Program, graph generation system, and graph generation method

Abstract

To provide a program for generating a graph that shows detail information on a probability that an aggregate value exists, a graph generation system, and a graph generation method.SOLUTION: A program causes a computer to execute processing to generate a graph showing a result of aggregating statistical quantities while guaranteeing privacy specified by a privacy parameter, the processing including: acquiring a noise function and a display value, the noise function being a function of a probability variable determined by the privacy parameter and a characteristic value indicating characteristics of an aggregation method used in calculating an aggregated value from the statistical quantities, and the display value being obtained by adding a noise value output from the noise function to the aggregated value; and generating graph information indicating a graph including a graphic representing a plurality of presence ranges corresponding to probabilities that the aggregated value exists, the graphic having a shape expanding in a direction of a main dimension corresponding to the aggregated value based on a position indicated by the display value on coordinates.SELECTED DRAWING: Figure 13

Description

[Technical field]

[0001] The present disclosure relates to a program, a graph generation system, and a graph generation method. [Background technology]

[0002] The idea of ​​differential privacy has been proposed as a method for guaranteeing the privacy of individual information contained in statistics when publishing the results of tallying statistics. In order to guarantee differential privacy, in Non-Patent Document 1, a display value is calculated by adding random numbers according to a probability density distribution to the tallying results as noise, and a graph of the display value is drawn. The graph also includes a bar indicating the range in which the original tally value, with noise removed from the display value, exists with a 95% probability. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Anonify, "Privacy protection technology that achieves both personal information protection and data utilization," p. 53 [online], [Retrieved April 10, 2023], Internet<URL:https: / / www.anonify.layerx.co.jp / wp-privacy-anonify> Summary of the Invention [Problem to be solved by the invention]

[0004] However, the probability that the original aggregate value exists varies at each position on the graph depending on the function of the random variable used for the noise. The graph described in Non-Patent Document 1 does not provide a more detailed criterion for determining the position where the original aggregate value exists. [Means for solving the problem]

[0005] According to a first aspect of the present disclosure, the program causes a computer to execute a process for generating a graph in which the aggregated results of statistics are displayed with privacy-guaranteed content defined by privacy parameters, and causes the computer to obtain a noise function, which is a function of a random variable determined by the privacy parameters and a characteristic value indicating the characteristics of the aggregation method used to aggregate the aggregated values ​​from the statistics, and a display value in which the noise value output from the noise function is added to the aggregated value; and generates graph information showing a graph including a figure having a shape that extends in the direction of the main dimension corresponding to the aggregated value, with the position indicated by the display value on the coordinates as the reference position, and in which multiple existence ranges corresponding to the probability of the aggregated value existing are represented.

[0006] According to a second aspect of the present disclosure, the program causes a computer to execute a process for generating a dynamic graph in which the aggregated results of statistics change over time with privacy guaranteed as specified by a privacy parameter, and causes the computer to obtain a noise function that is a function of a random variable determined by the privacy parameter and a characteristic value indicating the characteristics of the aggregation method used when the aggregated values ​​are aggregated from the statistics, and a display value in which the noise value output from the noise function is added to the aggregated value, and to generate graph information showing a dynamic graph in which the position of a pointer changes over time in the direction of the main dimension corresponding to the aggregated value, with the position indicated by the display value on the coordinates as the reference position, to indicate the probability that the aggregated value exists.

[0007] According to a third aspect of the present disclosure, a graph generation system is a system for generating a graph in which the aggregated results of statistics are displayed with privacy guaranteed as specified by privacy parameters, and includes an acquisition unit that acquires a noise function, which is a function of a random variable determined by the privacy parameters and a characteristic value indicating the characteristics of the aggregation method used to aggregate the aggregated values ​​from the statistics, and a display value in which the noise value output from the noise function is added to the aggregated value, and a generation unit that generates graph information showing a graph including a figure having a shape that extends in the direction of the main dimension corresponding to the aggregated value, with the position indicated by the display value on the coordinates as the reference position, and in which multiple existence ranges corresponding to the probability that the aggregated value exists are represented.

[0008] According to a fourth aspect of the present disclosure, a graph generation method is a method for generating a graph in which the aggregated results of statistics are displayed with privacy guaranteed as specified by privacy parameters, and includes obtaining a noise function that is a function of a random variable determined by the privacy parameters and a characteristic value indicating the characteristics of the aggregation method used to aggregate the aggregated values ​​from the statistics, and a display value in which the noise value output from the noise function is added to the aggregated value, and generating graph information showing a graph including a figure having a shape that extends in the direction of the main dimension corresponding to the aggregated value, with the position indicated by the display value on the coordinates as the reference position, and in which multiple existence ranges corresponding to the probability that the aggregated value exists are represented. [Brief description of the drawings]

[0009] [Figure 1] 1 is a schematic diagram showing an overall overview of a graph generation system in a first embodiment. FIG. [Diagram 2] FIG. 1 is a diagram showing the device configuration of a graph generation system according to a first embodiment. [Diagram 3] FIG. 2 is a diagram showing an overview of processing performed on the tabulation results of the graph generation system in the first embodiment. [Figure 4] 1 is a functional block diagram of a main part of a graph generation system according to a first embodiment. [Diagram 5]FIG. 2 is a diagram showing a first example of a graph generated by the graph generation system in the first embodiment. [Figure 6] FIG. 11 is a diagram showing a second example of a graph generated by the graph generation system in the first embodiment. [Figure 7] FIG. 13 is a diagram showing a third example of a graph generated by the graph generation system in the first embodiment. [Figure 8] FIG. 13 is a diagram showing a fourth example of a graph generated by the graph generation system in the first embodiment. [Figure 9] FIG. 13 is a diagram showing a fourth example of a graph generated by the graph generation system in the first embodiment. [Figure 10] FIG. 13 is a diagram showing a fifth example of a graph generated by the graph generation system in the first embodiment. [Figure 11] FIG. 13 is a diagram showing a sixth example of a graph generated by the graph generation system in the first embodiment. [Figure 12] FIG. 13 is a diagram showing a seventh example of a graph generated by the graph generation system in the first embodiment. [Figure 13] 4 is a flowchart showing an overview of operations performed by the graph generation system in the first embodiment. [Figure 14] 13 is a first modified example of a graph generated by the graph generation system in the first embodiment. [Figure 15] 13 is a first modified example of a graph generated by the graph generation system in the first embodiment. [Figure 16] 13 is a first modified example of a graph generated by the graph generation system in the first embodiment. [Figure 17] 13 is a second modified example of a graph generated by the graph generation system in the first embodiment. [Figure 18] 13 is a first example of a graph generated by the graph generation system in the second embodiment. [Figure 19] 13 is a second example of a graph generated by the graph generation system in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Please note that the disclosure described in this disclosure is premised on compliance with legal matters of the country of implementation necessary for the implementation of this disclosure, such as secrecy of communication. The embodiments for implementing the program, graph generation system, and graph generation method according to the present disclosure will be described with reference to the attached drawings. In each drawing, the same or corresponding parts are given the same reference numerals, and duplicated explanations are appropriately simplified or omitted. Note that this disclosure is not limited to the following embodiments, and it is possible to freely combine each embodiment, modify any component of each embodiment, or omit any component of each embodiment within the scope of the present disclosure.

