Distribution-based Microdata Anonymization

Transcription

1 Ditribution-baed Microdata Anonymization Nick Kouda niverity of Toronto Ting Yu North Carolina State niverity Diveh Srivatava AT&T Lab Reearch Qing Zhang Teradata ABSTRACT Before haring to upport ad hoc aggregate analye, microdata often need to be anonymized to protect the privacy of individual. A variety of privacy model have been propoed for microdata anonymization. Many of thee model (e.g., -cloene) eentially require that, after anonymization, group of enitive attribute value follow pecified ditribution. To upport uch model, in thi paper we tudy the problem of tranforming a group of enitive attribute value to follow a certain target ditribution with minimal data ditortion. Specifically, we develop and evaluate a novel methodology that combine the ue of enitive attribute permutation and generalization with the addition of fake enitive attribute value to achieve thi tranformation. We identify metric related to accuracy of aggregate query anwer over the tranformed data, and develop efficient anonymization algorithm to optimize thee accuracy metric. ing a variety of data et, we experimentally demontrate the effectivene of our technique. 1. INTRODCTION Cooperation among enterprie and governmental agencie often require the haring of private microdata, becaue they upport flexible and ad hoc aggregate analye, a major advantage over precomputed aggregate. Due to privacy concern, microdata need to be properly tranformed to prevent the dicovery of any individual enitive attribute. A variety of privacy model and technique have been propoed to addre thi problem. -anonymity [, 1], the firt privacy model propoed for microdata anonymization, only require that for each tuple there exit at leat other tuple with the ame quai-identifier a. Since -anonymity doe not conider the ditribution of enitive attribute, it uffer from the homogeneity attack when all thee tuple have the ame or imilar enitive attribute value [7]. Several privacy model have been recently propoed to remedy thi problem, including -diverity [7] and -cloene [6]. Though thee privacy model have different definition or target different type of enitive attribute, they eentially pecify Permiion to copy without fee all or part of thi material i granted provided that the copie are not made or ditributed for direct commercial advantage, the VLDB copyright notice and the title of the publication and it date appear, and notice i given that copying i by permiion of the Very Large Data Bae Endowment. To copy otherwie, or to republih, to pot on erver or to reditribute to lit, require a fee and/or pecial permiion from the publiher, ACM. VLDB, Augut 24-28,, Lyon, France Copyright VLDB Endowment, ACM ----//. contraint on the enitive attribute ditribution of a group of individual tuple. For example, -diverity require that there are at leat well-repreented enitive attribute value in. Similarly, -cloene require that the ditribution of enitive attribute in a group hould be imilar to that of the whole microdata table. Given thee ditribution-baed privacy model, the anonymization problem i thu to tranform the original microdata table to group of tuple o that the enitive attribute ditribution of each group atifie the privacy goal. Exiting approache are to form group (through quai-identifier generalization or clutering) uch that the ditribution of thoe group naturally atify the privacy goal without any modification. However, there are two concern with uch approache. Firt, there may not alway exit grouping that atify the privacy goal. For example, even if the microdata table a a ingle group atifie -diverity, no non-trivial grouping may do o. Second, the data owner ha no control over how the final grouping will look. Though thee group after anonymization atify a privacy goal, they may not be uitable for the target reearch analyi. For example, for health care reearch, it may be deirable to group patient record by age group, by geography, etc. However, to achieve a privacy goal, we may have to put an arbitrary ubet of patient record into a group. We oberve that, with exiting approache, there i a dilemma between the deirable grouping for microdata analyi and thoe for privacy protection. The eential reaon for the above dilemma i that exiting approache olely rely on the original ditribution of a group to achieve a privacy goal. In other word, they tightly couple grouping with privacy goal. In thi paper, we propoe ditribution tranformation a a new methodology to upport ditribution-baed anonymization. Specifically, we tudy the following problem: given an arbitrary group of tuple with quai-identifier and a enitive attribute and a target ditribution on the enitive attribute that atifie a privacy model, modify the enitive attribute value of tuple in the group uch that one can only infer from the anonymized data that for each tuple it enitive attribute in the group follow the target ditribution but nothing more. We call thi problem the ditribution tranformation problem. One major advantage of thi problem etting i that it clearly decouple grouping from privacy goal. It allow data owner to come up with more ueful grouping for data analyi while till protecting privacy. For example, both -diverity and -cloene require -anonymity. ing our problem etting, we may firt ue any baic -anonymity algorithm to come up with grouping that minimize the generalization. Then for each group, we can further achieve -diverity or -cloene (i.e., define target ditribution that atify -diverity or -cloene). Thi problem etting further

