CAREER: FormalDP: Formally Verified, Private, Accurate and Efficient Data Analysis

数据驱动的技术正在对社会产生令人印象深刻的影响，但隐私问题限制了数据的使用和发布方式。差异隐私已成为支持尊重隐私的高效和准确数据分析的主导概念。但是，设计和实现高效的、具有高实用性的差异私有数据分析可能是具有挑战性的，而且容易出错。即使是隐私专家也发布了带有错误的代码或设计了错误的算法。编程平台和正式的验证工具可以帮助数据分析人员设计不同的私有数据分析，而不会出现错误。然而，目前的方法有两个局限性：第一，它们支持关于隐私的推理，但不支持数据分析的另外两个重要方面-准确性和效率；第二，它们支持关于理想化数据分析的推理，但不支持它们在有限计算机上的实现。这个项目的目标是通过开发新的形式验证技术和工具来克服这两个限制，这些技术和工具支持形式推理，将数据分析及其实现的隐私、准确性和效率保证结合在一起。该项目的成果将有助于制定保护隐私技术的基本方法，通过改进和促进处理私人或敏感数据的更安全做法，使社会受益。此外，该项目将支持旨在培训学生以全球视角了解数据隐私及其做法的教育活动，以及旨在调查隐私政策和标准如何受到本研究结果影响的外联活动。该提案的技术目标是验证技术和工具的理论和技术发展，这些技术和工具能够设计私密、准确、高效和具有经过验证的实施的数据分析。为了实现这一目标，该项目将侧重于三个具体方向：第一，它将开发正式的验证技术，以正式方式推理差异私有数据分析的准确性；第二，它将开发资源分析技术，以从计算时间和空间以及所需数据样本的数量方面推理数据分析的效率；第三，它将开发推理技术，以验证在有限计算机上实现差异私有算法的私密性、准确性和效率。这些技术将被实现为一个基于类型的验证框架，称为ForMalDP，因此将支持基于类型的形式推理，将数据分析及其实现的保密性、准确性和效率结合在一起。这种方法的有效性将通过实验研究来评估，这些实验研究验证了不同的私人实施可以达到的准确性和效率水平。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Data-driven technology is having an impressive impact on society but privacy concerns restrict the way data can be used and released. Differential privacy has emerged as a leading notion supporting efficient and accurate data analyses that respect privacy. But designing and implementing efficient differentially private data analyses with high utility can be challenging and error prone. Even privacy experts have released code with bugs or designed incorrect algorithms. Programming platforms and formal verification tools can assist data analysts in designing differentially private data analyses without bugs. However, the current approaches have two limitations: first, they support reasoning about privacy but not about accuracy and efficiency which are two other important aspects of data analyses; second, they support reasoning about idealized data analyses but not about their implementations on finite computers. The goal of this project is to overcome these two limitations by developing novel formal verification techniques and tools supporting formal reasoning combining privacy, accuracy, and efficiency guarantees for both data analyses, and their implementations. The results of this project will contribute to develop foundational methods for privacy-preserving technology which can benefit society by improving and promoting safer practices in handling private or sensitive data. Moreover, the project will support educational activities aimed at training students with a global view on data privacy and its practices, and outreach activities aimed at investigating ways in which privacy policies and standards can be impacted by the results of this research.The technical goal of this proposal is the theoretical and technological development of verification techniques and tools that can enable the design of data analyses that are private, accurate, efficient, and with verified implementations. To achieve this goal the project will focus on three concrete directions: first, it will develop formal verification techniques to reason in a formal way about the accuracy of differentially private data analyses; second, it will develop resource analysis techniques to reason about the efficiency of a data analysis in terms of computing time and space, and in terms of the number of needed data samples; third, it will develop reasoning techniques to verify the privacy, accuracy and efficiency of implementations of differentially private algorithms on finite computers. These techniques will be implement as a type-based verification framework, named FormalDP, which will thus support type-based formal reasoning combining privacy, accuracy and efficiency for data analyses and their implementations. The effectiveness of this approach will be assessed through experimental studies about the level of accuracy and efficiency that verified differentially private implementations can achieve.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.