by the number of unit-length range it cover i.e.. A we prove later in the paper, uch averaging decreae the amount of noie therein. Specifically, the Laplace noie added to each unit-length range inide a bin covering b uch range ha a cale of /b ɛ, compared to the /ɛ cale in the hitogram of Fig. b. On the other hand, the ue of larger bin alo introduce information lo, a etimate e.g.,. for range 5- replace their repective exact value. Accordingly, the quality of a hitogram tructure depend on the balancing between information lo and noie cale. Fig. b, for example, how yet another hitogram for the ame dataet, which intuitively ha poor accuracy becaue i it merge unit-length range with very different value, e.g., range 5- and -5, leading to high information lo; and ii it contain a very mall bin, i.e., 55-6, that require a high noie cale /ɛ, epecially for mall value of ɛ. Thi example implie that the bet tructure depend on the data ditribution a well a ɛ. A further complication i that the optimal tructure itelf may reveal enitive information, ince removing a record from the original databae may caue the optimal tructure to change, which can be exploited by the adverary to infer enitive information. Thu, imply electing the bet tructure with an exiting hitogram contruction technique violate DP, regardle of the amount of noie injected to the count. Facing thee challenge, we propoe two effective olution for DP-compliant hitogram computation, namely NoieFirt and StructureFirt. The former determine the hitogram tructure after injecting random noie, wherea the latter revere An alternative definition of enitivity [] concern the maximum change in the query reult after modifying a record in the databae. In our example thi lead to =, ince in the wort cae, changing a peron age can affect the value in two different bin by each. 5 # of HIV+ patient Noie cale: /ε... Noie cale: /ε Age a Optimal hitogram with bin Fig.. 5 # of HIV+ patient Noie cale: /ε Noie cale: /ε b Poor hitogram tructure Impact of hitogram tructure on noie cale the order of thee tep. In particular, NoieFirt can be ued to improve the accuracy of an already publihed hitogram uing an exiting method []. Moreover, we adapt DP-hitogram to anwer arbitrary range-count querie, which ha drawn coniderable reearch attention e.g., [], [6]. For uch querie, NoieFirt achieve better accuracy for hort range, wherea StructureFirt i more uitable for longer one. Extenive experiment uing everal real data et demontrate that the propoed method output highly accurate hitogram, and ignificantly outperform exiting method for range count querie. In the remainder of the paper, Section provide neceary background on DP. Section and preent NoieFirt and StructureFirt, repectively. Section 5 dicue range-count query proceing. Section 6 contain a thorough experimental tudy. Section 7 overview exiting DP technique. Finally, Section 8 offer ome concluding remark. A. Hitogram Contruction II. PRELIMINARIES A hitogram i commonly ued in databae ytem a an effective tatitical ummarization tool on numerical domain. Given a erie of count in the databae, i.e., D = x, x,..., x n with x i R + for each i, hitogram aim to merge the neighbor count into k group and identify a repreentative count for each group. To accomplih thi, the hitogram generate k bin, i.e., H = B, B,..., B k, over the integer domain [, n]. Each bin B j = l j, r j, c j cover an interval [l j, r j ] [, n] and maintain a count c j that approximate all count in D in the interval, i.e., x i l j i r j. A hitogram H i valid, if and only if all the bin completely cover the domain [, n] without any overlap, i.e., l =, r k = n, and r j = l j+ for all j n. Given uch a count equence D, the error of the hitogram i meaured by the Sum of Squared Error SSE between the approximate count and the original count, i.e., ErrorH, D = j Age l j i r j c j x i Note that ErrorH, D can be interpreted a the um of the quared error for all range count querie. If the tructure of the hitogram i fixed, i.e., every l j and r j are known, the optimal value of c j for each B j equal the average r j j x i r j l j+ count in B j. That i, etting c j = for all j lead to a minimum ErrorH, D. Accordingly, the problem of

3 i= k= Fig.. Build of an optimal hitogram on Figure b. Each entry T i, k keep the minimal error for firt i count with exactly k bin conventional Hitogram Contruction [], [] i to identify the optimal hitogram tructure to minimize ErrorH, D, a formalized in the following. Problem. Given the count equence D and the ize contraint k, find the optimal hitogram H that minimize ErrorH, D among all hitogram with exactly k bin. In [], Jagadih et al. howed that the optimal hitogram H for Problem can be contructed uing a Dynamic Programming technique, with time complexity On k and pace complexity Onk. In Figure, we lit the table toring the intermediate reult of dynamic programming, baed on the data equence in Figure b and k =. In the table, each entry T i, k i the minimal error of any hitogram with exactly k bin covering the partial data et D i = x,..., x i. In the following, we ue SSED, l, r to denote the um of quare error if we merge a partial equence x l,..., x r into a ingle bin. Specifically, ince the average count on the interval i xl, r = r x i/r l +, we have SSED, l, r = r x i xl, r Therefore, the contruction of the table utilize the following recurive rule in dynamic programming: T i, k =.67 min T j, k + SSED, j +, i k j i Baed on the intermediate reult in the table, we build the optimal hitogram by tracing back the optimal election of the bin boundarie. By identifying the grey cell in the table, we are able to contruct the optimal reult hitogram in Figure a, i.e., H =,,.,, 5,.5, 6, 7, B. Differential Privacy Given a count equence D = x, x,..., x n, we ay that a equence D i a neighbor equence to D if and only if D differ from D in only one count, with difference on the count at exactly. That i, for ome integer m n, we have D = x, x,..., x m, x m ±, x m+,..., x n. A databae query proceing mechanim enure ɛ- differential privacy, if it provide randomized anwer H for any query Q, uch that D, D, Q, H : PrQD = H expɛ PrQD = H, where D and D denote two neighbor equence, and QD = H denote the randomized anwer H with repect to query Q when the input data et i D. In our problem etting, the randomized anwer for Q i the output