差分隐私
此词条暂由彩云小译翻译，翻译字数共4096，未经人工整理，Litinunispazio97审校中，带来阅读不便，请见谅。
Differential privacy is a system for publicly sharing information about a dataset by describing the patterns of groups within the dataset while withholding information about individuals in the dataset. The idea behind differential privacy is that if the effect of making an arbitrary single substitution in the database is small enough, the query result cannot be used to infer much about any single individual, and therefore provides privacy. Another way to describe differential privacy is as a constraint on the algorithms used to publish aggregate information about a statistical database which limits the disclosure of private information of records whose information is in the database. For example, differentially private algorithms are used by some government agencies to publish demographic information or other statistical aggregates while ensuring confidentiality of survey responses, and by companies to collect information about user behavior while controlling what is visible even to internal analysts.
差分隐私是一个用于公开分享数据集信息的系统，它在描述数据集中的群体特征的同时保护了数据集中的个人信息。差分隐私的理念是，如果在数据库中进行任意单次更迭的影响足够小，那么查询结果就不能用于推断任何单一个体的大量信息，因此个体的隐私得以保证。另一种对于差分隐私的描述表示，这是针对发布统计数据库Statistical Database的汇集信息的算法的约束条件，这种算法限制了数据库中信息的记录的个人信息的披露。例如，一些政府机构使用差分隐私算法公布人口信息或其他统计数据，同时确保调查结果的保密性Confidentiality；而公司则使用该算法收集用户行为信息，同时控制哪些信息对于内部分析人员是可见的。
Roughly, an algorithm is differentially private if an observer seeing its output cannot tell if a particular individual's information was used in the computation. Differential privacy is often discussed in the context of identifying individuals whose information may be in a database. Although it does not directly refer to identification and reidentification attacks, differentially private algorithms probably resist such attacks.[1]
简单来说，如果观察者发现某算法的输出不能推断出一个特定个体的信息是否被用于其计算，则该算法是差分隐私的。通常，差分隐私算法会在识别其信息可能存在于数据库中的个体时被讨论。虽然差分隐私算法不直接涉及身份识别和身份重识别Reidentification攻击，但它或许能够防御这些攻击。[1]
Differential privacy was developed by cryptographers and thus is often associated with cryptography, and draws much of its language from cryptography.
差分隐私是由密码学家开发的，因此经常与密码学Cryptography相关，且其大量内容来自于密码学。
History
Official statistics organizations are charged with collecting information from individuals or establishments, and publishing aggregate data to serve the public interest. For example, the 1790 United States Census collected information about individuals living in the United States and published tabulations based on sex, age, race, and condition of servitude. Statistical organizations have long collected information under a promise of confidentiality that the information provided will be used for statistical purposes, but that the publications will not produce information that can be traced back to a specific individual or establishment. To accomplish this goal, statistical organizations have long suppressed information in their publications. For example, in a table presenting the sales of each business in a town grouped by business category, a cell that has information from only one company might be suppressed, in order to maintain the confidentiality of that company's specific sales.
官方统计机构负责收集个人或机构的信息并公布汇集数据，以服务公众利益。例如，1790年的美国人口普查收集了生活在美国的个人的信息，并公布了基于性别、年龄、种族和奴役情况的表格。统计机构长期保证收集信息的保密性Confidentiality，即所提供的信息将用于统计目的，但出版物不会产生可追溯到具体个人或机构的信息。为了实现这一目标，统计机构长期以来一直在其出版物中压缩信息。例如，在按产业类别表示某个城镇中企业的销售情况的表格中，只有一家公司信息的单元格可能会被隐藏，从而对该公司的具体销售情况保密。
The adoption of electronic information processing systems by statistical agencies in the 1950s and 1960s dramatically increased the number of tables that a statistical organization could produce and, in so doing, significantly increased the potential for an improper disclosure of confidential information. For example, if a business that had its sales numbers suppressed also had those numbers appear in the total sales of a region, then it might be possible to determine the suppressed value by subtracting the other sales from that total. But there might also be combinations of additions and subtractions that might cause the private information to be revealed. The number of combinations that needed to be checked increases exponentially with the number of publications, and it is potentially unbounded if data users are able to make queries of the statistical database using an interactive query system.
1950年代和1960年代，统计机构采用了电子信息处理系统，这大量增加了统计机构可产出的表格数量，从而显著提高了不当暴露机密信息的潜在可能性。例如，如果一个企业的销售数字被隐藏，这些数字也被统计在该地区的总销售额中，那么可能从总销售额中减去其他销售额即可确定被隐藏的数据。或者也有可能通过增法和减法的结合，导致隐私信息被泄露。随着出版物数量的增加，需要检查的组合数量呈指数增长，甚至没有上限——如果数据的用户能够使用交互式查询系统对统计数据库进行查询。
In 1977, Tore Dalenius formalized the mathematics of cell suppression.[2]
1977年，托雷 · 达伦纽斯规范了单元抑制Cell Suppression的数学模型。[2]
In 1979, Dorothy Denning, Peter J. Denning and Mayer D. Schwartz formalized the concept of a Tracker, an adversary that could learn the confidential contents of a statistical database by creating a series of targeted queries and remembering the results.[3] This and future research showed that privacy properties in a database could only be preserved by considering each new query in light of (possibly all) previous queries. This line of work is sometimes called query privacy, with the final result being that tracking the impact of a query on the privacy of individuals in the database was NP-hard.
