Multi-user Pufferfish Privacy

2025-12-21

AI Summary

This paper addresses individual-level privacy protection for aggregate queries in multi-user dynamic systems—where users frequently join, leave, and update their data. To this end, it extends Pufferfish privacy to such dynamic settings for the first time. The authors propose a Laplace noise calibration mechanism grounded in the Wasserstein metric (i.e., the first-order Kantorovich distance), and establish a multi-user sensitive-pair model alongside a statistical indistinguishability analysis framework. Theoretically, they prove that an individual’s privacy budget depends solely on their own data distribution, independent of others’. For Bernoulli variables, they introduce a relaxable noise condition and derive sufficient conditions for Pufferfish privacy under four canonical secret-pair families. Experiments demonstrate that the method substantially reduces required noise magnitude for binary variables, thereby improving query accuracy and data utility—while strictly preserving Pufferfish privacy.

Technology Category

• Machine Learning: Privacy
• Reasoning under Uncertainty: Stochastic Optimization
• Multiagent Systems: Mechanism Design

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Large-scale security measurements
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

This paper studies how to achieve individual indistinguishability by pufferfish privacy in aggregated query to a multi-user system. It is assumed that each user reports realization of a random variable. We study how to calibrate Laplace noise, added to the query answer, to attain pufferfish privacy when user changes his/her reported data value, leaves the system and is replaced by another use with different randomness. Sufficient conditions are derived for all scenarios for attaining statistical indistinguishability on four sets of secret pairs. They are derived using the existing Kantorovich method (Wasserstain metric of order $1$). These results can be applied to attain indistinguishability when a certain class of users is added or removed from a tabular data. It is revealed that attaining indifference in individual's data is conditioned on the statistics of this user only. For binary (Bernoulli distributed) random variables, the derived sufficient conditions can be further relaxed to reduce the noise and improve data utility.

Problem

• Achieving individual indistinguishability in multi-user aggregated queries
• Calibrating Laplace noise for pufferfish privacy under user changes
• Deriving conditions for statistical indistinguishability using Kantorovich method

Innovation

• Calibrating Laplace noise for Pufferfish privacy
• Using Kantorovich method for statistical indistinguishability
• Relaxing conditions for binary variables to reduce noise