of the randomized tatitical report with noie on all the count, e.g. the age tatitic of AIDS patient. The tandard olution mechanim to fulfill differential privacy [] utilize the concept of query Fig.. 5 # of HIV+ patient Age Optimal hitogram when Alice i excluded enitivity. In particular, the enitivity of the query i defined a the maximal L -norm ditance between the exact anwer of the query et Q on any neighbor databae D and D, i.e., = max D,D QD QD Dwork et al. [] prove that differential privacy can be achieved by adding random noie to the anwer of Q, uch that the noie follow a zero-mean Laplace ditribution with noie cale b = ɛ. The Laplace ditribution with magnitude b, i.e., Lapb, follow the probability denity function a Prx = y = b exp y b. For example, if the original tatitical report i randomized with Lapb, the output report follow the ditribution below: PrQD = x, x,..., x n = n i= b exp x i x i b It i tempting to apply the following imple trategy to implement the differential privacy protection on hitogram. Given the count equence D, for example, the ytem contruct the optimal hitogram H = B,..., B k uing the olution in []. Random noie i then added on every repreentative count c i under ditribution Lapb with b = ɛ min. jr j l j+ Thi olution fail to atify the requirement of ɛ-differential privacy, ince the tructure of the reult hitogram i already leaking the privacie of the record. In the following, we preent an example on how the adverary infer unknown AIDS patient, when the ytem employ the cheme above. Aume that the adverary know all the AIDS patient included in the tatitical report, except Alice, in Fig. b. If Alice i not a AIDS patient, there are only two patient between and 5 year old. In that cae, the optimal hitogram with bin i a hown in Figure, which i lightly different from the hitogram in Figure a. In the new optimal hitogram, the firt bin conit of count intead of count. Even when the randomized count of the bin are not releaed, the adverary know Alice mut be an AIDS patient, purely baed on the difference of the hitogram tructure. The example above how that uch a imple cheme fail to ecure the privacy of peronal record. III. NOISEFIRST Our firt olution to the problem of hitogram contruction under differential privacy i done in two tep. In the firt tep, the algorithm follow the tandard olution to differential privacy [] by adding Laplace noie to each x i in the original count equence, outputting a randomized equence

4 ˆD = ˆx,..., ˆx n. In the econd tep, the ytem run the dynamic programming hitogram contruction algorithm on the dirty data ˆD. We call thi method NoieFirt, becaue the noie i added before the beginning of dynamic programming. Similar to the analyi in the tandard olution propoed in [], the enitivity of NoieFirt i exactly. Therefore, Laplace noie with magnitude b = ɛ i ufficient to guarantee ɛ- differential privacy on the reulting hitogram. The complete peudocode of the method i lited in Algorithm. The algorithm can be interpreted a a pot-optimization technique to the tandard olution, by merging adjacent noiy count. Intuitively, averaging over the neighboring noiy count i able to eliminate the impact of zero-mean Laplace noie, baed on the large number theorem []. In the ret of the ection, we provide ome theoretical analyi on the expected error incurred by NoieFirt. The major challenge in the analyi i deriving the connection between i the error of the hitogram on the noiy count equence ˆD and ii the error of the ame hitogram on the original databae D. A a firt tep, we will analyze the impact of merging conecutive noiy count into a ingle bin. The following two lemma quantify the expected error of a bin on the noiy equence and original equence, repectively. Lemma. Given ubequence of count x l, x l+,..., x r. Let ˆx l,..., ˆx r be the noiy count after the firt tep in Algorithm. If l, r, c i the reult bin by merging all the count, the expected quared error of the bin with repect to ˆx l,..., ˆx r i r l E Errorl, r, c, ˆx l,..., ˆx r = SSED, l, r + ɛ Proof. Aume that X i i the variable of the count x i after adding noie following Lap ɛ. Let C be the variable of the r average count c, i.e. C = Xi r l+. We ue δ i to denote the reidual variable on X i, i.e. δ i = X i x i, and let the ize of the bin = r l +. The expected error of the reult bin l, r, c on the noiy count equence ˆx l,..., ˆx r i thu derived a follow. r E X i C r r = E X i X i i= r r r = E x i + δ i r x i δ i r r = x i r r x i + E δ i δ i r = SSED, l, r + E δ i r δ i = SSED, l, r + ɛ Baed on our definition = r l +, it directly lead to the concluion in the lemma. Note that the error above i the um of quared error of the average count on the noiy data in ˆD. The following lemma how how to etimate the error of a bin with repect to the original count in D. Algorithm NoieFirt count equence D, bin number k, privacy guarantee ɛ : Generate a new databae ˆD by adding independent Lap ɛ on every count x i D. : Build the optimal hitogram on ˆD with dynamic programming method. : Return hitogram Ĥ = l, r, c,..., l k, r k, c k, in which every c j i the mean of the noiy data ˆx lj,..., ˆx rj. Lemma. Given ubequence of count x l, x l+,..., x r. Let ˆx l,..., ˆx r be the noiy count after the firt tep in Algorithm. If l, r, c i the reult bin by merging all the count, the expected quared error of the bin with repect to x l,..., x r i E Errorl, r, c, x l,..., x r = SSED, l, r + ɛ Proof. Similar to the proof of Lemma, we derive the error a follow. Again, we ue the notation X i, C and, a they are defined in the proof for Lemma. r E x i C r r = x i r x i + E X i r = SSED, l, r r x i + E x i + δ i r = SSED, l, r + E δ i = SSED, l, r + ɛ Thi complete the proof. Without uing the hitogram technique, the expected error of the noiy count ˆx l,..., ˆx r with repect to the original data x l,..., x r i exactly r l+ ɛ, i.e., E Errorl, l, ˆx l,..., r, r, ˆx r, x l,..., x r r l + = ɛ Lemma how that the expected error of hitogram with a ingle bin i SSED, l, r + ɛ. Thi implie that merging all count into a ingle bin i an attractive option, when ɛ i mall, i.e., ɛ < r l SSED,l,r. In other word, the performance of a one-bin hitogram i uperior than the tandard olution in [], given a mall enough ɛ. The following theorem i the traightforward extenion of Lemma and Lemma, extending the analyi from one bin to multiple bin.

