Design of Policy-Aware Differentially Private Algorithms

Transcription

1 Design of Policy-Aware Differentially Private Algorithms Samuel Haney Due University Durham, NC, USA Ashwin Machanavajjhala Due University Durham, NC, USA Bolin Ding Microsoft Research Remon, WA, USA ABSTRACT The problem of esigning error optimal ifferentially private algorithms is well stuie. Recent wor applying ifferential privacy to real worl settings have use variants of ifferential privacy that appropriately moify the notion of neighboring atabases. The problem of esigning error optimal algorithms for such variants of ifferential privacy is open. In this paper, we show a novel transformational equivalence result that can turn the problem of query answering uner ifferential privacy with a moifie notion of neighbors to one of query answering uner stanar ifferential privacy, for a large class of neighbor efinitions. We utilize the Blowfish privacy framewor that generalizes ifferential privacy. Blowfish uses a policy graph to instantiate ifferent notions of neighboring atabases. We show that the error incurre when answering a worloa W on a atabase x uner a Blowfish policy graph is ientical to the error require to answer a transforme worloa f (W) on atabase g (x) uner stanar ifferential privacy, where f an g are linear transformations base on. Using this result, we evelop error efficient algorithms for releasing histograms an multiimensional range queries uner ifferent Blowfish policies. We believe the tools we evelop will be useful for fining mechanisms to answer many other classes of queries with low error uner other policy graphs. 1. INTRODUCTION The problem of private release of statistics from atabases has become very important with the increasing use of atabases with sensitive information about iniviuals in government an commercial organizations. ɛ-differential privacy [3] has become the stanar for private release of statistics ue to its strong guarantee that similar inputs must yiel similar outputs. Two input atabases are similar if they are neighbors, meaning that they iffer in the presence or absence of a single recor. Output similarity is quantifie by ɛ, which bouns the log-os of generating the same output from any pair of neighbors. Thus, if a recor correspons to This wor is license uner the Creative Commons Attribution- NonCommercial-NoDerivatives 4.0 International License. To view a copy of this license, visit For any use beyon those covere by this license, obtain permission by ing info@vlb.org. Proceeings of the VLDB Enowment, Vol. 9, No. 4 Copyright 2015 VLDB Enowment /15/12. all the ata from one iniviual, ifferential privacy ensures that a single iniviual oes not influence the inferences that can be rawn from the release statistics. Small ɛ results in greater privacy but also lesser utility. Thus, ɛ can be use to trae-off privacy for utility. However, in certain applications (e.g., [17]), the ifferential privacy guarantee is too strict to prouce private release of ata that has any non-trivial utility. Tuning the parameter ɛ is not helpful here: enlarging ɛ egraes the privacy guarantee without a commensurate improvement in utility. Hence, recent wor has consiere relaxing ifferential privacy by moifying the notion of neighboring inputs by efining some metric over the space of all atabases. Application esigners can use this in aition to ɛ to better traeoff privacy for utility. This iea has been applie to graphs (egeversus vertex-ifferential privacy [17]), streams (event- instea of iniviual-privacy [6]), location privacy (geo-inistinguishability [1]) an to stuy fairness in targete avertising ([4]), an has been formalize by multiple propose framewors ([2, 11, 12]). While these relaxations permit algorithms with significantly better utility than the stanar notion of ifferential privacy, such algorithms must be esigne from scratch. It is unnown how to erive algorithms that optimally leverage the relaxe privacy guarantee provie by the moifie notion of neighbors to result in the least loss of utility. For instance, there are no nown algorithms for releasing histograms or answering range queries with high utility uner geo-inistinguishability. Moreover, there is no nown metho to utilize the literature on ifferentially private algorithms for this purpose. In this paper we present a novel an theoretically soun methoology for esigning algorithms for relaxe privacy notions using algorithms that satisfy ifferential privacy, thus briging the algorithm esign problem uner ifferent privacy notions. Our results apply to the Blowfish privacy framewor [11], which generalizes ifferential privacy by allowing for ifferent notions of neighboring atabases (or privacy policies). We use this methoology to erive novel algorithms that satisfy Blowfish uner relaxe privacy policies for releasing histograms an multi-imensional range queries that have significantly better utility than the best nown ifferentially private algorithms for these tass. In the rest of this section, we present an overview of our results, escribe the outline of the paper an then iscuss relate wor. Overview of Our Results. We first informally introuce the Blowfish privacy framewor to help unerstan our theoretical an algorithmic results. The Blowfish framewor instantiates a large class of similarity or neighbor efi- 264

