Questionnaire privacy protection method and system based on local differential privacy

Abstract

The invention relates to the technical field of data privacy protection, in particular to a questionnaire privacy protection method and system based on local differential privacy, and the method comprises three steps: data collection, data processing and statistical analysis. The answer data comprises single-option data and multi-option data; data processing: carrying out random response disturbance processing on single-option data by adopting a K-RR algorithm; carrying out disturbance on the multi-option data by adopting an RAPPOR algorithm; and statistical analysis: the server side performs aggregation analysis on the disturbed data to obtain statistical characteristics of real data. According to the invention, K-RR and RAPPOR algorithms are innovatively applied to questionnaire data processing, so that the defect of a traditional questionnaire system in the aspect of privacy protection is effectively overcome, the purpose of maintaining data statistics effectiveness while protecting user privacy is achieved, and the security and user credibility of the questionnaire system are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data privacy protection, and in particular to a questionnaire privacy protection method and system based on local differential privacy. Background Art

[0002] With the increasing popularity of online questionnaires, their applications in social surveys and public opinion gathering have become increasingly widespread. However, data security issues have also become increasingly prominent. In recent years, incidents of illegal information acquisition have frequently occurred, exposing the privacy vulnerabilities of questionnaire systems. Although online questionnaire platforms have strengthened the security of data transmission and storage through encryption technology, the high computing costs and complex management processes make large-scale implementation difficult, especially for small and medium-sized platforms. Traditional anonymization technologies can reduce information correlation, but they cannot protect against attackers with strong background knowledge. Once subjected to linking attacks or differential attacks, the risk of privacy leakage increases dramatically. In this context, localized differential privacy technology, which has been developing in recent years, offers significant advantages. Compared with other centralized data protection methods, localized differential privacy technology perturbs data locally to add noise. At the data collection end, unbiased estimates of the perturbed data are used to remove the noise and restore the statistical properties of the aggregated data. Localized differential privacy technology is characterized by low cost, high availability, easy dissemination, strong data protection, and rigorous mathematical proof. Even if the data is attacked or leaked in any form during transmission or storage, the original data cannot be recovered due to the perturbation.

[0003] Academic research on LDP has made significant progress. Ye Qingqing and others systematically sorted out the theoretical framework and application scenarios of LDP, while Huang Jue's team proposed an improved method for frequency feature extraction to further reduce statistical errors. In addition, the classic random response mechanism achieves individual data protection through probabilistic perturbations, but its early form is only applicable to binary data; the K-RR algorithm proposed in subsequent studies is extended to multi-value scenarios and improves utility through parameter optimization. Google's RAPPOR algorithm combines Bloom filters with a double perturbation mechanism to support high-frequency word statistics and high-dimensional data processing, providing a solution for multiple-choice questionnaires. Despite this, existing research focuses on optimization at the algorithm level, lacks end-to-end systematic design for questionnaire scenarios, and faces the challenge of reduced utility when the data domain is large and the sample size is limited. Summary of the Invention

[0004] The present invention aims to solve the problems of privacy leakage risks and third-party trust issues in data transmission and storage in traditional questionnaire systems. Existing research focuses on algorithm optimization and lacks end-to-end systematic design. The utility decreases when the data domain is large and the sample size is limited. This paper proposes a questionnaire privacy protection method and system based on local differential privacy. The K-RR algorithm and RAPPOR algorithm are used to perturb the questionnaire data, which can effectively maintain the statistical utility of the data while protecting user privacy, significantly improving the security of the questionnaire system and user trust.

[0005] In order to achieve the above purpose, the technical solutions adopted are:

[0006] This paper provides a questionnaire privacy protection method based on local differential privacy, which includes three steps: data collection, data processing and statistical analysis:

[0007] Data collection: obtaining user response data for questionnaires, including single-choice data and multiple-choice data;

[0008] Data processing: For single-choice data, the K-RR algorithm is used for random response perturbation processing; for multiple-choice data, the RAPPOR algorithm is used for perturbation;

[0009] Statistical analysis: The server performs aggregate analysis on the disturbed data to obtain the statistical characteristics of the real data.

[0010] According to the questionnaire privacy protection method based on local differential privacy of the present invention, the perturbation process of the K-RR algorithm further includes:

[0011] The user side calculates the probability of retaining the true value based on the privacy budget parameter ε and noise value generation probability Where k is the total number of options;

[0012] For each radio button selected by the user, the true value is returned with probability p1, and any other candidate value is returned with probability p2.

