Empirically provide data privacy with noise reduction

Abstract

An empirical approach to providing differential privacy involves applying a common statistical query to a set of data with and without data from any particular entity to produce sample values. The probability density is empirically estimated by sorting the sample values ​​to generate an empirical cumulative distribution function. The cumulative distribution function is differentiated approximately over the square root of the number of sample points to obtain the empirical density function. If the empirical density with and without any particular individual differs by no more than a factor exp(ε), then the statistical query can be considered empirically (ε, δ)-private, except for sets where the density exceeds a bound no greater than the total number δ.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Patent Application No. 62 / 893,376, filed on August 29, 2019, U.S. Provisional Patent Application No. 62 / 897,687, filed on September 9, 2019, U.S. Provisional Patent Application No. 62 / 905,657, filed on September 25, 2019, U.S. Provisional Patent Application No. 62 / 913,089, filed on October 9, 2019, U.S. Provisional Patent Application No. 62 / 933,800, filed on November 11, 2019, and U.S. Provisional Patent Application No. 62 / 968,742, filed on January 31, 2020, the subject matter of each of which is incorporated herein by reference in its entirety. Technical Field

[0003] The described subject matter relates generally to data analysis, and more particularly to empirical differential privacy methods that reduce reliance on artificially added noise. Background Art

[0004] Differential privacy refers to a special class of techniques for enabling statistical queries of databases without revealing information about individual rows. There are many databases where individual rows correspond to entities (e.g., individuals, companies, or other legal entities). As such, these techniques are useful for protecting the privacy of individuals while gaining utility from the data. Generally speaking, differential privacy methods are designed so that fluctuations in the results returned by a query due to random or other unpredictable factors are sufficient to mask differences resulting from the inclusion or omission of specific records. Therefore, it is impossible to determine the data in a specific record by running the same query on the complete dataset and on a dataset with that record omitted.

[0005] Several existing differential privacy techniques start with a fixed database and, before reporting the results of statistical queries, add controlled noise to the answers. For example, the size of the noise can be thought of as the maximum difference between a query on the full dataset and a query on the dataset with one row removed, divided by a privacy budget. For multiple private queries on the same dataset, the privacy budget is additive, such that the probability of any set of query results does not change by more than the multiplicative amount of the privacy budget when individual rows are removed. However, often, the noise added to ensure sufficient privacy is so large that it makes the answers less useful, as it can also obscure useful statistical information. Summary of the Invention

[0006] Embodiments relate to a differential privacy method that limits the amount of noise added to the search results of an aggregate query. By limiting the amount of noise added, the method maintains the privacy of individual entities represented in the data within an acceptable range while maintaining the accuracy of the results. Using the differential privacy method, differential privacy can be implemented for a single deterministic query against a random database, rather than asking multiple random queries against a single deterministic database. If rows are labeled by an entity, this still gives a probability distribution of answers with and without the entity, and when the entity's data is removed, differential privacy can be enforced by requiring that the probability of any particular query result does not change multiplicatively by more than the privacy budget.

[0007] In various embodiments, an empirical method is employed to provide differential privacy. The method involves applying a common statistical query to a set of databases (e.g., a time series of databases). Assuming that the data included in each database is substantially independent of the other databases, the set represents an empirical sample of a hypothetical probability distribution from the databases. The method generates an empirical sample of the values ​​of the statistical query from a set of databases with and without data for any particular entity. How the empirical probability distribution of the answer differs with and without data for any entity provides an empirical measure of differential privacy.

[0008] In one embodiment of a differential privacy method, a request is received to run a query on a set of databases that include data labeled by an entity. The query is run on a subset of the databases by iteratively running the query with and without data for each entity to generate query results for the databases in the subset. An empirical probability density function is calculated from the query results. A determination is made based on the empirical probability density function whether the query satisfies one or more differential privacy requirements. In response to determining that the query satisfies one or more differential privacy requirements, the results of the query are output to one or more users via any appropriate interface. Additionally, or alternatively, a report can be generated based on the query results and presented to one or more users via any appropriate interface. In response to determining that the query does not satisfy one or more differential privacy requirements, noise can be added to the query results until the query results satisfy one or more differential privacy requirements. In this way, the amount of added noise is limited and the accuracy of the query results is maintained. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a block diagram of a data analysis system according to one embodiment.