1979年，多萝西 · 丹宁(Dorothy Denning)、彼得 · j · 丹宁(Peter j. Denning)和迈耶 · d · 施瓦茨(Mayer d. Schwartz)正式提出了“跟踪器”(Tracker)的概念，这个对手可以通过创建一系列有针对性的查询并储存查询结果，来分析获取统计数据库的机密内容。[3]这项研究和包括之后的研究表明，只有根据(可能是所有)以前的查询来考虑每个新的查询，才能保证数据库的隐私属性。这种工作有时被称为查询隐私，最终的结果是，追溯某查询对于数据库中个人隐私造成的影响是 NP-hard问题。
In 2003, Kobbi Nissim and Irit Dinur demonstrated that it is impossible to publish arbitrary queries on a private statistical database without revealing some amount of private information, and that the entire information content of the database can be revealed by publishing the results of a surprisingly small number of random queries—far fewer than was implied by previous work.[4] The general phenomenon is known as the Fundamental Law of Information Recovery, and its key insight, namely that in the most general case, privacy cannot be protected without injecting some amount of noise, led to development of differential privacy.
2003年，Kobbi Nissim和Irit Dinur证明，在私人统计数据库上发布任意查询而不泄露一些私人信息是不可能的，而且通过公开少得惊人的随机查询的结果就可能会显示数据库的全部信息内容——远远少于以往研究的推断。[4]这种现象被称为信息恢复基本定律，其核心观点是，在最普遍的情况下，隐私无法在不加入一定量的噪音的情况下得到保护，这导致了差分隐私的发展。
In 2006, Cynthia Dwork, Frank McSherry, Kobbi Nissim and Adam D. Smith published an article formalizing the amount of noise that needed to be added and proposing a generalized mechanism for doing so.[1] Their work was a co-recipient of the 2016 TCC Test-of-Time Award[5] and the 2017 Gödel Prize.[6]
In 2006, Cynthia Dwork, Frank McSherry, Kobbi Nissim and Adam D. Smith published an article formalizing the amount of noise that needed to be added and proposing a generalized mechanism for doing so. Their work was a co-recipient of the 2016 TCC Test-of-Time Award and the 2017 Gödel Prize.
2006年，辛西娅 · 德沃克、弗兰克 · 麦克谢里、科比 · 尼西姆和亚当 · d · 史密斯发表了一篇文章，正式确定了需要增加的噪音量，并提出了一种通用的增加噪音的机制。他们的工作是2016年移动通信协会时间测试奖和2017年哥德尔奖的共同获得者。
Since then, subsequent research has shown that there are many ways to produce very accurate statistics from the database while still ensuring high levels of privacy.[7][8]
Since then, subsequent research has shown that there are many ways to produce very accurate statistics from the database while still ensuring high levels of privacy.
从那时起，随后的研究表明，有许多方法可以在保证高度隐私的同时，从数据库中生成非常准确的统计数据。
ε-differential privacy
The 2006 Dwork, McSherry, Nissim and Smith article introduced the concept of ε-differential privacy, a mathematical definition for the privacy loss associated with any data release drawn from a statistical database. (Here, the term statistical database means a set of data that are collected under the pledge of confidentiality for the purpose of producing statistics that, by their production, do not compromise the privacy of those individuals who provided the data.)
The 2006 Dwork, McSherry, Nissim and Smith article introduced the concept of ε-differential privacy, a mathematical definition for the privacy loss associated with any data release drawn from a statistical database. (Here, the term statistical database means a set of data that are collected under the pledge of confidentiality for the purpose of producing statistics that, by their production, do not compromise the privacy of those individuals who provided the data.)
2006年 Dwork、 McSherry、 Nissim 和 Smith 的文章引入了 ε- 差别隐私的概念，这是一个数学定义，用来定义从统计数据库中发布的任何数据所导致的隐私损失。(在这里，统计数据库一词是指根据保密承诺收集的一组数据，目的是编制统计数据，而编制这些数据不会损害提供数据的个人的隐私。)
The intuition for the 2006 definition of ε-differential privacy is that a person's privacy cannot be compromised by a statistical release if their data are not in the database. Therefore, with differential privacy, the goal is to give each individual roughly the same privacy that would result from having their data removed. That is, the statistical functions run on the database should not overly depend on the data of any one individual.
The intuition for the 2006 definition of ε-differential privacy is that a person's privacy cannot be compromised by a statistical release if their data are not in the database. Therefore, with differential privacy, the goal is to give each individual roughly the same privacy that would result from having their data removed. That is, the statistical functions run on the database should not overly depend on the data of any one individual.
2006年对 ε- 差别隐私的定义的直觉是，如果一个人的数据不在数据库中，那么他的隐私就不会因为统计公布而受到损害。因此，差分隐私的目标是给每个人大致相同的隐私，这将导致他们的数据删除。也就是说，在数据库上运行的统计功能不应过分依赖于任何个人的数据。
Of course, how much any individual contributes to the result of a database query depends in part on how many people's data are involved in the query. If the database contains data from a single person, that person's data contributes 100%. If the database contains data from a hundred people, each person's data contributes just 1%. The key insight of differential privacy is that as the query is made on the data of fewer and fewer people, more noise needs to be added to the query result to produce the same amount of privacy. Hence the name of the 2006 paper, "Calibrating noise to sensitivity in private data analysis."
Of course, how much any individual contributes to the result of a database query depends in part on how many people's data are involved in the query. If the database contains data from a single person, that person's data contributes 100%. If the database contains data from a hundred people, each person's data contributes just 1%. The key insight of differential privacy is that as the query is made on the data of fewer and fewer people, more noise needs to be added to the query result to produce the same amount of privacy. Hence the name of the 2006 paper, "Calibrating noise to sensitivity in private data analysis."
当然，任何个体对数据库查询结果的贡献程度部分取决于查询中涉及的人员数据的数量。如果数据库包含来自一个人的数据，那么该人的数据贡献率为100% 。如果数据库包含来自100人的数据，每个人的数据贡献率仅为1% 。差分隐私的主要观点是，由于查询是针对越来越少的人的数据进行的，所以需要在查询结果中添加更多的噪音来产生同样的隐私。因此，2006年的论文得名为《在私人数据分析中将噪声校准到灵敏度》
The 2006 paper presents both a mathematical definition of differential privacy and a mechanism based on the addition of Laplace noise (i.e. noise coming from the Laplace distribution) that satisfies the definition.