5 In the following analyi, we ue H to denote the hitogram with the ame tructure a Ĥ but with different average count in the bin. Intead of uing noiy count ˆx lj,..., ˆx rj, H calculate the average count for bin B j with the original count x lj x rj /r j l j +. It i eay to ee that ErrorH, D = j SSED, l j, r j, which help proving the following theorem by imple extenion from Lemma and Lemma. Theorem. Given H and Ĥ a defined above, the expected error of the hitogram on ˆD and D are repectively, EErrorĤ, ˆD = ErrorH, D + n k ɛ k EErrorĤ, D = ErrorH, D + ɛ Since k i fixed before running the algorithm, the theorem above implie that optimizing the hitogram by minimizing on ErrorĤ, ˆD lead to the olution that minimize ErrorĤ, D, i.e., arg min Ĥ EĤ, ˆD = arg min EĤ, D Ĥ The equation provide the intuition behind the correctne of NoieFirt method in Algorithm, which imply run the dynamic programming on the noiy data equence ˆD. While the analyi above aume that k i pecified by the uer, it i actually free for the algorithm to automatically elect the optimal k. Since the dirty data already atifie ɛ-different privacy, the algorithm i allowed to run n time, teting k =,..., n and returning the one with the minimal expected error on the original equence D. Although it i impoible to directly evaluate the expected error on D, we can utilize Theorem again. If Ĥk i the optimal hitogram returned by Algorithm with k =,... n bin, the final reult hitogram i elected baed on the following optimization objective: Ĥ = arg min E Ĥ k ErrorĤk, ˆD n k ɛ On the other hand, NoieFirt method add Lap ɛ on the count, auming that the enitivity equal. A hown in our example in Section I, however, the enitivity of the tatitical report can be much reduced, if we are allowed to add noie after the hitogram contruction. In next ection, we implement thi idea by propoing a new algorithm that i doe not inject noie on the data before tarting the dynamic programming, but ii randomize the dynamic programming reult. IV. STRUCTUREFIRST The NoieFirt method preerve ɛ-differential privacy and reduce the expected error by merging bin on the noiy data intead of original data. However, it fail to exploit the reduced enitivity after bin merging. In thi ection, we dicu another approach that adopt a completely different trategy, which calculate the hitogram tructure on the original data before adding the noie on the bin tructure. We call thi method StructureFirt. In the ret of the ection, we ue D i to denote the partial databae D i = x, x,..., x i, and HD i, j to denote the optimal hitogram with j bin on D i. Algorithm StructureFirt count equence D, bin number k, privacy parameter ɛ, count upper bound F : Partition ɛ into two part ɛ and ɛ that ɛ + ɛ = ɛ. : Build the optimal hitogram H and keep all intermediate reult, i.e. ErrorHD i, j, D i for all i n and j k : Set right boundary of kth bin at r k = n : for each j from k down to do 5: for each q from j up to r j+ do 6: Calculate Eq, j, r j+ = ErrorHD q, j, D q + SSED, q +, r j+ 7: end for 8: elect r j = q from k q < r j+ with probability ɛeq,j,rj+ k F + proportional to exp 9: Set l j+ = r j + : end for : Calculate average count c j for every bin on interval [l j, r j ]. : Add noie to count a ĉ j = c j + Lap : Return hitogram l, r, ĉ,..., l k, r k, ĉ k ɛ r j l j+ In Algorithm, we preent the detail of our StructureFirt method. The algorithm firt contruct the optimal hitogram H on the bai of the original data D. All the intermediate reult are tored in a table, a i done in Figure. To add noie to the tructure of the hitogram, the algorithm randomly move the boundarie between the bin. When chooing the boundary between B j and B j+, it pick up r j for bin B j at the count x q D with probability proportional to exp ɛ Eq, j, r j+ k F + Here, Eq, j, r j+ i the error of the hitogram, which conit of the optimal hitogram with j bin covering [, q] and the j + th bin covering [q +, r j+ ]. If q +, r j+, c i a new bin contructed by merging count x q+,..., x rj+ and c i the average count, it i traightforward to verify that Eq, j, r j+ = ErrorHD q, j q +, r j+, c, D rj+ = ErrorHD q, j, D q + SSED, q +, r j+ In the probability function, F i ome prior knowledge on the upper bound on the maximal count in the equence, which i aumed to be independent of the databae. After etting down all the boundarie, Laplace noie i added on the average count. For bin l j, r j, c j, the magnitude of the Laplace noie on c j i ɛ r j l j+. The complete peudocode of the algorithm i lited in Algorithm. In the ret of the ection, we will analyze the correctne and utility of the algorithm, and dicu how the value of

6 ɛ and ɛ hould be decided. Different from the NoieFirt method, StructureFirt doe not upport the optimization on the bin number k. The uer mut pecify the deired k before the beginning of the algorithm. In Section VI, we provide ome empirical tudie on how to pick up generally good k value on real data et. A. Correctne To pave the way for the correctne proof, we firt derive ome wort cae enitivity analyi on the intermediate reult in dynamic programming, when the count equence change by at mot on ome count x i D. Lemma. Let F be an upper bound of the maximum count in any of the bin. Given two neighbor databae D and D, the error of the optimal hitogram on D and D with repect to the firt i count change by at mot ErrorHD i, j, D i ErrorHD i, j, D i F + Proof: Given two neighbor databae a D and D, there i one and only one count x m change by, i.e., x m x m x m +. Aume that x m i in bin l z, r z, c z in HD i, j. Since HD i, j i the optimal hitogram for D i with j bin, it i traightforward to know that given any hitogram H covering interval [, i], we have ErrorHD i, j, D i ErrorH, D i 5 In particular, we contruct a pecial hitogram H rz by reuing all bin in HD i, j, except that c z = q=lz x q+x m xm rz r z l z+ replace c z = q=lz x q r. Let = r z l z+ z l z +. In the following, we derive ome upper bound on the error of uch H on D i. ErrorH, D i ErrorHD i, j, D i = x