A method for dynamically measuring the privacy protection effect of a local differential privacy mechanism

Abstract

The application discloses a method for dynamically measuring the privacy protection effect of a local differential privacy mechanism, and the measurement result of the method is the privacy budget of the local differential privacy mechanism, which can effectively represent the privacy protection degree of the algorithm and is dynamically measured over time, so that the algorithm protection degree can be captured in time if the algorithm protection degree changes. The application can be applied to the following scene: an algorithm of a frequency estimation mechanism meeting the local differential privacy has been designed, the algorithm is submitted to a third party for examination, and relevant details of the algorithm cannot be disclosed. In the case that the third party does not know the content of the algorithm, how to confirm whether the algorithm meets the epsilon-LDP and whether the epsilon value of the final output result is similar to the designed one.

Description

Technical Field

[0001] This invention belongs to information security technology and relates to a method for dynamically measuring the degree of privacy protection of a frequency estimation mechanism that satisfies local differential privacy in a black-box manner. Specifically, it is a method for dynamically measuring the privacy protection effect of a local differential privacy mechanism. Background Technology

[0002] With the development of data science and the advancement of the information industry, user data is becoming increasingly important for businesses and governments. The collection and analysis of this data holds immense economic value and can provide valuable information for subsequent decision-making. From simple frequency statistics to more complex machine learning, all rely on this data. However, in most cases, the information being collected is personal privacy data, including browsing history, personal behavior, preferences, or characteristic information. Therefore, regardless of the social value and utility of this data, those being analyzed may be unwilling to disclose their true information, and relevant laws and policies do not allow companies to directly collect this user information. For example, when browsing short video apps, the app's backend algorithms can derive user profiles based on the viewing frequency of different types of videos, predict viewer preferences, optimize recommendation algorithms, and thus identify user-preferred information, thereby increasing user online time. However, browsing information is personal privacy data, and most people do not want to upload it directly. Data analysts are not trustworthy third parties, and directly storing real data in the backend could pose a significant risk of privacy leaks.

[0003] In recent years, existing technologies have also developed and deployed many privacy-preserving solutions for this frequency estimation problem. Although their algorithmic details differ slightly, most are based on the concept of local differential privacy (LDP). At the core of these protocols, users do not directly provide their real personal data to the backend. Instead, the system randomly determines whether to provide genuine feedback or select incorrect answers based on a specified probability distribution. This randomization ensures that individual data points from the backend may not be the user's actual data, thus protecting user privacy. Although a single data point may not be accurate, data analysts can use relevant algorithms to approximate the frequency of different values, ensuring the accuracy of the statistical results.

[0004] Formal definition of local differential privacy: For a given ∈ [0,∞), δ∈ [0,1], the random mechanism A needs to satisfy the formula Pr(A(v)=y)≤e ε• Pr(A(v')=y)+δ is required to satisfy (ε,δ)-LDP, where v and v' are any two distinct inputs, y is the output of algorithm A, and ε is the privacy budget, a parameter that measures the degree of user privacy leakage and reflects the extent to which users entrust their privacy to third parties. This parameter can be used to control the strength of privacy protection, with a value range of [0,∞). The larger ε is, the greater the degree of privacy exposure, while the smaller ε is, the stronger the privacy protection. When ε is very small, it is difficult for attackers to distinguish between a pair of different inputs, but at the same time, data analysts need more data to ensure the accuracy of statistical results. δ is called the looseness, a parameter that measures the degree to which the algorithm cannot guarantee local differential privacy. The smaller its value, the higher the probability that the algorithm guarantees ε-LDP, but a certain degree of looseness can bring greater applicability. When δ=0, it is strict local differential privacy; when δ>0, it is loose local differential privacy.

[0005] Since the privacy budget (ε) directly determines the degree of privacy protection an algorithm provides, the algorithm needs to choose an appropriate ε value based on the type of data and the number of users. This ensures strong privacy protection for user data while meeting the data analysis and processing requirements of data companies. However, in practice, it is often impossible to determine whether an algorithm satisfies local differential privacy, and if so, the choice of which parameter ε to use is also crucial. Therefore, developing a metric algorithm for privacy-preserving algorithms is essential.