[0013] According to the questionnaire privacy protection method based on local differential privacy of the present invention, further, the statistical analysis of the K-RR algorithm adopts a back-propagation algorithm, and the back-propagation algorithm includes:

[0014] The server side uses the back-calculation formula based on the frequency S of the disturbed data Calculate the actual data distribution, where N is the total number of data, P r (x=a) is the problem to be solved, which represents the true proportion of option a in the original data.

[0015] According to the questionnaire privacy protection method based on local differential privacy of the present invention, the perturbation process of the RAPPOR algorithm further includes:

[0016] The user end encodes the multiple-option data into a binary vector B of length m through Bloom Filter;

[0017] Perform the first random response processing on the encoded vector B, flip each bit with probability f / 2, and generate the intermediate vector B′;

[0018] The second random response processing is performed on the vector B′ after the first processing. For each bit B of B′ i ′, if B i ′=1, it remains 1 with probability q and flips to 0 with probability 1-q; if B i ′=0, it remains 0 with probability 1-p, and flips to 1 with probability p, generating the final perturbation vector and reporting it to the server.

[0019] According to the questionnaire privacy protection method based on local differential privacy of the present invention, the statistical analysis process of the RAPPOR algorithm further includes:

[0020] The server aggregates all disturbance vectors and counts the proportion of each bit being 1.

[0021] Using the correction formula Estimate the true data distribution, where It represents the proportion of the estimated real data where the jth bit is 1;

[0022] Lasso regression is used to fit the corrected frequency and the Bloom Filter mapping matrix of the options to optimize the frequency estimation results.

[0023] According to the questionnaire privacy protection method based on local differential privacy of the present invention, further, the BloomFilter uses k hash functions to map the original string s to a vector B, where the condition that the jth bit is 1 is that there exists a hash function h i (s) = j.

[0024] Furthermore, the present invention also provides a questionnaire privacy protection system based on local differential privacy, which is used to implement the above-mentioned questionnaire privacy protection method based on local differential privacy. The system includes:

[0025] A data collection module is used to obtain the user's answer data to the questionnaire, wherein the answer data includes single-choice data and multiple-choice data;

[0026] The data processing module is used to perform random response perturbation processing using the K-RR algorithm for single-choice data and the RAPPOR algorithm for multi-choice data;

[0027] The statistical analysis module is used on the server side to perform aggregate analysis on the disturbed data to obtain the statistical characteristics of the real data.

[0028] According to the questionnaire privacy protection system based on local differential privacy of the present invention, the system further includes a visualization module for displaying the output results of the statistical analysis module to the user in a graphical interface.

[0029] The beneficial effects achieved by adopting the above technical solution are:

[0030] With the widespread use of online questionnaires, the issue of user privacy protection has become increasingly prominent. Traditional questionnaire systems are at risk of privacy leakage during data transmission and storage, have third-party trust issues, and are difficult to cope with complex attack scenarios. Based on local differential privacy technology, the present invention innovatively applies the K-RR algorithm and the RAPPOR algorithm to questionnaire data processing. The K-RR algorithm ensures the privacy of data during transmission and storage by performing random response perturbations on single-choice data, while ensuring the accuracy of statistical results through a back-propagation algorithm. The RAPPOR algorithm perturbs multi-choice data through Bloom Filter and two random response processes to ensure the anonymity and non-traceability of user data. Experimental results show that the K-RR algorithm and the RAPPOR algorithm can effectively maintain the statistical utility of data while protecting user privacy, significantly improving the security of the questionnaire system and user trust. The present invention provides a feasible solution for data protection based on localized differential privacy, which has high practical value and promotion prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. The drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0032] Figure 1 1 is a flowchart of a questionnaire privacy protection method based on local differential privacy according to an embodiment of the present invention;

[0033] Figure 2 is a data processing flow chart of the K-RR algorithm according to an embodiment of the present invention;

[0034] Figure 3 is a data processing flow chart of the RAPPOR algorithm according to an embodiment of the present invention;

[0035] Figure 4is a flow chart of the statistical analysis of the RAPPOR algorithm according to an embodiment of the present invention;

[0036] Figure 5 This is a system interface diagram of a questionnaire privacy protection method based on local differential privacy according to an embodiment of the present invention;

[0037] Figure 6 is a performance comparison of different privacy parameters of the embodiments of the present invention;

[0038] Figure 7 This is a comparison chart of K-RR processing of small data volumes according to an embodiment of the present invention;