[0011] Embodiment 1 A first embodiment of the present disclosure will be described with reference to Fig. 1 to Fig. 13. Fig. 1 is a schematic diagram showing an overall overview of a graph generation system. Fig. 2 is a diagram showing the configuration of graph generation equipment. Fig. 3 is a diagram showing an overview of processing performed on the tabulation results. Fig. 4 is a functional block diagram of the main parts of the graph generation system.

[0012] 1 and 2, a graph generation system 400 according to a first example of the first embodiment includes a server 100 and a user terminal 200. In the graph generation system 400, the server 100 and the user terminal 200 are connected to each other via a network 300 so as to be able to communicate with each other.

[0013] In the configuration example described here, the server 100 provides a tally result display service to a user terminal 200 owned by a user via the network 300. In the tally result display service, the result of tallying a certain statistic using a specified tallying method is visually displayed on the user terminal 200. Information for visually displaying the result is generated by the server 100. An operation is input on the user terminal 200 to specify the statistic and tally result to be displayed.

[0014] As an example, the statistics are the results of web advertisements requested by users. In this case, a database related to the results of web advertisements is stored in the server 100. The results tallied for each period are displayed on the user terminal 200.

[0015] The number of user terminals 200 connected to the network 300 is not limited to one, but may be two or more.

[0016] The network 300 serves to connect the user terminal 200 and one or more servers 100. In other words, the network 300 refers to a communication network that provides a connection path so that the user terminal 200 can transmit and receive data after connecting to the server 100. One or more parts of the network 300 may or may not be a wired network or a wireless network.

[0017] The network 300 may include, for example, an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of a public switched telephone network (PSTN), a mobile phone network, an integrated service digital network (ISDN), a wireless LAN, a long term evolution (LTE), a code division multiple access (CDMA), Bluetooth (registered trademark), or a satellite communication, or a combination of two or more of these. The network 300 may include one or more networks 300.

[0018] The user terminal 200 may be any terminal that can realize the functions of the embodiments of the present disclosure. The user terminal 200 includes, for example, a smartphone, a mobile phone (feature phone), a computer (e.g., a desktop PC, a laptop PC, a tablet PC, etc.), a media computer platform (e.g., a cable, a satellite set-top box, a digital video recorder), a handheld computer device (e.g., a PDA (Personal Digital Assistant), an email client, etc.), a wearable terminal (a glasses-type device, a watch-type device, etc.), or other types of computers or communication platforms. The user terminal 200 may also be expressed as an information processing terminal.

[0019] The server 100 has a function of providing a predetermined service to the user terminal 200. The server 100 may be any device that can realize the functions of the embodiments of the present disclosure. The server 100 includes, for example, a server device, a computer (e.g., a desktop PC, a laptop PC, a tablet PC, etc.), a media computer platform (e.g., a cable or satellite set-top box, a digital video recorder), a handheld computer device (e.g., a PDA, an email client, etc.), or other types of computers or communication platforms. The server 100 may also be expressed as an information processing device. When there is no need to distinguish between the server 100 and the user terminal 200, the server 100 and the user terminal 200 may or may not be expressed as an information processing device.

[0020] Next, the configuration of the user terminal 200 will be described with reference to Fig. 2. The user terminal 200 includes a terminal control means 210, a terminal storage means 220, a terminal communication means 230, an input / output means 240, and a display means 250. The hardware components of the user terminal 200 are connected to each other, for example, via a bus. It is not essential that the hardware configuration of the user terminal 200 includes all the components described here. For example, the user terminal 200 may or may not be configured such that individual components such as the input / output means 240 or multiple components are removable.

[0021] The terminal control means 210 is capable of controlling the overall operation of the user terminal 200 by using various information such as information stored in the terminal storage means 220 .

[0022] The terminal communication means 230 is an I / F (interface) that transmits and receives various data via the network 300. The communication may be performed either wired or wirelessly, and any communication protocol may be used as long as the communication between the terminals can be performed. The terminal communication means 230 has a function of performing communication with the server 100 via the network 300. The terminal communication means 230 transmits various information to the server 100 according to an instruction from the terminal control means 210. The terminal communication means 230 receives various information transmitted from the server 100 and transmits it to the terminal control means 210. The terminal communication means 230 may be simply referred to as a communication means. When the terminal communication means 230 is configured by a physically structured circuit, it may be referred to as a communication circuit.

[0023] The input / output means 240 includes an input means and an output means. The input means is a device for inputting various user operations to the user terminal 200. The output means is a device for outputting the results of processing performed by the user terminal 200. In the input / output means 240, the input means and the output means may be integrated, or the input means and the output means may be separate.

[0024] The input means is realized by any one or a combination of all kinds of devices that can receive input from a user and transmit information related to the input to the terminal control means 210. For example, the input means can include hardware keys such as a touch panel, a touch display, and a keyboard, and a pointing device such as a mouse.

[0025] The output means is realized by any one or a combination of all kinds of devices capable of outputting the processing results processed by the terminal control means 210. The output means may include, for example, a touch panel, a touch display, a lens (for example, 3D (Three Dimensions) output or hologram output), a printer, etc.

[0026] The display means 250 is realized by any one of all kinds of devices capable of displaying according to the display data written in the frame buffer, or a combination thereof. That is, the display means 250 may be included in the output means. The display means 250 may include, for example, a touch panel, a touch display, a monitor (for example, a liquid crystal display or an OELD (Organic Electroluminescence Display)), a head mounted display (HDM), a projection mapping, a hologram, a device capable of displaying images, text information, etc. in air (which may or may not be a vacuum). Note that these display means 250 may or may not be capable of displaying display data in 3D.

[0027] When the input / output means 240 has a touch panel, the input / output means 240 and the display means 250 may be disposed facing each other and have approximately the same size and shape.

[0028] The terminal control means 210 has a circuit physically structured to execute the functions realized by the codes or instructions included in the program, and is realized by, for example, a data processing device built into the hardware. Therefore, the terminal control means 210 may or may not be expressed as a control circuit.