The 2006 paper presents both a mathematical definition of differential privacy and a mechanism based on the addition of Laplace noise (i.e. noise coming from the Laplace distribution) that satisfies the definition.
2006年的论文给出了差分隐私的数学定义，以及基于拉普拉斯噪音(即。拉普拉斯分布发出的噪音)。
Definition of ε-differential privacy
Let ε be a positive real number and [math]\displaystyle{ \mathcal{A} }[/math] be a randomized algorithm that takes a dataset as input (representing the actions of the trusted party holding the data). Let [math]\displaystyle{ \textrm{im}\ \mathcal{A} }[/math] denote the image of [math]\displaystyle{ \mathcal{A} }[/math]. The algorithm [math]\displaystyle{ \mathcal{A} }[/math] is said to provide [math]\displaystyle{ \epsilon }[/math]-differential privacy if, for all datasets [math]\displaystyle{ D_1 }[/math] and [math]\displaystyle{ D_2 }[/math] that differ on a single element (i.e., the data of one person), and all subsets [math]\displaystyle{ S }[/math] of [math]\displaystyle{ \textrm{im}\ \mathcal{A} }[/math]:
[math]\displaystyle{ \Pr[\mathcal{A}(D_1) \in S] \leq \exp\left(\epsilon\right) \cdot \Pr[\mathcal{A}(D_2) \in S], }[/math]
where the probability is taken over the randomness used by the algorithm.[9]
Let ε be a positive real number and \mathcal{A} be a randomized algorithm that takes a dataset as input (representing the actions of the trusted party holding the data). Let \textrm{im}\ \mathcal{A} denote the image of \mathcal{A}. The algorithm \mathcal{A} is said to provide \epsilon-differential privacy if, for all datasets D_1 and D_2 that differ on a single element (i.e., the data of one person), and all subsets S of \textrm{im}\ \mathcal{A}:
\Pr[\mathcal{A}(D_1) \in S] \leq \exp\left(\epsilon\right) \cdot \Pr[\mathcal{A}(D_2) \in S],
where the probability is taken over the randomness used by the algorithm.
设 ε 是一个正实数，而 mathcal { a }是一个以数据集作为输入(表示持有数据的受信任方的操作)的随机化算法。让 textrm { im }数学{ a }表示数学{ a }的映像。算法数学{ a }被称为提供 epsilon-differentiation 保密性，如果对于所有数据集 d1和 d2在单个元素上不同(即，一个人的数据) ，以及所有 textrm { im }数学{ a }的子集 s: Pr [ mathcal { a }(d _ 1)在 s ] leq exp left (epon right) cdot Pr [数学{ a }(d _ 2)在 s ]中，其中概率取代了算法所使用的随机性。
Differential privacy offers strong and robust guarantees that facilitate modular design and analysis of differentially private mechanisms due to its composability, robustness to post-processing, and graceful degradation in the presence of correlated data.
Differential privacy offers strong and robust guarantees that facilitate modular design and analysis of differentially private mechanisms due to its composability, robustness to post-processing, and graceful degradation in the presence of correlated data.
由于其可组合性、对后处理的鲁棒性以及在相关数据存在时的优雅退化，差分隐私提供了强大而健壮的保证，可以促进模块化设计和差异专用机制的分析。
Composability
(Self-)composability refers to the fact that the joint distribution of the outputs of (possibly adaptively chosen) differentially private mechanisms satisfies differential privacy.
(Self-)composability refers to the fact that the joint distribution of the outputs of (possibly adaptively chosen) differentially private mechanisms satisfies differential privacy.
(Self -)可组合性是指差异私有机制的输出(可能是自适应选择的)的联合分布满足差分隐私的事实。
Sequential composition. If we query an ε-differential privacy mechanism [math]\displaystyle{ t }[/math] times, and the randomization of the mechanism is independent for each query, then the result would be [math]\displaystyle{ \epsilon t }[/math]-differentially private. In the more general case, if there are [math]\displaystyle{ n }[/math] independent mechanisms: [math]\displaystyle{ \mathcal{M}_1,\dots,\mathcal{M}_n }[/math], whose privacy guarantees are [math]\displaystyle{ \epsilon_1,\dots,\epsilon_n }[/math] differential privacy, respectively, then any function [math]\displaystyle{ g }[/math] of them: [math]\displaystyle{ g(\mathcal{M}_1,\dots,\mathcal{M}_n) }[/math] is [math]\displaystyle{ \left(\sum\limits_{i=1}^{n} \epsilon_i\right) }[/math]-differentially private.[10]
Sequential composition. If we query an ε-differential privacy mechanism t times, and the randomization of the mechanism is independent for each query, then the result would be \epsilon t-differentially private. In the more general case, if there are n independent mechanisms: \mathcal{M}_1,\dots,\mathcal{M}_n, whose privacy guarantees are \epsilon_1,\dots,\epsilon_n differential privacy, respectively, then any function g of them: g(\mathcal{M}_1,\dots,\mathcal{M}_n) is \left(\sum\limits_{i=1}^{n} \epsilon_i\right)-differentially private.
连续构图。如果我们对一个 ε- 差分隐私机制进行 t 次查询，并且该机制的随机化独立于每个查询，那么结果将是 epsilon t- 差异私有。在更一般的情况下，如果存在 n 个独立的机制: 数学{ m }1，点，数学{ m } n，它们的隐私保证分别是 epsilon 1，点，epsilon n 差分隐私，那么它们的任何函数 g: g (mathcal { m }1，点，cal { m } n)左(sum limits { i = 1} ^ { n } epsilon i right)-微分私有。
Parallel composition. If the previous mechanisms are computed on disjoint subsets of the private database then the function [math]\displaystyle{ g }[/math] would be [math]\displaystyle{ (\max_i \epsilon_i) }[/math]-differentially private instead.[10]
Parallel composition. If the previous mechanisms are computed on disjoint subsets of the private database then the function g would be (\max_i \epsilon_i)-differentially private instead.
