Empirically Providing Data Privacy Using Noise Reduction

Abstract

An empirical approach to providing differential privacy involves applying a general statistical query to a database collection to generate sample values ​​both with and without data for any particular entity. The probability density is empirically estimated by permuting the sample values ​​to generate an empirical cumulative distribution function. The cumulative distribution function is partitioned by a number that approximates the square root of the number of sample points to obtain the empirical density function. A statistical query is empirically (ε,δ)-private if the empirical densities with and without any particular individual differ by a factor of exp(ε) or less, except for sets where the densities covering the entire range δ or less are exceeded.

Description

[Technical field]

[0001] The subject matter described herein relates generally to data analysis, and more particularly to empirical differential privacy approaches that reduce reliance on artificially added noise. [Background technology]

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Patent Application No. 62 / 893,376, filed October 29, 2019, U.S. Provisional Patent Application No. 62 / 897,687, filed September 9, 2019, U.S. Provisional Patent Application No. 62 / 905,657, filed September 25, 2019, U.S. Provisional Patent Application No. 62 / 913,089, filed October 9, 2019, U.S. Provisional Patent Application No. 62 / 933,800, filed November 11, 2019, and U.S. Provisional Patent Application No. 62 / 968,742, filed January 31, 2020, the entire contents of each of which are incorporated herein by reference.

[0003] Differential privacy refers to a specific class of techniques that allow statistical queries against databases without revealing information about individual rows. Many databases exist in which individual rows correspond to entities (e.g., individuals, companies, or other legal entities). Inherently, these techniques are useful for protecting the privacy of individuals while also deriving utility from the data. Generally speaking, differential privacy approaches are designed such that the variation in the results returned by a query, due to randomness or other unpredictable factors, is sufficient to obscure the difference resulting from including or excluding a particular record. Thus, the data in a particular record cannot be determined by running the same query against the full dataset and against a dataset with that record excluded.

[0004] Some existing differential privacy techniques start with a clean database and add controlled noise to the response before presenting the results of a statistical query. For example, the amount of noise can be chosen to produce the maximum difference between a query on the full data set and a query on the data set with one row removed, divided by the privacy budget. For multiple private queries on the same data set, the privacy budget is additive, so that the probability of any set of query results does not change multiplicatively beyond the privacy budget when an individual row is removed. However, there are often cases where the noise added to ensure sufficient privacy is too much, making the response less effective enough that it can obscure useful statistical information. Summary of the Invention

[0005] The embodiments relate to a differential privacy approach that limits the amount of noise added to search results of aggregate queries. By limiting the amount of added noise, the approach maintains result accuracy while also preserving privacy for individual entities represented in the data within a tolerance range. Using this differential privacy approach, differential privacy can be implemented for a single deterministic query on a random database, rather than exposing a variety of randomly drawn queries on a single deterministic database. If rows are labeled with an entity, this also gives a probability distribution for responses in the presence and absence of that entity, allowing differential privacy to require that the probability for any particular query result does not change multiplicatively beyond the privacy budget when the entity's data is removed.

[0006] In various embodiments, an empirical approach is introduced to provide differential privacy. This approach involves applying a general statistical query to a collection of databases (e.g., a time series of databases). Assuming that the data contained in each database is substantially independent of the data contained in the other databases, the collection represents an empirical sample from an assumed probability distribution over the databases. This approach generates an empirical sample of values ​​of the statistical query from the collection of databases both in the presence and absence of data for any particular entity. How much the empirical probability distributions for the responses differ in the presence and absence of data for any entity provides an empirical measure of differential privacy.