[0039] Figure 8 This is a comparison chart of K-RR processing large amounts of data according to an embodiment of the present invention;

[0040] Figure 9 is a performance comparison of different privacy parameters of the embodiments of the present invention;

[0041] Figure 10 This is a comparison chart of RAPPOR processing a small amount of data in an embodiment of the present invention;

[0042] Figure 11 This is a comparison chart of large data volumes processed by RAPPOR according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the accompanying drawings of specific embodiments of the present invention to clearly and completely describe the exemplary embodiments of the present invention. Unless otherwise defined, technical or scientific terms used in the present invention should be given the common meanings understood by people with ordinary skills in the relevant field.

[0044] This embodiment discloses a questionnaire privacy protection method based on local differential privacy, which includes three main steps: data collection, data processing and statistical analysis. The process is as follows: Figure 1 As shown, specifically including:

[0045] Step S101: Obtain the user's answer data to the questionnaire, collect the results and send them to the database. The answer data includes single-choice data and multiple-choice data.

[0046] Single-choice data means that users can only choose one answer from multiple options, such as "What is your age range?", A. 18-25 years old; B. 26-35 years old; C. 36-45 years old; each user's answer is a single value; the data statistics goal is to calculate the frequency of each option (for example, 30% choose A, 50% choose B).

[0047] Multiple-choice data means that users can select multiple answers (at least one), for example, "Your hobbies are (multiple choices)", A. Reading, B. Sports, C. Music; each user's answer is a set (such as {"reading", "music"}); the data statistics goal is to calculate the selection ratio of each option (for example, "music" was selected by 40% of users).

[0048] Step S102, data processing, is the core of this method and is primarily used to perturb single-choice and multi-choice data to ensure that their security strength meets the requirements of localized differential privacy. For single-choice data, the K-RR algorithm is used for random response perturbation.

[0049] The responses to single-choice questions are single-valued frequency data. K-RR primarily overcomes the issue of random response techniques (RR) for binary variables. For variables with k candidate values, a random response can be directly used. Furthermore, compared to other localized differential privacy algorithms for single-valued frequency data, the K-RR algorithm is simpler to operate and requires less computational power. Therefore, the K-RR algorithm was chosen to process and analyze single-choice question data. The K-RR algorithm is a generalization of the random response technique, specifically designed for single-choice data with multiple candidate values. Its core concept is to achieve localized differential privacy by probabilistically perturbing the data on the user side, while maintaining the statistical availability of the data. Alternatively, it can be understood as follows: when a user truly answers a certain option, the system will "lie" with a certain probability, randomly changing it to another option to protect privacy.

[0050] When there are k candidate values ​​in a variable, a random response can be performed directly. For any input R∈χ, the response output R′∈χ is as shown in formula (1):

[0051]

[0052] Among them, R is the option actually selected by the user, R′ is the option reported after perturbation, k is the total number of options in the question, and ε is the privacy budget parameter (the larger the value, the weaker the privacy protection, but the more accurate the data). The probability of reporting the true option is The probability of reporting any one of the remaining k-1 false options is . Note that when k = 2, the above formula is the same as the form of random response W-RR, so this is a more generalized definition form.

[0053] For example: If the user actually chooses "A" (k=4 options, assuming ε=1), there is a 74% probability of directly reporting "A", about 8.7% probability of reporting "B", about 8.7% probability of reporting "C", and about 8.7% probability of reporting "D".

[0054] Step S103: On the server side, the data disturbed by the K-RR algorithm is aggregated and analyzed using a back-propagation algorithm to restore the true distribution of the data.

[0055] First, the initial setting Calculate the p1 and p2 values, where p1 is the probability that the true data is retained, and p2 is the probability that the true data is perturbed to any other noise value, that is: According to the formula NP r (x=a) is back-pushed, N is the total amount of data (for example, 1000 questionnaire answers), P r (x=a) is the problem to be solved, which represents the true proportion of option a in the original data, where:

[0056] NP r (y=a)=S (2)

[0057] NP r (y=a)=Np1P r (x=a)+P r (x≠a)p2N (3)

[0058]

[0059] Among them, P r (y=a) represents the proportion of option a in the perturbed data, and S represents the actual number of option a after the perturbation. According to formula (4), the back-calculated data can be obtained, and its overall trend is the same as the real data.