2 offer an additional flexibility to have different target ditribution for different group, o that the data owner can trike a fine-grained tradeoff between privacy and data utility. It i alo eay to ee that the ditribution tranformation problem i a more general problem etting, in the ene that it i independent of pecific privacy goal. Solution to thi problem thu can be generally applied to exiting ditribution-baed privacy model. A i true for any anonymization technique, beide privacy protection, olution to the ditribution tranformation problem hould alo maintain a much ueful information a poible in the publihed microdata. In particular, it hould till be poible to anwer ad hoc aggregate querie with reaonable accuracy. Otherwie, the whole purpoe of data haring i lot. For intance, one naive approach i to replace each record enitive attribute value with one that i randomly generated following the target ditribution. However, thi approach change the original data completely, and will have a ignificant negative impact on the accuracy of ad hoc query anwering. In particular, it i impoible to get determinitic bound except the trivial one for aggregate querie. Thi i becaue by only looking at the perturbed microdata table each tuple true enitive attribute can take any value independently in the domain. To get determinitic bound, we have to conider the wort cae which will reult in trivial bound. In thi paper, we propoe a methodology for ditribution-baed microdata anonymization that return accurate bound a anwer to ad hoc aggregate querie, and make the following contribution. Firt, we preent a general framework for ditribution-baed microdata anonymization. We develop novel technique that combine enitive attribute generalization and permutation to tranform microdata uch that each record appear to follow a target ditribution. Second, we identify metric related to accuracy of query anwer over the anonymized microdata, and develop algorithm to optimize thee metric. Intuitively, the le generalization we perform on enitive attribute, the more accurate query reult we tend to obtain. We deign efficient algorithm to minimize the um of range of enitive attribute generalization. Third, to further upport accurate aggregate query anwering, we propoe to add fake enitive attribute value into the original data et before performing enitive attribute generalization and permutation. The ue of fake value add ignificant challenge to the anonymization proce. We deign an efficient algorithm to compute the optimal fake value that minimize our propoed metric. Finally, we conduct comprehenive experiment over both real and ynthetic data et to verify the advantage of the propoed technique. The experimental reult how that microdata protected through enitive attribute generalization and permutation combined with the ue of fake enitive attribute value can anwer ad hoc querie with reaonable accuracy. Our experiment alo verify the effectivene of the propoed optimization algorithm. We organize the ret of the paper a follow. In Section 2, we ue example to how the baic idea of our approach. In Section, we preent a general privacy protection framework for ditributionbaed microdata anonymization. An optimal algorithm for enitive attribute generalization i preented in Section 4. We dicu the ue of fake value in Section 5. Experimental reult are reported in Section 6. We dicu cloely related work in Section 7 and conclude thi paper in Section ILLSTRATIVE EXAMPLES Figure 1 how an example employee record table. Before thi table i hared, the explicit identifier attribute Name hould be removed. Attribute Zipcode and Gender are quai-identifier and Salary i the enitive attribute. For implicity, we aume the do- ID Quai-identifier Senitive tuple ID name zipcode gender alary 1 Alice 111 F $K 2 Bob 111 M $K Carol 111 M $5K 4 Debra 11 F $K 5 Elaine 121 F $K 6 Grace 12 F $K 7 Helen 12 F $5K 8 Jaon 11 M $K Kyle 1 M $K 1 Leo 1 M $K 11 Nancy 1 F $K Figure 1: An example microdata table Quai-identifier Senitive group ID tuple ID zipcode gender alary F $K M $K M $K F $5K F $K,$K F $5K, $K F $K, $K, $5K, $K 8 11 M $K, $K, $5K, $K 1 M $K, $K, $5K, $K 1 1 M $5K, $k 11 1 F $K, $K Figure 2: An example microdata table after enitive attribute generalization and permutation main of Salary to be. Suppoe the data owner want to hare thi information with a third party for buine analyi, which prefer to have tuple grouped according to the firt three digit of their Zipcode. For privacy protection, it i further required that the alary attribute value in each group hould atify -diverity. To achieve thi privacy goal, the data owner may pecify for each group a ditribution (called a target ditribution) over the domain of Salary that atifie -diverity. For eae of explanation, we aume the target ditribution for each group i the uniform ditribution. In practice, each group may have it own target ditribution. Clearly, except the firt group (thoe with zipcode 11**), the ditribution of the enitive attribute value of the other two group do not follow the target ditribution. In thi paper, we tudy the following problem: given a target ditribution of enitive attribute value for a group of tuple, perform anonymization o that for each individual tuple one can only infer from the anonymized data that enitive attribute value follow but nothing more. We call it the ditribution tranformation problem. Thi problem cannot be olved by exiting anonymization technique (e.g., quai-identifier generalization or permutation), a none of them allow the modification of enitive attribute value, and thu cannot change the original ditribution of a group to fit into the target ditribution. Our baic cheme i to leave quai-identifier unchanged and generalize and permute the enitive attribute value (ee ection ). Figure 2 how one poible anonymized microdata table after applying our cheme. Figure how the generalization hierarchy for the Salary attribute. A we how in Section.1, any target ditribution can be pecified over the domain generalization hierarchy by giving different weight to the children of node in the hierarchy tree. The weight aignment in Figure correpond to a uniform ditribution. Note that in group 1, ince it ditribution i already the ame a the target ditribution, no generalization i needed. Intead, to protect privacy, we only need to perform a random per-

