Departmental Papers (CIS)
Date of this Version
8-2011
Document Type
Conference Paper
Recommended Citation
Andreas Haeberlen, Benjamin C. Pierce, and Arjun Narayan, "Differential Privacy Under Fire", . August 2011.
Abstract
Anonymizing private data before release is not enough to reliably protect privacy, as Netflix and AOL have learned to their cost. Recent research on differential privacy opens a way to obtain robust, provable privacy guarantees, and systems like PINQ and Airavat now offer convenient frameworks for processing arbitrary userspecified queries in a differentially private way. However, these systems are vulnerable to a variety of covertchannel attacks that can be exploited by an adversarial querier. We describe several different kinds of attacks, all feasible in PINQ and some in Airavat. We discuss the space of possible countermeasures, and we present a detailed design for one specific solution, based on a new primitive we call predictable transactions and a simple differentially private programming language. Our evaluation, which relies on a proof-of-concept implementation based on the Caml Light runtime, shows that our design is effective against remotely exploitable covert channels, at the expense of a higher query completion time.
Date Posted: 19 July 2012
Comments
Haeberlen, A., Pierce, B., & Narayan, A., Differential Privacy Under Fire, 20th USENIX Security Symposium, Aug. 2011, http://static.usenix.org/events/sec11/tech/full_papers/Haeberlen.pdf