[0060] For example, suppose there is a questionnaire about age groups (5 options) with the following parameters:

[0061] The total amount of data N = 1000; options: A (18-25 years old), B (26-35 years old), C (36-45 years old), D (46-55 years old), E (over 55 years old); privacy budget ε = 1, calculated as follows:

[0062]

[0063] Observed data: The number of option A after perturbation S=400.

[0064] Objective: Estimate the true proportion P of option A in the original data r (x=A).

[0065] ① Directly count the disturbed data

[0066] After the disturbance, S=400 times "A" were observed, that is:

[0067]

[0068] ②Establish a disturbance relationship

[0069] The perturbed “A” comes from two parts: (1) The actual choice of A and not perturbed: probability p1P r (x=A);② The actual choice is other options but the perturbation is A: p2P r (x≠A).

[0070] therefore:

[0071] 0.4=0.73P r (x=A)+0.07(1-P r (x=A)

[0072] ③Solve the equation and deduce the true proportion

[0073] Rearrange the equation:

[0074]

[0075] The results showed that approximately 50% of users in the original data (approximately 500 people) actually chose "A," but after the perturbation, only 400 "A" selections were observed. This deviation was corrected using a back-propagation algorithm.

[0076] Step S104: Use the RAPPOR algorithm to perturb the multiple-choice data.

[0077] The answers to multiple-choice questions represent multivariate frequency data. The RAPPOR algorithm performs well in processing high-dimensional discrete data, meeting the requirements for processing multiple-choice questions. The RAPPOR algorithm achieves privacy-preserving data collection and analysis through a collaborative mechanism between the client and the server.

[0078] In the user-side perturbation phase, the original string is first converted into a binary vector through Bloom Filter encoding: a vector of length m is set, and k independent hash functions are used to map the original string s into a vector B, where the condition for the jth bit to be 1 is that there exists a hash function h i (s) = j.

[0079] Then double randomization is performed: when the perturbation is first performed, each bit is flipped with probability f / 2 to generate an irreversible B′ for storage; each time it is reported, B′ is perturbed again, and for each bit B′ of B′ i ′, if B i ′=1, it remains 1 with probability q and flips to 0 with probability 1-q; if B i ′=0, it remains 0 with probability 1-p, and flips to 1 with probability p, and finally generates report R.

[0080] For example, consider a multiple-choice question: "Please select your hobbies (multiple choices): music, sports, reading", with the following parameters: binary vector length m = 8, number of hash functions k = 2;

[0081] ①Generate Bloom Filter code for each option

[0082] The hash values ​​of the option "music" are h1("music")=2, h2("music")=5, and the generated vector B is: [0,1,0,0,1,0,0,0] (the 2nd and 5th bits are 1).

[0083] The hash value of the option "sports" is h1("sports")=5, h2("sports")=7, and the generated vector B is: [0,0,0,0,1,0,1,0] (the 5th and 7th bits are 1).

[0084] The hash values ​​of the option "read" are h1("read")=1, h2("read")=3, and the generated vector B: [1,0,1,0,0,0,0,0] (the first and third bits are 1).

[0085] ②Merge multiple options vector

[0086] If the user selects "Music" and "Reading", the merged result (bitwise OR) is: [1,1,1,0,1,0,0,0] (the 1st, 2nd, 3rd, and 5th bits are 1, indicating that these two options are selected).

[0087] ③Double randomization perturbation

[0088] Perform two random perturbations on the merged vector [1,1,1,0,1,0,0,0]:

[0089] 1. First disturbance:

[0090] Each bit is flipped with probability f / 2 (eg f=0.5).

[0091] Possible results are: [1,0,1,1,1,0,0,0] (the 2nd bit is flipped to 0 and the 4th bit is flipped to 1).

[0092] 2. Second disturbance:

[0093] To B i Each bit of ′ is forced to 0 / 1 with probability q or p.

[0094] The final reported vector may be: [1,0,0,1,1,0,0,1] (the third bit is randomly set to 0 and the eighth bit is randomly set to 1).

[0095] Step S105: On the server side, aggregate statistics are performed on the vectors processed by the RAPPOR algorithm for all users, and the true distribution of the data is restored through regression analysis.

[0096] When decoding on the server side, aggregate all reports R and count the proportion of each bit being 1 Use formula (5) to estimate the true data distribution:

[0097]

[0098] in, Represents the proportion of the estimated real data where the jth bit is 1. The correction is used to obtain the true distribution estimate, and the parameters are optimized in combination with the constraints. In terms of privacy protection, the algorithm satisfies ε differential privacy and the total privacy budget ε total Through BloomFilter dimension reduction and double perturbation mechanism, RAPPOR maintains the availability of data statistics while resisting long-term tracking attacks.