3 1 {K} {K, K, 5K, K} 1 {K, K} {5K, K} {K} 1 {5K} {K} Figure : An example domain generalization hierarchy mutation to break the aociation between a tuple and a particular enitive attribute value. For the other two group, both generalization and permutation are needed to achieve the privacy goal. Once a group of tuple and the correponding target ditribution are given, each tuple enitive attribute i generalized to a ubdomain correponding to a node in the domain hierarchy. Then the generalized domain of the tuple in the ame group are permuted. For example, in group 1 of Figure 2, each tuple enitive attribute i generalized to itelf. Thee value are then permuted among group 1. In group 2, the three enitive attribute value K, K and 5K are generalized to K, K, K, K, 5K, K and 5K, K repectively. Then again we perform a random permutation of the generalized enitive attribute among group 2. The combination of generalization and permutation guarantee that even if an attacker can aociate a tuple with a unique individual through it quai-identifier, he can only infer that a tuple enitive attribute follow the target ditribution. Since enitive attribute are generalized and permuted, we uually cannot get exact anwer to aggregate querie. But we can alway derive a correct bound for a query from the anonymized table. For example, conider the following query: What i the average alary of female employee? A our cheme doe not change the quai-identifier of each tuple, we know exactly how many tuple in each group are elected by the query, i.e., 2 tuple from group 1, tuple from group 2, and 1 tuple from group. Since enitive attribute are generalized and permuted, we do not know thee tuple original alarie. But we can derive the lower and upper bound of the query reult. Specifically, from group 1, the minimum and the maximum of the um of the two tuple alarie are K+K = 7K and 5K+K=11K, repectively. For group 2, conider the generalized value K, K. Since we do not know it original value, we have to etimate conervatively to make ure that the derived bound are correct. Thu, the minimum and the maximum of the um of the three tuple in group 2 would be K+K+5K=11K and K+K+K=1K repectively. And the bound for the ingle tuple from group would be [K, K]. Overall, the bound for the anwer of the query would be [5K, 55K]. Domain generalization and permutation enure that each individual tuple enitive attribute value follow the target ditribution. Meanwhile, compared with perturbation-baed approach, the technique preerve ome of the propertie of enitive attribute in the whole group. For example, from group 1, one can only know that for each tuple it alary ha equal chance to be any of the four poible value, i.e., it follow the target ditribution. But one alo know that inide thi group, there i exactly one occurrence of each value in the domain. Thi help one obtain more accurate determinitic bound for aggregate querie. Note that if enitive attribute value were randomly generated to follow the target ditribution, we could get inaccurate anwer to querie without any confidence guarantee. For example, if the four tuple with group ID = were aociated with the randomly Quai-identifier Senitive group ID tuple ID zipcode gender alary F $K, $K M $5K M $K, $K F $K F $5K, $K F $K, $K F $K, $K, $5K, $K 11 M $K, $K, $5K, $K 1 1 M $K, $K, $5K, $K 11 1 M $K, $K, $5K, $K 12 1 F $K, $K, $5K, $K Figure 4: An example microdata table after enitive attribute generalization and permutation, where aggregate querie cannot be accurately anwered. generated alary value K, K, 5K and K (following the target uniform ditribution), the query What i the average alary of people in the 1* zipcode would return the incorrect value 45K, wherea our method baed on generalization and permutation would return the range [5K, 55K], which include the correct value of 55K. If one wanted to provide determinitic bound baed on the randomly generated alary value, one could only provide the trivial range [K, K]. Given a group of enitive attribute value, there are many way to generalize them to reach the target ditribution. For example, Figure 4 how another way of generalization and permutation. An extreme example i to generalize each enitive attribute to the whole domain. Though they offer the ame privacy, the accuracy of query anwering from thee different cheme may vary greatly. We can verify that the bound derived from the trivial generalization table are much wore than thoe from the table in Figure 2. Intuitively, the le generalization we perform, the better bound we tend to obtain. Baed on thi obervation, in Section 4, we identify optimization metric and deign algorithm that produce enitive attribute generalization and permutation cheme that offer better query anwering accuracy. A econd important technique we propoe to improve the accuracy of query anwering i to introduce fake enitive attribute value along with enitive attribute generalization and permutation. To how the benefit of thi technique, let u have a cloer look at group 2 in Figure 2. With only generalization and permutation, the generalization hown in Figure 2 i the bet we can do to minimize the um of range of generalization. If we ak what i the average alary of employee in area with zipcode 12**, the bet bound we can get i! ""#. Intead, if we introduce another enitive attribute value into the group (we call it a fake value a it doe not appear in the original data et), the reulting ditribution will be exactly the ame a the target ditribution. Thu we only need to perform a permutation without any generalization. Group 2 will then be a follow. Quai-identifier Senitive group ID tuple ID zipcode gender alary F $K F $K F $5K $K Here we lit three employee in thi group but four poible alarie, meaning that their alarie can be any three out of the four. 1 From the above table one can till only infer that the poible 1 Thi table can be eaily implemented by eparately creating a quai-identifier table and a enitive attribute table, which can be joined through the group ID, a in [1].