平行构图。如果前面的机制是在私有数据库的不相交子集上计算的，那么函数 g 将是(max _ i epsilon _ i)-微分私有。
Robustness to post-processing
For any deterministic or randomized function [math]\displaystyle{ F }[/math] defined over the image of the mechanism [math]\displaystyle{ \mathcal{A} }[/math], if [math]\displaystyle{ \mathcal{A} }[/math] satisfies ε-differential privacy, so does [math]\displaystyle{ F(\mathcal{A}) }[/math].
For any deterministic or randomized function F defined over the image of the mechanism \mathcal{A}, if \mathcal{A} satisfies ε-differential privacy, so does F(\mathcal{A}).
对于在机制数学{ a }映象上定义的任意确定或随机函数 f，如果数学{ a }满足 ε- 微分隐私性，则 f (数学{ a })也满足 ε- 微分隐私性。
Together, composability and robustness to post-processing permit modular construction and analysis of differentially private mechanisms and motivate the concept of the privacy loss budget. If all elements that access sensitive data of a complex mechanisms are separately differentially private, so will be their combination, followed by arbitrary post-processing.
Together, composability and robustness to post-processing permit modular construction and analysis of differentially private mechanisms and motivate the concept of the privacy loss budget. If all elements that access sensitive data of a complex mechanisms are separately differentially private, so will be their combination, followed by arbitrary post-processing.
总之，可组合性和对后期处理的健壮性允许模块化构建和分析不同的私有机制，并激励隐私损失预算的概念。如果访问复杂机制的敏感数据的所有元素都是单独的、不同的私有元素，那么它们的组合也是如此，然后是任意的后处理。
Group privacy
In general, ε-differential privacy is designed to protect the privacy between neighboring databases which differ only in one row. This means that no adversary with arbitrary auxiliary information can know if one particular participant submitted his information. However this is also extendable if we want to protect databases differing in [math]\displaystyle{ c }[/math] rows, which amounts to adversary with arbitrary auxiliary information can know if [math]\displaystyle{ c }[/math] particular participants submitted their information. This can be achieved because if [math]\displaystyle{ c }[/math] items change, the probability dilation is bounded by [math]\displaystyle{ \exp ( \epsilon c ) }[/math] instead of [math]\displaystyle{ \exp ( \epsilon ) }[/math],[11] i.e., for D1 and D2 differing on [math]\displaystyle{ c }[/math] items:
In general, ε-differential privacy is designed to protect the privacy between neighboring databases which differ only in one row. This means that no adversary with arbitrary auxiliary information can know if one particular participant submitted his information. However this is also extendable if we want to protect databases differing in c rows, which amounts to adversary with arbitrary auxiliary information can know if c particular participants submitted their information. This can be achieved because if c items change, the probability dilation is bounded by \exp ( \epsilon c ) instead of \exp ( \epsilon ), i.e., for D1 and D2 differing on c items:
一般来说，ε- 差分隐私保护的目的是保护相邻数据库之间的隐私，只有一行不同。这意味着任何拥有任意辅助信息的对手都不能知道一个特定的参与者是否提交了他的信息。然而，如果我们想要保护不同于 c 行的数据库，这也是可扩展的，这相当于拥有任意辅助信息的对手可以知道 c 特定的参与者是否提交了他们的信息。这是可以实现的，因为如果 c 项发生变化，概率膨胀的界限是 exp (epsilon c) ，而不是 exp (epsilon) ，也就是说，对于不同于 c 项的 D1和 D2来说:
- [math]\displaystyle{ \Pr[\mathcal{A}(D_{1})\in S]\leq \exp(\epsilon c)\cdot\Pr[\mathcal{A}(D_{2})\in S]\,\! }[/math]
- \Pr[\mathcal{A}(D_{1})\in S]\leq
\exp(\epsilon c)\cdot\Pr[\mathcal{A}(D_{2})\in S]\,\!
- Pr [ mathcal { a }(d _ {1}) in s ] leq exp (epsilon c) cdot Pr [ mathcal { a }(d _ {2}) in s ] ，！
Thus setting ε instead to [math]\displaystyle{ \epsilon/c }[/math] achieves the desired result (protection of [math]\displaystyle{ c }[/math] items). In other words, instead of having each item ε-differentially private protected, now every group of [math]\displaystyle{ c }[/math] items is ε-differentially private protected (and each item is [math]\displaystyle{ (\epsilon/c) }[/math]-differentially private protected).
Thus setting ε instead to \epsilon/c achieves the desired result (protection of c items). In other words, instead of having each item ε-differentially private protected, now every group of c items is ε-differentially private protected (and each item is (\epsilon/c)-differentially private protected).
因此，将 ε 设置为 epsilon/c 可以达到预期的结果(c 项的保护)。换句话说，取代了每个条目 ε- 差别私有保护，现在每组 c 条目都是 ε- 差别私有保护(每个条目 ε/c)-差别私有保护)。
ε-differentially private mechanisms
Since differential privacy is a probabilistic concept, any differentially private mechanism is necessarily randomized. Some of these, like the Laplace mechanism, described below, rely on adding controlled noise to the function that we want to compute. Others, like the exponential mechanism[12] and posterior sampling[13] sample from a problem-dependent family of distributions instead.
Since differential privacy is a probabilistic concept, any differentially private mechanism is necessarily randomized. Some of these, like the Laplace mechanism, described below, rely on adding controlled noise to the function that we want to compute. Others, like the exponential mechanismF.McSherry and K.Talwar. Mechasim Design via Differential Privacy. Proceedings of the 48th Annual Symposium of Foundations of Computer Science, 2007. and posterior samplingChristos Dimitrakakis, Blaine Nelson, Aikaterini Mitrokotsa, Benjamin Rubinstein. Robust and Private Bayesian Inference. Algorithmic Learning Theory 2014 sample from a problem-dependent family of distributions instead.