m x m c z + c z 6 When x m = x m +, the difference on the error above i When x m imilarly a ErrorH, D i ErrorHD i, j, D i = x m + x m c z + + c z = x m + c z x m + 7 = x m, the difference can be etimated ErrorH, D i ErrorHD i, j, D i = x m x m c z + c z = x m + + c z c z + max l q r x q + 8 Combining Equation 7 and Equation 8, and given that F i the upper bound of maximal count in the databae, we have ErrorHD i, j, D i ErrorH, D i ErrorH, D i + F + Thi reache the concluion of the lemma. Provided with the wort cae analyi on the change of error, we can prove the validity of differential privacy on the reelection of bin boundary in our algorithm. Lemma. The election of r j on line 8 of Algorithm atifie -differential privacy. ɛ k Proof. Let Eq, j, r j+ be the cot of etting r j = q, we ue E q, j, r j+ to denote the cot when the ame hitogram i contructed on D intead. Baed on Lemma, we have E q, j, r j+ Eq, j, r j+ F + Baed on peudocode in the algorithm, when r j+ i fixed, the probability of electing r j = q on D i exp ɛe q,j,r j+ k F + Prr j = q = z exp ɛe z,j,r j+ exp z exp k F + ɛeq,j,rj+ F k F + ɛez,j,rj++f + k F + ɛ exp ɛeq,j,rj+ k F + = exp k z exp ɛez,j,rj+ k F + Hence, the election of r j follow ɛ k -differential privacy. Given the reult in previou lemma, we are able to prove the correctne of Algorithm by the following theorem. Theorem. Algorithm atifie ɛ-differential privacy. Proof. In Algorithm, the output hitogram relie on the reult on line 8 and line, which are all independent of each other. Line 8 i run k time and line i run exactly once. According to Lemma, each execution on line 8 cot the privacy budget ɛ k. Baed on the concept of generalized enitivity ued in [8], the privacy cot of line i ɛ. It i becaue we can define W j = r j l j + to meet the requirement of generalized enitivity. Conider two databae D and D with the ame boundary tructure calculated in the StructureFirt algorithm, we have ĉ j and ĉ j being the noiy average count. They atify the following function in form of weighted enitivity. W j ĉ j W j ĉ j j j The total privacy budget pent in the algorithm i thu k ɛ k + ɛ = ɛ, ince ɛ + ɛ = ɛ. B. Cot Analyi The next quetion i: how much error i incurred by applying Algorithm on any count equence D? In thi part

7 of the ection, we anwer thi quetion with analytic analyi on the expectation cae. Lemma 5. Given any non-negative real number x and poitive contant c, we have x e cx c. Lemma 6. The error of the hitogram increment by no 8k F + more than ɛ 8k F + ɛ nf, every time we move the boundary by line 8 in Algorithm. Proof. Aume that the optimal hitogram with j + bin i uppoed to election q a the boundary between jth bin and j + th bin, to minimize the error ErrorHD q, j, D q + SSEq +, r j+. We are intereted in the expected increae on the error when the randomized algorithm fail to elect q. Note that the probabilitie remain the ame if we reduce each Eq, j, r j+ by Eq, j, r j+. Since each Eq Eq and there i at leat one z = q that Ez, j, r j+ Eq, j, r j+ =, the following inequalitie mut be valid, uing the well known fact e x x for any poitive x. z z exp ɛ Ez, j, r j+ Eq, j, r j+ k F + ɛ Ez, j, r j+ Eq, j, r j+ n ɛ nf 8k F + k F + To implify the notation, we ue Eq to replace Eq, j, r j+, when j and r j+ are clear in the context. Thu, the expectation on the additional error over the optimal one with q i Eq Prr j = q Eq, j, r j+ q = q = q q q Eq Eq Prr j = q exp ɛeq Eq Eq Eq k F + z exp ɛez Eq k F + exp ɛeq Eq Eq Eq k F + n k F + ɛ 8k F + ɛ 8k F + ɛ nf ɛ n F 8k F + ɛ n F n 8k F + 9 Here, the firt inequality i due to Equation 9. The econd inequality applie Lemma 5. The final inequality i becaue the number of candidate q i no larger than the ize of the databae. Note that the cot analyi in Lemma 6 doe not rely on j or r j+. Therefore, the total incremental error over the optimal hitogram without noie i imply k time of the error in Lemma 6. Combined with the error introduced on line in Algorithm, the total expected error i upper bounded by the following theorem. Theorem. The output hitogram of Algorithm, the expected error i at mot 8k F + ErrorHD, k, D+ ɛ 8k F + ɛ nf + k ɛ The error analyi in the theorem above how the uperiority of StructureFirt method. We can interpret the expected error of StructureFirt a ErrorHD, k, D + O k ɛ, by ignoring all contant item. Thi i a ignificant theoretical improvement over NoieFirt method. C. Budget Aignment When k i fixed, the expected error of the reult hitogram depend on the aignment of ɛ and ɛ, ince ɛ + ɛ = ɛ. In the error analyi of Theorem, the total error conit of three part. The firt part ErrorHD, k, D relie on k and the original data D. The other two part are independent of the data, but are decided by n, k, F, ɛ and ɛ. Therefore, it i poible to minimize the expected error by finding the optimal combination of ɛ and ɛ : 8k F + Minimize ɛ 8k F + ɛ nf + k ɛ.t. ɛ + ɛ = ɛ Although the optimization above doe not alway ha a cloed-form olution, we can employ numerical method to identify a near-optimal aignment on ɛ and ɛ. Specifically, we can apply a imple ampling technique that trie different < ɛ < ɛ and return the bet ɛ and ɛ = ɛ ɛ encountered. Since it take contant time to verify the cot when a pecific pair of ɛ and ɛ are given, the computational overhead of the budget aignment optimization i inignificant. V. ANSWERING ARBITRARY RANGE COUNTS A hitogram i contructed on the bai of the Sum of Squared Error SSE, which aim to minimize the average error of querie with unit length in the numeric domain. When the uer i querying on the um of conecutive count, the hitogram ynopi may not be optimal in term of query accuracy. To undertand the underlying reaon behind the ineffectivene of hitogram ynopi on large range querie, let u reviit the example in Figure a. If the uer querie for patient with age between 5 and 5, the average count of the firt bin i not ufficient to return accurate reult, even when there i no Laplace noie added on the hitogram. Therefore, in ome cae, it render more accurate reult if ome bin adopt a non-uniform cheme of count computation. In thi ection, we dicu how to implement uch nonuniform cheme on both NoieFirt and StructureFirt method repectively. Two different trategie are employed in NoieFirt and StructureFirt method becaue of the different propertie of the algorithm.

