Back to the Drawing Board: Revisiting the Design of Optimal - - PowerPoint PPT Presentation

▶
back to the drawing board
SMART_READER_LITE
LIVE PREVIEW

Back to the Drawing Board: Revisiting the Design of Optimal - - PowerPoint PPT Presentation

Aug 01, 2023 316 likes •526 views

Back to the Drawing Board: Revisiting the Design of Optimal Location Privacy-preserving Mechanisms Simon Oya, Carmela Troncoso, Fernando Prez-Gonzlez 1 Motivation. Obfuscation-Based Location Privacy. Location information is sensitive.

slide-1
SLIDE 1

Back to the Drawing Board:

Revisiting the Design of Optimal Location Privacy-preserving Mechanisms

Simon Oya, Carmela Troncoso, Fernando Pérez-González

1

slide-2
SLIDE 2
  • Location information is sensitive.
  • Solution: obfuscation mechanisms
  • We get some privacy.
  • We lose some quality of service.
  • There are many ways to evaluate the privacy and

quality loss of obfuscation mechanisms.

  • Motivation. Obfuscation-Based Location Privacy.

2

Service provider

Here you go! I’m at the fake location , closest ? I want to use location services without disclosing my location

In this work We study some flaws in the traditional evaluation approach and how to solve them.

slide-3
SLIDE 3

System Model

Real location Obfuscated location Prior of real locations Obfuscation mechanism Service Provider Provides utility… ...at the cost

  • f privacy

?

and adversary

3

slide-4
SLIDE 4

Traditional Evaluation: Metrics

  • Quality Loss: Average Loss
  • Privacy: Average Adversary Error

Euclidean, Hamming, semantic, … Adversary’s estimation of the real location Euclidean, Hamming, semantic, …

Real location Obfuscated location Estimated location

4

Shokri, Reza, et al. "Quantifying location privacy." Security and privacy (sp), 2011 ieee symposium on. IEEE, 2011.

slide-5
SLIDE 5

Optimal Remapping [1]

5

[1] Chatzikokolakis, K., Elsalamouny, E., & Palamidessi, C. “Efficient Utility Improvement for Location Privacy.” PETS’17.

Step 1: Generate a random location using the mechanism Step 2: Compute the posterior and remap to its “center”. The generated output is the

  • utput after the remapping.

How to compute the optimal remapping of a mechanism f.

slide-6
SLIDE 6

Traditional Evaluation: Example and Remapping

  • Theorem: if dQ=dP, the optimal

remapping gives an optimal mechanism in terms of .

  • Lemma: the set of optimal

mechanisms forms a convex polytope.

  • This means there are many
  • ptimal mechanisms… are all of

them “equally good”?

6

Remapped mechanism Original mechanism

Traditional evaluation compares average error with average loss.

slide-7
SLIDE 7

Problems of the Traditional Evaluation

7

Flip a biased coin Heads! Tails!

Real location “Center”

  • f the map

= =

Report real location Report central location p 1-p No privacy! Seems OK… How “good” is this mechanism?

The Coin Mechanism

slide-8
SLIDE 8
  • The coin mechanism is

useless in practice…

  • … yet it is optimal in terms
  • f .
  • How do we identify and

avoid these “undesirable” mechanisms?

  • Our proposal: use

additional privacy and/or quality loss metrics.

  • We will see two:
  • Conditional Entropy
  • Worst-Case Loss

Problems of the Traditional Evaluation

8

Flip a biased coin Heads! Tails!

= =

Report real location Report central location p 1-p No privacy! Seems OK… No utility! How “good” is this mechanism?

The Coin Mechanism

coin 2 Polytope of

  • ptimal

mechanisms

slide-9
SLIDE 9

Solution 1: Conditional Entropy

  • The Conditional Entropy is a privacy metric.*

9

Real location Obfuscated location * Shokri, Reza, et al. "Quantifying location privacy." Security and privacy (sp), 2011 ieee symposium on. IEEE, 2011.

slide-10
SLIDE 10

Conditional Entropy II

  • How does it help us?
  • The conditional entropy is concave!
  • The coin performs poorly.
  • The conditional entropy reveals “binary”

mechanisms such as the coin.

