Spreading the Privacy Blanket: Differentially Oblivious Shuffling for Differential Privacy
Spreading the Privacy Blanket: Differentially Oblivious Shuffling for Differential Privacy
复制标题
DOI：
10.1007/978-3-031-09234-3_25
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Dov S. Gordon;Jonathan Katz;Mingyu Liang;Jiayu Xu
中科院分区：
文献类型：
--
作者：
Dov S. Gordon;Jonathan Katz;Mingyu Liang;Jiayu Xu
在差异隐私的洗牌模型中，用户在本地随机化他们的数据并将结果提交给受信任的“洗牌者”，该“洗牌者”在将结果发送到服务器进行分析之前混合结果。对于差分隐私的实际应用来说，这是一个很有前途的模型，因为最近的一些结果表明，在某些情况下，shuffle 模型提供了比纯本地模型更好的隐私/效用权衡。shuffle 模型的缺点是它依赖于可信的 shuffler，很自然地尝试用用户自己运行的分布式 shuffle 协议来替换它。虽然当然可以使用完全安全的洗牌协议，但人们可能希望改用安全保证较弱的更高效的协议。在这项工作中，我们考虑一种称为差异遗忘性的安全洗牌放宽，我们证明它足以满足洗牌模型中的差异隐私。我们还提出了一种基于洋葱路由的差异性不经意洗牌协议，该协议仅需要通信，同时容忍任何恒定比例的损坏用户。我们表明，对于参数的实际设置，我们的协议优于现有的问题解决方案。
In theshuffle modelfor differential privacy,nusers locally randomize their data and submit the results to a trusted “shuffler” who mixes the results before sending them to a server for analysis. This is a promising model for real-world applications of differential privacy, as several recent results have shown that, in some cases, the shuffle model offers a strictly better privacy/utility tradeoff than what is possible in a purely local model.A downside of the shuffle model is its reliance on a trusted shuffler, and it is natural to try to replace this with a distributed shuffling protocol run by the users themselves. While it would of course be possible to use a fully secure shuffling protocol, one might hope to instead use a more-efficient protocol having weaker security guarantees.In this work, we consider a relaxation of secure shuffling calleddifferential obliviousnessthat we prove suffices for differential privacy in the shuffle model. We also propose a differentially oblivious shuffling protocol based on onion routing that requires onlycommunication while tolerating any constant fraction of corrupted users. We show that for practical settings of the parameters, our protocol outperforms existing solutions to the problem.