8 A. NoieFirt Method In Algorithm, after finding the tructure of the hitogram, NoieFirt method alway ue the average count to replace all the original noiy count. Another option i to keep uing the dirty data intead of the average count in ome of the bin. To enure that a better election i made, we propoe to compare the etimation on the error of the two option and adopt the one with maller expected error. In particular, for every bin B i, we aume that [l, r] i the interval B i cover in the data domain, and c i the average count over the noiy count. NoieFirt ue the average count for B i only when SSE ˆD, l, r < r l ɛ Otherwie, the dirty count ˆx l,..., ˆx r are kept a the original value. Intuitively, when the tructural error of the hitogram i mall, our cheme prefer to ue the average count in the bin. It i becaue the average count i capable of eliminating noie on conecutive dirty count. When the original count are very different from each other in the bin, averaging over all count doe not help reduce the error. In uch ituation, the dirty count may perform better. B. StructureFirt Method Unfortunately, the non-uniform trategy ued for Noie- Firt method i not applicable in StructureFirt method, ince StructureFirt calculate the hitogram on the original count. To apply non-uniform cheme, we mainly borrow the idea from [6]. Generally peaking, after contructing all the bin, StructureFirt run the booting algorithm [6] on every bin, with differential privacy parameter ɛ. Given a bin B i covering [l, r], Laplace noie with magnitude Lap ɛ i added on every count x j for l j r, a well a the um i = l j r x j. Aume x j i the reult noiy count and i i the noiy um. Our algorithm run normalization on x l,..., x r, i and return a new group of count x l,..., x r, i atifying that i = l j r x j. Thee count are ued to approximate the original count in the databae. By [6], thi cheme i alway conitent with ɛ -differential privacy. Therefore, the complete modified algorithm of StructureFirt i till fulfilling ɛ-different privacy. There i ome connection between uch method and [6]. Our StructureFirt method with thi non-uniform count aignment cheme can be conidered a an adaptive verion of the booting algorithm in [6]. In the original booting algorithm, the uer mut pecify the fan-out of the tree tructure before running the algorithm. Thi fan-out decide how the algorithm partition the count equence and how the normalization i run bottom-up and top-down. In our hitogram technique, an adaptive partitioning i ued intead, which i uppoed to better capture the ditribution of the data. Thi i the underlying reaon that our StructureFirt method outperform the original booting algorithm. In the following ection, ome empirical tudie will verify the advantage of our propoal. VI. EXPERIMENTS Thi ection experimentally compare the effectivene of the propoed olution NoieFirt and StructureFirt for rangecount querie with three tate-of-the-art method, referred to a Dwork [], Privelet [8] and Boot [6]. Specifically, our implementation of NoieFirt ue the noiy hitogram produced by Dwork a input; in StructureFirt, the parameter F i.e., maximal poible count in a hitogram bin, i fixed to NumOfRecord DomainSize. Meanwhile, the implementation of Boot follow the ame etting in [6], and employ binary tree a the ynopi tructure a in [6]. Similarly, StructureFirt alo ue a binary tree inide each bin of the hitogram, in order to enure fairne in our comparion. Akin to [6], we evaluate the accuracy of the algorithm over range querie with varying length and location. In particular, given a query length L, we tet all it poible range querie and report the average quare error. To evaluate the effectivene under different privacy requirement, we tet all method with three popular value of ɛ:.,. and. All method are implemented in C++ and teted on an Intel Core Duo. GHz CPU with GB RAM running Window XP. In each experiment, every algorithm i executed time, and it average accuracy are reported. The experiment involve four data et: i Age contain, 78, 675 record, each of which correpond to the age of an individual, extracted from the IPUM cenu data of Brazil. The age range from to. Differential privacy guarantee the hardne for adverarie to infer any individual true age from publihed tatitic. ii Search Log [6] i a ynthetic data et generated by interpolating Google Trend data and America Online earch log. It contain, 768 record, each of which tore the frequency of earche ranging from to 96 with the keyword Obama within a 9 minute interval, from Jan., to Aug. 9, 9. DP enure that the adverary cannot derive if any pecific peron ha earched the keyword Obama at a particular time. iii NetTrace [6] contain the IP-level network trace at a border gateway in a major univerity. Each record report the number of external hot connected to an internal hot. There are 65, 56 record with connection number ranging from to. The application of DP protect the information of individual connection. Finally, iv Social Network [6] record the friendhip relation among K tudent from the ame intitution, derived from an online ocial network webite. Each record contain the number of friend of certain tudent. There are, 768 tudent, each of which ha at mot 678 friend. DP protect the enitive information of individual connection from adverarie. To generate hitogram, we tranform all four data et to tatitical count on every poible value. On Age, for example, each x i indicate the number of individual aged i i. We oberved that the ditribution of Age i very different from the other three, in that the count therein are more evenly ditributed over the entire domain, while all the other data et exhibit a high degree of kewne.

