Differentially Private Query Log Release via Noise and Dummy Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Query logs contain valuable but sensitive user information, and previous attempts to release them while maintaining privacy have failed, as methods like replacing user names with random identifiers or securely hashing search queries have not effectively protected user privacy.
Innovation Solution
A system that adds noise to query counts in a query log and removes queries with counts below a threshold, while generating and adding 'dummy' queries based on a noise distribution to ensure differential privacy protection, thereby preserving computational resources and protecting user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If query logs are released for data mining, then valuable information about user behavior and search patterns is made available, but user privacy is compromised
Solution Approach 1:
The patent applies preliminary action by adding dummy queries to the query log before releasing it. This proactive measure ensures that even if real queries are present, the additional dummy data makes it computationally infeasible to distinguish between real and synthetic queries, thereby protecting user privacy while preserving data mining value
Solution Approach 2:
The patent uses dummy queries as an intermediary element between the real query log and the external world. These dummy queries act as a buffer that obscures the presence of real queries, allowing data to be released for mining purposes while preventing direct access to sensitive user information
2Reliability
If all possible queries are generated and noise is added to each count, then differential privacy protection is achieved, but computational resources are exhausted
Solution Approach 1:
The patent applies partial action by generating only a subset of possible dummy queries rather than all possible queries. By strategically selecting and adding a limited number of dummy queries with carefully crafted counts, the system achieves differential privacy protection without the computational burden of processing every possible query combination
Solution Approach 2:
The patent changes parameters by controlling the count values of dummy queries to be above a specific threshold. This parameter adjustment ensures that dummy queries are indistinguishable from real queries based on count alone, while avoiding the need to process queries with zero or low counts that would waste computational resources
Data Source
AI summary
A query log includes a list of queries and a count for each query representing the number of times that the query was received by a search engine. In order to provide differential privacy protection to the queries, noise is generated and added to each count, and queries that have counts that fall below a threshold are removed from the query log. A distribution associated with a function used to generate the noise is referenced to determine a distribution of a number of times that a hypothetical query having a zero count would have its count exceed the threshold after the addition of noise. Random queries of an amount equal to a sample from the distribution of number of times are added to the query log with a count that is greater than the threshold count.