[0029] The terminal control means 210 includes, for example, a central processing unit (CPU), a microprocessor, a processor core, a multiprocessor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and the like.

[0030] The terminal storage means 220 has a function of storing various programs and various data required for the operation of the user terminal 200. The terminal storage means 220 includes various storage media such as, for example, a hard disk drive (HDD), a solid state drive (SSD), a flash memory, a random access memory (RAM), and a read only memory (ROM). Furthermore, the terminal storage means 220 may or may not be expressed as a memory.

[0031] The user terminal 200 stores a program in the terminal storage means 220, and executes this program, causing the terminal control means 210 to execute processing as each unit included in the terminal control means 210. That is, the program stored in the terminal storage means 220 causes the user terminal 200 to realize each function executed by the terminal control means 210. In other words, the processor executes the program stored in the memory in the user terminal 200, and the hardware and software of the user terminal 200 work together to realize the function of each unit included in the user terminal 200. Note that this program may or may not be expressed as a program module.

[0032] Next, a description will be given of the configuration of the server 100. The server 100 includes a server processing means 110, a server storage means 120, and a server communication means 130. The hardware components of the server 100 are connected to each other via a bus, for example.

[0033] The server processing means 110 has a physically structured circuit for executing functions realized by codes or instructions included in a program, and is realized, for example, by a data processing device built into hardware. The server processing means 110 is typically a central processing unit (CPU), and may or may not be a microprocessor, a processor core, a multiprocessor, an ASIC, an FPGA, etc. In the present disclosure, the server processing means 110 is not limited to these.

[0034] The server storage means 120 has a function of storing various programs and various data required for the operation of the server 100. The server storage means 120 is realized by various storage media such as HDD, SSD, flash memory, etc. However, in this disclosure, the server storage means 120 is not limited to these. Also, the server storage means 120 may or may not be expressed as memory.

[0035] The server communication means 130 transmits and receives various data via the network 300. The communication may be performed either wired or wirelessly, and any communication protocol may be used as long as the communication between the two is possible. The server communication means 130 has a function of communicating with the user terminal 200 via the network 300. Specifically, the server communication means 130 transmits various pieces of information to the user terminal 200 in accordance with instructions from the server processing means 110. The server communication means 130 receives various pieces of information transmitted from the user terminal 200 and transmits them to the server processing means 110.

[0036] The server communication means 130 may be expressed as a server communication I / F (interface). When the server communication means 130 is configured with a physically structured circuit, it may be expressed as a server communication circuit.

[0037] The server 100 may include an input / output means and a display as a hardware configuration. The input / output means is realized by a device that inputs various operations to the server 100. The input / output means is realized by any of all types of devices that can receive input from a user and transmit information related to the input to the server processing means 110, or a combination thereof. The display is typically realized by a monitor (e.g., a liquid crystal display, an OELD, etc.). In this case, for example, the hardware of the server 100 may or may not be configured to have a detachable display.

[0038] Server 100 stores a program in server storage means 120, and executes this program, causing server processing means 110 to execute processing as each unit included in server processing means 110. That is, the program stored in server storage means 120 causes server 100 to realize each function executed by server processing means 110. In other words, a processor executes the program stored in memory in server 100, and the hardware and software of server 100 work together to realize the function of each unit included in server 100. Note that this program may or may not be expressed as a program module.

[0039] The terminal control means 210 of the user terminal 200 and / or the server processing means 110 of the server 100 may or may not realize each process by a CPU having a control circuit, but may also realize each process by a logic circuit (hardware) formed in an integrated circuit (IC (Integrated Circuit) chip, LSI (Large Scale Integration)) or a dedicated circuit. These circuits may be realized by one or more integrated circuits, and the multiple processes shown in the embodiments of the present disclosure may or may not be realized by one integrated circuit. LSIs may also be called VLSIs, super LSIs, ultra LSIs, etc., depending on the degree of integration.

[0040] In addition, the program (e.g., a software program, a computer program, or a program module) of the embodiment according to the present disclosure may or may not be provided in a state stored in a computer-readable storage medium. The storage medium can store the program in a "non-transitory tangible medium." In addition, the program may or may not be for realizing part of the functions of the embodiment according to the present disclosure. Furthermore, the program may or may not be a so-called difference file (difference program) that can realize the functions of the embodiment according to the present disclosure in combination with a program already recorded in the storage medium.

[0041] The storage medium may include one or more semiconductor-based or other integrated circuits (ICs) (e.g., field programmable gate arrays (FPGAs) or application specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard drives (HHDs), optical disks, optical disk drives (ODDs), magneto-optical disks, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid state drives (SSDs), RAM drives, secure digital cards, or drives, any other suitable storage media, or any suitable combination of two or more of these. The storage medium may be volatile, non-volatile, or a combination of volatile and non-volatile, where appropriate. It should be noted that the storage medium is not limited to these examples and may be any device or medium capable of storing a program. In addition, the storage medium may or may not be referred to as a memory.

[0042] Furthermore, the program of the present disclosure may or may not be provided to the server 100 and / or the user terminal 200 via any transmission medium capable of transmitting the program (such as a communication network or broadcast waves). When the program is provided via a transmission medium, the server 100 and / or the user terminal 200 can realize the functions of the multiple functional units shown in each embodiment by executing a program downloaded via the Internet, for example.

[0043] Also, by way of example and not by way of limitation, when the user terminal 200 is a smartphone or a PC, an application received from the server 100 (or a server device other than the server 100) may be incorporated (installed) into the smartphone or PC, and some of the elements (processing / operations) according to the claims of the present disclosure may be executed via the application. Also, by way of example and not by way of limitation, when the user terminal 200 is a smartphone or a PC, some of the elements (processing / operations) according to the claims of the present disclosure may be executed via a website accessible from the smartphone or PC, without an application being incorporated (installed) into the smartphone or PC.

[0044] Moreover, the embodiment according to the present disclosure may be realized in the form of a data signal embedded in a carrier wave in which a program is embodied by electronic transmission. Moreover, at least a part of the processing in the server 100 and / or the user terminal 200 may or may not be realized by cloud computing configured by one or more computers. Moreover, at least a part of the processing in the user terminal 200 may or may not be configured to be performed by the server 100. In this case, at least a part of the processing of each functional unit of the terminal control means 210 of the user terminal 200 may or may not be configured to be performed by the server 100. Moreover, at least a part of the processing in the server 100 may or may not be configured to be performed by the user terminal 200. In this case, at least a part of the processing of each functional unit of the server processing means 110 of the server 100 may or may not be configured to be performed by the user terminal 200.