4 , I alary of each employee i uniformly ditributed between and. Meanwhile, ince we reduce the generalization of enitive attribute dramatically, the average alary of employee in that area can be more accurately bounded to be $"%#. From the above example, we ee that adding fake value may reduce the level of generalization needed to match a target ditribution. Meanwhile, fake value alo introduce uncertainty into the original data et. Without any retriction, given any data et, we can alway protect privacy without uing any generalization. But thi may not be the bet choice for accurate aggregate query anwering. For example, in group of Figure 2, we can add the following fake and three ". Clearly, thi will re- value: three, two ult in much wore bound for aggregate querie. For example, the only bound we can get for the average alary for group would be &' "#, which i wore than ( )$*&''" ""#, the bound when only applying generalization and permutation. Thu, it would be enible to minimize the um of range of generalization while limiting the number of added fake value. In Section 5, we preent an efficient algorithm to do o.. A FRAMEWORK FOR DISTRIBTION- BASED ANONYMIZATION.1 Baic Concept and Notation A in mot work on microdata anonymization, we aume the chema of a de-identified microdata table conit of two part: a et of quai-identifier "+-,./)//.+1, and a enitive attribute 2. Our technique can be ued to protect both numerical and categorical enitive attribute. Here we focu on numerical data a they upport more intereting aggregation operation, uch a SM and AV- ERAGE, while for categorical data uually only CONT i meaningful. For implicity, we alo aume the domain of 2 i finite. Given the domain of 2, we ay i a ubdomain of 2 if it : cover a continuou egment of. In other word, there exit no uch that 4 but A*B=CD;E 4 >GF F A*HJIK;E 4 >. We thu alo denote 54 a A*B=CD;E54E>LA%H!IM;E54N>O#, and call A%H!IM;E54P>Q A*BRC7;E54N> the range of 54. A generalization hierarchy of 2 i a rooted tree S that atifie the following condition: (1) Each node of S i a ubdomain of ; (2) i the root; () All the children of a node T form a partition of T ; and (4) A leaf node i a ubdomain G, where. A mentioned in Section 2, the owner of a microdata table pecifie a partition.j,.///v$wx of the microdata table and a target ditribution MY for each group $Y. The requirement of anonymization i to make ure that in the releaed microdata table one can only infer that the enitive attribute value of each group ZY follow Y. Note that thi i a very flexible model for microdata protection. In particular, it doe not require the target ditribution to be the ame for all group. For example, the target ditribution [Y and ]\ may both atify -diverity or -cloene, but are different uch that each i cloer to the original ditribution of $Y and \. By doing o, we may reduce data ditortion for privacy protection. Without lo of generality and for eae of explanation, in the ret of our dicuion, we aume that the data owner only pecifie a target ditribution for the whole microdata table. When we have multiple group each with their own target ditribution, we can imply ue the technique in thi paper to accommodate the target ditribution of each group eparately. From an anonymized microdata table ^, if we can only derive that the ditribution of each tuple enitive attribute follow a ditribution, we ay ^ preerve privacy in term of, or i - private for hort. For example, the table in Figure 2 i _ -private, where _ i the uniform ditribution over K, K, 5K, K. Note that there are two type of privacy in microdata anonymization. One i exitence privacy, where the exitence of a record for an individual i conidered enitive. The other i linkage privacy, where the aociation between a tuple and it enitive attribute value i enitive. Depending on pecific application, either one of them or both may be deirable. Like many exiting work, in thi paper we focu on linkage privacy [8, 1, 15]. Given a target ditribution and a domain generalization hierarchy S for 2, we aign a weight to each edge of S uch that for any two children `, and `:a of a node T, we have bdc.beje ;f;rt%`, >f>gg bhcbeje ;f;rt%` a >f>5ij ;EI `h,> g[ ;EI ` a >. We call the reulting domain hierarchy a privacy-annotated hierarchy. For implicity, we aume all the weight are integer. It i eay to ee that a privacy-annotated hierarchy repreent a ditribution over. For example, Figure i a privacy-annotated hierarchy that correpond to a uniform ditribution. In the ret of thi paper, unle otherwie noted, we aume that a target ditribution i given a a privacy-annotated hierarchy..2 Senitive Attribute Generalization and Permutation A illutrated earlier, the baic idea of our approach i to generalize the enitive attribute value of each tuple to a ubdomain of. We then randomly permute the reulting ubdomain among all the tuple, o that the ditribution of the poible value of a tuple enitive attribute / 2 i the ame a the target ditribution. Note that the ditribution of / 2 depend on the given privacy-annotated hierarchy. For example, for a ubdomain K, K, given the privacy-annotated hierarchy in Figure, we know that, if / 2 K, K, then / 2 ha an equal probability to be either K or K. On the other hand, uppoe the ratio between the weight of K and K i 2:1 intead of 1:1 in the hierarchy (i.e., the hierarchy correpond to a different target ditribution). If / 2 K, K, the probabilitie of / 2 to be K and K will be 2/ and 1/ repectively. Formally, we have the following definition. DEFINITION.1. Let be a multiet of element in and k be a multiet of ubdomain of. 2 We ay k i a generalization of if there i a one-to-one mapping l from to k uch that mqn ]n lk;=n>. DEFINITION.2. Let koip.,..//)/f@wx be a generalization of, and be a target ditribution over. We ay k i - private generalization if for any element, ;EIi >hi W1q,fr Y r]w ;EI i. Y >. Intuitively, if k i a -private generalization of, then from a random permutation of k the probability for any element in to be in follow. Thu, k effectively hide the original ditribution of value in. From k, an attacker can only derive that element in follow but nothing more. For example, let _ denote the uniform ditribution over K, K, 5K, K. Then both K, K, 5K-K, 5K- K and K, K, K, K, 5K, K are _ - private generalization of K, K, 5K, K, and the latter i alo a _ -private generalization of K, K, 5K, K. Since the interpretation of a generalized ubdomain i ubject to the target ditribution, given in the form of a privacy-annotated hierarchy with weight on each ubdomain, a trivial -private generalization i to generalize every enitive attribute value to the whole 2 i a multiet becaue multiple tuple may have the ame enitive attribute value. Similarly, k i a multiet ince multiple element in may be generalized to the ame ubdomain.