因为差分隐私是一个概率概念，所以任何差异私有机制都必然是随机的。其中一些，如下面描述的拉普拉斯机制，依赖于在我们要计算的函数中添加受控噪声。其他的，比如指数机制，麦雪莉和塔瓦尔。设计图片来源: 差分隐私。2007年第48届计算机科学基础年会论文集。迪米特拉卡基斯(Dimitrakakis)、布莱恩 · 尼尔森(Blaine Nelson)、艾卡捷里尼 · 米特罗科萨(aikaterina Mitrokotsa)、本杰明 · 鲁宾斯坦(Benjamin Rubinstein)。强大的私人贝叶斯推断。算法学习理论2014年的样本取自一个依赖于问题的分布族。
Sensitivity
Let [math]\displaystyle{ d }[/math] be a positive integer, [math]\displaystyle{ \mathcal{D} }[/math] be a collection of datasets, and [math]\displaystyle{ f \colon \mathcal{D} \rightarrow \mathbb{R}^d }[/math] be a function. The sensitivity [1] of a function, denoted [math]\displaystyle{ \Delta f }[/math], is defined by
- [math]\displaystyle{ \Delta f=\max \lVert f(D_1)-f(D_2) \rVert_1, }[/math]
where the maximum is over all pairs of datasets [math]\displaystyle{ D_1 }[/math] and [math]\displaystyle{ D_2 }[/math] in [math]\displaystyle{ \mathcal{D} }[/math] differing in at most one element and [math]\displaystyle{ \lVert \cdot \rVert_1 }[/math] denotes the [math]\displaystyle{ \ell_1 }[/math] norm.
Let d be a positive integer, \mathcal{D} be a collection of datasets, and f \colon \mathcal{D} \rightarrow \mathbb{R}^d be a function. The sensitivity of a function, denoted \Delta f, is defined by
- \Delta f=\max \lVert f(D_1)-f(D_2) \rVert_1,
where the maximum is over all pairs of datasets D_1 and D_2 in \mathcal{D} differing in at most one element and \lVert \cdot \rVert_1 denotes the \ell_1 norm.
设 d 是正整数，数学{ d }是数据集合，f 冒号{ d }右行数学{ r } ^ d 是函数。函数的灵敏度定义为: △ f = max lVert f (d _ 1)-f (d _ 2) rVert _ 1，其中最大值是所有数据集对 d1和 d2在数学上的数值，最多只有一个元素不同，而 lVert 点 rVert _ 1表示 lVert _ 1范数。
In the example of the medical database below, if we consider [math]\displaystyle{ f }[/math] to be the function [math]\displaystyle{ Q_i }[/math], then the sensitivity of the function is one, since changing any one of the entries in the database causes the output of the function to change by either zero or one.
In the example of the medical database below, if we consider f to be the function Q_i, then the sensitivity of the function is one, since changing any one of the entries in the database causes the output of the function to change by either zero or one.
在下面的医学数据库的例子中，如果我们认为 f 是函数 q _ i，那么函数的灵敏度是1，因为改变数据库中的任何一个条目都会导致函数的输出变为0或1。
There are techniques (which are described below) using which we can create a differentially private algorithm for functions with low sensitivity.
There are techniques (which are described below) using which we can create a differentially private algorithm for functions with low sensitivity.
有一些技术(下面将描述) ，我们可以使用这些技术为低灵敏度函数创建一个差分私有算法。
The Laplace mechanism
The Laplace mechanism adds Laplace noise (i.e. noise from the Laplace distribution, which can be expressed by probability density function [math]\displaystyle{ \text{noise}(y)\propto \exp(-|y|/\lambda)\,\! }[/math], which has mean zero and standard deviation [math]\displaystyle{ \sqrt{2} \lambda\,\! }[/math]). Now in our case we define the output function of [math]\displaystyle{ \mathcal{A}\,\! }[/math] as a real valued function (called as the transcript output by [math]\displaystyle{ \mathcal{A}\,\! }[/math]) as [math]\displaystyle{ \mathcal{T}_{\mathcal{A}}(x)=f(x)+Y\,\! }[/math] where [math]\displaystyle{ Y \sim \text{Lap}(\lambda)\,\!\,\! }[/math] and [math]\displaystyle{ f\,\! }[/math] is the original real valued query/function we planned to execute on the database. Now clearly [math]\displaystyle{ \mathcal{T}_{\mathcal{A}}(x)\,\! }[/math] can be considered to be a continuous random variable, where
The Laplace mechanism adds Laplace noise (i.e. noise from the Laplace distribution, which can be expressed by probability density function \text{noise}(y)\propto \exp(-|y|/\lambda)\,\!, which has mean zero and standard deviation \sqrt{2} \lambda\,\!). Now in our case we define the output function of \mathcal{A}\,\! as a real valued function (called as the transcript output by \mathcal{A}\,\!) as \mathcal{T}_{\mathcal{A}}(x)=f(x)+Y\,\! where Y \sim \text{Lap}(\lambda)\,\!\,\! and f\,\! is the original real valued query/function we planned to execute on the database. Now clearly \mathcal{T}_{\mathcal{A}}(x)\,\! can be considered to be a continuous random variable, where
拉普拉斯机制增加了拉普拉斯的噪音(即。拉普拉斯分布的噪声，可以用概率密度函数文本{ noise }(y) propto exp (- | y |/lambda)来表示，！这个函数的平均值是0和标准差的 sqrt {2} lambda，!).现在，在我们的例子中，我们定义了数学{ a }的输出函数，！作为一个实值函数(由 mathcal { a } ，!)数学{ t } _ {数学{ a }}(x) = f (x) + y，！其中 y sim 文本{ Lap }(lambda) ，! ，！还有 f！是我们计划在数据库上执行的原始实值查询/函数。现在清楚的数学{ t } _ {数学{ a }(x) ，！可以被认为是一个连续的随机变量
- [math]\displaystyle{ \frac{\mathrm{pdf}(\mathcal{T}_{\mathcal{A},D_1}(x)=t)}{\mathrm{pdf}(\mathcal{T}_{\mathcal{A},D_2}(x)=t)}=\frac{\text{noise}(t-f(D_1))}{\text{noise}(t-f(D_2))}\,\! }[/math]
- \frac{\mathrm{pdf}(\mathcal{T}_{\mathcal{A},D_1}(x)=t)}{\mathrm{pdf}(\mathcal{T}_{\mathcal{A},D_2}(x)=t)}=\frac{\text{noise}(t-f(D_1))}{\text{noise}(t-f(D_2))}\,\!