[0099] For example:

[0100] The scenario is: 10,000 users answer "Hobbies (multiple choices): music, sports, reading".

[0101] Real data: 3,000 people chose "Music" (mapped to the third place); 5,000 people chose "Sports" (mapped to the fifth place).

[0102] Perturbed data: The reporting vector of a single user is random (e.g. [0,1,1,0,0,0,0,0]).

[0103] Server-side statistics found:

[0104] The proportion y3 of the third digit being 1 is 0.35 (including noise). After correction, the estimated true proportion f3 is ≈ 0.3 (ie, 30% of users choose "music").

[0105] Because multiple options may share the same bits (Bloom filter hash collisions), the corrected estimated true proportion is the sum of the frequencies of multiple options. Lasso regression is used to fit the corrected frequencies to the Bloom filter mapping matrix of the options to optimize the frequency estimate.

[0106] Through step S103 and step S105, the disturbed data is statistically analyzed to help publishers obtain survey results more intuitively, provide a visual graphical interface for users to more conveniently view and modify questionnaires, and for administrators to manage background data.

[0107] Corresponding to the above method, this embodiment also discloses a questionnaire privacy protection system based on local differential privacy, which includes:

[0108] The data collection module is used to obtain the user's answer data to the questionnaire, and the answer data includes single-choice data and multiple-choice data.

[0109] The data processing module is used to perform random response perturbation processing on single-choice data using the K-RR algorithm; and to perform perturbation on multi-choice data using the RAPPOR algorithm.

[0110] The statistical analysis module is used on the server side to perform aggregate analysis on the disturbed data to obtain the statistical characteristics of the real data.

[0111] A complete process for implementing the method of the present invention is given below.

[0112] For the processing of choice-based data, based on the principle of localized differential privacy, the data processing process is completely local to the user. Question types are divided into single-choice questions and multiple-choice questions. Different algorithms are used to process the data of these two types based on their different characteristics.

[0113] (1) Single-choice data processing method

[0114] Since the K-RR algorithm performs well in single-value frequency statistics and consumes less computing power, the single-choice question type of this method is implemented using the K-RR algorithm. The K-RR algorithm module generates a random number, compares it with the actual value filled in, and determines the uploaded value based on the comparison result, thus completing the perturbation. The flowchart of the data processing module is as follows: Figure 2 shown.

[0115] Considering that the multiple-choice questions in the questionnaire survey system are based on data analysis under single-value frequency statistics, the multiple-choice question type in this method refers to the situation where each user only sends one variable value for a question. After the user sends the data to the data collector, the data collector counts the frequency of each candidate value based on the existing or statistically obtained candidate value list and publishes it.

[0116] The data processing program (user side) is as follows:

[0117] Step 1: After the user fills out the questionnaire, when the answer data is sent back to the server, call the k_random_response class and enter the actual value of the user's answer.

[0118] Step 2: Calculate the value of probability p according to the epsilon parameter set in the k_random_response class.

[0119] Step 3: Determine the return value. If the random number r < p, return the original value value; otherwise, randomly select a value x from the values list that is not equal to value as the return value.

[0120] Through the above steps, the process of perturbing data by the K_RR algorithm on the user side can be completed.

[0121] The data analysis program (server side) in the method is as follows:

[0122] Step 1: Call the backtracking function aggregate_histogram and input the dataset of single-choice questions received by the server side.

[0123] Step 2: Return the processed aggregated data.

[0124] Through the above steps, the process of aggregating and analyzing data by the K-RR algorithm on the server side can be completed. The core is the backtracking function. When the response dataset of single-choice questions is collected, through the backtracking function, the perturbed data can be aggregated and backtracked to the original true trend of the data.

[0125] The processing flow of the backtracking function aggregate_histogram is as follows:

[0126] Step 1: Calculate the probabilities p1 and p2 according to the epsilon parameter set in the k_random_response class.

[0127] Step 2: Count the number of times 0 - 100 appears in each data in the perturbed dataset private_bucket_list one by one, and store it in the unary matrix private_hist.

[0128] Step 3: Calculate the values in private_hist to backtrack the original values and store them in estimate_hist.

[0129] Step 4: Return estimate_hist.