[0006] Existing data [Askin] The paper "Statistical quantification of differential privacy: a local approach" by Kutta T and Dette H [C] / / 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022: 402-421. presents a centralized differential privacy quantification algorithm. This algorithm categorizes the output of centralized differential privacy into discrete and continuous types. The result can be calculated by transforming the differential privacy definition formula without knowing the algorithm details. However, this algorithm only applies to centralized differential privacy and cannot be directly extended to local differential privacy. The main objective of this invention is to calculate local differential privacy, thereby determining the level of privacy provided by a given algorithm. This invention will focus on discussing frequency estimation algorithms that satisfy strict local differential privacy. Summary of the Invention

[0007] Purpose of the invention: To address the shortcomings of existing technologies in the privacy protection of frequency estimation algorithms for local differential privacy, this invention provides a method for dynamically measuring the privacy protection effect of local differential privacy mechanisms. This method enables the measurement of the privacy protection level of several common frequency estimation mechanisms under the local differential privacy model without knowing the details of the algorithm being measured.

[0008] Technical Solution: A method for dynamically measuring the privacy protection effect of a local differential privacy mechanism. This method dynamically calculates and measures the privacy protection effect of the local differential privacy mechanism in a black-box manner, including the following steps:

[0009] S1. Randomly select t values ​​from the input set, input these values ​​into the algorithm A under test, and execute it n times to construct the output three-dimensional matrix;

[0010] S2. Determine the output pattern and perform statistical analysis on the output algorithm based on the output pattern to construct the output matrix.

[0011] The matrix In the matrix, each row corresponds to one of the inputs in step (S1), each column corresponds to one of the bits in the output vector of the algorithm under test, and the value of each bit of the matrix is ​​set according to the different output styles.

[0012] S3, For matrices Combine any two rows and then substitute them into the following calculation formula:

[0013]

[0014] In the above formula, Representation matrix Any two row vectors in, Indicates that in the calculation After obtaining the result, compare it with the threshold τ. If it is less than the threshold τ, then the value is τ.

[0015] in: In this context, v represents the input value, i represents the index of the output value in the output vector, and the output value is a discrete vector value. This represents the distribution dictionary of the i-th element of the output vector when the input value is v, and when the output value is a continuous vector value. This represents the distribution function of the i-th element of the output vector when the input value is v; This is the computational representation when the input is v';

[0016] S4. Select the maximum value based on the calculation result of step (S3);

[0017] S5. Run the above program regularly to monitor changes in the privacy budget and update the results periodically.

[0018] Furthermore, in step (S1), considering that in the local differential privacy frequency estimation mechanism algorithm, there is no difference in magnitude between two input values, only the same or different values. Therefore, considering the use of the same set of encoding perturbation rules, any two different input values ​​v and v' have the same maximum |In(Pr[A(v)=y] / Pr[A(v')=y])| value, where v and v' are two different input values, y is the output value of algorithm A, and A is the applied local differential privacy algorithm. Thus, it is not necessary to iterate through all values ​​of v and v'; verifying any two values ​​is sufficient to estimate ∈. However, to reduce error, the metric algorithm randomly selects t values ​​for calculation, running n times for each value.

[0019] Different local differential privacy algorithms often have different output types. When the output value is discrete, a single value or a set of values ​​is uniformly regarded as a vector of length 1. When the output value is continuous, a single continuous value is regarded as a continuous vector of length 1.

[0020] Furthermore, in step (S1), since the output of each algorithm A is regarded as a one-dimensional vector, n outputs can form a two-dimensional matrix, and t random values ​​are input, so three-dimensional data can be obtained in the end.

[0021] Furthermore, in step (S2), the calculation rules or judgment process for different output styles are as follows:

[0022] If the output of algorithm A is a discrete vector value, by statistically analyzing the frequency of each distinct value of the output vector X under the same input (same row of the matrix), an output matrix can be constructed. Each value in the matrix is ​​a probability dictionary.

[0023] If the output of algorithm A is a continuous vector value, the probability density function of the output distribution under the same input can be calculated using kernel density estimation, and the output matrix can be constructed accordingly. Each value of a matrix is ​​a distribution function.

[0024] Furthermore, in step (S3), before performing the calculation, it is necessary to compare... and To reduce the error in the results, if the output is discrete, compare the JS divergence between the two. If the JS divergence is less than a certain threshold, they are considered to follow the same distribution. If the output is continuous, compare the difference between the kernel density estimates. If the difference is less than a certain threshold, they are considered to follow the same distribution. This effectively reduces the error in the results.

