This paper analyzes the privacy of traditional Statistical Disclosure Control (SDC) systems under a differential privacy interpretation. SDCs, such as cell suppression and swapping, promise to safeguard the confidentiality of data and are routinely adopted in data analyses with profound societal and economic impacts. Through a formal analysis and empirical evaluation of demographic data from real households in the U.S., the paper shows that widely adopted SDC systems not only induce vastly larger privacy losses than classical differential privacy mechanisms, but, they may also come at a cost of larger accuracy and fairness.

Artificial Intelligence (AI) systems planned for deployment in real-world applications frequently are researched and developed in closed simulation environments where all variables are controlled and known to the simulator or labeled benchmark datasets are used. Transition from these simulators, testbeds, and benchmark datasets to more open-world domains poses significant challenges to AI systems, including significant increases in the complexity of the domain and the inclusion of real-world novelties; the open-world environment contains numerous out-of-distribution elements that are not part in the AI systems' training set. Here, we propose a path to a general, domain-independent measure of domain complexity level. We distinguish two aspects of domain complexity: intrinsic and extrinsic. The intrinsic domain complexity is the complexity that exists by itself without any action or interaction from an AI agent performing a task on that domain. This is an agent-independent aspect of the domain complexity. The extrinsic domain complexity is agent- and task-dependent. Intrinsic and extrinsic elements combined capture the overall complexity of the domain. We frame the components that define and impact domain complexity levels in a domain-independent light. Domain-independent measures of complexity could enable quantitative predictions of the difficulty posed to AI systems when transitioning from one testbed or environment to another, when facing out-of-distribution data in open-world tasks, and when navigating the rapidly expanding solution and search spaces encountered in open-world domains.

The Collaborative Research Cycle (CRC) is a National Institute of Standards and Technology (NIST) benchmarking program intended to strengthen understanding of tabular data deidentification technologies. Deidentification algorithms are vulnerable to the same bias and privacy issues that impact other data analytics and machine learning applications, and can even amplify those issues by contaminating downstream applications. This paper summarizes four CRC contributions: theoretical work on the relationship between diverse populations and challenges for equitable deidentification; public benchmark data focused on diverse populations and challenging features; a comprehensive open source suite of evaluation metrology for deidentified datasets; and an archive of more than 450 deidentified data samples from a broad range of techniques. The initial set of evaluation results demonstrate the value of these tools for investigations in this field.

Disclosure avoidance (DA) systems are used to safeguard the confidentiality of data while allowing it to be analyzed and disseminated for analytic purposes. These methods, e.g., cell suppression, swapping, and k-anonymity, are commonly applied and may have significant societal and economic implications. However, a formal analysis of their privacy and bias guarantees has been lacking. This paper presents a framework that addresses this gap: it proposes differentially private versions of these mechanisms and derives their privacy bounds. In addition, the paper compares their performance with traditional differential privacy mechanisms in terms of accuracy and fairness on US Census data release and classification tasks. The results show that, contrary to popular beliefs, traditional differential privacy techniques may be superior in terms of accuracy and fairness to differential private counterparts of widely used DA mechanisms.

Privacy-protected microdata are often the desired output of a differentially private algorithm since microdata is familiar and convenient for downstream users. However, there is a statistical price for this kind of convenience. We show that an uncertainty principle governs the trade-off between accuracy for a population of interest (``sum query'') vs. accuracy for its component sub-populations (``point queries''). Compared to differentially private query answering systems that are not required to produce microdata, accuracy can degrade by a logarithmic factor. For example, in the case of pure differential privacy, without the microdata requirement, one can provide noisy answers to the sum query and all point queries while guaranteeing that each answer has squared error $O(1/\epsilon^2)$. With the microdata requirement, one must choose between allowing an additional $\log^2(d)$ factor ($d$ is the number of point queries) for some point queries or allowing an extra $O(d^2)$ factor for the sum query. We present lower bounds for pure, approximate, and concentrated differential privacy. We propose mitigation strategies and create a collection of benchmark datasets that can be used for public study of this problem.

The push for open data has made a multitude of datasets available enabling researchers to analyze publicly available information using various statistical and machine learning methods in support of policy development. An area of increasing interest that is being made available is public safety data, which can include both sensitive information and Personally Identifiable Information (PII). Release of sensitive data and PII can lead to individual and organizational harm. However, the removal of PII alone is an insufficient approach to preventing linkage attacks -- the process of combining unrelated data to identify individuals and entities. A growing body of academic research in the field of differential privacy exists which claims strict mathematical guarantees of data privacy, but with a potentially greater loss of dataset utility. In 2017 National Institute of Standards and Technology (NIST) Public Safety Communications Research (PSCR) Division initiated efforts to test, evaluate and strengthen research in differential privacy and add to its growing body of knowledge by making available open source algorithms for public safety use. This publication describes the design and results of PSCR's multi-phased innovation prize challenge and makes recommendations for conducting future challenges in differential privacy.