[0007] In an embodiment of the differential privacy approach, a request is received to perform a query on a set of databases that includes data labeled by entities. The query is performed on a subset of the databases by repeatedly performing the query with and without data for each entity, thereby generating a query result for the databases in the subset. An empirical probability density function is calculated from the query result. It is determined whether the query satisfies one or more differential privacy requirements based on the empirical probability density function. In response to determining whether the query satisfies one or more differential privacy requirements, the query result is output to one or more users through any suitable interface. Additionally or alternatively, a report may be generated based on the query result and presented to one or more users through a suitable interface. In response to the query not satisfying one or more differential privacy requirements, noise may be added to the query result until the query result does indeed satisfy one or more differential privacy requirements. In this manner, the amount of added noise is limited and the accuracy of the query result is maintained. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates a block diagram of a data analysis system, according to one embodiment. [Diagram 2] FIG. 2 is a block diagram of the data store in FIG. 1 according to one embodiment. [Diagram 3] 1 is a flow chart of a method for generating reports based on queries of a database while maintaining data privacy, according to one embodiment. [Figure 4] 1 is a flow chart of a method for outputting results of a database query while preserving data privacy, according to one embodiment. [Diagram 5] FIG. 2 is a block diagram illustrating an example computer suitable for use as the data analysis system in FIG. 1, according to one embodiment. [Figure 6] FIG. 1 illustrates an illustration of an adaptive kernel, according to one embodiment. [Figure 7] FIG. 7 illustrates an illustration of the estimated empirical probabilities generated by the summation of kernels in FIG. 6, according to one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Detailed explanation

[0010] Reference will now be made to several embodiments, examples of which are illustrated in the accompanying drawings. Wherever possible, like or similar reference numbers are used in the drawings to indicate like or similar functionality. Although several embodiments described relate to generating market sentiment reports from financial data, those skilled in the art will recognize that the disclosed techniques may be applied to other types of data and reports.

[0011] Overview Differential privacy can be implemented for a single deterministic query against a random database without exposing multiple randomly drawn queries against a single deterministic database. If rows are labeled with an entity, this also gives a probability distribution for the response in the presence and absence of that entity, and differential privacy can be required to require that the probability of any particular query result does not change multiplicatively beyond the privacy budget when the entity's data is removed.

[0012] In various embodiments, an empirical approach is introduced to provide differential privacy. This approach involves applying a general statistical query to a collection of databases (e.g., a time series of databases). Assuming that the data contained in each database is substantially independent of the data in the other databases, the collection represents an empirical sample from an assumed probability distribution over the databases. This approach generates an empirical sample of values ​​of the statistical query from the collection of databases, both in the presence and absence of data for any particular entity. How much the empirical probability distributions for the responses differ in the presence and absence of data for any entity provides an empirical measure of differential privacy.

[0013] Exemplary Data Analysis System 1 illustrates one embodiment of a data analysis system 100. In the embodiment shown, data analysis system 100 includes a data store 110, a query module 120, a privacy analysis module 130, and a result generation module 140. In other embodiments, data analysis system 100 includes different or additional elements. Moreover, functionality may be distributed among the elements in various ways than described. For example, while data store 110 is shown as part of data analysis system 100, in some embodiments, its data is accessed remotely over a network.

[0014] The data store 110 includes a collection of databases that hold data for which statistical analysis that maintains personal privacy is desired. In some embodiments, each database in the collection of databases includes data related to multiple entities labeled by entity. FIG. 2 illustrates one embodiment of the data store 110 in more detail. In the embodiment shown, the data store 110 includes a first database 210A, a second database 210B, and an Nth database 210C. The databases 210A-N may be a time series of databases, such as results related to daily or weekly data collections. Those skilled in the art will recognize that the disclosed techniques may be used with any number of the databases 210A-N. In various embodiments, the databases 210A-N are substantially independent, meaning that data in one database is not dependent on data in another database. Each database includes rows that correspond to individual entities (e.g., individuals, companies, or other legal entities). For example, the databases may include financial data related to individual entities that are used to generate periodic market sentiment reports.

[0015] Referring back to FIG. 1 , the query module 120 is configured to receive requests to perform queries against a collection of databases. In an embodiment, the query module 120 provides a user interface (UI) through which a user may define a statistical query. In one embodiment, the UI allows a user to select a collection of databases, provide one or more privacy parameters (values ​​by which a determined probability for a query is acceptable to change if an entity is excluded), and define one or more statistical queries to perform against the selected collection of databases. The UI may be provided within a software package that executes the data analysis system 100, or may be accessed remotely from a client computing device, such as through a web interface or an application program interface (API).