[0130] (2) Method for processing multiple-choice data

[0131] RAPPOR is a local differential privacy protection algorithm for crowdsourcing statistics, which is a privacy solution based on the user side. It perturbs the data before the user side sends the data, and at the same time the server can analyze and process the overall data collected without knowing individual data.

[0132] First, introduce the parameters:

[0133] (1) vis the true value of the input.

[0134] (2) S = s1, ..., s k is the perturbation value generated by the RAPPOR algorithm.

[0135] (3)B=b1,……,b k is the binary vector obtained by the first filtering through BloomFilter.

[0136] (4)B′=b1′,……,b k ′ is the binary vector obtained by B after the first random response.

[0137] (5) f is the probability of getting 1 in the first random response, and p and q are the probabilities of getting 1 in the second random response.

[0138] In this method, due to the excellent protection effect of the RAPPOR algorithm on high-dimensional discrete data, a method for protecting multiple-choice question data in the questionnaire system was designed using the basic idea of ​​the RAPPOR algorithm. The data processing flow was modified according to the needs of the questionnaire system, and data processing and data analysis programs were written and encapsulated in the back-end of the questionnaire system, so as to facilitate user-side data processing and server-side data analysis.

[0139] After users complete and upload the questionnaire, the data processing program begins. Once the data processing is complete, the user's completed data is sent to the server-side database. The data collector then enters the questionnaire data analysis section, whereupon the data analysis program begins running, analyzing the collected data. Once the analysis results are obtained, they are presented to the data collector in a visual format, thus completing the questionnaire data processing and analysis process.

[0140] The RAPPOR algorithm module uses BloomFilter to map the true value to a two-dimensional vector and performs two random response function processes to complete the perturbation.

[0141] Step 1: After the user fills out the questionnaire, a call is sent to the user end along with the questionnaire, and the true value v of the option selected by the user is entered.

[0142] Step 2: Perform BloomFilter processing and use BloomFilter to map the input true value v to a binary vector B of length h.

[0143] Step 3: Conduct the first random response. Call the random response function to process the mapped two-dimensional vector B. Change each bit of the vector with a probability f (0 < f < 1, representing the degree of privacy protection, set by the data collector) to obtain the changed vector B'.

[0144]

[0145] Step 4: Save B' locally on the user side.

[0146] Step 5: Conduct the second temporary response S. Initialize a binary vector S of length h with all elements being 0, and assign values according to the probability in formula (7) (0 < p < 1, 0 < q < 1). After completion, report the vector S to the server side. Thus, the processing process of the user's questionnaire data is completed.

[0147]

[0148] The RAPPOR algorithm module uses BloomFilter to map the true values to two-dimensional vectors and conducts two random response function processes, which can successfully complete the processing and protection of user data. It should be noted that when the user submits the questionnaire for the first time, the data processing program executes from Step 1 to Step 5. If the user submits the questionnaire again, the file stored locally in Step 4 is called, and Step 5 is directly executed.

[0149] The flowchart of data processing by this module is as Figure 3 shown.

[0150] The specific steps of the data analysis program (server side) are as follows:

[0151] Step 1: Call the load_from_csv function to load the questionnaire response data collected in the database.

[0152] Step 2: In order to use lasso regression for data processing, the loaded data needs to be preliminarily processed. Call the data_association function to count the number of times each bit of the collected vector S is set to 1 and store it in the vector y. The length of the vector y is the same as the length of the vector S.

[0153] Step 3: Call the true_matrix_maker function to construct a mapping matrix x of size m * h, where m represents the number of options in the question and h is the length of the vector S. This matrix is obtained by concatenating the BloomFilter mapping values of all option true values v corresponding to the question in the questionnaire row by row.

[0154] Step 4: Call the lasso regression function lasso_simulation, fit y = ωx + b, the coefficient ω is the number of times each true value v appears in the queue, and output the coefficient ω. The specific process of data analysis is as follows Figure 4 shown.

[0155] The above steps successfully complete the analysis of user data, with the core function being the lasso regression function. Lasso regression, performed on the collected data vector y and the ground truth mapping matrix x, yields results highly similar to the user's undisturbed data, ensuring data validity while protecting user privacy. Furthermore, by modifying certain algorithm parameters on the server side, such as the probabilities f, p, and q, the number of hash functions used, and the hash length h, the degree of privacy protection and computing power consumption can be easily controlled.

[0156] In order to verify the effectiveness of this scheme, further explanation is given below in combination with experimental data.