[0025] Furthermore, in step (S3), when the output results are continuous, and The difference calculation needs to take a certain range on the x-axis. If the range is too small, the final estimation result will have a lot of omissions. If the range is too large, smaller values ​​will be included, increasing the error. It is preferable to sort all the output values ​​when the input is v and v', remove the first 2.5% and the last 2.5%, and use all the remaining values ​​as the range of values ​​for the x-axis.

[0026] In calculation After finding the value, theoretically, we need to find the maximum value among them for subsequent calculations. However, considering that if we directly select the maximum value, the sum of the t maximum values ​​will lead to the accumulation of errors and increase the error, we can select the 90th percentile as the value to be selected according to the actual situation. This will reduce the accumulation of errors and prevent the final result from having a large error.

[0027] Furthermore, for step (S4), the operation includes the following considerations:

[0028] After completing step (S3), the preliminary measurement result is calculated, which is the ∈ value when the input is v and v'. However, since a total of t input values ​​are selected, there can be... Given a set of different values, a local differential privacy algorithm should find the final value of ∈ to be the maximum value of ∈ calculated from all input combinations. However, due to the characteristics of frequency estimation, it is not necessary to substitute all values ​​for calculation. The result can be calculated after verifying some values.

[0029] Theoretically, it is necessary to calculate the similar sizes There are ∈ , where d represents the number of input value categories. Since d can be very large in practice, leading to excessive computational complexity, and it's unnecessary to iterate through all values, only ... The calculation can be performed on each value, and the maximum value can be taken to reduce the amount of calculation and control the error.

[0030] In this method, the user calls the algorithm under test multiple times, and then the output results are statistically analyzed. Based on the distribution pattern of the output results, the degree of protection of the algorithm is finally measured using the definition formula of local differential privacy.

[0031] Beneficial Effects: This invention can dynamically measure the privacy protection level of several common frequency estimation mechanisms under a local differential privacy model, ultimately obtaining the ∈ value of the measured algorithm. This allows for the assessment of the privacy protection level of a local differential privacy algorithm. Furthermore, changes in the ∈ value of the algorithm can be detected and captured during the periodic execution of the measurement algorithm. By running the measured algorithm multiple times and statistically analyzing the distribution of its output results, the result can be estimated using relevant formulas for local differential privacy. During estimation, to reduce errors, methods such as JS divergence or kernel density estimation are used to ignore distributions with a certain degree of similarity, preventing the accumulation of many small errors and the resulting excessively large error. This ensures that the final error remains within a controllable range. Attached Figure Description

[0032] Figure 1 This is an overall flowchart of the present invention;

[0033] Figure 2 This is a schematic diagram of the user-side process in an example of the present invention;

[0034] Figure 3 This is a schematic diagram illustrating the evaluation results of the direct encoding algorithm in the embodiment;

[0035] Figure 4 The evaluation results of the symmetric unary coding measured in the embodiment are shown.

[0036] Figure 5 This is the evaluation result of the histogram encoding test. Detailed Implementation

[0037] The above-described solution will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the protection scope of the present invention.

[0038] This invention provides an algorithm that dynamically measures the privacy protection level of several common frequency estimation mechanisms under a local differential privacy model without knowing the algorithm details. It is a method for dynamically measuring the privacy protection effect of local differential privacy mechanisms in a black-box manner. Even if the algorithm is adjusted during use, the measurement algorithm can still be captured. Estimation can be performed when the algorithm output is a discrete value, a discrete vector value, a set value, a single continuous value, or a continuous vector value. Existing local differential privacy algorithms can be evaluated using the method described in this invention. Any frequency estimation algorithm whose output meets the above conditions can be used. Examples include: Random Response (DE), Symmetric Unary Coding (SUE), Optimized Unary Coding (OUE), Histogram Coding (HE), and Subset Selection.

[0039] like Figure 1 This invention, based on the definition of local differential privacy and the relevant characteristics of frequency estimation algorithms, and combined with the different types of algorithm output results, performs statistical analysis on the algorithm output, and finally measures the degree of protection of privacy data by the algorithm according to the defined formula, which can effectively verify the accuracy of the algorithm.

[0040] Specifically, the implementation steps of the method for dynamically measuring the privacy protection level of several common frequency estimation mechanisms under the local differential privacy model described in this invention are as follows:

[0041] 1. Set the hyperparameters of the algorithm, such as the number of times the algorithm is run (n) and the threshold for JS divergence.

[0042] 2. Call the algorithm being tested.

[0043] 3. Call the privacy measurement algorithm to obtain the results.