2 nitions, using a policy graph efine over the omain of atabase recors. Two input atabases are neighbors if they iffer in one recor, an the iffering values form an ege (u, v) in the policy graph. Thus, one can not infer whether an iniviual s value was u or v base on the release output. For example, consier a gri policy graph (we will stuy its general form later in this paper): uniformly ivie a 2D map into gri cells, an each atabase recor is one of the 2 gri cells; only nearby points, e.g., pairs within Manhattan istance θ, are connecte by eges in the policy graph. Such a policy when use for location ata implies that it is acceptable to reveal the rough location of an iniviual (e.g., the city), as two points belonging to two ifferent cities are far away so no ege in the policy graph connects them; however, it requires that fine-graine location information (e.g., whether the iniviual is at home or at a nearby cafe) be hien, when two gri points are close enough. This special instance of Blowfish framewor is similar to a recently propose notion calle geo-inistinguishability [1]. Our main result is calle transformational equivalence, an we aim to show that a mechanism M for answering a set of linear queries W on a atabase x satisfies (ɛ, )- Blowfish privacy (i.e., ifferential privacy where neighboring atabases are constructe with respect to the policy graph ) if an only if M is a mechanism for answering a transforme set of queries f (W) on a transforme atabase g (x) that satisfies ɛ-ifferential privacy. Here, f an g are linear transformations. However, we can not hope to prove such an equivalence in general. We prove (Theorem 4.4) that such an equivalence result implies that there exist a metho to embe istances on any graph to istances in the L 1 metric without any istortion. This is because the istance between two input atasets inuce by the neighborhoo relation for ifferential privacy is the L 1 metric, an the istance uner Blowfish is relate to istances on graph. Such a istortion free embeing is not nown for large classes of graphs (e.g., a cycle) [16]. Nevertheless, we are able to show this equivalence result for a large class of mechanisms an for a large class of graphs. First, we show that the transformational equivalence result hols for all algorithms that are instantiations of the matrix mechanism framewor [14]. Matrix mechanisms algorithms, lie Laplace mechanism for releasing histograms, an hierarchical mechanism [10] an Privelet [18] for answering range queries, are popular builing blocs for ifferentially private algorithm esign. Transformational equivalence hols for such ata inepenent mechanisms since the noise introuce by such mechanisms is inepenent of the input atabase. (The negative result uses a ata-epenent mechanism whose error epens on the input atabase). Next, we are also able to show that when is a tree there exist linear transformations f an g such that any mechanism M for answering W on atabase x satisfies (ɛ, )- Blowfish privacy if an only if M is an ɛ-ifferentially private mechanism for answering f (W) on atabase g (x). The result follows (though not immeiately) from the fact that trees permit a istortion free embeing into the L 1 metric [7, 16]. This result hols for all privacy mechanisms, incluing ata-epenent mechanisms. Finally, while the equivalence result oes not hol for general mechanisms an general policy graphs, we can achieve an approximate equivalence. More specifically, we show the following subgraph approximation result: if an are such that every ege (u, v) in is connecte by a path of length at most l in, then a mechanism M that ensures (l ɛ, )-Blowfish privacy also ensures (ɛ, )-Blowfish privacy. Thus, if for a graph there is a tree T such that istances in are not istorte by more than a multiplicative factor of l in the tree T, then there exist transformations f T an g T such that an ɛ-ifferentially private mechanism M for answering f T (W) on atabase g T (x), is also an (l ɛ, )- Blowfish private mechanism for answering W on x. Aitionally, a irect consequence of transformational equivalence is it allows us to erive error lower bouns an general approximation algorithms for Blowfish private mechanisms by extening wor on error lower bouns for ifferentially private mechanisms [9, 15]. We refer the reaer to the full paper [8] for these results. We apply the transformational equivalence theorems to erive novel (near) optimal algorithms for answering multiimensional range query an histogram worloas uner reasonable Blowfish policy graphs (lie the gri graph). We reuce the problem of esigning a Blowfish algorithm to that of fining a ifferentially private mechanism for a new worloa W = f (W) an a atabase x g = g (x). We esign matrix mechanism algorithms for all the policy graphs, an ata epenent techniques when is a tree or can be approximate by a tree. For the policy graphs we consier, we show a polylogarithmic (in the omain size) improvement in error compare to the best ata oblivious ifferentially private mechanism. We also present empirical results for the tass of answering 1- an 2-imensional range queries to show that our ata epenent algorithms outperform their ifferentially private counterparts. Organization. The rest of this section is a brief survey of relate wor. Section 2 presents notations an efinitions that we will use throughout the paper. Section 3 introuces an motivates the Blowfish privacy framewor. We escribe our main result, transformational equivalence in Section 4. Section 5 presents novel mechanisms for answering multiimensional range queries an histogram queries uner various instantiations of the Blowfish framewor, an presents the subgraph approximation lemma. In Section 6, we perform experiments comparing the performance of our Blowfish private mechanisms to ifferentially private mechanisms, an explore ata-epenent mechanisms. Relate Wor. As mentione earlier, wors ([1],[4]) have evelope relaxations of ifferential privacy that have specific applications (e.g. location privacy). Other wor has focuse on eveloping flexible privacy efinitions that generalize all these application specific notions. The Pufferfish framewor [12] generalizes ifferential privacy by specifying what information shoul be ept secret, an the aversary s prior nowlege. He et al. [11] propose the Blowfish framewor which also generalizes ifferential privacy an is inspire by Pufferfish. [2] investigates notions of privacy that can be efine as metrics over the set of atabases. All these framewors allow finer graine control on what information about iniviuals is ept secret, an what prior nowlege an aversary might possess, an thus allow customizing privacy efinitions to the requirements of ifferent applications. As far as we aware, all previous wor on relaxe privacy efinitions have evelope mechanisms irectly for their applications. We on t now of any wor which shows how to map these relaxe privacy efinitions to instances of ifferential privacy. 265