[0045] The program of the present disclosure may be implemented using, for example, a scripting language such as ActionScript or JavaScript (registered trademark), an object-oriented programming language such as Objective-C or Java (registered trademark), or a markup language such as HTML5.

[0046] 3, the database of statistics stored in the server 100 includes confidential information such as personal information. Therefore, appropriate privacy protection processing must be performed on the information that can be viewed by the server 100.

[0047] For example, even if the statistics are subjected to statistical aggregation such as arithmetic averaging, it may be undesirable to make the aggregated value public from the viewpoint of protecting the privacy of each data provider included in the statistics. As an example, assume that an aggregated value s obtained by performing statistical aggregation from a database D of statistics is made public, and then an aggregated value s' obtained by performing a similar statistical aggregation from a database D' is made public. The database D' is obtained by removing only one element of the statistics from the database D. In this case, the removed element can be restored by comparing the aggregated value s and the aggregated value s'. Furthermore, if the one element is personal information and is associated with information indicating another individual (not shown), the personal information of the one element will be known to a third party.

[0048] As one privacy protection process for avoiding such an event, there is a process in which a display value to which a noise value is added is published instead of the aggregated value. In this process, the noise value is set to a value that makes it difficult to restore the removed element even if the display value corresponding to database D is compared with the display value corresponding to D'. In one example of the process, the difficulty of distinguishing database D from database D' is specified by a privacy parameter ε, which is an index value. In general, when a noise value is added such that it is difficult to distinguish database D from database D' by the privacy parameter ε, it is expressed that ε-differential privacy is guaranteed. Note that the process for guaranteeing differential privacy may be not only ε-differential privacy but also another differential privacy process such as (ε, δ)-differential privacy.

[0049] For example, a graph showing the results of statistics collected by the server 100 is displayed on the user terminal 200. In this embodiment, the graph with guaranteed ε-differential privacy is displayed on the user terminal 200. That is, each value shown on the graph is not a collected value but a displayed value. Therefore, a person who views the graph from the user terminal 200 cannot know the exact collected value. For example, the person can know the trend of the collected values ​​from the displayed values ​​shown on each graph. For example, the person can judge whether or not the collected value is considered to exceed a reference value set by the person by reading the displayed value shown on a certain graph.

[0050] Next, we will explain ε-differential privacy in more detail. In the following, we will explain the contents of central differential privacy as shown in Figure 3. First, we assume that any pair of databases D and D' satisfies the following formula (1), that is, they are adjacent databases. Adjacent databases are a pair of databases that differ by only one arbitrary element. d H is the Hamming distance.

[0051]

number

[0052] Mechanism M, which is a mechanism for adding noise values, outputs an output S, which is a display value, from D. It is defined that mechanism M satisfies ε-differential privacy when the following formula (2) holds. Here, S is a set of any output.

[0053]

number

[0054] From equation (2), the smaller ε is, the more difficult it is to distinguish between D and D' from the output, i.e., the higher the privacy is guaranteed. ε is set according to the degree of privacy you want to guarantee. For example, ε between 0.5 and 2 is considered to be practical to a certain extent.

[0055] In this embodiment, the mechanism M is the sum of the aggregation result of the statistic D and the noise value n. When the aggregation method is a function f, the aggregation value of D is expressed as f(D).

[0056] The noise value n needs to be designed according to the degree of variation that may occur in the aggregated value f(D) for the assumed database D, that is, according to the characteristic value that indicates the characteristics of the aggregation method. One method for designing the noise value n is to set the noise value n to a value randomly sampled from a function of a random variable determined by the privacy parameter ε, which is an index value of the privacy to be guaranteed, and the characteristic value. The random variable may be a continuous random variable or a discrete random variable.

[0057] Specifically, one example of a method for designing the noise value n is to sample the noise value n from a Laplace distribution function. The Laplace distribution function has a mean of zero and a sensitivity Δ f The quotient of dividing by the privacy parameter ε is used as the distribution. That is, the mechanism M shown in the following formula (3) is designed.

[0058]

number

[0059] Sensitivity Δ f is a characteristic value that indicates the characteristics of the aggregation method, and is defined by the following formula (4). That is, sensitivity Δ f is the maximum change in the output that occurs when the pair of assumed adjacent databases D and D' is input to the function f of the aggregation method. In other words, if you want to guarantee a certain ε-differential privacy, the sensitivity Δ f The larger the noise level, the larger the maximum noise value n must be. Also, the expected value of the noise value n must be larger.

[0060]

number

[0061] According to formula (3), the mechanism M(D) is a representation, which is the sum of the aggregate value f(D) and a noise value n, which is a randomly sampled value from the Laplace distribution function. A graph with such representations is one that is guaranteed to have ε-differential privacy.

[0062] In addition to the display value, the graph of this embodiment also depicts a figure showing the function of the random variable. For example, in the above example, a figure expressing the probability density of the Laplace distribution is depicted with the display value at the center. Since the Laplace distribution has a shape that is linearly symmetrical about the average and the average is set to 0, the value of the probability density at a certain position means the probability that the position is an aggregated value. Therefore, a user who sees the graph can intuitively understand the range in which the aggregated value is likely to exist for the display value. In addition, a user can intuitively understand the shape, type, etc. of the function of the random variable used in the noise value n.

[0063] The function of the random variable employed in the mechanism M may be a Gaussian distribution function or other probability density function. Even in this case, for example, the shape of the Laplace distribution and the shape of the Gaussian distribution are easily distinguishable. The function of the random variable employed in the mechanism M may be a function of a discrete random variable such as a discrete Laplace function or a discrete Gaussian function.

[0064] Fig. 4 shows a functional block diagram. As an example, the server 100 provides an interface for accepting input regarding the tally results and displaying the tally results in the form of a graph or the like. The interface is displayed on the display means 250 of the user terminal 200. In the user terminal 200, the user inputs the tally results of which the user wishes to know the details into the interface.

[0065] The server 100 includes a storage unit 10, a reception unit 11, a compilation unit 12, a first calculation unit 13, a second calculation unit 14, an acquisition unit 15, a generation unit 16, and an output unit 17.

[0066] For example, the storage unit 10 is realized by the server storage means 120 shown in Fig. 2. The storage unit 10 stores information such as various setting values, setting amounts, and arithmetic expressions related to the aggregation of statistics. The storage unit 10 may store a database of statistics.

[0067] The reception unit 11 receives information through an interface. Specifically, the reception unit 11 receives instructions for generating a graph, such as the statistical quantity to be counted, the display format of the graph, etc. The reception unit 11 may also receive input of information related to counting and calculation, such as a privacy parameter ε, values ​​to be counted, counted values, and functions of random variables to be used.