[0010] Figure 2 According to one embodiment Figure 1 Block diagram of a data repository.

[0011] Figure 3is a flowchart of a method for generating reports based on database queries while maintaining data privacy, according to one embodiment.

[0012] Figure 4 is a flowchart of a method for outputting results of a database query while maintaining data privacy according to one embodiment.

[0013] Figure 5 is shown according to an embodiment suitable as Figure 1 A block diagram of an example computer used in a data analysis system.

[0014] Figure 6 An adaptive kernel according to one embodiment is illustrated.

[0015] Figure 7 The diagram shows a method for Figure 6 The estimated empirical probability is generated by summing the kernel of . DETAILED DESCRIPTION

[0016] Reference will now be made to several embodiments, examples of which are illustrated in the accompanying drawings. Wherever practical, like or similar reference numerals are used in the drawings to indicate like or similar functionality. Although some of the described embodiments relate to generating market color reports from financial data, those skilled in the art will recognize that the disclosed technology can be applied with other types of data and reports.

[0017] Overview

[0018] Using differential privacy methods, differential privacy can be implemented for a single deterministic query against a random database, rather than asking multiple random queries against a single deterministic database. If rows are labeled by entity, this still gives a probability distribution over the answers with and without the entity, and when the entity's data is removed, differential privacy can be enforced by requiring that the probability of any particular query result does not change multiplicatively by more than the privacy budget.

[0019] In various embodiments, an empirical method is employed to provide differential privacy. The method involves applying a common statistical query to a set of databases (e.g., a time series of databases). Assuming that the data included in each database is substantially independent of the other databases, the set represents an empirical sample of a hypothetical probability distribution from the databases. The method generates an empirical sample of the values ​​of the statistical query from a set of databases with and without data for any particular entity. How the empirical probability distribution of the answer differs with and without data for any entity provides an empirical measure of differential privacy.

[0020] Sample data analysis system

[0021] Figure 1One embodiment of a data analysis system 100 is illustrated. In the illustrated embodiment, data analysis system 100 includes a data repository 110, a query module 120, a privacy analysis module 130, and a result generation module 140. In other embodiments, data analysis system 100 includes different or additional elements. Furthermore, functionality may be distributed among the elements in a manner different from that described. For example, although data repository 110 is shown as part of data analysis system 100, in some embodiments, the data is accessed remotely via a network.

[0022] The data repository 110 includes a set of databases that store data for which statistical analysis is required to protect individual privacy. In some embodiments, each database in the set of databases includes data of multiple entities, and the data is labeled by the entity. Figure 2 One embodiment of the data repository 110 is illustrated in more detail. In the illustrated embodiment, the data repository 110 includes a first database 210A, a second database 210B, and an Nth database 210C. The databases 210A-210N can be a time series of databases, such as the results of daily or weekly data collection. Those skilled in the art will recognize that the disclosed technology can be used with any number of databases 210A-210N. In various embodiments, the databases 210A-210N are essentially independent, meaning that the data in one database does not depend on the data in another database. Each database includes rows corresponding to individual entities (e.g., individuals, companies, or other legal entities). For example, a database can include financial data for an individual entity used to generate a periodic market color report.

[0023] Return Reference Figure 1 , the query module 120 is configured to receive a request to run a query on the set of databases. In one embodiment, the query module 120 provides a user interface (UI) by which a user can define a statistical query. In one embodiment, the UI enables the user to select a set of databases, provide one or more privacy parameters (e.g., if an entity is excluded, what is the acceptable amount of probability change determined for the query), and define one or more statistical queries to run on the selected set of databases. The UI can be provided within a software package executed on the data analysis system 100, or can be accessed remotely from a client computing device via a web interface or application program interface (API).

