Dataset Privacy Evaluation Using Inference Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data de-identification techniques are inadequate in ensuring thorough anonymization without over-de-identification, and there is a need to assess and enhance anonymization levels in datasets to prevent identification risks when cross-referenced with other datasets.
Innovation Solution
A dataset evaluation system that analyzes data environments, identifies quasi-identifiers, and computes inference risk scores using distance linkage disclosure techniques to ensure datasets are anonymized to a threshold level, applying iterative de-identification if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional de-identification methods are used, then the dataset can be released for analysis, but individual privacy may be compromised due to cross-referencing with other datasets
Solution Approach 1:
The system performs preliminary actions by computing an inference risk score using Cartesian product and distance linkage disclosure techniques before releasing the dataset. This allows the system to identify potential privacy risks in advance and apply appropriate de-identification measures, rather than relying on traditional methods that assume de-identification is sufficient without further validation.
Solution Approach 2:
The system implements a feedback mechanism where the inference risk score is calculated based on the de-identified dataset and available intruder datasets. If the score indicates insufficient privacy protection, the system iteratively applies additional de-identification techniques until the privacy threshold is met, creating a closed-loop system that continuously validates privacy protection.
2Reliability
If additional de-identification methods are applied to enhance privacy, then individual privacy is better protected, but the dataset may become overly de-identified and skew analyses
Solution Approach 1:
The system dynamically adjusts the level of de-identification based on the calculated inference risk score. Rather than applying fixed de-identification rules, the system iteratively applies additional de-identification techniques only when the risk score indicates insufficient privacy protection, allowing the de-identification level to adapt to the actual privacy risks present in the data environment.
Solution Approach 2:
The system changes parameters by computing an inference risk score that quantifies the level of privacy protection. This score serves as a parameter to determine whether additional de-identification is needed, allowing the system to objectively assess and adjust the de-identification level based on measurable privacy risks rather than arbitrary thresholds.
3Reliability
If the dataset is thoroughly analyzed against multiple intruder datasets to ensure privacy, then privacy protection is improved, but the computational complexity and time required increase
Solution Approach 1:
The system performs preliminary computation by calculating the Cartesian product of the de-identified dataset with available intruder datasets and computing distance linkage disclosure scores before final release. This preliminary analysis identifies the specific privacy risks present, allowing the system to apply targeted de-identification measures rather than exhaustive processing of all possible intruder datasets.
Solution Approach 2:
The system applies partial action by computing inference risk scores only against available intruder datasets rather than all possible datasets. The system iteratively applies de-identification until the privacy threshold is met, which may require less processing than exhaustive analysis of every possible data combination, while still providing sufficient privacy protection against realistic threats.
4Measurement precision
If normalization and preprocessing are applied to the dataset, then the data quality for analysis is improved, but quasi-identifiers may become more apparent and increase inference risk
Solution Approach 1:
The system performs preliminary normalization and preprocessing of the dataset before computing the inference risk score. This allows the system to assess privacy risks on the actual data quality that will be used for analysis, rather than on raw or differently processed data. The risk assessment is tailored to the specific preprocessing steps applied.
Solution Approach 2:
The system implements feedback by computing the inference risk score after normalization and preprocessing are applied. If the score indicates increased privacy risks due to these operations, the system iteratively applies additional de-identification techniques to counteract the increased identifiability, ensuring that data quality improvements do not compromise privacy protection.
Data Source
AI summary
In some implementations, a dataset evaluation system may receive a target dataset. The dataset evaluation system may-processing the target dataset to generate a normalized target dataset. The dataset evaluation system may process the normalized target dataset with an intruder dataset to identify whether any quasi-identifiers are present in the normalized target dataset. The dataset evaluation system may determine a Cartesian product of the normalized target dataset and the intruder dataset. The dataset evaluation system may compute, using a distance linkage disclosure technique, an inference risk score for the target dataset with the intruder dataset based on the Cartesian product and whether any quasi-identifiers are present in the normalized target dataset. The dataset evaluation system may output information associated with the inference risk score.