Goal Reasoning (GR) agents operating in partially observable environments need to hypothesize about hidden features in the current state to select an appropriate goal and create a plan to achieve it. The Online Iterative Explanation (OIE) problem is a variant of explanatory diagnosis tailored to the needs of these agents; it requires maintaining a complete plausible hypothetical execution history that is consistent with all previous observations, and which is updated iteratively with each new agent observation. Previous work has proposed and demonstrated a variety of OIE approaches for goal reasoning agents. Our contribution in this work is instead a formal investigation of the OIE solution space , which is the set of all consistent explanations at a given point during execution. This space spans a range of uncertainty (both unimportant and important) about the system’s ground truth execution history and state. We propose formal tools for exploring this space, recognizing its features, and understanding its dynamics over the course of execution. We approach this complex problem through two formalisms, starting with a rigorous formalization in the situation calculus, and followed by an application of a more intuitive state-set framework. This analysis will inform efforts to improve efficiency and reduce risk in future OIE algorithms.

Rigorous data mining results require measures of the statistical significance of the outcomes. The complexity of the data and models makes this a challenge; methods to protect privacy further complicate the issue. We demonstrate how to estimate statistical significance of results in the context of a social network analysis problem; the impact of the noise required to provide differential privacy is included in the significance measure. As a result, providing privacy does not complicate the use of the analysis. While demonstrated for social network analysis, the approach is general. The Wilcoxon signed-rank test used is appropriate for a wide variety of data with “before” and “after” measurements, and adapts well to differential privacy. We demonstrate on publicly available data with known privacy issues, showing that some apparently large differences are not significant, some small differences are, and that when the analysis is done using differential privacy, the same results can been achieved while protecting individual privacy.

Graphs and networks are used to model interactions in a variety of contexts. There is a growing need to quickly assess the characteristics of a graph in order to understand its underlying structure. Some of the most useful metrics are triangle-based and give a measure of the connectedness of mutual friends. This is often summarized in terms of clustering coefficients, which measure the likelihood that two neighbors of a node are themselves connected. Computing these measures exactly for large-scale networks is prohibitively expensive in both memory and time. However, a recent wedge sampling algorithm has proved successful in efficiently and accurately estimating clustering coefficients. In this paper, we describe how to implement this approach in MapReduce to deal with massive graphs. We show results on publicly-available networks, the largest of which is 132M nodes and 4.7B edges, as well as artificially generated networks (using the Graph500 benchmark), the largest of which has 240M nodes and 8.5B edges. We can estimate the clustering coefficient by degree bin (e.g., we use exponential binning) and the number of triangles per bin, as well as the global clustering coefficient and total number of triangles, in an average of 0.33 seconds per million edges plus overhead (approximately 225 seconds total for our configuration). The technique can also be used to study triangle statistics such as the ratio of the highest and lowest degree, and we highlight differences between social and non-social networks. To the best of our knowledge, these are the largest triangle-based graph computations published to date.

The vast amounts of data that are now available provide new opportunities to social science researchers, but also raise huge privacy concerns for data subjects. Differential privacy offers a way to balance the needs of both parties. But how?

Many online services now allow you to designate friendship relations with other users, creating a quickly growing abundance of social network data-sets. As social network analysts have raced to make use of these fascinating new data sources, privacy researchers have been simultaneously working to develop analysis techniques which protect individual privacy. Their efforts have produced a diverse variety of privatization approaches. But how exactly do these techniques affect privacy and how do they compare to each other? This work is an initial step toward the development of a universal view of social network privatization.

A s with any good discussion of a complicated issue, we should start by defining our terms. What do we mean by privacy? By ano-nymity? By disclosure, invasion , or reasonable protec-tion? As we draw a few lines with some assurance, we want you to join us in giving them some serious thought. An ex-admirer relentlessly tracking down your real-world information through supposedly protected on-line spaces, and finding creative ways to terrorize your waking life, is an invasion of privacy. This can and does happen to victims of cyber-stalking. If it's anonymity you want for protection, there are tools that can help. Tools that are very sophisticated and incredibly important for protecting people such as dissident journalists in totalitarian states, where privacy is a matter of life or death. Tor is perhaps the best known of these. Kelley Mistata dis-scusses how Tor works and why it's important. But an anonymous on-line world has consequences too; as with any weapon, what protects the victim can also be taken and used by the attacker. Is what you really want anonymity or pri-vacy? Or is it pseudanonym-ity? What exactly do those words mean? Dave Birch asks whether we could move to a world where transactions are covered by credentials , rather than identity, to protect privacy. Is anonymity sufficient protection to provide privacy , anyway? We can take your name off the data and make sure it doesn't include your address. However, there are lots of ways to identify someone. Your health issues, frequent geographical locations , or favorite websites can all be used to help pick you out of an anonymized crowd. While there are many arguments to be made that our new interconnected world provides too little privacy, Andreas Birkbak points out it may also provide too much. From a policy perspective, anonymity has quite serious effects on transparency, for example. If governments release data on their own performance, this will inevitably involve data about us— their citizens. Elaine Mackey and Mark Elliot ask how effectively can we anonymize and yet release data that informs and provides knowledge of crime, education, or health? Are there places where the information environment heightens the risk of statistical disclosure? What effect does the world of big data have on this? What effect might transparency have when information is routinely released, rather than gathered under FOIA? How do we quantify risk? Marion Oswald asks how …