[0024] The privacy analysis module 130 determines whether the one or more provided queries satisfy the defined differential privacy requirements. To determine whether the one or more provided queries satisfy the defined differential privacy requirements, the privacy analysis module 130 may apply a general statistical query to a subset of the database, such as a time series of the database. In one embodiment, some or all of the databases in the subset of databases are subsets of a larger database. The subset of the database to be queried can be extracted by an operation to pull out data that meets specified parameters. For example, a select (SELECT) operation can be used to extract data for a specific day or week to generate a time series of the database from a database that includes data for a longer period of time.

[0025] Assuming that the data included in each database of a set of databases is substantially independent of the data in the other databases, the set of databases represents an empirical sample from a hypothetical probability distribution of the databases. In these embodiments, the privacy analysis module 130 generates an empirical sample of the values ​​of a statistical query from the set of databases with and without data for any particular entity. For example, the privacy analysis module 130 can be configured to run a query on each database in a subset of the databases by iteratively running the query with and without data for each entity to generate query results for the databases in the subset. The privacy analysis module 130 can be configured to calculate an empirical probability density function from the query results.

[0026] In one embodiment, the privacy analysis module 130 empirically estimates the probability density by ranking the sample answers to generate an empirical distribution function. The privacy analysis module 130 differentiates the cumulative distribution function over approximately the square root of the number of sample points (in an asymptotic sense, differing by at most a constant factor) to estimate the empirical density function. Those skilled in the art may use other different difference widths. For example, the difference width may depend on the number of sample points.

[0027] Alternatively or alternatively, the privacy analysis module 130 can use an adaptive kernel density estimation technique to empirically estimate the probability density. Using this technique, the privacy analysis module 130 replaces each sample point with a kernel whose width is approximately the square root of the number of sample points. The privacy analysis module 130 sums the kernels, and the sum is the density. Other adaptive kernel widths can be used by those skilled in the art. In addition, various kernel shapes can be used, including but not limited to rectangular, triangular, Gaussian, etc. Figure 6 Figure 1 shows an example of an adaptive kernel generated from a data sample. The kernel is narrow in the center of the distribution and wider in the tails. Figure 7 The empirical probability density of the resulting estimate, which is the sum of the kernels, is shown.

[0028] Given an empirical density probability density, the privacy analysis module 130 can measure the differential privacy of a query as a function of two parameters ε and δ. ε defines the maximum acceptable amount by which the determined probability for the query changes when an entity is excluded. δ indicates the probability that the query does not meet the requirement defined by ε. In particular, a statistical query is empirically (ε, δ)-private if the empirical density with and without any particular individual does not differ by more than a factor exp(ε), except for sets where the density exceeds a bound no greater than the total number δ. If p(x) is the probability density with an individual and p1(x) is the probability density without the individual, the privacy requirement can be expressed as Equation 1.

[0029] δ≥max(∫(p(x)-exp(ε)p1(x)) + dx,∫(p1(x)-exp(ε)p(x)) + dx) (1)

[0030] The worst-case scenario δ in the privacy criterion often overstates the potential loss of privacy. To address this, some embodiments use a metric called “total gain” Δ, which provides an estimate of the probability that the privacy of some entity i is compromised by a factor greater than ε. To define this, let δ i Become the minimum δ that plays a role in the privacy criterion for entity i. Then the total increment Δ can be defined according to Equation 2.

[0031] Δ=1-π i (1-δ i ) (2)

[0032] If the user provides more than one query, the privacy analysis module 130 can use the corresponding multi-dimensional empirical probability density to jointly analyze the queries for differential privacy compliance. For example, the privacy analysis module 130 calculates the two-dimensional empirical probability density for two queries, the three-dimensional empirical probability density for three queries, and so on.

[0033] Measures of privacy may also be useful in adversarial situations, where the recipient of a statistical query has partial information about the data in the database. An example use case is when an entity that contributes to a database knows what its contribution to the database is and can also see the public results of the statistical query. In such an adversarial situation, the privacy analysis module 130 can perform a similar empirical privacy analysis, but with an empirical probability distribution conditioned on the information known to the adversary. The privacy analysis module 130 constructs an empirical conditional distribution by bucketing the information known to the adversary and only contributing the results of the statistical query on a particular database to the conditional distribution corresponding to the bucket into which the information known to the adversary falls. In practice, buckets can be chosen that are coarse enough but fine enough to compute the exact conditional distribution so that many data points contribute to each conditional distribution.

