Differential Privacy Differential Privacy Primer (ii)

(Book to back)

Interested in the difference between privacy, read a few articles, to understand the general idea. Now decided to look again, found some article content is not very understand, simply on the side of the translation while looking, do not know where I will underline, if someone saw, also please feel free. (Note: The article is Cynthia Dwork's "Differential Privacy")

The non-implementation of complete protection of privacy breaches this "impossible outcome" requires attention to the usefulness of the data, after all, if a mechanism only outputs an empty string or is simply noise, it is also clear that privacy is protected. Starting with some existing mechanisms, such as histogram publishing or k-anonymity technology [19], it is clear that for a useful mechanism, his output should not be predicted by the user, nor is it in the stochastic mechanism, but the unpredictability is not a random selection of random mechanisms. In the sense that there should be a series of problems (most of them), the answers to these questions are for the user to learn, but they are not known beforehand. So we propose an availability vector called W, which is a binary vector with a fixed length of k (no special meaning for binary values). We can assume that the answer to the data question is these availability vectors. Database privacy violations can be described by Turing C, input the description of the database distribution D, through this description to generate a database db, a so-called privacy violation of the string and output a separate bit (we do not know what the distribution of the specific D is what). We ask C to always stop. We say that if in C, given a pair (D,DB), a C (d,db,s)-accepted string s is generated, the privacy is considered violated. The following C will be omitted.
The additional information generator is a Turing, whose input is the distribution of the database D and the database db in this build, outputting an additional information string Z. Both the attacker and the simulator get the string. The emulator does not have any database permissions, and the attacker can access the database through a privacy protection mechanism.
We use an AC Turing to simulate our opponents. The following theory shows that for any privacy-preserving san () and any distribution in the San () that satisfies a certain technique, d, there will always be some additional information z, so that Z has no effect on its own, but it can be considered a privacy breach if it is combined with access to the database. In addition to formalizing the entropy requirements of the utility vectors discussed above, the technical conditions in the distribution show that understanding the length of privacy leaks does not help people to guess privacy issues. Theory 1: Given any privacy protection mechanism san () and a Privacy Disclosure Judge C.  There is an additional information generator and an attacker, for any distribution that satisfies the Assumption 3 D, and all of the simulated attackers A *, Pr[a (D,san (d,db), X (d,db)) wins]-pr[a* (D,x (d,db)) wins]>=∆ ∆ a qualified selected constant. The probability spaces is over choice of db∈r D and the coinflips of San, X, A, and a∗. (Translator: It is said that the existence of privacy protection mechanism increases the risk of privacy leaks ∆. ）
Distribution D describes any information the attacker knows about the database before it sees the information that the additional information generator outputs. For example, you might know that a database row is associated with a person who has at least two pets. Note that in the declaration of the theorem, all parties may be able to distribute D, and possibly have a hard link to C; however, they are not used by attackers.
When all w is obtained from the San (DB) The strategy selected by X and a: to study our point of view, we first use some informal way to describe this special case strategy, in which case the opponent always learns all the utility vector w from the privacy mechanism. This is more realistic, for example, when data cleansing provides a statistical histogram of the number of people who are sick at all ages, or a subset of data cleaners randomly selected from the database to publish statistics for different diseases and ages. This simple example allows us to use a more general version of hypothesis 3: Assuming 2:1, arbitrary 0<γ<1, existence nγ, making pr[| Db|>nγ]<γ (db belongs to RD); nγ can be computed as output by D. 2, existence of an L is the following two are established: (a) given any privacy leakage length l, the minimum entropy of using vectors is L. (b) A privacy breach of length l for each db belonging to D. The 3,pr[b (D,san (DB)) wins]<=u was established and is a suitable small constant for any interactive Turing b,u. The probability is taken through the coinflips of B and the privacy mechanism San (), as well as the choice of Db∈r D.
Intuitively, Part 2 (a) means that we can randomly extract the L-bits from the usability vectors ...
(The slave dull, more and more do not understand, the next article directly to the differential privacy bar)