[0044] Considerations for selecting hyperparameters:

[0045] Choice of n value for discrete algorithm:

[0046] To ensure the accuracy of the evaluation result ∈, it is first necessary to ensure that the error of the estimated p-value is within a certain range.

[0047] By using the Clopper-Pearson inequality:

[0048]

[0049] Where x is the number of successes, n is the number of trials, and p is the success rate. α: Significance level. F(α,b,c): The specified α-quantile of the F-distribution with degrees of freedom b and c. F-distribution: Let U ~ χ 2 (n1),V~χ 2 (n2), and U and V are independent of each other. Quantiles: 0 < α < 1, for a continuous random variable X, are said to satisfy P(X > x). α The point x = α α Let X be the upper α quantile (or quantile point) of the probability distribution.

[0050] Therefore, the error range l is:

[0051]

[0052] When α = 0.05 and n = 40000, the maximum value of l is less than 0.01, which meets the error limit requirement.

[0053] Choice of n value for continuous algorithm:

[0054] The error range for the plug-in method can be estimated as follows:

[0055]

[0056] in For the estimated distribution function, μ K =∫K 2 (x)dx, where h is the bandwidth, n is the number of tests, and d is the dimension of the variable.

[0057] This interval indicates that the error in the kernel density estimation result is... because The distribution function is estimated, and its specific value is unknown. The maximum value is 1 and the minimum value is 0. To ensure the range of error, the specific value is taken as the maximum value of 1. It can be concluded that when the value of n is 600000, l≤0.001 can be satisfied.

[0058] Choosing the JS divergence threshold:

[0059] JS divergence is mainly used to determine whether the difference between two sets of variables satisfies the same distribution. The more they satisfy the same distribution, the closer the value is to 0, and the larger the difference, the closer it is to 1.

[0060] However, even with the same algorithm, due to randomness, it's difficult to guarantee that the value distributions of the outputs in two rounds are exactly the same. Its JS divergence is close to 0 but not equal to 0; the more types of output values ​​there are, the larger the value will be. Similarly, for two sets of variables with different distributions, the fewer the types of variable values, the smaller the relative JS divergence value will be.

[0061] Therefore, a JS divergence threshold needs to be determined to ensure that when the value distribution is the same, values ​​less than the threshold can be judged as the same, and values ​​greater than the threshold can be judged as different. This threshold needs to be determined based on the number of variables in the algorithm's output vector. Most algorithms only have 2 types of values, that is, the value is 0 or 1. To ensure universality, when testing the same threshold, it is assumed that there are 10 different variables in the output value, and when testing different thresholds, it is assumed that there are only 2 different variables in the output value.

[0062] When n = 40000, if the variable set has 10 distinct values, and each value occurs at a frequency of 1 / 10, then 95% of the JS divergence values ​​will be less than 0.0001. Therefore, a threshold of 0.0001 can satisfy most requirements.

[0063] Algorithm testing:

[0064] To test the algorithm evaluation results, the metric algorithm can be run multiple times, and the difference between its output and the true value can be observed. Algorithms such as direct coding, symmetric unary coding (SUE), optimized unary coding (OUE), and histogram coding (HE) can be used to evaluate the results. During testing, the metric algorithm is run 100 times, and the results of these 100 runs are statistically analyzed to construct the cumulative distribution function. The ∈ values ​​used for testing are {0.3, 0.5, 0.8}. To ensure easy observation of the test results, the ∈ values ​​of the tested algorithm will not change during the test.

[0065] 1. Test direct coding:

[0066] The direct coding algorithm (DE) consists of two steps: coding and perturbation: DE = Perturb DE (Encode DE (v))

[0067] coding:

[0068] x = Encode DE v = v5

[0069] Disturbance:

[0070] y = Perturb DE x

[0071]

[0072] k: The number of values ​​that the user can input. See the algorithm evaluation results. Figure 3 The horizontal axis in the figure is The value is shown in the cumulative distribution curve.

[0073] 2. Test Symmetric Unary Encoding (SUE):

[0074] coding:

[0075] x = Encode SUE v = 0,…,0,1,0,…07

[0076] The length of the encoded vector is k, with the v-th bit being 1 and the rest being 0.

[0077] Disturbance:

[0078] y = Perturb SUE x

[0079]

[0080] That is, the probability of each value being p remains unchanged, while the probability of each value being q changes. The algorithm evaluation results are shown below. Figure 4 .