[0068] The counting unit 12 acquires the statistical quantity to be counted and an arithmetic expression for counting the statistical quantity from the storage unit 10. The counting unit 12 counts the statistical quantity to be counted and calculates the counted value and the characteristic value of the counting method. For example, the counting unit 12 calculates the sensitivity Δ f Calculate the following.

[0069] The first calculation unit 13 and the second calculation unit 14 constitute a privacy calculation unit, and perform calculations of each value to guarantee differential privacy. That is, the aggregation unit 12 and the privacy calculation unit realize a mechanism that guarantees differential privacy.

[0070] The first calculation unit 13 acquires the function of the random variable used to guarantee differential privacy from the storage unit 10. The parameters for determining the acquired function of the random variable include a characteristic value and a privacy parameter. The first calculation unit 13 determines the function of the random variable by reflecting the characteristic value and privacy parameter ε calculated by the aggregation unit 12 in the function of the random variable, that is, determines the graph shape of the function of the random variable. The first calculation unit 13 samples one value according to the determined function of the random variable, and sets it as a noise value n.

[0071] The second calculation unit 14 calculates the sum of the counted value calculated by the counting unit 12 and the noise value n calculated by the first calculation unit 13, and sets the sum as a display value.

[0072] Basically, from the statistics, a plurality of aggregate values ​​distinguished by elements are aggregated, such as a plurality of aggregate values ​​divided by period with period as an element, a plurality of statistical values ​​divided by item with item as an element, etc. The aggregation unit 12, the first calculation unit 13, and the second calculation unit 14 determine or calculate, for each of the plurality of aggregate values, the aggregate value, the characteristic value, the function of the random variable, the noise value, and the display value in correspondence with each other.

[0073] The acquiring unit 15 acquires, as information necessary for drawing a graph, the function of the random variables determined by the first computing unit 13 and the display value calculated by the second computing unit 14. At this time, the acquiring unit 15 acquires a plurality of pairs of functions of random variables and display values ​​associated with a certain statistical quantity.

[0074] The generating unit 16 generates graph information that displays a graph showing the acquired multiple display values. At this time, the generating unit 16 generates graph information of a graph in which a figure showing a function of a random variable corresponding to each of the multiple display values ​​is drawn. The figure of the function of the random variable spreads in the direction of the main dimension, which is the dimension indicated by the display value in the graph. The figure means the existence range of the corresponding aggregate value in the item of the display value. The figure represents multiple existence ranges for the corresponding aggregate value. In other words, multiple pairs of the display value and the function of the random variable are drawn in the graph shown in the graph information.

[0075] The output unit 17 outputs the graph information generated by the generation unit 16. The output process of the graph information may be performed in such a manner that the graph shown in the graph information is finally displayed to the user. For example, the output unit 17 may display the graph shown in the graph information on an interface being viewed on the user terminal 200 as the output process of the graph information. For example, the output unit 17 may transmit the graph information to the user terminal 200 as the output process of the graph information. In this case, the graph shown in the graph information may be displayed on the user terminal 200 at any timing.

[0076] Next, examples of generated graphs will be described with reference to Fig. 5 to Fig. 12. Fig. 5 to Fig. 12 are diagrams showing examples of graphs generated by the graph generation system in embodiment 1. Unless otherwise specified, the Laplace distribution function is adopted as a function of a random variable, and a graph based on a display value with ε-differential privacy guaranteed is shown.

[0077] Fig. 5 shows a first example of a graph. In the first example, the graph is a graph in which the y-axis is the main dimension, which is the dimension of the aggregated value, and a plurality of display values ​​divided by elements are arranged in the x-axis direction perpendicular to the y-axis. Specifically, five display values ​​of elements A, B, C, D, and E are arranged in the x-axis direction. In the example of Fig. 5, the graph is a bar graph in which the ends of the bars indicate the display values, but it may also be a scatter plot in which each point indicates a display value.

[0078] In the first example, the figure indicating the multiple existence ranges is a scale. The scale includes multiple bars indicating the existence range of the aggregated value. For example, the scale includes a reference position, 50%, 90%, and 95% bars. The 50%, 90%, and 95% bars are provided at two symmetrical positions in the main dimension direction with the bar at the reference position p as the center. The bar at the reference position p, the 50%, 90%, and 95% bars are distinguished from each other by methods such as different lengths in the direction perpendicular to the main dimension direction, different bar thicknesses, etc.

[0079] The 50% bar, 90% bar, and 95% bar each indicate the range in which the aggregate value exists. That is, in the range between two 50% bars, there is a 50% probability that the aggregate value exists in that range. In the range between two 90% bars, there is a 90% probability that the aggregate value exists in that range. In the range between two 95% bars, there is a 95% probability that the aggregate value exists in that range.

[0080] The interval between each bar corresponds to the distance from the mean of the Laplace distribution function. That is, based on the shape of the scale, the user can know that the displayed value is a noise value based on the Laplace distribution function.

[0081] Note that the display manner of the bars included in the scale and their numerical values ​​is not limited to the example shown in Fig. 5. For example, the scale may include a 25% bar, indicating that there is a 25% probability that the aggregate value exists in the range between the bar at the reference position p and the 25% bar.

[0082] FIG. 6 shows a second example of a graph. In the second example, the graph is a scatter graph drawn according to the same rules as in the first example. In the second example, the figure showing multiple existence ranges is a band. The band spreads on both sides from a center position, which is a reference position, in the direction of the main dimension. The center position of the band in the direction of the main dimension is the position indicated by the display value. The color inside the band differs in stages so as to correspond to the distribution of the probability that the aggregate value exists. For example, the color inside the band is darker the higher the probability that the aggregate value exists, and lighter the lower the probability that the aggregate value exists. Note that the type of color may differ in stages inside the band, instead of the color darkness.

[0083] In the graph of the second example, the closer to the center of the y-axis direction, which is the reference position, the darker the color, and the farther from the center, the lighter the color. Note that, although both ends of the band in the y-axis direction in Fig. 6 are clearly separated, the both ends may be gradually lighter without being clearly separated.

[0084] The multiple existence ranges are indicated by the color density inside the band. The probability that the aggregate value exists in the range of the density indicated by 50% is 50%. Note that in FIG. 6, the band in the y-axis direction is drawn with multiple types of density, but the color density inside may not be clearly divided and may be drawn as a gradation. Even in this case, the user can recognize it as multiple existence ranges according to the example.