[0034] The privacy guarantees described above are based on the assumption that each database in the ordered sequence is drawn independently from an assumed probability distribution over the databases. This is often true, or nearly so, in many cases. However, this assumption can be tested empirically by measuring the empirical autocorrelation of query results in the ordered sequence. If significant autocorrelation is present, one solution is to locally aggregate the databases in the sequence to produce a shorter sequence of databases over a longer time scale where there is no significant autocorrelation in the query results. For example, the autocorrelation may only exist over the short term. If this is the case, daily data can be combined into weekly buckets, weekly data into monthly buckets, and so on, so that there is no longer a significant degree of autocorrelation. Note that adding noise may not be a practical solution to autocorrelation, as the noise required to effectively reduce autocorrelation is often at the same granularity as the query results themselves.

[0035] The result generation module 140 determines whether and how to present the results of the query. In some embodiments, the result generation module 140 is configured to determine whether the query meets one or more differential privacy requirements based on an empirical probability density function, and is further configured to output the results of the query in response to determining that the query meets one or more differential privacy requirements. In one such embodiment, if the privacy analysis module 130 determines that the query meets the defined differential privacy requirements, the result generation module provides the results of the query for display to the user. The results can be displayed in any appropriate format, such as a chart, a spreadsheet, a list, or a report. For example, the result generation module 140 can generate a report based on the query results and provide it in a web page, via email, or within the UI of the data analysis system 100 for access by the user.

[0036] If the query does not meet the defined differential privacy requirements, the result generation module 140 can add noise (e.g., Gaussian noise or Laplace noise) to the result. In one embodiment, the result generation module 140 can determine the amount of noise to be added so that the result meets the defined differential privacy requirements. For example, the result generation module 140 can iteratively run a solver that tries different amounts of noise to determine the amount of noise to be added that provides the desired privacy protection without overly obscuring the underlying statistical information. The amount of noise added may be less than the amount of noise added in traditional differential privacy methods. Therefore, even when noise is added to provide improved privacy, the query can return more accurate statistical information. Alternatively, if the differential privacy requirements are not met, the result generation module 140 can notify the user that the defined query cannot be run.

[0037] Example report generation method

[0038] Figure 3 An example method 300 for generating a report that satisfies differential privacy requirements is illustrated. Figure 3 However, some or all of the steps may be performed by other entities or components. In addition, some embodiments may perform steps in parallel, in a different order, or different steps.

[0039] exist Figure 3 In the illustrated embodiment, method 300 begins with the data analysis system 100 defining 310 a statistical query (e.g., based on user input) to run against a set of databases, where rows correspond to entities. The data analysis system 100 generates 320 empirical sample query values ​​by running the query against a sample of the set of databases with and without data for each entity. The data analysis system 100 can select a sample size that is large enough to give statistically significant results but small enough to be relevant (e.g., if the sequence of databases is a time series, sampling the most recent databases has greater relevance). From the sample query values, the data analysis system 100 generates 330 an empirical cumulative distribution function, from which an empirical density function can be generated 340 (e.g., by differencing approximately at the square root of the number of sample points).

[0040] The data analysis system 100 determines 350 whether the statistical query satisfies applicable differential privacy requirements based on the empirical density function. For example, as previously described, a statistical query can be considered empirically (ε, δ)-private if the empirical density with and without any particular individual does not differ by more than a factor exp(ε), except for sets whose density exceeds a bound no greater than a total of δ.

[0041] If the statistical query does not meet the applicable differential privacy requirements, the data analysis system 100 can add 360 sufficient noise to make the query compliant with differential privacy. For example, the data analysis system 100 can add Gaussian or Laplace noise to blur individual row data at the expense of making the resulting statistics returned by the query less precise. Regardless of whether noise is added 360, the data analysis system 100 can generate 370 a report based on the query results. The report can be presented to one or more users via any appropriate interface.