9 Average quare errore+5 5 ε=. StructureFirtk= StructureFirtk=7 StructureFirtk= StructureFirtk= StructureFirtk= Average quare errore+ ε= Average quare errore+ ε= Average quare errore ε=. StructureFirtk= StructureFirtk= StructureFirtk=5 StructureFirtk= StructureFirtk=97 5 Average quare errore+5 Fig. 5. Varying k on Age ε= Average quare errore+ ε= Average quare errore ε=. StructureFirtk= StructureFirtk=95 StructureFirtk= StructureFirtk=85 StructureFirtk= 6 8 Average quare errore+5 Fig. 6. Varying k on Search Log ε= Fig. 7. Varying k on NetTrace Average quare errore+ ε= Average quare errore ε=. StructureFirtk= StructureFirtk= StructureFirtk=68 StructureFirtk=6 StructureFirtk= Average quare error+ ε= Fig. 8. Varying k on Social Network Average quare errore+ ε= A. Impact of Parameter k on StructureFirt Thi ubection evaluate the effectivene of StructureFirt with varying the number of bin k in the reulting hitogram. Specifically, for each data et with domain ize n, we tet five n different value of k:,, n. Figure 5-8 illutrate the average quare error of StructureFirt with different value of k and different query range ize on all the four data et. There are everal important obervation we made from the reult. Firt, when k equal the domain ize n, StructureFirt reduce to method Dwork [] that add random Laplace noie 5, n, n 5 with magnitude ɛ to every count in the dataet. In thi cae, the average quare error of StructureFirt increae linearly with the query range ize, regardle of the etting on ɛ. Note that the hitogram tructure i fixed to one bin per count in the original tatitic; hence, there i no need to pend privacy budget on the hitogram tructure. Second, when k =, StructureFirt i equivalent to the Boot method. Similar to the cae for k = n, the hitogram tructure i fixed, and the expenditure of privacy budget on the hitogram i ɛ =. From the figure, we can ee that StructureFirt performance follow the propertie of Boot, with more accurate query reult on querie with the minimum and maximum length. Third, when < k < n, StructureFirt achieve better performance compared to the cae with extreme value,

10 Average quare errore Dwork Privelet Boot NoieFirt StructureFirt ε= Average quare errore+ ε= Fig. 9. Average quare error on Age Average quare errore+ ε= epecially on querie with intermediate length. Thi how that our StructureFirt method uccefully contruct hitogram adaptively to the data ditribution, reducing the error for querie covering different bin on the data domain. Finally, on all data et, StructureFirt achieve it highet accuracy when k i around n/. In uch cae, every bin conit of count by average, offering a balanced reult for all type of querie with different length. Moreover, the performance of binary tree and the normalization technique from [6] alo work well, ince every bin only involve random count in the proceing by average. Therefore, we employ k = n/ in the ret of the paper. B. Evaluation on all method We now evaluate the performance of all olution for range count querie, tarting with unit-length querie. The error of uch querie i equivalent to the Sum of Squared Error divided by the domain ize n. The reult are lited in Table I, with bet performance on pecific data et and ɛ value marked in bold. Clearly, NoieFirt achieve bet accuracy on Search Log, NetTrace and Social Network data et. Dwork remain the bet method on Age data et. The reaon for their relative performance are explained a follow. Since Age i more evenly ditributed, it i more difficult for NoieFirt to find a good hitogram tructure after Dwork adding random noie to the count. On the other hand, becaue the lat three data et have a large number of mall count, NoieFirt i more effective on merging conecutive mall count into bin and eliminating the impact of the random noie in the bin. StructureFirt doe not how competitive reult for querie with unit length, mainly becaue the extenion with the binary tree normalization technique from [6]. The performance of StructureFirt on uch querie i thu cloer to that of Boot. In generally, the reult imply that NoieFirt i the better for querie with a hort range. To the bet of our knowledge, it i alo the firt method outperforming Dwork in uch etting. Next we evaluate the performance of all method on querie with varying range, reporting their accuracy in term of average quare error. The reult are hown in Figure 9-. Note that StructureFirt et k = n in all etting, baed on the concluion drawn in Section VI-A. On all data et, the average quare error of NoieFirt and Dwork increae linearly with the query range. Both of them ignificantly outperform the other three algorithm on mall range ize. A the query length grow, the performance gap between NoieFirt and Dwork expand, though NoieFirt i better by a mall margin on mot of the query range. Thee reult again verify the advantage of NoieFirt for hort range, which i conitent with the reult in Table I. The accuracy of both Privelet and Boot i high for querie with very long or very hort range; for other querie, they tend to incur rather high error. Thi i due to the binary tree tructure ued in their algorithm note that the Haar wavelet ued in Privelet i eentially a binary tree. Hence, very hort querie favor both method, a they only need to acce a mall number of node cloe to the leaf level. Very long querie, on the other hand, are anwered