[0016] The privacy analysis module 130 determines whether a provided query or set of queries satisfies the defined differential privacy requirements. To determine whether a provided query or set of queries satisfies the defined differential privacy requirements, the privacy analysis module 130 may apply a general statistical query to a subset of a database, such as a database time series. In one embodiment, some or all of the database subsets are subsets of a larger database. An operation that extracts data that satisfies specific parameters allows for the extraction of the queried database subset. For example, a SELECT operation may be used to extract data for a particular day or week, thereby generating a database time series from a database that includes data for a longer period of time.

[0017] Assuming that the data contained in each database in the set of databases is substantially independent from the data in the other databases, the set of databases represents an empirical sample from an assumed probability distribution for the set of databases. In these embodiments, the privacy analytics module 130 provides an empirical sample of values ​​for statistical queries from the set of databases, both with and without data for any particular entity. For example, the privacy analytics module 130 may be configured to perform queries on each subset of the set of databases by repeatedly executing queries with and without data for each entity, thereby generating query results for the databases in the subset. The privacy analytics module 130 may be configured to calculate an empirical probability density function from the query results.

[0018] In one embodiment, the privacy analytics module 130 empirically estimates the probability density by permuting the sample responses, thereby generating the empirical distribution function. The privacy analytics module 130 partitions the cumulative distribution function by a number that approximates (in asymptotic terms, up to a certain factor) the square root of the number of sample points, thereby estimating the empirical density function. Other partition widths may be used by those skilled in the art. For example, the partition width may depend on the number of sample points.

[0019] Alternatively, or in addition, the privacy analysis module 130 may empirically estimate the probability density using a technique of adaptive kernel density estimation. Using this technique, the privacy analysis module 130 replaces each sample point with a kernel whose width spans an interval of numbers that approximate the square root of the number of sample points. The privacy analysis module 130 sums the kernels, the sum of which is the density. Other adaptive kernel widths may be used by those skilled in the art. Furthermore, various kernel shapes may be used, including, but not limited to, rectangular, triangular, or Gaussian distributions. FIG. 6 shows an example of an adaptive kernel generated by a data sample. The kernel is narrower in the center of the distribution and wider in the tails of the distribution. FIG. 7 shows the resulting estimated empirical probability density, which is the sum of the kernels.

[0020] Given an empirical density probability density, the privacy analysis module 130 may measure the differential privacy for a query as a function of two parameters ε and δ. ε defines the maximum acceptable amount by which the determined probability for a query changes if an entity is excluded. δ indicates the probability that the query does not satisfy the requirement defined by ε. In particular, a statistical query is in an empirical (ε, δ)-privacy state if the empirical densities with and without any particular individual differ by a factor of exp(ε) or less, except for sets that exceed the full range of densities less than or equal to δ. If p(x) is the probability density with the individual and p1(x) is the probability density without the individual, then the privacy requirement may be expressed by Equation 1:

[0021]

number

[0022] In the privacy metric, δ may exaggerate the potential loss of privacy in the worst case. To address this, some embodiments use a metric called “total delta”, Δ, which provides an estimate of the probability that an entity i will have impaired privacy in excess of ε. To define this, δ is i Let be the smallest δ that works within the privacy criteria for entity i. The total delta may then be defined according to Equation 2.

[0023]

number

[0024] If a user provides multiple queries, the privacy analysis module 130 may jointly analyze the queries for differential privacy compliance using corresponding multi-dimensional empirical probability densities. For example, the privacy analysis module 130 may calculate a two-dimensional empirical probability density for two queries, a three-dimensional empirical probability density for three queries, etc.

[0025] Privacy measures can also be useful in adversarial situations, where recipients of statistical query results have incomplete information about the data in the databases. One exemplary case is when an entity that contributes to a database identifies what its own contribution to the database is and what those that can also see the public results of a statistical query. In such an adversarial case, the privacy analysis module 130 can perform a similar empirical privacy analysis, except with empirical probability distributions conditioned on information known to the adversary. The privacy analysis module 130 builds empirical conditional distributions by bucketing information known to the adversary, and then simply feeds the results of statistical queries for a particular database into the conditional distribution that corresponds to the bucket into which the information known to the adversary falls. In practice, the buckets can be chosen to be coarse enough that there are many data points that contribute to each conditional distribution, but fine enough to compute accurate conditional distributions.