[0081] 3. Test histogram encoding (HE):

[0082] coding:

[0083] x = Encode HE v=0.0,…,0.0,1.0,0.0,…0.09

[0084] The encoded vector has a length of k, with the v-th bit being 1.0 and the remaining bits being 0. Two different v values ​​have an encoded distance of 2.0.

[0085] Disturbance:

[0086]

[0087] The algorithm evaluation results are shown below. Figure 5 .

[0088] The test results above show that 95% of the tests can achieve the desired outcome. Furthermore, most test results are larger than the actual values, with only a few values ​​being smaller than the theoretical values.

Claims

1. A method for dynamically measuring the privacy protection effect of a local differential privacy mechanism, characterized in that: This method dynamically calculates and measures the privacy protection effect of the local differential privacy mechanism in a black-box manner, including the following steps: S1. Randomly select from the input set t These values ​​are input into the algorithm being tested. And it is executed n times to construct the output three-dimensional matrix; Considering the use of the same set of encoding perturbation rules, for any two different input values and their largest The values ​​are the same, among which , These are two different input values. The algorithm to be tested The output value, For the applied local differential privacy algorithm; thus eliminating the need to... and By iterating through all values, it is only necessary to verify any two of them to estimate the result. To reduce error, the measurement algorithm randomly selects... Calculate for each value, and run for each value. Second-rate, ; S2. Determine the output pattern and perform statistical analysis on the output algorithm based on the output pattern to construct the output matrix. ; The matrix In this matrix, each row corresponds to one input in step S1, and each column corresponds to one bit of the output vector of the algorithm under test. The value of each bit of the matrix is ​​set according to the different output styles, specifically including the following judgment process: If the algorithm The output is a discrete vector value. The statistical analysis shows that, under the same input, the output vector... The frequency of occurrence of each different value can form the output matrix. Each value in the matrix is ​​a probability dictionary; If the algorithm The output is a continuous vector value. Using kernel density estimation, the probability density function of the output distribution under the same input can be calculated, and the output matrix can be constructed accordingly. Each value of the matrix is ​​a distribution function; S3, For matrices Combine any two rows and then substitute them into the following calculation formula: In the above formula, , Representation matrix Any two row vectors in, Indicates that in the calculation After obtaining the result, compare it with the threshold. Compare, if it is less than the threshold Then the value is ; in: In Represents the input value. This represents the index of the output value in the output vector, when the output value is a discrete vector value. The input value represents When, the output vector of the first... A dictionary of bit distributions, where the output values ​​are continuous vector values. The input value represents When, the output vector of the first... The distribution function of the bits; The input is Time-based calculation representation; S4. Select the maximum value based on the calculation result of step S3; S5. Run the above steps regularly to monitor the privacy budget. The results are updated periodically based on the changes.

2. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 1, characterized in that: In step S1, different local differential privacy algorithms have different output types. When the output value is discrete, a single value and a set of values ​​are uniformly regarded as a vector of length 1. When the output value is continuous, a single continuous value is regarded as a continuous vector of length 1.

3. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 1, characterized in that: In step S3, a comparison is required before the calculation. and If the output is a discrete distribution, compare the JS divergence of the two. If the JS divergence is less than a certain threshold, the two can be considered to follow the same distribution. If the output is a continuous distribution, compare the difference after kernel density estimation. If the difference is less than a certain threshold, the two can be considered to follow the same distribution.

4. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 3, characterized in that: Step S3 is when the output results are continuous. and During the difference calculation process, it is necessary to The axis takes a certain range. Specifically, for this range, the input is... and Sort all output values, remove the top 2.5% and bottom 2.5%, and use the remaining values ​​as... The range of values ​​for the axis.

5. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 1 or 4, characterized in that: Step S3 calculates After finding the values, we need to find the maximum value among them, and then perform subsequent calculations. The maximum value is selected based on the 90th percentile.

6. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 1, characterized in that: In step S4, based on a local differential privacy algorithm, regarding the privacy budget... The process of determining the maximum value does not require... Each input value is substituted into the calculation, and the result can be determined directly after verifying some values.

7. The method for dynamically measuring the privacy protection effect of the local differential privacy mechanism according to claim 6, characterized in that: In this method, the user calls the algorithm under test multiple times, then the output results are statistically analyzed, and the degree of protection of the algorithm is finally measured by the distribution pattern of the output results and the definition formula of local differential privacy.

Images