- frc { mathrm { pdf }(mathcal { t } _ { mathcal { a } ，d _ 1}(x) = t)}{ mathrm { pdf }(mathcal { t } _ { mathcal { a } ，d _ 2}(x) = t)} = frc { text { noise }(t-f (d _ 1))}{ text { noise }(t-f (d _ 2))} ，！
which is at most [math]\displaystyle{ e^{\frac{|f(D_{1})-f(D_{2})|}{\lambda}}\leq e^{\frac{\Delta(f)}{\lambda}}\,\! }[/math]. We can consider [math]\displaystyle{ \frac{\Delta(f)}{\lambda}\,\! }[/math] to be the privacy factor [math]\displaystyle{ \epsilon\,\! }[/math]. Thus [math]\displaystyle{ \mathcal{T}\,\! }[/math] follows a differentially private mechanism (as can be seen from the definition above). If we try to use this concept in our diabetes example then it follows from the above derived fact that in order to have [math]\displaystyle{ \mathcal{A}\,\! }[/math] as the [math]\displaystyle{ \epsilon\,\! }[/math]-differential private algorithm we need to have [math]\displaystyle{ \lambda=1/\epsilon\,\! }[/math]. Though we have used Laplace noise here, other forms of noise, such as the Gaussian Noise, can be employed, but they may require a slight relaxation of the definition of differential privacy.[11]
which is at most e^{\frac{|f(D_{1})-f(D_{2})|}{\lambda}}\leq e^{\frac{\Delta(f)}{\lambda}}\,\!. We can consider \frac{\Delta(f)}{\lambda}\,\! to be the privacy factor \epsilon\,\!. Thus \mathcal{T}\,\! follows a differentially private mechanism (as can be seen from the definition above). If we try to use this concept in our diabetes example then it follows from the above derived fact that in order to have \mathcal{A}\,\! as the \epsilon\,\!-differential private algorithm we need to have \lambda=1/\epsilon\,\!. Though we have used Laplace noise here, other forms of noise, such as the Gaussian Noise, can be employed, but they may require a slight relaxation of the definition of differential privacy.
最多 e ^ { frac { | f (d _ {1})-f (d _ {2}) | }{ lambda } leq e ^ { frac { Delta (f)}{ lambda } ，。我们可以考虑 frac { Delta (f)}{ lambda } ，！成为隐私保护因素。因此数学{ t } ，！遵循不同的私有机制(从上面的定义可以看出)。如果我们在我们的糖尿病示例中尝试使用这个概念，那么从上面的派生事实可以推出，为了得到数学{ a } ，！作为 epsilon!-我们需要 lambda = 1/epsilon! 。虽然我们在这里使用了拉普拉斯噪音，但是也可以使用其他形式的噪音，比如高斯噪音，但是它们可能需要稍微放宽差分隐私的定义。
According to this definition, differential privacy is a condition on the release mechanism (i.e., the trusted party releasing information about the dataset) and not on the dataset itself. Intuitively, this means that for any two datasets that are similar, a given differentially private algorithm will behave approximately the same on both datasets. The definition gives a strong guarantee that presence or absence of an individual will not affect the final output of the algorithm significantly.
According to this definition, differential privacy is a condition on the release mechanism (i.e., the trusted party releasing information about the dataset) and not on the dataset itself. Intuitively, this means that for any two datasets that are similar, a given differentially private algorithm will behave approximately the same on both datasets. The definition gives a strong guarantee that presence or absence of an individual will not affect the final output of the algorithm significantly.
