Consider a data holder, such as a hospital or a bank, that has a privately held collection of person-specific, field structured data. Suppose the data holder wants to share a version of the data with researchers. How can a data holder release a version of its private data with scientific guarantees that the individuals who are the subjects of the data cannot be re-identified while the data remain practically useful? The solution provided in this paper includes a formal protection model named k-anonymity and a set of accompanying policies for deployment. A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release. This paper also examines re-identification attacks that can be realized on releases that adhere to k- anonymity unless accompanying policies are respected. The k-anonymity protection model is important because it forms the basis on which the real-world systems known as Datafly, µ-Argus and k-Similar provide guarantees of privacy protection.

k -anonymity: a model for protecting privacy

Publishing data about individuals without revealing sensitive information about them is an important problem. In recent years, a new definition of privacy called k-anonymity has gained popularity. In a k-anonymized dataset, each record is indistinguishable from at least k − 1 other records with respect to certain identifying attributes.In this article, we show using two simple attacks that a k-anonymized dataset has some subtle but severe privacy problems. First, an attacker can discover the values of sensitive attributes when there is little diversity in those sensitive attributes. This is a known problem. Second, attackers often have background knowledge, and we show that k-anonymity does not guarantee privacy against attackers using background knowledge. We give a detailed analysis of these two attacks, and we propose a novel and powerful privacy criterion called e-diversity that can defend against such attacks. In addition to building a formal foundation for e-diversity, we show in an experimental evaluation that e-diversity is practical and can be implemented efficiently.

/pdf/l-diversity-privacy-beyond-k-anonymity-54qdj1526d.pdf

L-diversity: Privacy beyond k-anonymity

Over the past five years a new approach to privacy-preserving data analysis has born fruit [13, 18, 7, 19, 5, 37, 35, 8, 32]. This approach differs from much (but not all!) of the related literature in the statistics, databases, theory, and cryptography communities, in that a formal and ad omnia privacy guarantee is defined, and the data analysis techniques presented are rigorously proved to satisfy the guarantee. The key privacy guarantee that has emerged is differential privacy. Roughly speaking, this ensures that (almost, and quantifiably) no risk is incurred by joining a statistical database.

In this survey, we recall the definition of differential privacy and two basic techniques for achieving it. We then show some interesting applications of these techniques, presenting algorithms for three specific tasks and three general results on differentially private learning.

/pdf/differential-privacy-a-survey-of-results-36msco9vw4.pdf

Differential privacy: a survey of results

A fruitful direction for future data mining research will be the development of techniques that incorporate privacy concerns. Specifically, we address the following question. Since the primary task in data mining is the development of models about aggregated data, can we develop accurate models without access to precise information in individual data records? We consider the concrete case of building a decision-tree classifier from training data in which the values of individual records have been perturbed. The resulting data records look very different from the original records and the distribution of data values is also very different from the original distribution. While it is not possible to accurately estimate original values in individual data records, we propose a novel reconstruction procedure to accurately estimate the distribution of original data values. By using these reconstructed distributions, we are able to build classifiers whose accuracy is comparable to the accuracy of classifiers built with the original data.

Privacy-preserving data mining

Publishing data about individuals without revealing sensitive information about them is an important problem. In recent years, a new definition of privacy called \kappa-anonymity has gained popularity. In a \kappa-anonymized dataset, each record is indistinguishable from at least k—1 other records with respect to certain "identifying" attributes. In this paper we show with two simple attacks that a \kappa-anonymized dataset has some subtle, but severe privacy problems. First, we show that an attacker can discover the values of sensitive attributes when there is little diversity in those sensitive attributes. Second, attackers often have background knowledge, and we show that \kappa-anonymity does not guarantee privacy against attackers using background knowledge. We give a detailed analysis of these two attacks and we propose a novel and powerful privacy definition called \ell-diversity. In addition to building a formal foundation for \ell-diversity, we show in an experimental evaluation that \ell-diversity is practical and can be implemented efficiently.

/pdf/l-diversity-privacy-beyond-k-anonymity-43op5i6gzs.pdf

L-diversity: privacy beyond k-anonymity

(1976). A Systematic Approach to Automatic Edit and Imputation. Journal of the American Statistical Association: Vol. 71, No. 353, pp. 17-35.

A Systematic Approach to Automatic Edit and Imputation

In Section 1 the nature of statistical confidentiality is explored, i.e., its essential role in the collection of data by statistical offices, its relationship to privacy and the need for increased attention to potential statistical disclosures because of the increased tabulation and dissemination capabilities of statistical offices. In Section 2 a definition of inadvertent direct disclosure is provided as well as a theorem concerning a test for residual disclosure of tabulations. In Section 3 different media and methods of data dissemination are considered from the point of view of potential for statistical disclosure.

On the Question of Statistical Confidentiality

The impact on linear statistics of the sample design used in obtaining survey data is the subject of much of sampling literature. Recently, more attention has been paid to the design's impact on nonlinear statistics; the major factor inhibiting these investigations has been the problem of estimating at least the first two moments of such statistics. The present article examines the problem of estimating the variances of nonlinear statistics from complex samples, in the light of existing literature. The behavior of the chi-squared statistic computed from a complex sample to test hypotheses of goodness of fit or independence is studied. Alternative tests are developed and their properties studied in simulation experiments.

Approximate Tests of Independence and Goodness of Fit Based on Stratified Multistage Samples

Summary The objective of national statistical systems is to provide relevant, comprehensive, accurate and objective (politically untainted) statistical information. The end purposes to be supported by the information are multiple, but include prominently the monitoring of the evolution of the country's economic and social conditions, the planning and evaluation of government and private sector programs and investments, policy debates and advocacy, and the creation and maintenance of an informed public. The presentation will discuss ten broad criteria for the assessment of national statistical systems. They are: 1. The broad framework, including the legal one as well as the rank and standing of a Chief Statistician; 2. Professional core values; 3. Non-political objectivity and the means used to assure this; 4. Systems and approaches used to assess and meet federal priorities; 5. Systems and approaches used to assess and meet state (provincial) priorities; 6. Systems and approaches to assess and meet other users' priorities; 7. Mechanisms for the coordination of the statistical system; 8. Balancing priorities against available resources; 9. Serving the needs of different client groups; 10. Generating a supportive environment.

Characteristics of an Effective Statistical System

Hansen, Hurwitz and Bershad [3] have provided an estimator for the correlated response variance based on the interpenetration of a sample of interviewers' assignments. This article provides a second estimator of the correlated response variance based on the work of all interviewers (those working on interpenetrated assignments as well as the other interviewers). Under certain specified conditions the two estimators are uncorrelated so that an appropriate linear combination of them is an estimator with smaller variance than the Hansen, Hurwitz and Bershad estimator. Both estimators are unbiased and based on the same field experiment so that the reduction in the variance through their joint use incurs only the cost of computation.

Ivan P. Fellegi

Papers

A Systematic Approach to Automatic Edit and Imputation

On the Question of Statistical Confidentiality

Approximate Tests of Independence and Goodness of Fit Based on Stratified Multistage Samples

Characteristics of an Effective Statistical System

An Improved Method of Estimating the Correlated Response Variance