mainly uing a mall number of node cloe to the top of the tree, leading to high accuracy. When querie with length in neither extreme, thee method return poorer reult, ince a large number of node from different level of the tree are involved in query proceing. StructureFirt produce more accurate etimate than both Privelet and Boot for mot querie. The main reaon are i that StructureFirt utilize the count imilaritie amongt conecutive bin; ii that StructureFirt avoid building a large tree over the whole data domain; reducing the number of node required to anwer a range query; and iii that bin in a domain partition tend to have imilar count, and, thu, building tree eparately on each partition benefit from both the conitency and the imilaritie amongt bin. Another intereting obervation concerning StructureFirt i that when the range ize i a large a the domain ize, Boot ha better accuracy than StructureFirt. Thi i becaue Boot perform the conitency inference on the whole domain, and hence, it ha a better overview on range count on the complete domain. C. Summary Baed on experimental reult hown above, we conclude that NoieFirt uually return more accurate reult for unitlength range count querie than all the tate-of-the-art method. For the error of unit-length querie ha direct impact on the hitogram hape, therefore NoieFirt provide u a poibility to make a better viualization of the publihed data. StructureFirt, on the other hand, ha apparent uperiority with mot etting of the query length. Thu, a query executer can provide the uer more precie reult by querying the DPcomplaint hitogram publihed by the StructureFirt method. VII. RELATED WORK Numerou technique have been propoed for publihing variou type of data while achieving differential privacy ee

11 Average quare errore+7 Average quare errore+7 Average quare errore Dwork Privelet Boot NoieFirt StructureFirt ε= Dwork Privelet Boot NoieFirt StructureFirt Dwork Privelet Boot NoieFirt StructureFirt ε=. ε= Average quare errore Fig.. Average quare errore+5 Average quare errore+5 ε= Fig.. Average quare error on Search Log ε= Fig.. Average quare error on NetTrace Dwork Privelet Boot NoieFirt StructureFirt ε= Average quare error on Social Network Average quare errore+ Average quare errore+ Average quare errore ε= ε= ε= Data et Age Search Log NetTrace Social Network ɛ Dwork 9,57. 9, , , Privelet 6,77,75 678,76 6, ,88 9, , 9,6 9 Boot 69, 7,8 8,9,886,5,776,99 7,7 76,78,7 7, 78 NoieFirt,67.,9.7,95.8,9.5 StructureFirt 566, ,89 9,5 88,,7,9 5,97,9, 9 TABLE I COMPARISON OF THE AVERAGE SQUARE ERRORS ON QUERY WITH UNIT LENGTH, I.E. SSE n [] for urvey. For example, Bhakar et al. [] invetigate how frequent itemet from tranaction data can be publihed. Friedman et al. [5] devie method for contructing deciion tree. Korolova et al. [6] and Götz et al. [7] preent method for publihing tatitic in earch log, while McSherry and Mahajan [8] develop technique for network trace analyi. Among the exiting approache, the one mot related to our are by Blum et al. [9], Hay et al. [6], Xiao et al. [8], and Li et al. [7]. Specifically, Blum et al. [9] propoe to contruct one-dimenional hitogram by dividing the input count into everal bin, uch that the um of count in each bin i roughly the ame. The bin count are then publihed in a differentially private manner. Thi approach, however, i hown to be inferior to the method by Hay et al. [6] in term of the variance of the noie in range count query reult. Hay et al. method work by firt i computing the reult of a et of range count querie with Laplace noie injected, and then ii refining the noiy reult by exploiting the correlation among the querie. The reult obtained thu can then be ued to anwer any range count querie, and the variance of noie in the query anwer i Olog n, where n i the number of count in the input data. Hay et al. method, a with our olution, i deigned only for one-dimenional data. Meanwhile, Xiao et al. [8] develop a wavelet-baed approach that can handle multi-dimenional dataet, and it achieve a noie variance bound of Olog d n, where d i the dimenionality of the data et. A hown in our experiment, however, both Hay et al. and Xiao et al. approache are outperformed by our technique in term of query accuracy. Li et al. [7] propoe an approach that generalize both Hay et al. and Xiao et al. technique in the ene that it can achieve optimal noie variance bound for a large pectrum

12 of query workload. In contrat, Hay et al. and Xiao et al. technique only optimize the accuracy of range count querie. Neverthele, Li et al. approach incur ignificant computation cot, and hence i inapplicable on large data et. In addition, there exit everal technique that addre problem imilar to but different from our. Barak et al. [] and Ding et al. [] propoe method for releaing marginal, i.e., projection of a data et onto ubet of it attribute. The core idea of their method are to exploit the correlation among the marginal to reduce the amount of noie required for privacy protection. However, neither Barak et al. nor Ding et al. method can be applied for our problem, a we conider the releae of one hitogram intead of multiple marginal. Xiao et al. [] devie a differentially private approach that optimize the relative error of a given et of count querie. The approach target the cenario where the count querie overlap with each other