[0026] The privacy guarantees described above are based on the assumption that each database in the ordered sequence is independent, drawn from an assumed probability distribution over the databases. This is true or close to true in many situations. However, this assumption can be empirically verified by measuring the empirical autocorrelation of query results in the ordered sequence. If significant autocorrelation exists, then one solution is to locally aggregate the databases in the sequence to generate a shorter sequence of databases at a longer time scale such that there is no significant autocorrelation in the query results. For example, autocorrelation may only exist in the short-term domain. If so, daily data may be aggregated into weekly buckets, weekly data into monthly buckets, and so on, such that there is no longer a significant degree of autocorrelation. It should be noted that adding noise may not be a practical solution to autocorrelation, since the noise required to effectively reduce autocorrelation is typically on the same order of magnitude as the query results themselves.

[0027] The result generation module 140 determines when and how to present the results of the query. In some embodiments, the result generation module 140 is configured to determine whether the query satisfies one or more differential privacy requirements based on the empirical probability density function, and is further configured to output the results of the query in response to determining that the query satisfies the one or more differential privacy requirements. In one such embodiment, if the privacy analysis module 130 determines that the query satisfies the defined differential privacy requirements, the result generation module provides the results of the query for display to the user. The results may be displayed in any suitable form, such as a chart, a spreadsheet, a list, or a report. For example, the result generation module 140 may generate a report based on the query results and provide the report for access by the user in a web page, via email, or within the UI of the data analysis system 100.

[0028] If the query does not satisfy the predefined differential privacy requirements, the result generation module 140 may add noise (e.g., Gaussian or Laplace noise) to the result. In one embodiment, the result generation module 140 may determine the amount of noise to be added so that the result satisfies the predefined differential privacy requirements. For example, the result generation module 140 may iteratively run a solving function that tries different amounts of noise, thereby determining the amount of noise to add that provides the desired privacy protection without overly obscuring the underlying statistics. The amount of noise added may be less than the amount of noise added in traditional differential privacy approaches. In this way, the query may return more accurate statistics even when noise is added to provide improved privacy. Alternatively, if the differential privacy requirements are not met, the result generation module 140 may inform the user that the predefined query was not feasible.

[0029] Exemplary Report Generation Method 3 illustrates an example method 300 for generating reports that satisfy differential privacy requirements. The steps in FIG. 3 are described in terms of a data analysis system 100 performing the method 300. However, some or all of the steps may be performed by other entities or components. Furthermore, some embodiments may perform steps in parallel, in a different order, or perform different steps.

[0030] In the embodiment shown in FIG. 3, the method 300 begins with the data analysis system 100 including step 310 of defining a statistical query (e.g., based on user input) to run against a collection of databases whose rows correspond to entities. The data analysis system 100 includes step 320 of generating empirical sample query values ​​by running the query against a sample of the collection of databases, both with and without data for each entity. The data analysis system 100 may select a sample size that is large enough to give substantially significant results, but small enough to be relevant (e.g., if the database columns are time series, sampling more recent databases has greater relevance). The data analysis system 100 includes step 330 of generating an empirical cumulative distribution function from the sample query values, from which an empirical density function may be generated (e.g., by partitioning the cumulative distribution function by a number that approximates the square root of the number of sample points).

[0031] The data analysis system 100 includes a step 350 of determining whether the statistical query satisfies applicable differential privacy requirements based on an empirical density function. For example, as previously described, the statistical query may be evaluated as being in an empirical (ε, δ)-privacy condition if the empirical densities in the presence and absence of any particular individual differ by a factor of exp(ε) or less, except for sets that have densities that span the full range of δ or less.

[0032] If the statistical query does not satisfy the applicable differential privacy requirements, the data analysis system 100 may include step 360, which may add enough noise to make the query differentially privacy compliant. For example, the data analysis system 100 may add Gaussian or Laplace noise to obscure individual row data at the cost of less accurate statistical information as a result returned by the query. Regardless of whether noise is added by step 360, the data analysis system 100 includes step 370, which may generate a report based on the query results. The report may be presented to one or more users through any suitable interface.

[0033] 4 illustrates an example method 400 for outputting results of a database query while preserving data privacy. The steps in FIG. 4 are described in terms of the data analysis system 100 performing the method 400. However, some or all of the steps may be performed by other entities or components. Additionally, some embodiments may perform steps in parallel, in a different order, or perform different steps.