[0085] FIG. 7 shows a third example of a graph. In the third example, the graph is a scatter graph drawn according to the same rules as in the second example. In the third example, the outline of the figure showing the multiple existence ranges spreads on both sides from the center position, which is the reference position, in the direction of the main dimension. The center position of the figure in the direction of the main dimension is the position indicated by the display value. The outline of the figure is a similar shape to the shape of the graph of the Laplace distribution function, which is a noise function. Specifically, the outline of the figure in the direction of the x-axis perpendicular to the direction of the main dimension is a curve similar to the graph of the Laplace distribution function. In this case, the width of the outline of the figure in the x-axis direction indicates the probability that the value in the y-axis direction is the aggregate value. The user can read the probability that the aggregate value exists in the range from the value in the y-axis direction to the reference position.

[0086] FIG. 8 shows a fourth example of a graph. In the fourth example, the graph is a scatter graph drawn according to the same rules as in the third example. In the fourth example, the outer shape of the figure showing multiple existence ranges is the same as in the third example. In the fourth example, the color inside the figure differs in stages so as to correspond to the distribution of the probability that the aggregate value exists. That is, the color inside the figure is colored in the same way as in the second example.

[0087] Fig. 9 shows a fourth example of the graph in which the noise function is a Gaussian distribution function, not a Laplace distribution function. As shown in Fig. 9, the outer shape of the figure showing multiple existence ranges differs depending on the graph shape of the function of the applied random variable. Note that the color inside the figure may be colored in the same way as in the second example.

[0088] Figure 10 shows the fifth example of the graph, which is a line graph. In the graph, the y-axis is the main dimension. Multiple display values ​​are arranged along the x-axis, and each display value is connected by a line.

[0089] In the case of a line graph, for each of the multiple elements, a figure showing the range of the aggregated value in the main dimension is drawn with the display value as the reference position p, as in the graph of the second example. Also, for the lines connecting elements, a figure showing the range of the aggregated value is drawn spreading in the main dimension with the lines as the reference position. In the figure between elements, the color in the main dimension changes in a gradual gradation, as in the figure centered on the display value.

[0090] It should be noted that a graphic similar to that in the fifth example may be applied to a line graph that is shown with smooth lines, rather than a graph with sharp edges such as a broken line graph.

[0091] FIG. 11 shows a sixth example of a graph in which the graph is a 100% stacked bar graph consisting of a first element A and a second element B. A 100% stacked bar graph is a graph in which the total aggregate value is 100% and shows the ratio of each element to the whole. When consisting of two elements A and B, the ratio (%) of the second element B is the difference obtained by subtracting the ratio (%) of the first element A from 100%. For example, the first element A and the second element B are drawn by painting them in different colors.

[0092] The display value of the first element A is the sum of the aggregated value of the first element A and the noise value of the first element A. The noise value of the first element A can be regarded as the noise value of the second element B. Therefore, differential privacy is guaranteed even if the difference between 100% and the first element A is used as the display value of the second element B. In the graph, the display value of the first element A is the boundary value between the first element A and the second element B. The graph includes a figure showing multiple ranges of the existence of the aggregated value of the first element A, with the boundary value between the first element A and the second element B as the reference position, that is, a figure showing multiple ranges of the existence of the boundary value based on the aggregation result of the first element A and the second element B.

[0093] Specifically, the figure has the display value of the first element A at its center and the color gradually changes in the direction of the main dimension to correspond to the probability that the aggregate value of the first element A exists. For example, in the direction of the main dimension, the color at the center of the figure is white, and the color gradually becomes darker from the center to the edge. In this case, the color of the figure becomes darker the same color as the first element A toward the first element A, and becomes darker the same color as the second element B toward the second element B.

[0094] The color of the center position of the figure does not have to be white, but may be a mixture of the color of the first element A and the color of the second element B. Even in this case, the color of the figure may change so that the color of the first element A becomes darker toward the first element A, and the color of the second element B becomes darker toward the second element B. Specifically, for example, the color of the first element A may be red, the color of the second element B may be blue, and the color of the center of the figure may be purple.

[0095] FIG. 12 shows a seventh example of a graph in which the graph is a pie chart made up of a first element A and a second element B. That is, the pie chart shows the ratio between the first element A and the second element B. The direction of the main dimension of a pie chart is along the circumference of the pie chart. In the example of FIG. 12, the direction of the main dimension is a counterclockwise direction along the circumference of the pie chart.

[0096] In the seventh graph example, a figure similar to that in the sixth graph example is shown at the boundary between the first element A and the second element B. That is, the figure of the pie chart is a figure in which the displayed value of the first element A is at the center and the color gradually changes in the direction of the main dimension so as to correspond to the probability that the aggregate value of the first element A exists.

[0097] Next, the flow of processing by the server 100 will be described with reference to Fig. 13. Fig. 13 is a flowchart showing an outline of the operation performed by the graph generation system in the first embodiment.

[0098] In step S1, the receiving unit 11 receives an instruction to generate a graph.

[0099] After that, in step S2, the counting unit 12 counts the statistics and calculates the counted value and the characteristic value.

[0100] After that, in step S3, the first calculation unit 13 calculates a noise value n, and the second calculation unit 14 calculates a display value.

[0101] Then, in step S4, the acquisition unit 15 acquires a function of the random variable and a display value.

[0102] After that, in step S5, the generation unit 16 generates graph information for drawing a graph.

[0103] After that, in step S6, the output unit 17 outputs the graph information, and then the operation of the flowchart ends.

[0104] According to the above-described first embodiment, the server 100 of the graph generation system 400 executes the process of the graph generation method by a program. Each process of the graph generation method corresponds to the process of each function of the server 100. The program causes the server 100 to execute the function of the acquisition unit 15 and the function of the generation unit 16, and generate graph information. The graph shown in the graph information shows a plurality of existence ranges corresponding to the probability that the aggregated value exists. This allows the user to know more detailed information regarding the probability that the aggregated value exists. For example, by obtaining two or more judgment criteria regarding the aggregated value, the user can organize the information by guessing into which range the aggregated value falls, whether the aggregated value is larger than a reference value, etc.

[0105] Moreover, the noise function is a probability density function. As an example, the noise function is a Laplace distribution function. Here, not only graphs in which differential privacy is guaranteed, but also graphs may have error bars. The error bars are generally values ​​based on a Gaussian distribution, and the probability density function on which the error bars are based is often not particularly explained. On the other hand, the probability density function used in the field of differential privacy is not limited to a Gaussian distribution function. For this reason, in a graph such as that described in Non-Patent Document 1, a user may mistakenly believe that the figure of the range displayed together is necessarily due to a Gaussian distribution. In the graph described in this embodiment, since multiple existence ranges are represented, the user can infer the shape of the probability density function being used. In particular, the Laplace distribution function has a sharper shape than the Gaussian distribution function. The user can easily know that the function used for the noise value is a Laplace distribution function and not a Gaussian distribution function.

