Blowfish Privacy: Tuning Privacy-Utility Trade-offs using Policies

Privacy definitions provide ways for trading-off the privacy of individuals in a statistical database for the utility of downstream analysis of the data. In this paper, we present Blowfish, a class of privacy definitions inspired by the Pufferfish framework, that provides a rich interface for this trade-off. In particular, we allow data publishers to extend differential privacy using a policy, which specifies (a) secrets, or information that must be kept secret, and (b) constraints that may be known about the data. While the secret specification allows increased utility by lessening protection for certain individual properties, the constraint specification provides added protection against an adversary who knows correlations in the data (arising from constraints). We formalize policies and present novel algorithms that can handle general specifications of sensitive information and certain count constraints. We show that there are reasonable policies under which our privacy mechanisms for k-means clustering, histograms and range queries introduce significantly lesser noise than their differentially private counterparts. We quantify the privacy-utility trade-offs for various policies analytically and empirically on real datasets.Comment: Full version of the paper at SIGMOD'14 Snowbird, Utah US

Linear and Range Counting under Metric-based Local Differential Privacy

Local differential privacy (LDP) enables private data sharing and analytics without the need for a trusted data collector. Error-optimal primitives (for, e.g., estimating means and item frequencies) under LDP have been well studied. For analytical tasks such as range queries, however, the best known error bound is dependent on the domain size of private data, which is potentially prohibitive. This deficiency is inherent as LDP protects the same level of indistinguishability between any pair of private data values for each data downer. In this paper, we utilize an extension of $\epsilon$-LDP called Metric-LDP or $E$-LDP, where a metric $E$ defines heterogeneous privacy guarantees for different pairs of private data values and thus provides a more flexible knob than $\epsilon$ does to relax LDP and tune utility-privacy trade-offs. We show that, under such privacy relaxations, for analytical workloads such as linear counting, multi-dimensional range counting queries, and quantile queries, we can achieve significant gains in utility. In particular, for range queries under $E$-LDP where the metric $E$ is the $L^1$-distance function scaled by $\epsilon$, we design mechanisms with errors independent on the domain sizes; instead, their errors depend on the metric $E$, which specifies in what granularity the private data is protected. We believe that the primitives we design for $E$-LDP will be useful in developing mechanisms for other analytical tasks, and encourage the adoption of LDP in practice

Laser-assisted spin-polarized transport in graphene tunnel junctions

Keldysh nonequilibrium Green's function method is utilized to study theoretically the spin polarized transport through a graphene spin valve irradiated by a monochromatic laser field. It is found that the bias dependence of the differential conductance exhibits successive peaks corresponding to the resonant tunneling through the photon-assisted sidebands. The multi photon processes originate from the combined effects of the radiation field and the graphene tunneling properties, and are shown to be substantially suppressed in a graphene spin valve which results in a decrease of the differential conductance for a high bias voltage. We also discussed the appearance of a dynamical gap around zero bias due to the radiation field. The gap width can be tuned by changing the radiation electric field strength and the frequency. This leads to a shift of the resonant peaks in the differential conductance. We also demonstrate numerically the dependencies of the radiation and spin valve effects on the parameters of the external fields and those of the electrodes. We find that the combined effects of the radiation field, the graphene, and the spin valve properties bring about an oscillatory behavior in the tunnel magnetoresistance (TMR), and this oscillatory amplitude can be changed by scanning the radiation field strength and/or the frequency.Comment: 31 pages, 5 figures, corrected version to the paper in J. Phys.: Condens. Matter 24 (2012) 26600