5 i domain. For example, uppoe the target ditribution i a normal ditribution. Then if a enitive value i generalized to the root domain, one can only infer that it follow the target normal ditribution (not a uniform ditribution). Though ecure, the reulting microdata table from thi trivial generalization i hardly ueful. Thu, it i important to develop algorithm to produce generalization which protect privacy, and further, can anwer aggregate querie accurately. Before preenting uch algorithm, we firt briefly dicu how to anwer aggregate querie over an anonymized microdata table.. Anwering Aggregate Querie In thi paper, we conider ad hoc data analyi in OLAP and focu on querie that elect a ubet of tuple baed on arbitrary condition on quai-identifier and then aggregate over the enitive attribute, i.e., the aggregate querie are of the form SELECT i a condition Aggr(2 ) FROM Microdata WHERE `, where ` on quai-identifier, and Aggr may be common aggregate uch a SM, AVERAGE and MIN. Given an aggregate query, ince quai-identifier are not changed during anonymization, from the anonymized table, we know exactly how many tuple in each group are elected by the query. Thu, from a -private generalization of the group, we can etimate the lower and upper bound of the aggregation inide each group. Thee bound can then be combined together to form thoe for the whole table. In fact, to get the bound for an aggregate query, what matter i only the number of elected tuple in each group. Therefore, a in [15], we can pre-compute for each group the bound of each type of aggregate when different number of tuple in that group are elected by a query, and tore thee bound in an auxiliary table. When anwering an aggregate query +, after knowing the number of tuple elected by +, we only look up the auxiliary table, and combine together the bound of each group to get the bound for +. Thi proce can be eaily implemented uing SQL. Therefore, there i no need to modify the DBMS query engine to upport aggregate querie over the anonymized table. 4. OPTIMAL ALGORITHM FOR SENSITIVE ATTRIBTE GENERALIZATION A mentioned before, a trivial -private generalization that generalize every enitive attribute value to the whole domain i not ueful for anwering aggregate querie. In thi ection, we preent optimization criteria for ditribution-baed anonymization o that aggregate querie can be more accurately anwered. 4.1 Minimize the Sum of Range of Senitive Attribute Generalization The higher a ubdomain i in the domain hierarchy, the more general it i, and thu the more uncertainty i introduced when anwering querie. A natural meaure of the uncertainty of a ubdomain i it range, i.e., the difference between the maximum and the minimum element in the ubdomain. Formally, we define the following optimization problem. PROBLEM 4.1. Given a multiet of enitive attribute value, a privacy-annotated domain generalization hierarchy S that correpond to a ditribution over, find a -private generalization k of uch that qutdvrw$xzy HJC]JcZ;E54N> i minimized. We call k the optimal -private generalization of. Thi problem etting can be eaily extended to handle categorical data with hierarchie, by defining the range of each ubdomain in the hierarchy a the number of categorical value in that ubdomain. To facilitate our dicuion, we introduce the following notation. Given a ubdomain 4 and a multiet of enitive attribute value, we denote tdv to be the multiet that contain all the element in that belong to 4. For example, uppoe i " and 141i{"$. Then t v i ". Further, let T i};ec, /)//C~> be a equence of integer, i ;Eb,.//)/fb > be a equence of weight, and A be an integer. We ay ;EC 4, /)/./fc >, where C 4Y i an integer and C 4Y F CQY for B%i./)//, i an A -bound allocation of T ubject to, if CQ4, g C 4a g@ƒƒƒ5g C i{b, g b a g@ƒ)ƒƒ@g b, and q,fr Y r C 4Y F A (i.e., proportional). We ay ;EC 4, //)/C > i a maximum A -bound allocation, if for any other A -bound allocation ;ECQ4, 4 )///fc 4 >, C 4Y<ˆ 4 C 4Y, B i )/.//. With a light abue of notation, we aume that ;RJfJ.///)$> i alway an A -bound allocation that i ubject to any equence of weight. For example, uppoe we have TŠi ;R!ŒJ! $>, Ži ;L '!'Z. > and Aji.. Then ;='Z&fJ'> i the maximum A -bound allocation ubject to. If Aji8, then the only A -bound allocation of T ubject to i ;RJfJJf$>. To minimize the um of range of generalization, it i preferable to generalize a enitive attribute value to a more pecific ubdomain (i.e., one far away from the root in the privacy-annotated hierarchy). Meanwhile, to make the tuple in the group follow the target ditribution, the number of enitive value generalized to a certain level of ubdomain hould preerve the ratio between the weight of thoe ubdomain in the privacy-annotated hierarchy. Thi explain the intuition behind maximum allocation. Algorithm 1 how an optimal algorithm to the above problem. The algorithm i eentially a greedy algorithm. We tart at the root node, and determine how many tuple have to be generalized to the root node. The baic idea i that we hould puh a many of T tuple a poible to the ubtree rooted at it children, a long a the ditribution i preerved (i.e., ubject to the weight of it children). In detail, uppoe we have C element in and the root node ha children,.)//./f5 in the domain generalization hierarchy. We determine what i the maximum number of tuple that hould be generalized to ubdomain in the ubtree rooted at each Y, BDi.///), ubject to the target ditribution. The remaining tuple mut be generalized to the root domain. EXAMPLE 1. Here we ue an example to how in detail how the algorithm work. Conider the privacy-annotated hierarchy S in Figure and a multiet of enitive attribute value K, K, K, K, 5K, K. Initially, we et A to i}, and call MinSumOfRange(, S, A ). For the two children of the root of S, we have! f f G and! L šf : i '. Since the ratio between the weight of K, K and 5K, K i 1:1 in S, we can at mot have two ubdomain in the ubtree rooted at K, K in the final -private generalization. Otherwie, the target ditribution cannot be preerved. In other word, the maximum A -bound allocation i ;='!'>. And the algorithm output 1'X 1'5i8' generalized domain correponding to the root, which i ". Thi mean that any -private generalization hould contain at leat two root domain. We next call MinSumOfRange(, S Y, 2), where S Y i the ubtree rooted at $ and ) repectively. For the left child, we have! f f : iœ' and! f f : iœ'. The maximum 2-bound allocation of would be ;L.>. Therefore, at thi tep, we do not output any generalized ubdomain a 'G ž Ÿ hi8. A imilar proce happen for the ubtree rooted at ".