[0106] The noise function may be a probability mass function that handles discrete random variables. For example, the noise function may be a discrete Laplace distribution function, a discrete Gaussian distribution function, etc. Even in this case, a display value that ensures differential privacy can be calculated.

[0107] Furthermore, the figures shown on the graph may have multiple scales, allowing the user to know the existence ranges of multiple values ​​clearly.

[0108] In addition, the figure shown in the graph may be a band, and multiple ranges of existence may be indicated by different colors, so that the user can intuitively understand the combination of the location and probability where the aggregate value exists.

[0109] The outer shape of the figure shown in the graph may be similar to the shape of the graph of the noise function. This allows the user to easily understand what kind of function the noise function being used is. Furthermore, the color inside the figure may be gradually changed according to the probability that the aggregate value exists. This allows the user to intuitively understand the combination of the position where the aggregate value exists and the probability.

[0110] The graph may also be a 100% stacked bar graph. Alternatively, the graph may be a pie chart. In either case, a figure with gradually different colors is displayed between the first element A and the second element B to correspond to the probability that the aggregate value of the first element A exists. Therefore, even if the aggregate value indicates a ratio, the user can know more detailed information about the probability that the aggregate value exists while ensuring differential privacy.

[0111] The reception unit 11 may receive an input of the display value and a formula indicating the noise function, and the acquisition unit 15 may acquire the display value and the formula indicating the noise function. The generation unit 16 may generate graph information based on the display value and the noise function thus acquired. That is, the display value and the noise function do not have to be collected and calculated by the server 100.

[0112] Next, a first modified example will be described with reference to Figures 14 to 16. Figures 14 to 16 show a first modified example of a graph generated by the graph generation system in the first embodiment.

[0113] In the first modified example, when the graph information generated by the generation unit 16 is displayed, it is possible to accept a designation of one designated existence range among a plurality of existence ranges from the user. In the graph shown in the graph information, only the designated existence range is displayed as a range of the probability that the displayed value exists.

[0114] 14 to 16 show graphs in which the first modified example is applied to the first example of the graph. An interface for accepting the designation of a designated existence range is also displayed on the graph shown in the graph information. When one of the items described as "noise bar setting" is designated, only the designated existence range shown in that item is displayed on the graph as a range showing the probability that the aggregate value exists.

[0115] In FIG. 14, a specified existence range of 50% is specified, and only a 50% bar centered on the reference position is displayed on the graph. In addition, "±3" is also displayed to indicate the range of values ​​that exist between the two bars. This range means that the aggregated value exists within a range of +3 to -3 with the reference position as the center. In FIG. 15, a specified existence range of 90% is similarly specified, and only a 90% bar centered on the reference position is displayed on the graph. In FIG. 16, a specified existence range of 95% is similarly specified, and only a 95% bar centered on the reference position is displayed on the graph.

[0116] According to the first modification of the first embodiment described above, the user can view a graph that displays only the designated existence range among the multiple existence ranges. Therefore, the user can easily organize information such as in which range the aggregated value falls, whether the aggregated value is larger than a reference value, and so on.

[0117] Next, a second modified example will be described with reference to Fig. 17. Fig. 17 shows a second modified example of a graph generated by the graph generation system in the first embodiment.

[0118] In the second modification, when the graph information generated by the generating unit 16 is displayed, it is possible to receive an instruction from the user of a position within the range in which the aggregate value exists. When an instruction of a position is received, information indicating the probability that the aggregate value exists at that position is also displayed on the graph. That is, the generating unit 16 generates graph information indicating such a graph.

[0119] In Fig. 17, a graph in which the second modified example is applied to the second example of the graph is shown. As an example, the position is specified by a pointer or the like. In the example shown in Fig. 17, as information indicating the probability that the aggregated value exists, a graph of the noise function used when the corresponding display value is calculated and an indication figure of the specified probability in the graph are displayed. For example, as the noise function, a graph of the Laplace distribution function and an indication figure P2 indicating the probability corresponding to the indicated position P1 are drawn on the graph.

[0120] According to the second modification of the first embodiment described above, the user can know information about the probability that the total value exists at the specified position. Therefore, the user can easily sort out information such as whether the total value is larger than a reference value.

[0121] The information indicating the probability that a counted value exists at the position where the instruction is received may be a number indicating the probability, instead of information such as a noise function.

[0122] Embodiment 2 Fig. 18 is a first example of a graph generated by the graph generation system in the embodiment 2. Fig. 19 is a second example of a graph generated by the graph generation system in the embodiment 2. Note that the same reference numerals are used to designate parts that are the same as or equivalent to those in the embodiment 1. Explanation of these parts will be omitted.

[0123] In the second embodiment, the generating unit 16 generates a dynamic graph. A dynamic graph is a graph in which the position of a figure shown in the graph changes with time. Specifically, the position of the pointer in the main dimension moves with time, with the position of the display value as the reference position, so as to indicate the probability that the aggregate value exists.

[0124] In the first example of the graph in the second embodiment shown in FIG. 18, the pointer blinks at regular time intervals and moves its position. At this time, the probability that the pointer appears at a certain position is equal to the probability that an accumulation value exists at that position. That is, the pointer blinks according to the change in time and appears at a position according to the probability that an accumulation value exists. The solid pointer indicated by P3 is at the reference position. The dashed circle indicates the position where the pointer appears within a certain time range.

[0125] The reference position pointer may or may not be displayed at all times, independently of the flashing pointer.

[0126] The user can intuitively understand the range and probability in which a summary value exists based on the frequency of appearance of the pointer and the value of the main dimension at that time.

[0127] In the second example of the graph in the second embodiment shown in FIG. 19, the pointer moves up and down repeatedly in the main dimension, reciprocating around a reference position. At this time, the moving speed of the pointer changes in response to the probability that a tally value exists. Specifically, the moving speed of the pointer at a certain position corresponds to the probability that a tally value exists at that position. At this time, the higher the probability that a tally value exists at a certain position, the slower the moving speed of the pointer. For example, the moving speed of the pointer may be a value inversely proportional to the probability that a tally value exists.

[0128] The higher the probability that the aggregate value exists within a certain time range, the longer the time that the pointer exists in. This allows the user to intuitively understand the range in which the aggregate value exists and the probability.

[0129] The reference position pointer may or may not always be displayed independently of the moving pointer.

[0130] According to the second embodiment described above, graph information showing a dynamic graph that changes over time is generated. In the dynamic graph, the position of the pointer changes over time to indicate the probability that a count value exists. In one example, the pointer appears at a position according to the probability while blinking over time. In another example, the pointer moves back and forth at a moving speed corresponding to the probability. This allows the user to intuitively understand the position of the count value.