3 Figure 1: PRELIMINARIES I (left) an C (right) worloas. Databases an Query Worloas. Let T = {v 1, v 2,..., v } be a omain of values with omain size T =. A atabase D is a set of entries whose values come from T. Let I n be the set of all atabases D over T such that the number of entries in D is n, i.e., D = n. An let I be the set of all atabases with any number of entries. We represent a atabase D as a vector x R with x[i] enoting the true count of entries in D with the i th value of the omain T. That is, the atabase is represente as a histogram over the omain. A linear query q is a -imensional row vector of real numbers with answer q x. If the entries of q are restricte to 1 s an 0 s, we sometimes call q a linear counting query, since it counts the number of entries in D with a particular subset of values in the omain. A worloa is a set of q linear queries. So a worloa can be represente as a q matrix W = [q 1q 2... q q] R q, where each vector q i R correspons to a linear query. The answer to the worloa W is W x, whose entries will be answers to the iniviual linear queries. Example 2.1. Figure 1 shows examples of two well stuie worloas. I is the ientity matrix representing the histogram query on T reporting [x[1]x[2]... x[]]. C correspons to the cumulative histogram worloa, where each query correspons to the prefix sum i j=1 x[j]. Differential privacy is base on the concept of neighbors. Two atabases are neighbors if they iffer in one entry. Definition 2.1 (Neighbors [5]). Any two atabases D an D are neighbors iff they iffer in the presence of a single entry. That is, v T, D = D {v} or D = D {v}. An algorithm satisfies ifferential privacy if its outputs on any two neighboring atabases are inistinguishable. Definition 2.2 (ɛ-differential privacy [5]). A ranomize algorithm (mechanism) M satisfies ɛ-ifferential privacy if for any subset of outputs S range(m), an for any pair of neighboring atabases D an D, Pr[M(D) S] e ɛ Pr[M(D ) S]. A slightly ifferent efinition of neighbors yiels a common variant of ifferential privacy: one atabase can be obtaine from its neighbor by replacing one entry x with a ifferent value y T. The resulting privacy notation is calle ɛ-inistinguishability or boune ɛ-ifferential privacy. Unless otherwise specifie, we use the term ifferential privacy to mean the original unboune version (Definitions ). Sensitivity an Private Mechanisms. Suppose we use a ifferentially private algorithm M to publish the result of a worloa W on a atabase D that is represente as a vector x. M is calle ata inepenent if the amount of noise M as oes not epen on the atabase x, an ata epenent otherwise. In both cases, the amount of noise epens the sensitivity of a worloa. 1 enotes the L 1 norm. Definition 2.3 (Sensitivity [5, 15]). Let N enote the set of pairs of neighbors. The L 1 sensitivity of W is: W = max Wx Wx 1. (x,x ) N Example 2.2. The L 1 sensitivities of I an C are 1 an, resp. A well-stuie class of ifferentially private algorithms is calle Laplace mechanism [5]. Let Lap(σ) m be a m- imensional vector of inepenent samples, where each sample is rawn from η exp( x σ ). Measuring Errors. We use mean square error to measure the amount of noise injecte in private algorithms. Definition 2.4 (Error). Let W = [q 1q 2... q q] be a worloa of linear queries, an M be a mechanism to publish the query result privately. Let x be the vector representing the atabase. The mean square error of answering a worloa W on the atabase x using M is q ERROR M(W, x) = E [ (q i x M(q i, x)) 2] i=1 where M(q, x) is the noisy answer of query q. We efine the ata-inepenent error of a mechanism M to be ERROR M(W) = max {ERRORM(W, x)}. x Laplace mechanism is nown to provie ɛ-ifferential privacy with mean square error as a function of L 1 sensitivity. Theorem 2.1 ([5]). Let W be a q worloa. The Laplace mechanism L(W, x) = Wx + Lap(σ) q satisfies ɛ- ifferential privacy, with ERROR L(W) = 2q 2 W/ɛ BLOWFISH PRIVACY The Blowfish privacy framewor, originally introuce by He et al. [11], is a class of privacy notations that generalize neighboring atabases in ifferential privacy. It allows privacy policy to focus only on neighbors that users are sensitive about. The major builing bloc of an instantiation of Blowfish is calle policy graph. A policy graph encoes users private an sensitive information by specifying which pairs of omain values in T shoul not be istinguishe between by an aversary. By carefully choosing a policy graph (or equivalently, restricting the set of neighboring atabases), Blowfish traes-off privacy for potential gains in utility. Definition 3.1 (Policy graph). A policy graph is a graph = (V, E) with V T { }, where is the name of a special vertex, an E (T { }) (T { }). The above efinition of policy graph is slightly ifferent from the one in [11] with an aitional special vertex to generalize both unboune an boune versions of ifferential privacy. Intuitively, an ege (u, v) E efines a pair of omain values that an aversary shoul not be able to istinguish between. is a ummy value not in T, an an ege (u, ) E means that an aversary shoul not be able to istinguish between the presence of a tuple with value u or the absence of the tuple from the atabase. For technical reasons, if there is some ege incient on, we a a 266

4 zero column vector 0 into the worloa W to correspon to the ummy value, as well as a zero entry in the atabase vector x corresponingly. So it is ensure that every noe in V is associate with a column in W an an entry in x. We next revisit the Blowfish privacy framewor. Definition 3.2 (Blowfish neighbors). We consier a policy graph = (V, E). Let D an D be two atabases. D an D are neighbors, enote (D, D ) N (), iff exactly one of the following is true: D an D iffer in the value of exactly one entry such that (u, v) E, where u is the value of the entry in D an v is the value of the entry in D ; D iffers from D in the presence or absence of exactly one entry, with value u, such that (u, ) E. Definition 3.3 ((ɛ, )-Blowfish Privacy). Let be a policy graph. A mechanism M satisfies (ɛ, )-Blowfish privacy if for any subset of outputs S range(m), an for any pair of neighboring atabases (D, D ) N (), Pr[M(D) S] e ɛ Pr[M(D ) S]. Policy graph an Privacy guarantee. Policy graphs are use to efine how privacy will be guarantee to users, inepenent of an aversary s nowlege. For example, when the users require the strongest privacy guarantee, the following two policy graphs can be use, = (V, E) such that E = {(u, ) u T }, an = (V, E) such that E = {(u, v) u, v T }, which correspons to the unboune an boune versions of ifferential privacy, respectively. More generally, if a policy graph oes not inclue, we are essentially focusing on atabases from I n, i.e., atabases with fixe nown size. When the privacy guarantee is relaxe, we can ajust the policy graphs so that our algorithms in Section 5 will have higher utility. Following are two examples of esigning such policy graphs for real-life scenarios. (Line raph) Consier a totally orere omain T = {a 1, a 2,..., a }, where i : a i < a i+1. One such example is a atabase of binne salaries of iniviuals, where a i correspons to a salary between 2 i 1 an 2 i. When only revealing rough ranges of salaries is fine, it is OK for an aversary to istinguish between values that are far apart (e.g., a 1 vs a ) but not istinguish between values that are closer to each other. So we can use a line graph as our policy graph to express this guarantee, where only ajacent omain values a i an a i+1 are connecte by an ege. (ri raph) In the scenario of location ata, when revealing rough location information is fine but more precise location information is private, we can use a gri policy graph (also iscusse in Section 1). Here, a 2D map uniformly ivie into gri points as noes in the graph (i.e., T = {1,..., } {1,..., }). Only nearby points are connecte by eges: E = {(u, v) (u, v) θ} where (u, v) enotes the istance between two points u, v T (e.g., Manhattan istance) an θ is a policy-specific parameter. Metric on atabases. In general, a policy graph introuces a metric over atabases, which quantifies the privacy guarantee provie by Blowfish. Consier two atabases that iffer in one tuple: D 1 = D {u} an D 2 = D {v}, efine the istance between D 1 an D 2 be ist (u, v), i.e., the length of the shortest path between u an v in. For mechanism M satisfying (ɛ, )-Blowfish privacy (Defs ), we have, Pr[M(D 1) S] e ɛ ist (u,v) Pr[M(D 2) S]. (1) For two atabases iffering in more than one tuple, we can repeately apply (1) for each iffering tuple. For the gri graph policy, changing the location of a tuple from u to v results in the output probabilities of M iffering by a factor of e ɛ if (u, v) θ, an iffering be a factor of e ɛ (u,v)/θ in general. So finer graine location information gets stronger protection. This privacy guarantee is ientical to a recent notion calle geo-inistinguishability [1]. In this paper, we assume Blowfish policy graphs are connecte. We iscuss Blowfish policies with isconnecte components in the full version. 4. TRANSFORMATIONAL EQUIVALENCE We now present our main result, calle transformational equivalence, which we will use to esign Blowfish private algorithms later in the paper. This result establishes a mechanism-preserving two way relationship between Blowfish privacy an ifferential privacy. In general, our transformation can be state as follows: For policy graph, there exists a transformation of the worloa an atabase, (W, x) (W, x ) such that Wx = W x, an a mechanism M is an (ɛ, )-Blowfish private mechanism for answering worloa W on input x if an only if M is also an ɛ-ifferentially private mechanism for answering W on x. However, we can t hope to show this result in general. We prove that for certain mechanisms transformational equivalence hols only when istances on a graph can be embee into points in L 1 with no istortion. It is well nown [16] that not all graphs permit such embeings. Hence, we show ifferent results for ifferent restrictions on M an. In Section 4.1, we show that uner a class of mechanisms calle the matrix mechanism, transformational equivalence hols for any policy graph. In Section 4.2, we show via a metric embeing-lie argument that when is a tree, transformational equivalence hols for any mechanism M. In Section 4.3, we state the negative result for general graphs an mechanisms, an present an approximate transformational equivalence that uses spanning trees of albeit with some loss in the utility. All of our results rely on the existence of a transformation matrix P with certain properties, whose construction is iscusse in Section Equivalence for Matrix Mechanism Li et al [14] escribe the matrix mechanism framewor for optimally answering a worloa of linear queries. The ey insight is that while some worloas W have a high sensitivity, they can be answere with low error by answering a ifferent strategy query worloa A such that (a) A has a low sensitivity A, an (b) rows in W can be reconstructe using a small number of rows in A. In particular, let A be a p matrix, an A + enote its Moore-Penrose pseuoinverse, such that WAA + = W. The matrix mechanism is given by the following: M A (W, x) = Wx + WA + Lap( A /ɛ) p (2) where, Lap(λ) p enotes p inepenent ranom variables rawn from the Laplace istribution with scale λ. Recall 267

5 that A is the sensitivity of worloa A. It is easy to see that all matrix mechanism algorithms are ata inepenent (i.e., the noise is inepenent of the input ataset). In orer to exten matrix mechanisms to Blowfish, we efine the Blowfish specific sensitivity of a worloa, W () analogously to Definition 2.3: Definition 4.1. The L 1 policy specific sensitivity of a query matrix W with respect to policy graph is,w () = max (x,x ) N() Wx Wx 1 Let P be a matrix that satisfies the following properties. We will escribe its construction in Section 4.4. P has V 1 rows an E columns. Let W = WP. Then W () = W. I.e., the sensitivity of worloa W uner Blowfish policy is the same as the sensitivity of W uner ifferential privacy. P has full row ran (an therefore a right inverse P 1 ). For vector x we let x enote P 1 x. iven such a P, we can show our first transformational equivalence result. Theorem 4.1. Let be a Blowfish policy graph an W be a worloa. Suppose P exists with the properties given above. Then the matrix mechanism given by Equation 2 is both a (ɛ, )-Blowfish private mechanism for answering W on x an an ɛ-ifferentially private algorithm for answering W on x. Since Wx = W x, the mechanism has the same error in both instances. Proof. We show that Wx+WA + Lap( A() ɛ ) p = W x +W A + Lap( A ) p. ɛ First, WP P 1 x = WI x = Wx. Next, by assumption we have that A () = A. Finally, W A + = WP (AP ) + = WP P + A + = WA + (P has full row ran) 4.2 Equivalence when is a Tree