根据这个定义，差分隐私是发布机制的一个条件(例如，可信方发布数据集的信息) ，而不是数据集本身。直观上，这意味着对于任何两个相似的数据集，一个给定的差异私有算法在两个数据集上的行为大致相同。该定义强有力地保证了个体的存在或不存在不会对算法的最终输出产生重大影响。
For example, assume we have a database of medical records [math]\displaystyle{ D_1 }[/math] where each record is a pair (Name, X), where [math]\displaystyle{ X }[/math] is a Boolean denoting whether a person has diabetes or not. For example:
For example, assume we have a database of medical records D_1 where each record is a pair (Name, X), where X is a Boolean denoting whether a person has diabetes or not. For example:
例如，假设我们有一个医疗记录数据库 d _ 1，其中每个记录是一对(Name，x) ，其中 x 是一个布尔值，表示一个人是否患有糖尿病。例如:
| Name | Has Diabetes (X) |
|---|---|
| Ross | 1 |
| Monica | 1 |
| Joey | 0 |
| Phoebe | 0 |
| Chandler | 1 |
| Rachel | 0 |
| Name | Has Diabetes (X) |
|---|---|
| Ross | 1 |
| Monica | 1 |
| Joey | 0 |
| Phoebe | 0 |
| Chandler | 1 |
| Rachel | 0 |
| -| Ross | | 1 |-| Monica | | | 1 | |-| Joey | | 0 |-| Phoebe | 0 |-|-| Chandler | | 1 |-|-| Rachel | | | | |
Now suppose a malicious user (often termed an adversary) wants to find whether Chandler has diabetes or not. Suppose he also knows in which row of the database Chandler resides. Now suppose the adversary is only allowed to use a particular form of query [math]\displaystyle{ Q_i }[/math] that returns the partial sum of the first [math]\displaystyle{ i }[/math] rows of column [math]\displaystyle{ X }[/math] in the database. In order to find Chandler's diabetes status the adversary executes [math]\displaystyle{ Q_5(D_1) }[/math] and [math]\displaystyle{ Q_4(D_1) }[/math], then computes their difference. In this example, [math]\displaystyle{ Q_5(D_1) = 3 }[/math] and [math]\displaystyle{ Q_4(D_1) = 2 }[/math], so their difference is 1. This indicates that the "Has Diabetes" field in Chandler's row must be 1. This example highlights how individual information can be compromised even without explicitly querying for the information of a specific individual. Now suppose a malicious user (often termed an adversary) wants to find whether Chandler has diabetes or not. Suppose he also knows in which row of the database Chandler resides. Now suppose the adversary is only allowed to use a particular form of query Q_i that returns the partial sum of the first i rows of column X in the database. In order to find Chandler's diabetes status the adversary executes Q_5(D_1) and Q_4(D_1), then computes their difference. In this example, Q_5(D_1) = 3 and Q_4(D_1) = 2, so their difference is 1. This indicates that the "Has Diabetes" field in Chandler's row must be 1. This example highlights how individual information can be compromised even without explicitly querying for the information of a specific individual. 现在假设一个恶意用户(通常称为对手)想要查看 Chandler 是否患有糖尿病。假设他也知道 Chandler 在数据库的哪一行中。现在假设对手只允许使用特定形式的查询 q _ i，该查询返回数据库中列 x 的第一个 i 行的部分和。为了查找钱德勒的糖尿病状态，对手执行 q5(d1)和 q4(d1) ，然后计算它们的差异。在这个例子中，q _ 5(d _ 1) = 3和 q _ 4(d _ 1) = 2，所以它们的差值是1。这表示 Chandler 行中的“ Has Diabetes”字段必须为1。这个示例突出说明了即使不显式查询特定个人的信息，个人信息也可能被泄露。 Continuing this example, if we construct [math]\displaystyle{ D_2 }[/math] by replacing (Chandler, 1) with (Chandler, 0) then this malicious adversary will be able to distinguish [math]\displaystyle{ D_2 }[/math] from [math]\displaystyle{ D_1 }[/math] by computing [math]\displaystyle{ Q_5 - Q_4 }[/math] for each dataset. If the adversary were required to receive the values [math]\displaystyle{ Q_i }[/math] via an [math]\displaystyle{ \epsilon }[/math]-differentially private algorithm, for a sufficiently small [math]\displaystyle{ \epsilon }[/math], then he or she would be unable to distinguish between the two datasets. Continuing this example, if we construct D_2 by replacing (Chandler, 1) with (Chandler, 0) then this malicious adversary will be able to distinguish D_2 from D_1 by computing Q_5 - Q_4 for each dataset. If the adversary were required to receive the values Q_i via an \epsilon-differentially private algorithm, for a sufficiently small \epsilon, then he or she would be unable to distinguish between the two datasets. 继续这个例子，如果我们用(Chandler，1)替换(Chandler，0)来构造 d2，那么这个恶意的对手将能够通过计算每个数据集的 q _ 5-q _ 4来区分 d _ 2和 d _ 1。如果对手被要求通过一个 epsilon-differentially private 算法接收值 q _ i，对于一个足够小的 epsilon，那么他或她将无法区分两个数据集。 Randomized responseA simple example, especially developed in the social sciences,[14] is to ask a person to answer the question "Do you own the attribute A?", according to the following procedure: A simple example, especially developed in the social sciences, is to ask a person to answer the question "Do you own the attribute A?", according to the following procedure: 一个简单的例子，尤其是在社会科学领域，就是让一个人回答“你拥有属性 a 吗?”？”，根据下列程序:
(The seemingly redundant extra toss in the first case is needed in situations where just the act of tossing a coin may be observed by others, even if the actual result stays hidden.) The confidentiality then arises from the refutability of the individual responses. (The seemingly redundant extra toss in the first case is needed in situations where just the act of tossing a coin may be observed by others, even if the actual result stays hidden.) The confidentiality then arises from the refutability of the individual responses. (在第一种情况下，看似多余的额外投掷是必要的，因为在这种情况下，即使实际结果仍然隐藏着，仅仅是抛硬币的动作就可能被其他人看到。)这种保密性来自于个人反驳的可驳斥性。 But, overall, these data with many responses are significant, since positive responses are given to a quarter by people who do not have the attribute A and three-quarters by people who actually possess it. Thus, if p is the true proportion of people with A, then we expect to obtain (1/4)(1-p) + (3/4)p = (1/4) + p/2 positive responses. Hence it is possible to estimate p. But, overall, these data with many responses are significant, since positive responses are given to a quarter by people who do not have the attribute A and three-quarters by people who actually possess it. Thus, if p is the true proportion of people with A, then we expect to obtain (1/4)(1-p) + (3/4)p = (1/4) + p/2 positive responses. Hence it is possible to estimate p. 