[0034] In the embodiment shown in Figure 4, the method 400 includes receiving 410 a request to perform a query against a set of databases. Each database in the set of databases includes data about entities, the data being labeled with the entities. The method 400 further includes performing 420 a query against a subset of the databases by iteratively executing the query in the presence and absence of data for each entity, thereby generating a query result for the databases in the subset.

[0035] An empirical probability density function is calculated from the query results at step 430. In some embodiments, the empirical probability density function is calculated at step 430 by permuting the query results to produce an empirical cumulative distribution function for the query results in the presence and absence of each entity. The empirical cumulative distribution function is partitioned using an interval of a number of data points that is dependent on the data for which the empirical probability density function is generated. For example, the interval may be a number that approximates the square root of the total number of data points in the data set.

[0036] Alternatively, or additionally, the empirical probability density function may be calculated in step 430 by determining an adaptive kernel density estimate. In these embodiments, the data points are replaced by a kernel whose width is selected to span a number of data points, which are summed to calculate the density. The number of data points may depend on the data set. For example, the width of the kernel may span an interval of a number that approximates the square root of the total number of data points in the data set. The kernel may have a variety of shapes. For example, the kernel may be rectangular, triangular, Gaussian, etc. Furthermore, if there is some information in the database that is known or potentially known to the adversary, the empirical probability density may be calculated conditioned on the adversary's information that falls into the bucket columns.

[0037] Method 400 further includes determining 440 whether the query satisfies one or more differential privacy requirements based on an empirical probability density function. In some embodiments, determining that the one or more privacy requirements are satisfied includes calculating a total quantity δ such that the probability densities with and without data for each entity exceed a range that disagrees by no more than a factor of exp(ε), where ε is a parameter that indicates the maximum acceptable change in the determined probability for the query if the entity is removed.

[0038] In response to determining that the query satisfies one or more differential privacy requirements, the results of the query are output at step 450. In some embodiments, determining that the query satisfies one or more privacy requirements comprises calculating a total delta Δ, which is the aggregation Δ=Π over entities i i (1-δ i ) and δ i is the smallest δ that works within the privacy criterion for entity i.

[0039] In response to a query not satisfying one or more differential privacy requirements, noise may be added to the query results until the query results do satisfy one or more differential privacy requirements. The output results may be based on the results including the added noise. In some embodiments, the noise is Gaussian noise, Laplace noise, or the like.

[0040] In some embodiments, the database collection is an ordered sequence. In those embodiments that correspond to empirical evidence that query results within this sequence are not substantially independent and have statistically significant autocorrelation, the database sequence can be locally aggregated into a shorter sequence of the larger database until the query results no longer have statistically significant autocorrelation. Differential privacy requirements can then be verified based on the shorter sequence of the larger database.

[0041] Exemplary Computing Device Architecture FIG. 5 illustrates an exemplary computer 500 suitable for use as the data analysis system 100. The computer 500 includes at least one processor 502 coupled to a chipset 504. For clarity, operations may be described as being performed by a single processor, but this should be understood to include multiple processors operating in conjunction with each other to perform the enumerated operations. The chipset 504 includes a memory controller hub 520 and an I / O controller hub 522. A memory 506 and a graphics adapter 512 are coupled to the memory controller hub 520, and a display 518 is coupled to the graphics adapter 512. A storage device 508, a keyboard 510, a pointing device 514, and a network adapter 516 are coupled to the I / O controller hub 522. Other embodiments of the computer 500 have different architectures.

[0042] 5, the storage device 508 is a non-transitory computer-readable medium and / or a non-transitory computer-readable storage medium, such as a hard drive, a compact disc read-only memory (CD-ROM), a DVD, or a solid-state memory device. The memory 506 holds instructions and data used by the processor 502. Although the storage device 508 is shown to be a single medium, the term "machine-readable medium" should include a single medium or multiple media (such as a centralized or distributed database, or coordinated caches and servers) configured to store data or software used by the computer 500. For example, the data store 110 may be a distributed database served by multiple servers and coordinated by the data analysis system 100 over a network.