[0042] Figure 4 An example method 400 for outputting the results of a database query while maintaining data privacy is illustrated. Figure 4 However, some or all of the steps may be performed by other entities or components. In addition, some embodiments may perform steps in parallel, in a different order, or different steps.

[0043] exist Figure 4 In the illustrated embodiment, method 400 includes receiving 410 a request to run a query on a set of databases. Each database in the set of databases includes data for an entity, and the data is labeled by the entity. Method 400 also includes running 420 the query on a subset of the databases by iteratively running the query with and without data for each entity to generate query results for the databases in the subset.

[0044] An empirical probability density function is calculated 430 from the query results. In some embodiments, the empirical probability density function is calculated 430 by sorting the query results to create an empirical cumulative distribution function of the query results with and without each entity. The empirical cumulative distribution function is differentiated using a spacing of a number of data points that depends on the size of the data to derive the empirical probability density function. For example, the spacing can be approximately the square root of the total number of data points in the data set.

[0045] Alternatively or additionally, the empirical probability density function can be calculated 430 by determining an adaptive kernel density estimate. In these embodiments, the data points are replaced by a kernel, the width of the kernel is selected to span a number of data points, and the kernels are summed to calculate the density. The number of data points may depend on the set of data sets. For example, the width of the kernel spans approximately the square root of the total number of data points in the set. The shape of the kernel may vary. For example, the kernel can be rectangular, triangular, Gaussian, etc. In addition, if there is certain information in the database that is known or potentially known to the opponent, the empirical probability density can be calculated based on the opponent's information falling into a series of buckets.

[0046] The method 400 also includes determining 440 whether the query satisfies one or more differential privacy requirements based on the empirical probability density function. In some embodiments, determining that the query satisfies the one or more privacy requirements includes calculating a quantity δ by which the probability density with and without data for each entity exceeds a bound that differs by no more than a factor exp(ε), where ε is a parameter indicating a maximum acceptable change in the determined probability for the query if the entity is excluded.

[0047] In response to determining that the query satisfies one or more differential privacy requirements, the result of the query is output 450. In some embodiments, determining that the query satisfies one or more differential privacy requirements includes calculating a total delta Δ, which is defined as the cumulative delta for entity i = 1-π i (1-δ i ), where δ i is the minimum δ that plays a role in the privacy criterion for entity i.

[0048] In response to determining that the query result does not satisfy one or more differential privacy requirements, noise can be added to the query result until the query result satisfies one or more differential privacy requirements. The output result can be based on the result with the added noise. In some embodiments, the noise is Gaussian noise, Laplace noise, etc.

[0049] In some embodiments, a set of databases is an ordered sequence. In these embodiments, in response to empirical evidence indicating that query results in the sequence have statistically significant autocorrelation, the sequence of the database can be locally aggregated into shorter sequences of a larger database until the query results no longer have statistically significant autocorrelation. The differential privacy requirement can then be tested based on the shorter sequences of the larger database.

[0050] Example Compute Device Architecture

[0051] Figure 5 An example computer 500 suitable for use with the data analysis system 100 is illustrated. The example computer 500 includes at least one processor 502 coupled to a chipset 504. For clarity, operations may be described as being performed by a "processor," but this should be understood to include multiple processors working in concert to perform the operations. The chipset 504 includes a memory controller hub 520 and an input / output (I / O) controller hub 522. Memory 506 and a graphics adapter 512 are coupled to the memory controller hub 520, and a display 518 is coupled to the graphics adapter 512. Storage device 508, keyboard 510, pointing device 514, and network adapter 516 are coupled to the I / O controller hub 522. Other embodiments of the computer 500 have different architectures.

[0052] exist Figure 5In the illustrated embodiment, the storage device 508 is a non-transitory computer-readable medium and / or a non-transitory computer-readable storage medium, such as a hard drive, a compact disc read-only memory (CD-ROM), a DVD, or a solid-state memory device. The memory 506 retains instructions and data used by the processor 502. Although the storage device 508 is shown as a single medium, the term "machine-readable medium" should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, or associated caches and servers) configured to store data or software used by the computer 500. For example, the data repository 110 can be a distributed database provided by multiple servers and accessed by the data analysis system 100 via a network.