6 S > > l i l > i The algorithm continue to the leaf node in the hierarchy. The optimal generalization of would be Z.$, ",, "$, "$". Note that a we continue to the children of a node by calling function MinSumOfRange, we pa the ubtree rooted at a child node the new bound. But we till pa, all the tuple in the group, to the function. In other word, our algorithm doe not need to decide which tuple enitive attribute value i generalized to which ubdomain. Thi deciion i not relevant becaue we will later permute all the generalized ubdomain anyway. We only need to know what generalized ubdomain are in an optimal olution. Thi i the eential reaon for the efficiency of the algorithm. Algorithm 1 MinSumOfRange(, S, A ): optimal generalization for the minimum um of range problem Let be the root of S Let, //./)f5 be the children of the root Let i ;Eb,.///Lb > be the weight of,./)//5 in S Let T i ; td./// t[ Compute ;EC[,././/LCK>, the maximum A -bound allocation of T ubject to Output A q Y, C Y copie of to the final generalization k for each ubtree S-Y rooted do if C YD then MinSumOfRange(, S Y, CQY ) end if end for for all ubdomain 54 bottom-up from all the leaf node. Therefore the complexity of thi tep i ; auming i greater than the number of ubdomain in S. The above algorithm imply doe a depth-firt traveral of S, with complexity of ; >. Thu the overall complexity i ; >, i.e., linear to the ize of the microdata. We can compute tdv THEOREM 1. The multiet of ubdomain generated by the algorithm MinSumOfRange i a -private generalization with the minimum um of range of ubdomain. The complexity of Min- SumOfRange i linear to the ize of the microdata. 4.2 Partitioning Quai-Identifier We have hown an optimal algorithm that find a -private generalization with the minimum um of range of ubdomain for a given et of enitive attribute value. Meanwhile, we oberve that the more tuple in a group an aggregate query elect, the more accurate the bound tend to be. For example, conider group 1 in Figure 2. If a query ak for the average alary of employee who live in the area with zipcode 11**, ince all the elected tuple are in group 1, we can get very accurate bound for thi query. On the other hand, if the elected tuple are cattered in three different group, then we can only get the trivial bound [K-K]. Since a majority of aggregate querie involve range condition, tuple with imilar quai-identifier tend to be elected together. Thi obervation ugget that, we may further partition the group pecified by the microdata owner, and have tuple with imilar quai-identifier together to improve query anwering accuracy. One poible approach i to preerve the optimal -private generalization of the whole group. In other word, we further partition the tuple in the group into multiple ubgroup uch that the union of the optimal -private generalization of each ubgroup i the ame a that of the whole group. And the optimization goal i to minimize the um or max of the ditance among the quaiidentifier of tuple in all the ubgroup. Here everal poible ditance function can be ued. However, clutering problem involving multi-dimenional attribute are generally intractable. In thi paper, we pecifically conider a pragmatic approach, where we firt partition a group into multiple ubgroup uch that tuple in each ubgroup have the ame quai-identifier. Then for each ubgroup we find it optimal -private generalization. We call thi algorithm the QI-SA algorithm. In contrat, we ue SA-only to denote the approach that ue only the optimal enitive attribute generalization to anwer querie without further partitioning. One advantage of QI-SA i that, given any aggregate query, either all or none of the tuple in a ubgroup are elected by the query. On the other hand, though the union of each ubgroup optimal -private generalization i till a -private generalization for the whole group, it may not be optimal. Thu in general we cannot claim that one approach alway yield more accurate query anwer than the other. In our experiment, we will perform a detailed comparion of the two approache with different data et. 5. INTEGRATION OF FAKE VALES In thi ection, we conider the ue of fake value to further improve query anwering accuracy. A hown in ection 2, adding fake value may reduce the level of generalization. However, if we do not limit the number of fake value, though the um of range of generalization can alway be reduced to, it may not improve the bound for querie. The um of range of generalization can erve a a reaonable heuritic only when we retrict the number of added fake value. Formally, we tudy the following problem. PROBLEM 5.1. Given a multiet of enitive attribute value, a privacy-annotated hierarchy S correponding to a target ditribution over, and a threhold, find a multiet l of no more than fake value, uch that ª«BRC~2[ A 5lX dh!c]jcz;n] žlxfs X l ;N %l S > for hort) i minimized. 5.1 Challenge For implicity, for the ret of our dicuion, we aume S a binary hierarchy. A mentioned before, with appropriate privacy annotation, a binary hierarchy can repreent any ditribution over a domain. EXAMPLE 2. Suppoe <i Z J$, i ', and S i the uniform ditribution over $.///)ŒZ. The optimal olution i for l to have only one fake value (either 7 or 8). We can eaily verify that any l with two fake value i uboptimal. Thi example ugget that it i not ufficient to only examine et l that contain exactly fake tuple. In fact, we can alo how that there exit fake value et l which i locally optimal but uboptimal globally. By locally optimal, we mean that for any lz, and l a, where l$, ± and $² l a, we have ;N l, S > ;N ³l S > and z;n@ *l a S > ;Nd l S >. EXAMPLE. Conider i±$!! and that l i±$ i a locally optimal olution. The optimal generalization for ž 1l i [1-2], [-4], [5-6], [7-8], [1-4], [5-8], whoe um of range i 1. For any lz, with ize 1, the optimal generalization for l$, i [1-2], [-4], [5-6], [7-8], [1-8], whoe um of range i 11. Similarly, for any la with ize, the optimal generalization for [ hl a i [1-2], [-4], [5-6], [7-8], [1-4], [5-8], [1-8], whoe um of range i 17. Though l i locally optimal, it i not a globally optimal olution, which hould be l 4 io'!jjœ$, a ;N %l 4 fs >7i«. i iu. We can ee