[0043] Pointing device 514 is a mouse, trackball, touch screen, or other type of pointing device and is used in combination with keyboard 510 (which may be an on-screen keyboard) to input data to computer system 500. Graphics adapter 512 causes display 518 to display images and other information. Network adapter 516 couples data analysis system 100 to one or more computer networks, such as the Internet. In some embodiments, a computer may lack some of the components discussed above, such as keyboard 510, pointing device 514, or display 518.

[0044] Additional Considerations Some portions of the preceding description describe embodiments in terms of algorithmic processes or operations. These algorithmic descriptions and representations are commonly used by those skilled in the computing arts to effectively convey the substance of their work to others skilled in the art. While these operations may be described in functional, operational, or logical terms, they will be understood to be implemented by computer programs that include instructions for execution by a processor or equivalent electronic circuitry. Moreover, it has proven convenient at times to refer to these arrangements of functional operations as modules, without loss of generality.

[0045] As used herein, any reference to "one embodiment" or "an embodiment" means that a particular element, feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment. The appearance of the phrase "in one embodiment" in various places in the specification does not necessarily refer to the same embodiment. Similarly, the use of "a" or "an" preceding an element or component is done merely for convenience. This description should be understood to mean that there is one or more elements or components present, unless it is clear that something else is meant. Where values ​​are described as "approximately" or "substantially" (or derived therefrom), such values ​​should be interpreted as accurate to + / - 10% unless it is clear from the context that something else is meant. For example, "approximately 10" should be understood to mean "in the range of 9 to 11".

[0046] As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, component, or apparatus that includes a list of elements is not necessarily limited to only those elements and may include other elements not expressly listed or inherent to such process, method, component, or apparatus. Unless expressly stated to the contrary, "or" refers to an inclusive or and not an exclusive or. For example, conditions A or B satisfy any one of the following: A is true (or exists) and B is false (or does not exist); A is false (or does not exist) and B is true (or exists); and both A and B are true (or exist).

[0047] Upon reading this disclosure, one of ordinary skill in the art will recognize alternative architectural and functional designs for systems and processes for administering pension plans. For example, server processing may be implemented using a single server or multiple servers operating in unison, databases and applications may be implemented on a single system or distributed across multiple systems, and distributed components may operate in serial or parallel. Thus, while specific embodiments and patent applications have been illustrated and described, the scope of protection should be limited only by the following claims.

Claims

1. A method for providing differential privacy in a data analysis system comprising at least one processor, comprising: The steps executed by the at least one processor include: receiving a request to perform a query on a collection of databases, each database in the collection of databases containing data relating to a plurality of entities, the data being labeled by entity, whereby a label applied to the data indicates which of the plurality of entities the data corresponds to; executing the query against each subset of the databases by repeated execution of the query with and without data for each entity to generate query results for the databases in the subset; calculating an empirical probability density function from the query results; determining whether the query satisfies one or more differential privacy requirements based on the empirical probability density function; in response to determining that the query satisfies the one or more differential privacy requirements, outputting a result of the query; A method comprising:

2. 2. The method of claim 1, wherein determining whether the query satisfies one or more differential privacy requirements comprises calculating a global quantity δ such that probability densities from the empirical probability density function with and without data for each entity exceed a range that differs by no more than a factor of exp(ε), where ε is a parameter indicating the maximum acceptable change in the probability determined for the query if an entity is removed.

3. The step of calculating the empirical probability density function comprises: permuting the query results to produce an empirical cumulative distribution function for the query results in the presence and absence of each of the plurality of entities; partitioning the empirical cumulative distribution function using intervals over a number of data points that depend on the size of the data to generate the empirical probability density function; The method of claim 1 , comprising:

4. 4. The method of claim 3, wherein the interval is a number that approximates the square root of the total number of data points in the data set.

5. The step of calculating the empirical probability density function comprises: determining an adaptive kernel density estimate, where the data points are replaced by a kernel, the width of the kernel being selected to span a number of data points, the number of data points being dependent on the size of the data set; summing said kernels to calculate a density from said empirical probability density function; The method of claim 1 , comprising:

6. 6. The method of claim 5, wherein the adaptive kernel has a width that spans an interval of a number that is approximately the square root of the total number of data points in the data set.