When is a tree, we can show something stronger, that transformational equivalence hols for any mechanism M. More formally, suppose P has the following property. Claim 4.2. If is a tree, any pair of y, z R are neighbors accoring to the Blowfish policy if an only if P 1 y an P 1 z are neighbors accoring to unboune ifferential privacy (which are vectors with L 1 istance of 1). We construct a P satisfying Claim 4.2 in Section 4.4. Our stronger transformational equivalence result follows. Theorem 4.3. Let x R represent a atabase, W be a worloa with q linear queries, an = (V, E) be a Blowfish policy graph an a tree. We can fin an invertible mapping given by f(x, W, ) = (P 1 x, WP), where P is a matrix epening on, such that M is a (, ɛ)-blowfish private mechanism for answering (W, x) with error α if an only if M is an ɛ-ifferentially private mechanism for answering (WP, P 1 x) with error α. Proof. Suppose P satisfies the properties given at the beginning of the section. Then, mechanism M will have the same error on both instances, since the true answers to the worloas are the same in both cases: WP P 1 x = WI x = Wx. Aitionally, the mapping is invertible, since WP P 1 = W an P P 1 x = x. M is both (ɛ, )-ifferentially private on W, x an ɛ-ifferentially private on W, x, since the mapping preserves neighbors. 4.3 eneral raphs an Mechanisms We can show that we can not hope to prove transformation equivalence for general graphs an mechanisms. First we efine an embeing of graphs. Definition 4.2. Let = (V, E) be a graph. Let ρ be a eterministic mapping from vertices in V to real value vectors. Let (u, v) enote the shortest istance between vertices u an v, an (ρ(u), ρ(v)) = ρ(u) ρ(v) 1 the L 1 istance between the mappe vectors. We efine the stretch of mapping ρ to be max u,v V (ρ(u), ρ(v))/ (u, v), or the maximum multiplicative increase in istances ue to the mapping. Similarly the shrin of ρ is efine as min u,v V (ρ(u), ρ(v))/ (u, v), or the smallest multiplicative ecrease in istances. We call ρ an isometric embee if stretch an shrin equal to 1. We now show that for graphs with no isometric embeing into points in L 1, transformational equivalence oes not hol. It is well nown that such graphs exist. One example is the cycle on n vertices, for which no eterministic mapping is nown with stretch less than (n 1) [16]. Theorem 4.4. Let be a graph that oes not have an isometric embeing into points in L 1. There exists a mechanism M an worloa W such that for any transformation of (W, x) (W, x ) such that Wx = W x, either M is not an (ɛ, )-Blowfish private mechanism for answering W on x, or M is not a ɛ-ifferentially private mechanism for answering W on x. We refer the reaer to the full paper for all proofs in this section. We woul lie to note that transformational equivalence hols for policy graphs that are trees, since trees can be isometrically embee into points in L 1, an the P we construct is one such mapping. Moreover, the proof for Theorem 4.4 requires a mechanism M that is ata-epenent; it uses the exponential mechanism that introuces noise that epens on the input. We believe ata epenence is necessary for the negative result, an hence we were able to show transformational equivalence for matrix mechanism algorithms (that are ata inepenent). Despite the negative result, we next show an approximate transformational equivalence for general graphs an mechanisms with some loss in utility. The error in our approximate transformation is proportion to the stretch resulting from embeing into a spanning tree of,. Transformational equivalence can then be applie on giving us an approximate equivalence uner the original graph. Lemma 4.5. (Subgraph Approximation) Let = (V, E) be a policy graph. Let = (V, E ) be a spanning tree of on the same set of vertices, such that every (u, v) E is connecte in by a path of length at most l ( is sai to 268

6 be an l-approximate subgraph 1 ). Then for any mechanism M which satisfies (ɛ, )-Blowfish privacy, M also satisfies (l ɛ, )-Blowfish privacy. Corollary 4.6. Let be a graph an let be an l- approximate spanning tree. Suppose M is an ɛ ifferentially private mechanism for W, x. Then, M is an (l ɛ, )- Blowfish private mechanism for W, x. Since Wx = W x, the mechanism has the same error in both instances. A well-nown result of Facharoenphol et al [7] (Theorem 2) shows that any metric can be embee into a istribution of trees with O(log n) expecte stretch. It woul be esirable to use this result to give a O(log(n))-approximate subgraph for any graph. However, because the boun on stretch only hols in expectation, our privacy guarantee woul only hol in expectation! A eterministic embeing with low stretch oes not always exist. To see this, consier an n-vertex cycle. Any spanning tree consists of all but one ege (u, v) from the cycle. While u an v were istance 1 apart in the cycle, they are istance n 1 apart in the spanning tree! If we pice a spanning tree at ranom by ranomly choosing the ege that was roppe the expecte stretch is only 2. Using a union boun over all pairs in this example, we can also see that it is impossible to guarantee a low stretch (an therefore a privacy guarantee) with high probability. Therefore, we cannot apply Lemma 4.5 in a general way to fin a suitable spanner for any policy graph. However, the lemma is still useful in many cases an we will use it throughout the rest of the paper. 