[0157] The experimental environment is as follows: Hardware environment: A computer equipped with an Intel Core i7 processor and 16GB of memory is used to ensure sufficient computing resources during the algorithm operation. Software environment: The operating system is Windows 10, the programming language is Python 3.8, and libraries such as NumPy and Pandas are used for data processing. The Matplotlib library is used for data visualization. The system interface is as follows Figure 5 shown.

[0158] (1) Data selection

[0159] The answer submitted by a user to a question is abstracted into a symbol, and the symbol is perturbed into other symbols to meet the perturbation requirements while reducing unnecessary computing overhead.

[0160] For options ABCD, the English letters are mapped to corresponding numbers, with A numbered 0, and the rest are recursively numbered, as shown in Table 1.

[0161] Table 1

[0162] A B C D E …… 0 1 2 3 4 ……

[0163] Single-choice dataset: This simulates a questionnaire about user age groups, containing 10,000 samples. The age groups are divided into five options: "18-25 years old," "26-35 years old," "36-45 years old," "46-55 years old," and "55 years old and above." Each sample is randomly assigned an age group option.

[0164] Multiple-choice dataset: This simulates a questionnaire about user interests and hobbies, also containing 10,000 samples. The hobby options include "reading," "sports," "music," "movies," "travel," and "games." Each sample randomly selects 1-3 hobbies.

[0165] (2) Data Analysis

[0166] ①Analysis of the privacy protection effect of K-RR algorithm

[0167] In this test, we used probability generation to obtain data with different distributions. We generated some test data for the experiment. The main types are average, normal, decreasing, and skew. In addition, we also need to discretize the data. Because random response (RR) requires discrete data, if the data is continuous, we need to discretize it. By changing the privacy parameters, we can get the following: Figure 6 The line chart shown.

[0168] It can be observed that the relative error remains at a low value at 0.8. The K-RR algorithm data processing module is used to process data sets of different data volumes, and the perturbed data and the regressed data are obtained. The three types of data are compared, as shown in the following example: Figure 7 、 Figure 8 shown.

[0169] Comparative analysis shows that the K-RR algorithm can obtain the overall distribution trend of question options regardless of whether it processes small or large data sets, which is consistent with the initial data. Regarding the specific number of options, the accuracy of the data after regression of large data sets is higher than that of small data sets, while the data after regression of small data sets has a large deviation compared to the initial data. In addition, the distribution trend of the perturbed data is flatter than that of the initial data, and the characteristic of the data has been significantly reduced. This meets the design requirements of the K-RR algorithm module and the characteristics of data processing, and has passed the test well. The specific experimental data is as follows:

[0170] Privacy Budget ε Data accuracy after disturbance Data accuracy after regression 0.5 0.34 0.964 0.8 0.27 0.986 1 0.16 0.991 1.2 0.23 0.983 1.5 0.27 0.975

[0171] From these data, we can see that as ε increases, the accuracy of the data after disturbance first decreases and then increases, while the accuracy of the data after regression first decreases and then increases, which requires reasonable settings.

[0172] ②Analysis of the privacy protection effect of RAPPOR algorithm

[0173] The trend of the processed data can be seen in Figure 9 Furthermore, the RAPPOR algorithm data processing module was used to process data sets of different data volumes. The test input and parameter table are shown in Table 2. The perturbed data and the regressed data were obtained, and the initial data, perturbed data, and regressed data were compared. Figure 10 and Figure 11 shown.

[0174] Table 2

[0175]

[0176] After comparison, it can be found that for the processing of small and large data volumes, the overall distribution trend of the options is consistent with the initial data. Regarding the specific number of selected options, the accuracy of the data after large data volume regression is better, and the error is maintained within the acceptable range of the large data set. Compared with the initial data, the data after small data volume regression has a large deviation and low accuracy. Moreover, after the data is disturbed, its distribution trend is flatter than the initial data, and the characteristic of the data is significantly reduced. This meets the design requirements of the RAPPOR algorithm module and the characteristics of data processing, and passed the test well. The experimental data is as follows:

[0177] Permanent random response probability f Proportion of attackers successfully identified 0.2 5％ 0.4 10％ 0.6 15％ 0.8 20％

[0178] From this we can see that a lower f-value can provide stronger privacy protection, and as the f-value increases, the privacy protection effect decreases.

[0179] ③K-RR algorithm data utility analysis

[0180] Compare the true frequency of each age group in the original data with the frequency estimated by the back-calculation algorithm and calculate the relative error. The smaller the relative error, the higher the data utility.