7 ² ² ² ; ² ² The above example how that Problem 5.1 cannot be olved by equentially canning fake value et from ize to ize and uing local optimality a a topping condition. To further how the challenge in olving thi problem, let u conider a impler cae. Suppoe we only allow to add a ingle fake value, and the target ditribution i uniform. Aume in the number of value in the left ubtree i one more than that in the right ubtree. When adding a fake value, a natural conjecture i that it i optimal to add a value belonging to the right ubtree. Intuitively, by doing o the number of value in the two ubtree are balanced and thu cloer to the target ditribution. If thi conjecture were true, the problem can be olved in a traightforward top-down manner. nfortunately, it turn out that adding fake value to the ubtree with fewer value in i not alway the bet choice. EXAMPLE 4. Conider = 1, 1, 1, 2,, 4, 5, 6, 7,,, 11, 11, 1, 1, 15, 15, where the domain {i $ D//./.$. Here ha one more element in the ubdomain Œ# than If we add a fake value to the right ubtree, i.e., ³ "#, then the optimal generalization would be three copie of [1-8], two copie of [-1], [11-12], [1-14] and [15-16] repectively, and a ingle copy of [1-2], [-4], [5-6], [7-8], [1-4], [5-8] and [-16] repectively, whoe um of range i 46. Intead, if we add 8 which belong to the left ubtree, the optimal generalization would be two copie of [1-16], [-1], [11-12], [1-14] and [15-16] repectively, and a ingle copy of [1-1], [2-2], //)/, [8-8], whoe um of range i Œ ˆ $. The above example how that when determining where to put fake value, we have to take the whole data et into conideration. Heuritic that only examine local propertie (e.g., the balance of the ubtree at ome level of the generalization hierarchy) would not yield optimal olution. 5.2 Optimal Algorithm Next we preent an optimal algorithm for Problem 5.1. The baic idea i illutrated a follow. For implicity, aume the target ditribution repreented by S i uniform. Let the two children of the root domain be, Suppoe we want to find a et l of exactly fake value, among which I come from, and 8I come from 5a, uch that ;N* µl S > i minimized. Once I i fixed, we would know exactly how many value hould be generalized to the root domain and from which ide. In!²!² detail, let C i t[ I and A i tk ui (which are the number of value in z l that belong to, and a repectively). If C³ A, then exactly C@ <A value hould be generalized to the root domain, and they are all from,. Thu, to minimize ;N l S >, we need to do the following. Firt, chooe a et l a of ¹I fake value, uch that ;N tk l a S tm > i minimized, where S tm i the hierarchy rooted at a. Second, chooe a et l, of I fake value, and then chooe l 4 6«tD l,, where l 4 iuc< A, uch that z;n td <lz,[ ³l 4=S t[ > i minimized. In other word, for the ide of,, we need to inert I fake value and then remove C -A value o that the reulting data et offer the minimum um of range of generalization. Note that thi i not the ame a imply inerting I ;EC5 A> fake value, a the C ¹A removed value may come from both the inerted fake value and the original data et td. In general, if S i not uniform, for both ubdomain we may need to inert ome fake value and then remove everal other. For example, uppoe in S the ratio between, and a i 2:1. Originally t[ i and tm i8. Now aume we want to add fake value to each of td and tm. In thi cae, we need to have 5 value generalized to the root domain, 1 from thoe in, and 4 from a. That mean, for td, we need to inert fake value and then remove 1 value. And for tm, we hould inert fake value and then remove 4 value. Here we ee that ometime the number of removed value may be more than that of thoe inerted. The above dicuion how that Problem 5.1 i a pecial cae of a more general problem: adding a et of fake value to and then removing y value, what i the minimum um of range for the remaining data et after it i generalized and permuted to achieve -privacy? We denote the problem a º HJ Jc!;N]f y S >. Our dicuion alo ugget that thi problem ha the optimal ubtructure property, and i amenable to dynamic programming olution. Specifically, let the ratio between, and a be H»g:¼. Suppoe among the added fake value, I belong to ubdomain, and ŸI belong to ubdomain a. Clearly, to minimize the um of range of generalization, the fewer value generalized to the root domain, the better. Let ;E ~f½j> be the maximum pair uch that F td (² I, ½-F tk (² and g$½ziuh g¼. Therefore, among the V² value, there hould be at leat L² ³;E ½J> to be generalized to. Remember that we alo need to remove y value. If y F "² 7 ;E ½J>, we can imply take y value out from thoe generalized to the root domain. Otherwie, we have to further take value from td and tm. Thu, in general, we hould let ;E Kf½J> be the maximum pair uch that g½ iuh g¼, F td ² I, ½<F tk ² K hi, and )² ;E ½J>: y. Once ;E Kf½J> i determined, we eentially break the olution to º HJ &cz;n]l y f 5> into three part: (1) thoe value generalized to the root domain ; (2) thoe value generalized to the ubdomain within the hierarchy rooted at, ; and () thoe value generalized to the ubdomain within the hierarchy rooted at 1a. For the ubdomain, and td, we eentially inert I fake value and then remove y, i td.² I- Ÿ value, i.e., it i the ubproblem º HJ &cz;n t[ IK y,)s td >. Similarly, for the ubdomain 5a, we have ubproblem º HJ Jc!;N tk fik y a"f tm >, where y a i tm.² ;R z I >M Ÿ½. In ummary, we have º HJ JcZ;N] y 5>Di q rx¾r º HJ &cz;n td fik y, t[ > º HJ &cz;n tm fik y a" tk > - ½5 y >L dh!c]jc!;ez> where, ½, y, and y a are calculated a decribed above. Algorithm 2 how the peudocode for the optimal algorithm. For implicity, we preent the algorithm uing recurion, which can be eaily converted to a tandard dynamic programming algorithm. To olve Problem 5.1 completely, we invoke minsorfake(,,, S ) for i J.//)/ in order to identify the optimal number of fake value to add. Another intereting obervation i that, if we et iœ, i.e., we do not inert any fake value, then algorithm minsorfake i exactly the ame a algorithm MinSumOfRange. EXAMPLE 5. Let zi»z 'ZJZJŹ $ and i±$.//)/œz. Aume S i a balanced binary tree that repreent the uniform ditribution over. Suppoe we want to inert exactly 2 fake value into, and thu invoke minsorfake(, 2,, S ). At the root level, we firt let I%i and Ii ', i.e., all the fake value are from 5 Œ"#, and will have nb=à$cáui and n.b=à$c i. Since now the right ubtree ha more value than the left one, we have to extract value from the right tree and generalize them to the root domain. Thi i exactly what the algorithm doe, a we et i ½uiÂ, y, i» and y a i, and invoke minsorfake(&ã,fä LÅ,,, S*Ã,fÄ LÅ ) and minsorfake( à ÄXÆ Å, 2,,S à ÄXÆ Å ). Becaue we do not need to add or remove any value from Ã,fÄ LÅ, minsorfake( Ã,fÄ LÅ,,, S Ã,fÄ LÅ ) i the ame a MinSumOfRange( Ã,fÄ LÅ, S Ã,fÄ LÅ, Ã,fÄ LÅ ).