i.e., there exit at leat one tuple that atifie multiple querie, in which cae adding le noie in one query reult may neceitate a larger amount of noie for another query, o a to enure privacy protection. Under thi etting, Xiao et al. approach calibrate the amount of noie in each query reult, uch that querie with maller larger anwer are likely to be injected with le more noie, which lead to reduced relative error. Thi approach, however, i inapplicable for our problem, ince the count querie concerned in a hitogram are mutually dijoint. Ratogi and Nath [] develop a technique for releaing aggregated reult on time erie data collected from ditributed uer. The technique inject noie into a time erie by firt i deriving an approximation of the time erie and then ii perturbing the approximation. Our hitogram contruction algorithm i imilar in pirit to Ratogi and Nath technique, in the ene that our algorithm i approximate a et D of count with everal bin and ii perturb the bin count. One may attempt to apply Ratogi and Nath technique for hitogram contruction, by regarding the et D of count a a time erie. Thi approach, however, would lead to highly uboptimal reult, ince Ratogi and Nath technique aume that all information in a time erie concern the ame uer, in which cae changing one uer information could completely change all count in D. VIII. CONCLUSION In thi paper, we preent a new differential privacy mechanim upporting arbitrary range querie on numeric domain. Utilizing commonly ued hitogram technique, our mechanim generate randomized and biaed etimation on the count in the databae. Our method i effective on reducing the enitivitie of the ynopi, thu dramatically cutting the amount of noie added on the ynopi. Experiment on real data et validate the advantage of our propoal over all tateof-the-art olution. IX. ACKNOWLEDGEMENT Jia Xu and Ge Yu are upported by the National Baic Reearch Program of China 97 Program under grant CB6, the National Natural Science Foundation of China No. 69 and No. 658, and the Fundamental Reearch Fund for the Central Univeritie No. N7. Zhenjie Zhang and Yin Yang are upported by SERC Grant No from Singapore A*STAR. Xiaokui Xiao i upported by Nanyang Technological Univerity under SUG Grant M586 and AcRF Tier Grant RG 5/9, and by the Agency for Science, Technology and Reearch Singapore under SERG Grant 587. REFERENCES [] N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V. Pearon, D. A. Stephan, S. F. Nelon, and D. W. Craig, Reolving individual contributing trace amount of dna to highly complex mixture uing high-denity np genotyping microarray, PLoS Genetic, vol., no. 8, 8. [] R. Wang, Y. Li, X. Wang, H. Tang, and X. Zhou, Learning your identity and dieae from reearch paper: Information leak in genome wide aociation tudy, in ACM CCS, 9. [] C. Dwork, F. McSherry, K. Niim, and A. Smith, Calibrating noie to enitivity in private data analyi, in TCC, 6, pp [] C. Dwork, F. McSherry, and K. Talwar, The price of privacy and the limit of LP decoding, in STOC, 7, pp [5] C. Dwork, G. N. Rothblum, and S. P. Vadhan, Booting and differential privacy, in FOCS, pp [6] M. Hay, V. Ratogi, G. Miklau, and D. Suciu, Booting the accuracy of differentially private hitogram through conitency, PVLDB, vol., no., pp.,. [7] C. Li, M. Hay, V. Ratogi, G. Miklau, and A. McGregor, Optimizing linear counting querie under differential privacy, in PODS,, pp.. [8] X. Xiao, G. Wang, and J. Gehrke, Differential privacy via wavelet tranform, in ICDE,, pp [9] S. Kotz, T. Kozubowki, and K. Podgórki, The Laplace ditribution and generalization: a reviit with application to communication, economic, engineering, and finance. Birkhäuer Publication,, pp.. [] H. V. Jagadih, N. Kouda, S. Muthukrihnan, V. Pooala, K. C. Sevcik, and T. Suel, Optimal hitogram with quality guarantee, in VLDB, 998, pp [] S. Guha, N. Kouda, and K. Shim, Approximation and treaming algorithm for hitogram contruction problem, ACM TODS, vol., no., pp. 96 8, 6. [] T.-H. H. Chan, E. Shi, and D. Song, Private and continual releae of tatitic, in ICALP,, pp [] C. Dwork, Differential privacy: A urvey of reult, in TAMC, 8, pp. 9. [] R. Bhakar, S. Laxman, A. Smith, and A. Thakurta, Dicovering frequent pattern in enitive data, in KDD,, pp [5] A. Friedman and A. Schuter, Data mining with differential privacy, in KDD,, pp [6] A. Korolova, K. Kenthapadi, N. Mihra, and A. Ntoula, Releaing earch querie and click privately, in WWW, 9, pp [7] M. Götz, A. Machanavajjhala, G. Wang, X. Xiao, and J. Gehrke, Publihing earch log - a comparative tudy of privacy guarantee, in TKDE, in pre. [8] F. McSherry and R. Mahajan, Differentially-private network trace analyi, in SIGCOMM,, pp.. [9] A. Blum, K. Ligett, and A. Roth, A learning theory approach to noninteractive databae privacy, in STOC, 8, pp [] B. Barak, K. Chaudhuri, C. Dwork, S. Kale, F. McSherry, and K. Talwar, Privacy, accuracy, and conitency too: a holitic olution to contingency table releae, in PODS, 7, pp [] B. Ding, M. Winlett, J. Han, and Z. Li, Differentially private data cube: optimizing noie ource and conitency, in SIGMOD,, pp [] X. Xiao, G. Bender, M. Hay, and J. Gehrke, ireduct: differential privacy with reduced relative error, in SIGMOD,, pp. 9. [] V. Ratogi and S. Nath, Differentially private aggregation of ditributed time-erie with tranformation and encryption, in SIGMOD,, pp