[0181]

[0182]

[0183] From these data, we can see that as ε increases, the mean relative error first decreases and then increases.

[0184] ④RAPPOR algorithm data utility analysis

[0185] Compare the actual selection ratio of each interest in the original data with the ratio estimated by the server and calculate the mean square error (MSE). The smaller the MSE, the higher the data utility. Use the formula:

[0186]

[0187] Where n is the number of options for interests and hobbies.

[0188] The experimental data are as follows:

[0189] Permanent random response probability f Mean Squared Error (MSE) 0.2 0.08 0.4 0.05 0.6 0.06 0.8 0.09

[0190] According to the above data analysis, the data utility may reach the best balance when the f value is between 0.4 and 0.6.

[0191] This paper systematically integrates localized differential privacy (LDP) technology to propose a privacy protection solution for questionnaire scenarios. It innovatively applies the K-RR and RAPPOR algorithms to protect single-choice and multiple-choice data, respectively. It employs a unique data classification and processing strategy, providing strong privacy protection for various data types. This design fundamentally addresses the issue of third-party trust in data collection, a level of sophistication not currently achieved by other questionnaire software on the market.

[0192] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A questionnaire privacy protection method based on local differential privacy, characterized by: It includes three steps: data collection, data processing and statistical analysis: Data collection: obtaining user response data for questionnaires, including single-choice data and multiple-choice data; Data processing: For single-choice data, the K-RR algorithm is used for random response perturbation processing; for multiple-choice data, the RAPPOR algorithm is used for perturbation; Statistical analysis: The server performs aggregate analysis on the disturbed data to obtain the statistical characteristics of the real data.

2. The questionnaire privacy protection method based on local differential privacy according to claim 1 is characterized in that: The perturbation process of the K-RR algorithm includes: The user side calculates the probability of retaining the true value based on the privacy budget parameter ε and noise value generation probability Where k is the total number of options; For each radio button selected by the user, the true value is returned with probability p1, and any other candidate value is returned with probability p2.

3. The questionnaire privacy protection method based on local differential privacy according to claim 2 is characterized in that: The statistical analysis of the K-RR algorithm adopts a back-calculation algorithm, which includes: The server side uses the back-calculation formula based on the frequency S of the disturbed data Calculate the actual data distribution, where N is the total number of data, P r (x=a) is the problem to be solved, which represents the true proportion of option a in the original data.

4. The questionnaire privacy protection method based on local differential privacy according to claim 1, characterized in that: The perturbation process of the RAPPOR algorithm includes: The user end encodes the multiple-option data into a binary vector B of length m through Bloom Filter; Perform the first random response processing on the encoded vector B, flip each bit with probability f / 2, and generate the intermediate vector B′; The second random response processing is performed on the vector B′ after the first processing. For each bit B of B′ i ′, if B i ′=1, it remains 1 with probability q and flips to 0 with probability 1-q; if B i ′=0, it remains 0 with probability 1-p, and flips to 1 with probability p, generating the final perturbation vector and reporting it to the server.

5. The questionnaire privacy protection method based on local differential privacy according to claim 4 is characterized in that: The statistical analysis process of the RAPPOR algorithm includes: The server aggregates all disturbance vectors and counts the proportion of each bit being 1. Using the correction formula Estimate the true data distribution, where It represents the proportion of the estimated real data where the jth bit is 1; Lasso regression is used to fit the corrected frequency and the Bloom Filter mapping matrix of the options to optimize the frequency estimation results.

6. The questionnaire privacy protection method based on local differential privacy according to claim 4 is characterized in that: The Bloom Filter uses k hash functions to map the original string s to a vector B, where the condition for the jth bit to be 1 is that there exists a hash function h i (s) = j.

7. A questionnaire privacy protection system based on local differential privacy, characterized by: A questionnaire privacy protection method based on local differential privacy according to any one of claims 1 to 6 is implemented, the system comprising: A data collection module is used to obtain the user's answer data to the questionnaire, wherein the answer data includes single-choice data and multiple-choice data; The data processing module is used to perform random response perturbation processing using the K-RR algorithm for single-choice data and the RAPPOR algorithm for multi-choice data; The statistical analysis module is used on the server side to perform aggregate analysis on the disturbed data to obtain the statistical characteristics of the real data.

8. The questionnaire privacy protection system based on local differential privacy according to claim 7, characterized in that: The system also includes a visualization module for displaying the output results of the statistical analysis module to the user in a graphical interface.

Images