TWC: Medium: Distributed Differential Privacy

当数据由不同的利益相关者控制时，隐私方面的担忧可能会限制共享。松散的联邦可能会成为可靠性的障碍，因为缺乏全球视野可能会限制大规模的协调和稳定。缺乏全球视野是导致2008年金融崩溃的问题之一。理想情况下，外部各方可以协调行为，但这通常是不可能的：域可能不愿共享它们的本地信息。差异隐私可以缓解这些担忧--它提供了强大、有吸引力的隐私保证，保护数据所有者免受与其数据泄露相关的风险，但这种保证在分布式环境中可能很难实现。该项目正在开发实用的分布式私有数据分析工具，非专家可以在各种应用程序中使用这些工具，从而能够对分布式数据进行重要的新分析。该项目还包括以课程开发和讲习班组织的形式开展的大量外联活动，并将培训博士生成为未来隐私技术开发的领导者。该项目提出了分布式环境中差异隐私的实用理论。它有三个主要目标：1)将差异隐私理论扩展到松散的保证下，当只有相对较少的、能力有限的合谋能力的各方时，可以进行高精度分析；2)开发能够自动证明分布式系统的差异隐私属性的编程语言和自动验证工具，其中每一方只能部分访问数据；以及3)开发工具链，以(除其他技术外)安全多方计算作为计算基础，在分布式环境中实现差异私有算法。

When data is controlled by diverse stake-holders, privacy concerns may limit sharing. Loose federation can be an obstacle to dependability because lack of a global view can limit large-scale coordination and stability. Lack of a global view is one of the problems that contributed to the 2008 financial collapse. Ideally, an outside party could coordinate behavior, but this is often impossible: domains may be reluctant to share their local information. Differential privacy can mitigate these concerns -- it provides a strong, attractive privacy guarantee that protects data owners from risks associated disclosure of their data, but this guarantee can be hard to achieve in distributed settings. This project is developing practical tools for distributed private data analysis that can be used by non-experts in a variety of applications, allowing for important new analyses of distributed data. The project also includes substantial outreach activities, in the form of course development and workshop organization, and will train PhD students to be future leaders in the development of privacy technologies. This project advances the practical theory of differential privacy in distributed settings. It has three main thrusts: 1) to extend the theory of differential privacy to work with relaxed guarantees, amenable to high-accuracy analyses when there are only a relatively small number of parties with limited ability to collude; 2) to develop programming languages and automatic verification tools capable of automatically certifying the differential privacy properties of distributed systems, in which each party has only partial access to the data; and 3) to develop tool chains to implement differentially private algorithms in distributed settings, using (among other technologies) secure multi-party computation as a computational substrate.