4.4 Construction of P Our construction of P from the policy graph is relate to the vertex-ege incience matrix, where every row correspons to a vertex in, every column correspons to an ege in. A column has two non-zero entries (1 an -1) in the rows corresponing vertices connecte by the corresponing ege. We can view P an P 1 as linear transformations from the vertex omain V to the ege omain E. While x correspons to counts on vertices of, the transforme atabase x = P 1 x woul assign weights to eges in. Similarly, while an original linear query q W associates weights on (a subset of) vertices in, a query q W = WP associates weights on (a subset of) eges in. This intuition will be very useful when using the equivalence result to esign (ɛ, )-Blowfish algorithms. We cannot just use the vertex-ege incience matrix as P since it may either have + 1 rows (when contains ), or since it oes not have an inverse (when oes not contain ). We will escribe our construction of P that satisfies all our constraints in the rest of the section. The etails are quite technical, an an unintereste reaer can sip over them an still unerstan the rest of the paper. As mentione before, we assume is connecte. Case I: Unboune (with ) We start our construction with a simple case. Let = (V, E) be a connecte unirecte graph, with V = T { }, T =. We efine P to be the following E -matrix: let each row of P correspon to a value in T ; for each ege 1 While we that require V () = V ( ), the proof oes not require to be a subgraph of (i.e., E E). But it suffices for the applications of this technique in this paper. Figure 2: Example policy graph an their P, P 1 (u, v) E (u, v ), a a column to P with a 1 in the row corresponing to value u, a 1 in the row corresponing to value v (orer of 1 an 1 is not important), an zeros in the rest of the rows; an for each ege (u, ) E (u ), a a column with a 1 in the row corresponing to u an zeros in the rest. Figure 2 gives an example. It is easy to see that P has all the properties require for our transformational equivalence results to hol. Lemma 4.7. Let W be a worloa, an be a policy graph. Then W () = W. Lemma 4.8. P constructe above has ran. As P has ran, an E, it has a right inverse: P 1 = P (P P ) 1. Finally, we prove Claim 4.2: When is a tree P isometrically maps neighbors uner policy graph to neighbors uner ifferential privacy. Lemma 4.9. Suppose P is constructe for a Blowfish policy graph as above, an is a tree. Any pair of atabases y, z R are neighbors accoring to the Blowfish policy if an only if P 1 y an P 1 z are neighboring atabases accoring to unboune ifferential privacy. We refer the reaer to the full paper for all the proofs. Case II: Boune (without ) We next consier a slightly more involve case: let = (V, E) be a connecte unirecte graph, with V = T, where T =. If we follow the same construction as in Case I, rows in the resulting P are not linearly inepenent any is not well-efine (no right inverse can be efine for P ). Fortunately, for every such, we can replace one vertex in V with, enoting the resulting graph as, an corresponingly moify W an x to W, x resp., such that (a) P is full ran, (b) answering W on x uner policy has the same error as answering W on x uner, an (c) Wx can be reconstructe from the answer to W x. Pic any value v V ; in = (V, E ), let V = V {v}+ { } an E = E {(v, u) u V } + {(, u) (v, u) E}. more, an thus P 1 Then falls into Case I, so we can construct P an P 1 as in Case I. We transform x by removing the entry x[v] (enote as x v). We then transform W to W by removing the column v an rewriting all queries that epen on x[v] to use n j v x[j], where n = i T x[i] is the size of the input atabase, without any loss in our ability to answer the original queries. We can o this because when is not in, neighboring atabases have the same number of tuples. We can show that our construction satisfies all three requirements (a), (b), an (c) iscusse above. Lemma Consier, W, an x v constructe above. We have: i) Wx = W x v + c(w, n), where c(w, n) is a constant vector epening only on W an the size of the atabase; an ii) any two atabases y an z are neighbors uner if an only if y v an z v are neighbors uner. 269

7 Error per query Worloa Blowfish ɛ-diff. [18] R 1 Θ(1/ɛ 2 ) O(log 3 /ɛ 2 ) θ O( log3 θ ɛ 2 ) O( log3( 1) R Figure 3: bouns. 1 θ ɛ 2 ) O( 3 log3( 1) log 3 θ ɛ 2 ) O(log 3 /ɛ 2 ) Summary of ata inepenent error Require: W is a worloa of range queries, x is a atabase. 1: function 1DRange(W, x) 2: x P 1 1 x // prefix sums from x 3: x Differentially private estimate for x 4: W WP 1 // ifferences between prefix sum pairs 5: return W x 1 Algorithm 1: 1D range queries. Technical etails of the construction an proof of correctness are presente in the full paper. Example 4.1. Recall the C worloa from Figure 1. In C, the last row computes n, the size of the atabase. Since we alreay now n, we o not nee to answer that query privately. We can equivalently consier a worloa C with all zeros in the last row an removing the last column (since it woul have all zeros). We can also remove the all zero row that remains resulting in a ( 1) by ( 1) matrix. Consier the line graph with noes connecte in a path. We can replace the rightmost noe with (Figure 2) to get. P is a ( 1) ( 1) matrix that is full ran, an P 1 is equal to C. Thus, by Theorem 4.3 an Lemma 4.10, the minimum error for answering C uner Blowfish policy 1 is equal to the minimum error for answering C P = I 1 uner ɛ- ifferential privacy. Since I 1 is the ientity worloa, an optimal ata inepenent strategy woul be to a Laplace noise to yiel a total error of Θ(/ɛ 2 ). 5. BLOWFISH PRIVATE MECHANISMS In this section, we erive mechanisms (with near optimal ata inepenent error) for answering range queries an histograms uner Blowfish policies to illustrate the power of the transformational equivalence theorem. In Section 5.1 we efine the types of queries an graphs we will be focusing on. In Sections 5.2 an 5.3 we present strategies for answering multi-imensional range queries uner the gri graph policy. These algorithms are ata inepenent an incur the same error on all atasets. In Section 5.4, we exten our strategies to get ata epenent algorithms for Blowfish. Figure 3 summarizes our ata inepenent error bouns. The error incurre by ata epenent versions of our algorithms will be evaluate in Section Worloas an Policy raphs Consier a multiimensional omain T = [], where [] enotes the set of integers between 1 an (inclusive). The size of each imension is an thus the omain size is. A atabase in this omain can be represente as a (column) vector x R with each entry x i enoting the true count of a value i T. It is important to note that our results in this paper can be easily extene to the case when imensions have ifferent sizes. A multiimensional range query can be represente as a -imensional hypercube with the bottom left corner l an the top right corner r. In particular, when = 1, a range query q(l, r) is a linear counting query which count the values within l an r in the atabase x, i.e., q(l, r)x = l i r xi. Let R enote the worloa of all such one imensional range queries, ı.e., R = {q(l, r) l, r [] l r}. Similarly, let R = {q(l, r) l, r [] l r} enote the worloa of all -imensional range queries. Note that each range query can be represente as a -imensional row vector, an R can be represente as a q matrix, where q = (( 1)/2) is the total number of range queries. The class of policy graphs θ = (V, E) we consier here are calle istance-threshol policy graphs. They are efine base on the L 1 istance in the omain T = []. Consier two vertices u = (u 1,..., u ) an v = (v 1,..., v ) V [], the L 1 istance between is u v = u 1 v u v. There is an ege (u, v) in E if an only if u v θ. Two special cases of θ an their semantics were iscusse in Section 3 as line graph ( 1 ) an gri graph ( θ 2). We note that the ata inepenent mechanisms we present for one imensional range queries uner 1 an θ (Sections an 5.3.1) are similar to the ones presente in the original Blowfish paper [11]. We present them here to illustrate our transformational equivalence an subgraph approximation results, an to help the reaer unerstan our novel mechanisms for multi-imensional range queries. 5.2 Range Queries uner 1 In this section we first escribe the easy case of 1D range queries before consiering multi-imensional range queries. We will heavily utilize the structure of the transforme query worloa in this section. The following lemma helps relate the queries in W to the queries in W. Lemma 5.1. Let q be a linear counting query (that is, all entries in q are either 1 or 0), an = (V, E) be a policy graph. Let {v 1,..., v l } V be the vertices corresponing to the nonzero entries of q. Then, the nonzero columns of q P = q correspon to the set of eges (u, v) with exactly one en point in {v 1,..., v l }. That is, {(u, v) : {u, v} {v 1,..., v l } = 1}. Proof. Each entry c of q satisfies c = u v where u, v are entries in q an (u, v) E. c is nonzero exactly when u v, or equivalently, when {u, v} {v 1,..., v } = R uner 1 We begin with a simple case: one-imensional range queries uner a one-imensional line graph. We outline the application of Theorem 4.3 in Algorithm 1. Recall from Example 4.1 that the inverse of P 1 is the cumulative histogram worloa. Therefore, the transforme atabase x = P 1 x 1 correspons to the set of prefix sums in x. Algorithm 1 computes a ifferentially private estimate of x (say using the Laplace mechanism). 270

8 Figure 4: A one imensional range query on vertices is transforme into a query on eges (represente by ashe lines). (a) with a two imensional range query, represente by a grey box. The eges in the transforme query (satisfying Lemma 5.1), are shown with ashe lines. These eges form four ranges. (b) For each row of vertical eges, we answer all ranges over the row. One such row is shown with ashe lines. We must o the same for columns, an one such column is shown with otte lines. Figure 5: Answering R 2 uner 1 2. Next, we transform the queries. Note that for any range query q = [l, r], by Lemma 5.1 q contains at most two nonzero elements (this is illustrate in Figure 4) corresponing to the eges (l 1, l) an (r, r + 1). The values of x at these eges are the prefix sums l 1 i=1 xi an r i=1 xi, an their ifference is inee the answer to the original range query. We can show the following boun on the ata inepenent error of Algorithm 1. Theorem 5.2. Algorithm 1 with x 1 = x 1 + Lap(1/ɛ) answers worloa R with Θ(1/ɛ 2 ) error per query uner (ɛ, 1 )-Blowfish privacy. Proof. Every q 1 (l, r) R 1 can be reconstructe by summing at most two queries in x 1. Each entry in has Θ(1/ɛ 2 ) error from the Laplace mechanism. q 1 (l, r) incurs only Θ(1/ɛ 2 ) error. x 1 So each In fact we show that Algorithm 1 is the optimal ata inepenent algorithm for answering range queries in 1D uner 1. The proof appears in the full version of the paper [8]. Lemma 5.3. Any (ɛ, 1 )-Blowfish private mechanism answers R with Ω(1/ɛ 2 ) error per query. The best nown ata inepenent strategy (with minimum error) for answering R uner ɛ-ifferential privacy is the Privelet strategy [18] with a much larger asymptotic error of O(log 3 /ɛ 2 ) per query R uner 1 1 is a gri with vertices an ( 1) 1 eges. Let us consier the problem in two imensions first. (see Figure 5a). The transforme omain (after using Theorem 4.3) woul be the set of eges in the graph. Consier a 2D range query q([x, y], [x, y ]) (grey box in figure). The transforme query q has non-zero entries corresponing to eges on the bounary of the original range query (ashe lines in the figure). Note that these eges can be ivie into 4 contiguous ranges of eges; i.e., q is the sum of 4 isjoint range queries in the transforme omain. Thus, a strategy for answering the transforme query worloa in two imensions woul be to answer all one imensional range queries along the rows (ashe vertical eges in Fig 5b) an columns (otte horizontal eges in Fig 5b) uner ifferential privacy. There are 2( 1) such sets of range queries. Note that these sets of range queries are isjoint, an can each be answere using ɛ-ifferential privacy (uner parallel composition). Any query q can be compute by aing up the answers to 2 row range queries an 2 column range queries. In imensions, q will be the sum of 2 ( 1)-imensional range queries on the transforme ataset x, each corresponing to a face of the -imensional range query. Our strategy woul be to answer ( 1) sets of ( 1)-imensional range queries uner ɛ-ifferential privacy. We boun the ata inepenent error of our algorithm. Theorem 5.4. Worloa R can be answere with O( log 3( 1) /ɛ 2 ) error per query uner (ɛ, 1 )-Blowfish privacy. Proof. For each imension, we must answer 1 sets of ( 1)-imensional range queries, for a total of ( 1) sets of ( 1)-imensional ranges. As we have shown, all of these sets are isjoint an can be answere in parallel. Therefore, the total error is just the error of answering one of these sets of ranges. We can answer these ranges using Privelet [18] with O( log3( 1) ) error. To answer our query, we must ɛ 2 sum 2 of these ranges for a total error of O( log3( 1) ). ɛ 2 By Theorem 4.3, we can answer R uner 1 with the same error per query. We get a Ω(log 3 ) factor better error than ifferential privacy using Privelet [18] uner a fixe imensionality. 