Coin Optimal CE

10

Heads! Tails!

= =

Report real location Report central location

p 1-p

slide-11
SLIDE 11

Conditional Entropy III

  • Is a mechanism that maximizes the

conditional entropy “good” enough?

  • Consider this adversary posterior:
  • This is undesirable for the user… yet

it achieves large conditional entropy.

  • Therefore, we have to design

mechanisms using CE as a complementary metric.

11

slide-12
SLIDE 12

Conditional Entropy IV. Design.

  • How to design a mechanism that performs well in terms of AE and CE?
  • Algorithm:

Rate-Distortion: Blahut-Arimoto

Summary:

  • Tries to make an exponential posterior (we

call it ExPost).

  • For computational reasons, we need to

perform approximations.

  • The more computational power we have, the

closer it is to the optimal mechanism in terms of CE.

  • Iterative.
  • Uses remapping to achieve optimal AE.

12

slide-13
SLIDE 13

Solution 2: Worst-Case Loss

13

  • How does it help us?
  • Tails  Huge loss
  • Having a constraint on the WC loss avoids this.
  • This constraint makes sense in real applications

where we need a minimum utility (e.g., search nearby points of interest).

  • Implementation: add a WC loss constraint to the

design problem, use truncation, etc.

1.5km radius

slide-14
SLIDE 14

Multi-Dimensional Notion of Privacy

14

  • The two-dimensional approach is misleading.
  • Consider privacy as a multi-dimensional

notion.

  • Both mechanisms are
  • ptimal with respect to

this privacy and quality loss notions.

slide-15
SLIDE 15

Evaluation I. Mechanisms.

  • Selection of relevant mechanisms.

15

Laplacian [1] Gaussian Circular

We also perform an optimal remapping after these mechanisms to improve them.

Exponential Exponential Posterior (ExPost) The coin Optimal AE [2]

  • Two from our work

Linear program! Only feasible in simple scenarios.

[1] Chatzikokolakis, K., Elsalamouny, E., & Palamidessi, C. “Efficient Utility Improvement for Location Privacy.” PETS’17. [2] Shokri, Reza, et al. "Protecting location privacy: optimal strategy against localization attacks." CCS’12

slide-16
SLIDE 16

Evaluation II. Continuous Scenario.

16

With Worst-Case Loss = 1.5km Datasets: Gowalla, Brightkite San Francisco region Without Worst-Case Loss

slide-17
SLIDE 17

Evaluation II. Continuous Scenario.

17

With Worst-Case Loss = 1.5km Datasets: Gowalla, Brightkite San Francisco region Without Worst-Case Loss

No mechanism fares well in all the metrics!!! Looking at a single privacy metric is misleading

slide-18
SLIDE 18

Evaluation III. Discrete Scenario (Semantic)

18

  • We evaluate Shokri et. al optimal mechanism

[2], optimized for the semantic metric.

  • We consider a

semantic metric.

[2] Shokri, Reza, et al. "Protecting location privacy: optimal strategy against localization attacks." CCS’12

slide-19
SLIDE 19

Evaluation III. Discrete Scenario (Semantic)

19

  • We evaluate Shokri et. al optimal mechanism

[2], optimized for the semantic metric.

  • We consider a

semantic metric.

No mechanism fares well in all the metrics!!!

Careful with the multiple solutions of the same program!

[2] Shokri, Reza, et al. "Protecting location privacy: optimal strategy against localization attacks." CCS’12

slide-20
SLIDE 20

Conclusions

20

Many location-privacy mechanisms are being proposed Most of them are evaluated following a two-dimensional approach This might give “bad”

  • mechanisms. Design and

evaluation should be done considering privacy as a multidimensional notion.

Thank you!!

simonoya@gts.uvigo.es