[0131] Although the invention according to the present disclosure has been described based on various drawings and examples, it should be noted that a person skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these modifications and corrections are included in the scope of the invention according to the present disclosure. For example, the functions included in each part, each means, each step, etc. can be rearranged so as not to be logically contradictory, and multiple means, steps, etc. can be combined into one or divided. In addition, the configurations shown in the embodiments described above may be appropriately combined.

[0132] As an example, the program, graph generation system, and graph generation method according to the present disclosure can be used when generating graphs that report the aggregated results of statistics regarding advertisement viewing to advertisers. [Explanation of symbols]

[0133] 10 memory unit, 11 reception unit, 12 aggregation unit, 13 first calculation unit, 14 second calculation unit, 15 acquisition unit, 16 generation unit, 17 output unit, 100 server, 110 server processing means, 120 server storage means, 130 server communication means, 200 user terminal, 210 terminal control means, 220 terminal storage means, 230 terminal communication means, 240 input / output means, 250 display means, 300 network, 400 graph generation system

Claims

1. A program for causing a computer to execute a process for generating a graph in which a statistical calculation result is displayed in a privacy-guaranteed manner defined by a privacy parameter, the program comprising: Obtaining a noise function, which is a function of a random variable determined by a characteristic value indicating a characteristic of an aggregation method when an aggregate value is aggregated from the statistics and the privacy parameter, and a display value obtained by adding a noise value output from the noise function to the aggregate value; generating graph information showing a graph including a figure having a shape extending in a main dimension direction corresponding to the aggregated value with a position indicated by the display value on a coordinate system as a reference position, the figure showing a plurality of existence ranges corresponding to the probability that the aggregated value exists; A program for causing the computer to execute the above.

2. the noise function is a probability density function determined by the characteristic value and the privacy parameter; The program according to claim 1 , wherein the graph shows the plurality of existence ranges indicating the shape of the probability density function.

3. the characteristic value is a sensitivity determined from the aggregation method and the statistical amount; 3. The program according to claim 2, wherein the noise function is a Laplace distribution function having a mean of zero and a variance equal to a quotient of the sensitivity divided by the privacy parameter.

4. The program according to claim 1 , wherein the noise function is determined by the characteristic value and the privacy parameter, and is a probability mass variable that outputs a discrete random variable.

5. The program according to claim 1 , wherein the graphic is a plurality of scales each indicating one of the plurality of existence ranges.

6. The figure is a band extending in the direction of the primary dimension, The program according to claim 1 , wherein within the band, a color gradually changes in the direction of the main dimension so as to correspond to a probability that the aggregated value exists as one of the multiple existence ranges.

7. 5. The program according to claim 1, wherein the figure extends in the direction of the main dimension and has an outer shape in a direction perpendicular to the direction of the main dimension that is similar to a shape of a graph of the noise function.

8. the figure extends in the direction of the main dimension, and an outer shape in a direction perpendicular to the direction of the main dimension has a shape similar to a shape of a graph of the noise function, 5 . The program according to claim 1 , wherein within the figure, colors are gradually changed in the direction of the main dimension so as to correspond to the probability that the aggregated value exists as one of the multiple existence ranges.

9. the graph is a 100% stacked bar graph showing the ratio of the first element to the second element in a whole; The program according to any one of claims 1 to 4, wherein the figure has a color that gradually changes in the direction of the primary dimension to correspond to the probability that the aggregate value of the first element exists at the boundary between the display value of the first element and the display value of the second element.

10. the graph is a pie chart showing a ratio of a first element to a second element in a whole; the direction of the primary dimension is along the circumference of the pie chart; The program according to any one of claims 1 to 4, wherein the figure has a color that gradually changes in the direction of the primary dimension to correspond to the probability that the aggregate value of the first element exists at the boundary between the display value of the first element and the display value of the second element.

11. When causing the computer to generate the graph information, generating the graph information, when a designation of a designated existence range among the plurality of existence ranges is accepted, which is a graph showing only the designated existence range among the plurality of existence ranges as a probability that the aggregate value exists; The program according to any one of claims 1 to 4, which causes the program to execute the steps of:

12. When causing the computer to generate the graph information, generating, when an instruction for a position included in the plurality of existence ranges is received, the graph information being a graph showing information indicating a probability that the aggregated value is present at the position where the instruction was received together with the plurality of existence ranges; The program according to any one of claims 1 to 4, which causes the program to execute the steps of:

13. A program for causing a computer to execute a process for generating a dynamic graph in which the aggregated results of statistics are changed over time with privacy guaranteed as specified by a privacy parameter, the program comprising: Obtaining a noise function, which is a function of a random variable determined by a characteristic value indicating a characteristic of an aggregation method when an aggregate value is aggregated from the statistics and the privacy parameter, and a display value obtained by adding a noise value output from the noise function to the aggregate value; generating graph information showing a dynamic graph in which a pointer position changes over time in a direction of a main dimension corresponding to the aggregated value, the pointer position being taken as a reference position on the coordinate system indicated by the display value, to show a probability that the aggregated value exists; A program for causing the computer to execute the above.

14. 14. The program according to claim 13, wherein the pointer appears on the graph at a position according to the probability that the aggregated value exists, while blinking over time.

15. In the graph, the pointer reciprocates around the reference position in the direction of the primary dimension; 14. The program according to claim 13, wherein the moving speed of the pointer at a position corresponds to the probability that the tally value exists at that position.

16. A system for generating a graph in which a statistical analysis result is displayed in a privacy-guaranteed manner defined by privacy parameters, comprising: an acquisition unit that acquires a noise function, which is a function of a random variable determined by a characteristic value indicating a characteristic of a counting method when a counted value is tallied from the statistics and the privacy parameter, and a display value obtained by adding a noise value output from the noise function to the counted value; a generation unit that generates graph information showing a graph including a figure having a shape extending in a main dimension direction corresponding to the aggregate value with a position indicated by the display value on a coordinate system as a reference position, the figure showing a plurality of existence ranges corresponding to the probability that the aggregate value exists; A graph generation system with

17. A method for generating a graph in which a statistical analysis result is displayed in a privacy-guaranteed manner defined by privacy parameters, comprising the steps of: Obtaining a noise function, which is a function of a random variable determined by a characteristic value indicating a characteristic of an aggregation method when an aggregate value is aggregated from the statistics and the privacy parameter, and a display value obtained by adding a noise value output from the noise function to the aggregate value; generating graph information showing a graph including a figure having a shape extending in a main dimension direction corresponding to the aggregated value with a position indicated by the display value on a coordinate system as a reference position, the figure showing a plurality of existence ranges corresponding to the probability that the aggregated value exists; A graph generation method comprising:

Images