[0053] Pointing device 514 is a mouse, trackball, touch screen, or other type of pointing device and is used in conjunction with keyboard 510 (which may be an on-screen keyboard) to input data into computer system 500. Graphics adapter 512 enables display 518 to display images and other information. Network adapter 516 couples data analysis system 100 to one or more computer networks, such as the Internet. In some embodiments, a computer system may lack some of the aforementioned components, such as keyboard 510, pointing device 514, or display 518.

[0054] Other considerations

[0055] Some of the foregoing descriptions describe embodiments of algorithmic processes or operations. These algorithmic descriptions and examples are commonly used by those skilled in the computing arts to effectively convey the substance of their work to others skilled in the art. These operations, while described functionally, computationally, or logically, are understood to be implemented by computer programs comprising instructions executed by a processor or equivalent circuitry. Furthermore, it sometimes proves convenient to refer to arrangements of these functional operations as modules without loss of generality.

[0056] As used herein, any reference to "one embodiment" or "an embodiment" means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase "in one embodiment" in different places in the specification are not necessarily all referring to the same embodiment. Likewise, the use of "a" or "an" before an element or component is merely for convenience. The description should be understood to mean that one or more elements or components are present unless it is obvious that another meaning is intended. If a value is described as "about" or "substantially" (or derivatives thereof), such value should be interpreted as being accurate + / - 10% unless the context clearly indicates otherwise. For example, "about ten" should be understood to mean "between nine and eleven"

[0057] As used herein, the terms "comprises," "includes," "including," "has," "having" or any other variations thereof are intended to cover a non-exclusive inclusion. For example, a process, method, article, or apparatus that comprises a list of elements is not necessarily limited to only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Unless expressly specified to the contrary, "or" refers to an inclusive or and not to an exclusive or. For example, condition A or B is satisfied by any of the following: A is true (or exists) and B is false (or does not exist), A is false (or does not exist) and B is true (or exists), or both A and B are true (or exist).

[0058] After reading this disclosure, those skilled in the art will appreciate alternative structural and functional designs for systems and processes for managing pension plans. For example, server processes can be implemented using a single server or multiple servers working in combination, databases and applications can be implemented on a single system or distributed across multiple systems, and distributed components can run sequentially or in parallel. Therefore, while specific embodiments and applications have been illustrated and described, the scope of protection should be limited only by the following claims.

Claims

1. A method comprising: receiving a request to run a query on a set of databases, each database in the set of databases including data for a plurality of entities, the data being labeled by the entity; running a plurality of sample queries based on the query to generate sample query results for databases in a subset of the set of databases, each sample query in the plurality of sample queries removing data for different entities relative to other sample queries in the plurality of sample queries; Calculating an empirical probability density function from the sample query results; determining whether the query satisfies one or more differential privacy requirements based on the empirical probability density function; as well as In response to determining that the query satisfies the one or more differential privacy requirements, a result of the query is output.

2. A method according to claim 1, wherein determining whether the query satisfies one or more differential privacy requirements includes calculating a total amount δ by which the probability density with and without data for each entity exceeds a limit that differs by no more than a factor exp(ε), where ε is a parameter that indicates the maximum acceptable change in the determined probability for the query if the entity is excluded.

3. The method of claim 1 , wherein calculating the empirical probability density function comprises: sorting the query results to create an empirical cumulative distribution function of the query results with and without each entity of the plurality of entities; as well as The empirical cumulative distribution function is differentiated using a spacing of a number of data points that depends on the size of the data to derive the empirical probability density function. The method of claim 3 , wherein the spacing is within + / - 10% of the square root of the total number of data points in the data.

5. The method of claim 1 , wherein calculating the empirical probability density function comprises: determining an adaptive kernel density estimate in which data points are replaced by a kernel whose width is selected to span a number of data points, the number of data points being dependent on the size of the data; as well as The kernel is added to calculate the density. 6 . The method of claim 5 , wherein the width of the adaptive kernel is a width that spans a range of + / - 10% of the square root of a total number of data points in the data. The method according to claim 5 , wherein the kernel shape is rectangular, triangular or Gaussian. 8 . The method of claim 1 , further comprising, in response to determining that the query does not satisfy the one or more differential privacy requirements, adding noise to the query results until the query results satisfy the one or more differential privacy requirements. The method according to claim 8 , wherein the noise is Gaussian noise or Laplace noise.

