CAREER: PROTEUS: A Practical and Rigorous Toolkit for Privacy

统计隐私，即披露从个人收集的数据的汇总统计数据，同时确保个人级别敏感财产的隐私的问题，是当今大数据时代的一个重要问题。统计隐私方面的关键挑战是，数据收集和分析应用程序对各种类型的数据进行操作，对必须保密的信息和他们必须容忍的对手有不同的要求。因此，通常不是隐私专家的应用领域专家不能直接使用现有的通用隐私定义。相反，他们必须制定新的隐私定义或定制现有的定义。目前还没有严格的技术来定制应用程序的隐私。这个项目构建了Proteus，这是一个通用工具包，用于开发严格的隐私定义和机制，可以根据应用程序进行定制。Proteus的基石是一个新的隐私框架，它允许通过明确列出要保护的秘密、列举(潜在的无限组)可能的对手以及确保向每个对手披露关于每个秘密的信息的严格界限来实现定制的隐私保护。Proteus中的新理论工具包括对相关数据的隐私进行推理的方法，针对现实对手的隐私，以及表达和实施个性化隐私偏好的技术。这些工具为发布社会科学调查数据、社交网络分析和分析用户活动流提供了实用的隐私机制。该项目的更广泛影响包括开发隐私和大数据管理方面的新课程，以及向美国人口普查局转让技术。

Statistical privacy, or the problem of disclosing aggregate statistics about data collected from individuals while ensuring the privacy of individual level sensitive properties, is an important problem in today's age of big data. The key challenge in statistical privacy is that applications for data collection and analysis operate on varied kinds of data, and have diverse requirements for the information that must be kept secret, and the adversaries that they must tolerate. Thus, application domain experts, who are frequently not experts in privacy, cannot directly use an existing, general-purpose privacy definition. Instead, they must develop a new privacy definition or customize an existing one. Currently there exist no rigorous techniques to customize privacy to applications.This project builds PROTEUS, a general-purpose toolkit for developing rigorous privacy definitions and mechanisms that can be customized to applications. The cornerstone of PROTEUS is a novel privacy framework that allows customized privacy protection by explicitly listing the secrets to be protected, enumerating the (potentially infinite set of) possible adversaries, and ensuring rigorous bounds on the information disclosed to each adversary about every secret. Novel theoretical tools in PROTEUS include methods to reason about privacy for correlated data, privacy against realistic adversaries, and techniques to express and enforce personalized privacy preferences. These tools result in practical privacy mechanisms for publishing social science survey data, social network analysis, and analysis of user-activity streams. Broader impacts of this project include developing new courses in privacy and big-data management, as well as technology transfer to the US Census.