8 > > ² ' Î > Algorithm 2 minsorfake(,, y, S ): the minimum um of range of generalization when allowing fake value Let be the root of S Let, and a be the left and right children of the root if minsorfake(,, y, S ) calculated before then return the calculated reult end if if S i a leaf node then return end if A*BRC =inf; for I = to do let H<g$¼ be the ratio between left and right children of the root nb=à$cá = td +I nb=à$c = tk + z ³I let ;E Kf½J> be the maximum pair uch that Çgd½ ièhpgh¼, F td V² I, ½-F tm O² *I, and V² h ;E ½J> y y,ži td ² I< y a:i tm ² z ŸI- ½ A É = minsorfake( t[, I, y,,s t[ )+ minsorfake( tk, 1 ŸI, y a,s tm )+ ; ³ < ³½5 y >KÊ hhjc]jcz;ez> if A É ˆ A*BRC then A%BRCi AzÉ end if end for return A*B=C After minsorfake( à Ä]Æ Å, 2,,S à Ä]Æ Å ) i invoked, we alo firt check the cae I¹i. A we need to eventually remove value from the domain z ËŒ"#, we will have i ½Ÿi, y,-i and y a i. Here we take a total of 4 value from the domain "# and «Œ#, among which are removed (they are in fact thoe taken to the higher level to be generalized), and the remaining one i generalized to z Œ"#. The algorithm will then continue to the next level of S. From the example, we ee that the algorithm doe not really need to generate pecific fake value to add. Intead, it directly compute domain generalization uppoing optimal fake value are added. 5. Complexity Analyi Suppoe the hierarchy S i a balanced binary tree, and the domain of the enitive attribute i (i.e., the root domain of S ). Oberve that there are at mot ' node in S. For each node, ~² the algorithm can be invoked with at mot poible value of the number of fake value to be inerted in the node ubtree. And for each node and each poible number of fake value to inert in Z²8 the node ubtree, there are at mot value for the number of value to remove from the ubtree. Thu a natural but looe bound for the number of cell in the dynamic programming matrix 7² ². For each cell, the computation take the i 'J; >); K² minimum over poible cell, which give the time bound a ; a ; ² >. However, oberve that, given and S, even though algorithm minsorfake ha two additional parameter and y, y i not a free parameter. From the peudocode we ee that, once the number of fake value for each ubdomain of the root i fixed (i.e., I and 5 I ), y i alo uniquely determined. Let Ì be the depth of a node 54 in S (where the root depth i ). Then the number of poi- 7² X² tdv ² Summed over all the ' Í node in the ame level a 14, we get ž² '> Í Z²u ' Í >. Note that the firt term ble choice of fake value to add i bounded by ; >LÍ, which, baed on the above obervation, alo bound the number of poible choice of value to remove from the ubtree. Further, a the number of value to remove from a ubtree cannot exceed the number of value in 4, a tighter bound i given by A*B=CD;f; >VÍZ >. the bound for the number of value to remove from all node in that level a A*B=CD;f;=' i mall cloe to the root of the tree and get much larger than the econd term cloe to the leave of the tree, if i reaonably large. Summed over all level (and hence all the node) in the tree, the um of the econd term i given by ;L ²»Î Ï > + '. Thu, even ignoring the firt term in A%BRCD;f;=' ² '> Í $²«' Í >, thi would yield a bound for the number of cell to be maintained in the dynamic programming matrix a ; D².>); ;L ²uÎ Ï > + >, which i much tighter than the bound '!; ~².>); ² given above. Similarly, a much tighter bound for time complexity i given by ; a ; ÎPÏ + '. >f>. THEOREM 2. A -private generalization with minimum um of range of ubdomain 7² when adding no more than fake value i obtained uing invocation of Algorithm minsorfake. The pace and time complexitie of the algorithm are ; ; Î Ï +. >f> and ; a ; Î Ï + >f> repectively. 6. EXPERIMENTS Our experiment are conducted on the Adult Databae from the CI Machine Learning Repoitory [12]. The databae i obtained from the S Cenu data, and contain 14 attribute and over 48, tuple. The ame databae ha been commonly ued in previou work on microdata anonymization [5,7]. We chooe the ame eight attribute a quai-identifier in our experiment in accordance to previou work. Since our approach focue on numerical enitive attribute, we chooe capital lo a the enitive attribute. In particular, we are intereted in thoe people who do have capital lo. Therefore, we remove thoe tuple whoe capital lo attribute are or NLL. That leave u with 1427 tuple. The range of capital lo in thee tuple i from 155 to, with 8 ditinct value. We alo conduct experiment on ynthetic data et with the ame chema a the Adult Databae. We populate a table with different number of tuple, auming certain ditribution of the capital lo attribute. We alo conider the correlation between capital lo and quai-identifier. The detail of the ynthetic data et will be decribed later when we preent the experimental reult. We deign the following experiment to verify the effectivene of our approach. In all the experiment, we evaluate the accuracy Î of the bound derived from an anonymized table. Specifically, let and be the lower and upper bound of an aggregate query reult y. We define c yy i ;E h >f y to be the relative error of the bound. The maller c y"y i, the more accurate the bound are. The performance of anonymization through SA generalization. We how the accuracy of aggregate query anwer of different query ize, when applying the SA-only algorithm and the QI-SA algorithm on both real and ynthetic data et. The impact of adding fake value. We how the impact of integrating different number of fake value with the QI-SA and SAonly cheme. The impact of the target ditribution. We tudy the accuracy tradeoff when the data owner pecifie different target ditribution other than the actual ditribution of the enitive attribute in the original microdata. Enforcing different target ditribution on different part of the data. We how the effectivene of our algorithm when we enforce different target ditribution for different part of the data. Next, we decribe each et of experiment in detail. nle otherwie pecified, the domain generalization hierarchy ued in thee