但是，总的来说，这些有很多回答的数据是有意义的，因为有四分之一的人给出了肯定的回答，而有四分之三的人给出了真正拥有 a 属性的人的答案。因此，如果 p 是 a 型人群的真实比例，那么我们期望得到(1/4)(1-p) + (3/4) p = (1/4) + p/2的积极反应。因此，我们可以估计 p。 In particular, if the attribute A is synonymous with illegal behavior, then answering "Yes" is not incriminating, insofar as the person has a probability of a "Yes" response, whatever it may be. In particular, if the attribute A is synonymous with illegal behavior, then answering "Yes" is not incriminating, insofar as the person has a probability of a "Yes" response, whatever it may be. 特别是，如果属性 a 是非法行为的同义词，那么回答“是”并不意味着定罪，只要这个人有可能作出“是”的回答，无论它可能是什么。 Although this example, inspired by randomized response, might be applicable to microdata (i.e., releasing datasets with each individual response), by definition differential privacy excludes microdata releases and is only applicable to queries (i.e., aggregating individual responses into one result) as this would violate the requirements, more specifically the plausible deniability that a subject participated or not.[15][16] Although this example, inspired by randomized response, might be applicable to microdata (i.e., releasing datasets with each individual response), by definition differential privacy excludes microdata releases and is only applicable to queries (i.e., aggregating individual responses into one result) as this would violate the requirements, more specifically the plausible deniability that a subject participated or not.Dwork, Cynthia. "A firm foundation for private data analysis." Communications of the ACM 54.1 (2011): 86–95, supra note 19, page 91.Bambauer, Jane, Krishnamurty Muralidhar, and Rathindra Sarathy. "Fool's gold: an illustrated critique of differential privacy." Vand. J. Ent. & Tech. L. 16 (2013): 701. 虽然这个例子受到了随机化回答的启发，可能适用于微数据(例如，发布每个响应的数据集) ，但根据定义，差分隐私排除了微数据发布，并且只适用于查询(例如，将单个响应聚合成一个结果) ，因为这将违反要求，更具体地说，是一个主题参与或不参与的似是而非的否认。辛西娅。“为私人数据分析奠定坚实的基础。”美国计算机学会通讯54.1(2011) : 86-95，上注19，第91页. Bambauer，Jane，Krishnamurty Muralidhar，and Rathindra Sarathy。“愚人的黄金: 对差分隐私的插图式批评。”Vand.J. Ent.北京科技发展有限公司。L. 16(2013) : 701. Stable transformationsA transformation [math]\displaystyle{ T }[/math] is [math]\displaystyle{ c }[/math]-stable if the Hamming distance between [math]\displaystyle{ T(A) }[/math] and [math]\displaystyle{ T(B) }[/math] is at most [math]\displaystyle{ c }[/math]-times the Hamming distance between [math]\displaystyle{ A }[/math] and [math]\displaystyle{ B }[/math] for any two databases [math]\displaystyle{ A,B }[/math]. Theorem 2 in [10] asserts that if there is a mechanism [math]\displaystyle{ M }[/math] that is [math]\displaystyle{ \epsilon }[/math]-differentially private, then the composite mechanism [math]\displaystyle{ M\circ T }[/math] is [math]\displaystyle{ (\epsilon \times c) }[/math]-differentially private. A transformation T is c-stable if the Hamming distance between T(A) and T(B) is at most c-times the Hamming distance between A and B for any two databases A,B. Theorem 2 in asserts that if there is a mechanism M that is \epsilon-differentially private, then the composite mechanism M\circ T is (\epsilon \times c)-differentially private. 对于任意两个数据库 a，b，如果 t (a)和 t (b)之间的汉明距离最多是 a 和 b 之间的汉明距离的 c 倍，则变换 t 是 c 稳定的。定理2断言，如果存在一个机制 m 是 epsilon-微分私有的，那么复合机制 m circ t 是(epsilon 乘以 c)-微分私有的。 This could be generalized to group privacy, as the group size could be thought of as the Hamming distance [math]\displaystyle{ h }[/math] between [math]\displaystyle{ A }[/math] and [math]\displaystyle{ B }[/math] (where [math]\displaystyle{ A }[/math] contains the group and [math]\displaystyle{ B }[/math] doesn't). In this case [math]\displaystyle{ M\circ T }[/math] is [math]\displaystyle{ (\epsilon \times c \times h) }[/math]-differentially private. This could be generalized to group privacy, as the group size could be thought of as the Hamming distance h between A and B (where A contains the group and B doesn't). In this case M\circ T is (\epsilon \times c \times h)-differentially private. 这可以推广到群组隐私，因为群组大小可以被认为是 a 和 b 之间的汉明距离 h (其中 a 包含群组，而 b 没有)。在这种情况下，m circ t 是(epsilon 乘以 c 乘以 h)-微分私有的。 Other notions of differential privacySince differential privacy is considered to be too strong or weak for some applications, many versions of it have been proposed.[17] The most widespread relaxation is (ε, δ)-differential privacy,[18] which weakens the definition by allowing an additional small δ density of probability on which the upper bound ε does not hold. Since differential privacy is considered to be too strong or weak for some applications, many versions of it have been proposed. The most widespread relaxation is (ε, δ)-differential privacy, which weakens the definition by allowing an additional small δ density of probability on which the upper bound ε does not hold. 由于对于某些应用程序来说，差分隐私被认为太强或太弱，因此人们提出了许多版本。最广泛的松弛是(ε，δ)-差分隐私，它通过允许增加一个上限 ε 不成立的概率密度 δ 来削弱定义。 Adoption of differential privacy in real-world applicationsSeveral uses of differential privacy in practice are known to date:
2008: u.s. Census Bureau，for shows comforting patterns. 在实践中，差分隐私的几个用途已经为人所知:
Public purpose considerationsThere are several public purpose considerations regarding differential privacy that are important to consider, especially for policymakers and policy-focused audiences interested in the social opportunities and risks of the technology:[27] There are several public purpose considerations regarding differential privacy that are important to consider, especially for policymakers and policy-focused audiences interested in the social opportunities and risks of the technology: 关于差分隐私技术，有几个公共目的方面的考虑是需要考虑的，特别是对于那些对技术的社会机遇和风险感兴趣的决策者和政策关注的受众:
See also
References
引用错误：Closing tag missing for
<references>Further reading
|
|---|