5.3 Range Queries uner θ We next consier answering range queries uner a more complex graph. Unlie in the case of 1, the worloas resulting from the use of Theorem 4.3 to the θ policy are not well stuie uner ifferential privacy. We will use subgraph approximation to esign Blowfish private mechanisms R uner θ We next present an algorithm for answering one imensional range queries uner, θ. These results generalize the results from Section 5.2.1, an will leverage subgraph approximation (Lemma 4.5). We first escribe how to obtain a subgraph H θ from θ. We esignate /θ vertices at intervals of θ; call these re vertices. In H, θ consecutive re vertices are connecte to form a path (lie the line graph). All non-re vertices are only connecte to the next re vertex (to its right); i.e., vertices {1, 2,..., θ 1} are connecte only to vertex θ, vertices {θ + 1, θ + 2,..., 2θ 1} are connecte only to vertex 2θ, an so on. We orer the eges in H θ by their left enpoints. Lie 1, H θ is also a tree with 1 eges. Figure 6a shows 3 10 an Figure 6b shows H10. 3 Note that for all θ, a pair of ajacent vertices in θ are connecte by a path of length l 3 in H. θ So we can use subgraph approximation. Consier some query in R, say q(l, r). The corresponing query q H θ in R H θ consists of all eges with one of 271

9 (a) 3 10, each vertex is connecte to other vertices within istance 3 along the line. (b) H10 3, each vertex is connecte to the nearest re vertex to its right. (c) A range query shown on H10 3. The transforme query consists of the eges highlighte in purple an their left en points always form two contiguous ranges. () Our strategy will answer all range queries on 3 sets of eges, each set shown in a ifferent color. These sets of eges are isjoint. Figure 6: A summary of a strategy for answering R uner θ for θ = 3, = 10. Our results hol in general. the en points within the range (l, r) (Lemma 5.1). If l xθ r yθ, where xθ an yθ are the smallest re noes greater than l an r, then these eges correspon to {(i, xθ) (x 1)θ i < l} an {(j, yθ) (y 1)θ j < r} (eges connecte to otte noes in Figure 6c). That is, the transforme query q H θ (l, r) correspons to the ifference of two range queries (accoring to the orering of eges in H). θ Moreover, each range query is of length at most θ within [(x 1)θ, xθ] for some x. Thus, our strategy for answering all the queries in R H θ = R P H θ is as follows. Partition the transforme omain (or eges in H) θ into isjoint groups of θ all eges connecting a re noe to noes on its left form a group (see Figure 6). Next, answer all range queries of length at most θ within each of these groups uner ɛ-ifferential privacy (say using Privelet). Finally, reconstructing queries q H θ (l, r) R H θ using the compute range queries. Since these sets of range queries form isjoint subsets of the omain, they all can use the same ɛ privacy buget (by parallel composition). Theorem 5.5. There exists a mechanism that answers worloa R with O ( log 3 θ/ɛ 2) error per query uner (ɛ, θ )-Blowfish privacy. Proof. Our strategy partitions the transforme omain (or eges in H) θ into groups of size θ, an answers range queries over them. Using Privelet to compute range queries within each partition results in O(log 3 θ/ɛ 2 ) error per query. Queries in R H θ are ifferences of at most 2 range queries, an thus also incur at most O(log 3 θ/ɛ 2 ) error. By Theorem 4.3, the same mechanism answers R an satisfies (ɛ, H)-Blowfish θ privacy with O(log 3 θ/ɛ 2 ) error per query. For every ege (u, v) θ, u an v are connecte by a path of length at most 3, this strategy also ensure (3ɛ, θ )- Blowfish privacy. Thus, using the above strategy with privacy buget ɛ/3 gives us the require result R uner θ We now turn our attention to multiimensional range queries uner θ. Our strategy will be similar to the one in Section We fin a subgraph to approximate θ. We show the queries of the transforme worloa can be ecompose into range queries on eges of boune size, an our strategy is to answer these range queries. To get a subgraph H, θ we ivie θ into -imensional hypercubes with ege length θ (see Figures 7a an 7b). We esignate the vertices at the corners of the cubes as re vertices. We pic a mapping of hypercubes to re vertices. For example, in the 2-imensional case, we may map each square to its upper right re vertex. Each non-re vertex within a cube is connecte to this selecte re vertex (we pic a consistent mapping for vertices that are on the bounary of cubes). We call these internal eges. The re vertices are then connecte in a gri (lie 1 ) with external eges. Due to space constraints we give a brief setch of our strategy. iven a range query q, the transforme query will correspon to a set of internal an a set of external eges (as per Lemma 5.1). Since external an internal eges are isjoint, our strategy answers the transforme query restricte to the external eges an internal eges inepenently, each uner ɛ-ifferential privacy. Since the external eges form a gri graph 1 (/θ) (Figure 7c), we can use our strategy from Section to an- swer this part of the transforme query with error at most ). We can show that the non-re en points of the internal eges featuring in the transforme query for 2 -imensional range queries. However, each of these range queries has a with at most θ in one of the imensions (see Figure 7). Thus lie in Section 5.2.2, it is sufficient to answer all -imensional range queries having with at most θ in one imension. However, the eges in these range queries are not isjoint, an hence we can only use θ/ privacy buget for answering these range queries, resulting in the following error boun: O( log3( 1) /θ ɛ 2 Theorem 5.6. Worloa R can be answere with O( 3 log3( 1) log 3 θ ɛ 2 ) error per query uner (ɛ, θ )-Blowfish privacy. Discussion. Our Blowfish mechanisms uner 1 an θ policy graphs improve upon Privelet by a factor of log 3, but incur aitional error by a factor of an 3 log 3 θ respectively. Thus the propose mechanisms are better than using Privelet when log θ is small compare to log. This is true in the case of location privacy where = 2 an θ (10s of m) is usually much smaller than (1000s of m). 5.4 Data Depenent Algorithms Till now we consiere ata inepenent Blowfish mechanisms whose error is inepenent of the input atabase. Recent wor has investigate a new class of ata epenent algorithms for answering histogram an range queries 272