7. The method of claim 5 , wherein the kernel shape is rectangular, triangular, or Gaussian.

8. 2. The method of claim 1 , further comprising, in response to determining that the query does not satisfy the one or more differential privacy requirements, adding noise to the query results until the query results do indeed satisfy the one or more privacy requirements.

9. The method of claim 8, wherein the noise is Gaussian noise or Laplace noise.

10. 9. The method of claim 8, wherein the outputted results are based on the results with noise added.

11. 2. The method of claim 1, wherein information possibly known to an adversary is present in the database, and empirical probability densities from the empirical probability density function are calculated conditioned on this adversary's information falling into bucket columns.

12. the database collection being an ordered sequence, and responding to empirical evidence indicating that the query results within the sequence have statistically significant autocorrelation, the method comprising: locally aggregating columns of the database into shorter columns of the larger database until the query results no longer have statistically significant autocorrelation and can be assumed to be substantially independent; verifying differential privacy requirements based on the shorter sequences from a larger database; The method of claim 1 further comprising:

13. Determining whether the query satisfies one or more differential privacy requirements includes calculating a “total delta” Δ, where Δ is the aggregation Δ=1−Π over entities i i (1-δ i ) and δ i 2. The method of claim 1, wherein: i is the smallest δ that works within the privacy criterion for entity i.

14. A non-transitory computer readable storage medium containing computer program code including instructions that, when executed by a processor, cause the processor to: receiving a request to perform a query on a collection of databases, wherein each database in the collection of databases contains data regarding a plurality of entities, and the data is labeled by entity, whereby a label applied to the data indicates which of the plurality of entities the data corresponds to; executing the query for each subset of the databases by iteratively executing the query with and without data for each entity to generate query results for the databases in the subset; calculating an empirical probability density function from the query results; determining whether the query satisfies one or more differential privacy requirements based on the empirical probability density function; in response to determining that the query satisfies the one or more differential privacy requirements, outputting a result of the query; A non-transitory computer-readable storage medium, comprising:

15. Calculating the empirical probability density function permuting the query results to produce an empirical cumulative distribution function of the query results in the presence and absence of each of the plurality of entities; partitioning the empirical cumulative distribution function using intervals of a number of data points that depend on the size of the data to generate the empirical probability density function; 15. The non-transitory computer-readable storage medium of claim 14, comprising:

16. Calculating the empirical probability density function determining an adaptive kernel density estimate, where data points are replaced by a kernel, the width of the kernel being selected to span an interval of a number approximately equal to the square root of the total number of data points in the data set; summing said kernels to calculate a density from said empirical probability density function; 15. The non-transitory computer-readable storage medium of claim 14, comprising:

17. The database collection is an ordered sequence, and corresponds to empirical evidence indicating that the query results within the sequence have statistically significant autocorrelation, and the computer program code further comprises instructions that, when executed by the processor, cause the processor to: locally aggregating columns of a database into shorter columns of a larger database until the query results no longer have statistically significant autocorrelation and can be assumed to be substantially independent; Verifying differential privacy requirements based on the shorter sequences from a larger database; 15. The non-transitory computer-readable storage medium of claim 14, further comprising:

18. 15. The non-transitory computer-readable storage medium of claim 14, wherein information possibly known to an adversary is present in the database, and an empirical probability density from the empirical probability density function is calculated conditioned on this adversary's information falling into a column of buckets.

19. The computer program code further comprises instructions that, when executed by the processor, cause the processor to: in response to determining that the query does not satisfy the one or more differential privacy requirements, adding noise to the query result until the query does indeed satisfy the one or more differential privacy requirements.

15. The non-transitory computer-readable storage medium of claim 14, further comprising:

20. a collection of databases, each database in the collection of databases containing data relating to a plurality of entities, the data being labelled by the entities, such that a label applied to the data indicates which of the plurality of entities the data corresponds to; a query module configured to receive a request to perform a query on the collection of databases; a privacy analytics module configured to execute the query against each subset of databases by iteratively executing the query with and without data for each entity to generate query results for databases in the subset, and configured to calculate an empirical probability density function from the query results; a result generation module configured to determine whether the query satisfies one or more differential privacy requirements based on the empirical probability density function, the result generation module being further configured to output a result of the query in response to determining that the query satisfies the one or more differential privacy requirements; A data analysis system comprising:

Images