10. The method of claim 8, wherein the result outputted is based on the result with added noise.

11. The method of claim 1, wherein there is some information in the database that may be known to the opponent, and the empirical probability density is calculated conditioned on the opponent's information falling into a series of buckets.

12. The method of claim 1 , wherein the set of databases is an ordered sequence, and in response to empirical evidence indicating that the query results in the sequence have statistically significant autocorrelation, the method further comprises: locally aggregating the ordered sequences of a database into shorter sequences of a larger database until the query results no longer have statistically significant autocorrelation; as well as The one or more differential privacy requirements are tested based on the shorter sequence of the larger database.

13. The method of claim 1 , wherein determining whether the query satisfies one or more differential privacy requirements comprises computing a “total delta” Δ, wherein the “total delta” Δ is defined as the cumulative Δ=1-π for entity i. i (1-δ i ), where δ i is the minimum δ that plays a role in the privacy criterion for entity i.

14. A non-transitory computer-readable storage medium comprising computer program code, the computer program code comprising instructions that, when executed by a processor, cause the processor to: receiving a request to run a query on a set of databases, each database in the set of databases including data for a plurality of entities, the data being labeled by the entity; running a plurality of sample queries based on the query to generate sample query results for databases in a subset of the set of databases, each sample query in the plurality of sample queries removing data for different entities relative to other sample queries in the plurality of sample queries; Calculating an empirical probability density function from the query sample results; determining whether the query satisfies one or more differential privacy requirements based on the empirical probability density function; as well as In response to determining that the query satisfies the one or more differential privacy requirements, a result of the query is output.

15. The non-transitory computer-readable storage medium of claim 14, wherein calculating the empirical probability density function comprises: sorting the query results to create an empirical cumulative distribution function of the query results with and without each entity of the plurality of entities; as well as The empirical cumulative distribution function is differentiated using a spacing of a number of data points that depends on the size of the data to derive the empirical probability density function.

16. The non-transitory computer-readable storage medium of claim 14, wherein calculating the empirical probability density function comprises: determining an adaptive kernel density estimate in which data points are replaced by a kernel whose width is selected to span a range of + / - 10% of the square root of the total number of data points in the data; and The kernel is added to calculate the density.

17. The non-transitory computer-readable storage medium of claim 14, wherein the set of databases is an ordered sequence, and in response to empirical evidence indicating that the query results in the sequence have statistically significant autocorrelation, wherein the computer program code further comprises instructions that, when executed by the processor, cause the processor to: locally aggregating the sequences of the database into shorter sequences of a larger database until the query results no longer have statistically significant autocorrelation; and The differential privacy requirement is tested on shorter sequences based on the larger database.

18. The non-transitory computer-readable storage medium of claim 14, wherein there is some information in the database that may be known to the opponent, and the empirical probability density is calculated conditioned on the opponent's information falling into a series of buckets.

19. The non-transitory computer-readable storage medium of claim 14, wherein the computer program code further comprises instructions that, when executed by the processor, cause the processor to: In response to determining that the query does not satisfy the one or more differential privacy requirements, noise is added to the query results until the query results satisfy the one or more differential privacy requirements.

20. A data analysis system comprising: a set of databases, each database in the set of databases comprising data of a plurality of entities, the data being labeled by the entity; a query module configured to receive a request to run a query on the set of databases; a privacy analysis module configured to run a plurality of sample queries based on the query to generate sample query results for databases in a subset of the set of databases, each of the plurality of sample queries removing data of different entities relative to other sample queries in the plurality of sample queries, and further configured to calculate an empirical probability density function from the sample query results; and A result generation module is configured to determine whether the query satisfies one or more differential privacy requirements based on the empirical probability density function, wherein the result generation module is further configured to output a result of the query in response to determining that the query satisfies the one or more differential privacy requirements.

Images