Differentially private processing and database storage
A hardware database privacy device is communicatively coupled to a private database system. The hardware database privacy device receives a request from a client device to perform a query of the private database system and identifies a level of differential privacy corresponding to the request. The identified level of differential privacy includes privacy parameters (ε,δ) indicating the degree of information released about the private database system. The hardware database privacy device identifies a set of operations to be performed on the set of data that corresponds to the requested query. After the set of data is accessed, the set of operations is modified based on the identified level of differential privacy such that a performance of the modified set of operations produces a result set that is (ε,δ)-differentially private.
1. A method for returning differentially private results in response to a query to a database storing restricted data as records comprising rows and columns, the method comprising:
receiving a database query from a client device, the database query requesting a linear model describing correlations among values of columns in a set of records in the database, the database query identifying a level of differential privacy corresponding to the request, the identified level of differential privacy comprising privacy parameters ε and δ, wherein ε describes a degree of information released about the restricted data stored in the database due to the query, and δ describes an improbability of the query satisfying (ε)-differential privacy;
performing the database query on the set of records in the database to produce a differentially private version of the linear model that maintains the identified level of differential privacy for the restricted data, performing the query comprising:
modeling the values of the columns in the set of records in the database to produce a linear model comprising a set of parameters θ that describe correlations among the values;
minimizing a loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ; and
perturbing the optimal set of parameters θ to produce the differentially private version of the linear model, the set of parameters θ produced by optimizing a loss function perturbed by an additive term defined by:
θ
T
v
(
G
(
4
·
K
2
·
R
2
2
·
(
log
1
δ
+
ϵ
)
ϵ
2
)
)
where K is a constant, R 2 is a value based on the columns in the set of records, G( ) denotes a Gaussian random variable, and v denotes a unit vector; and
returning the differentially private version of the linear model to the client device in response to the query.
2. The method of claim 1 , wherein the client device is used by a user and further comprising:
identifying a privacy budget associated with the user, the privacy budget representing remaining queries available to the user in terms of the privacy parameters ε and δ;
decrementing the privacy budget associated with the user responsive to performing the database query and based on the privacy parameters corresponding to the request to produce a decremented privacy budget.
3. The method of claim 2 , further comprising:
receiving a subsequent query of the database from the user, the subsequent query identifying a corresponding level of differential privacy;
checking whether the corresponding level of differential privacy can be accommodated by the decremented privacy budget; and
denying the subsequent query responsive to the check indicating that the corresponding level of differential privacy cannot be accommodated by the decremented privacy budget.
4. The method of claim 1 , wherein the linear model is at least one of a linear regression classifier, a logistic regression classifier, and a support vector machine classifier.
5. The method of claim 1 , wherein K is the Lipschitz constant and wherein R 2 is a radius value representing a radius of a hypersphere that includes values of the columns in the set of records.
6. The method of claim 1 , wherein minimizing the loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ comprises:
minimizing
according
to
θ
=
arg
min
θ
(
X
train
,
y
train
;
θ
)
.
where X train and Y train are training data comprising columns in the set of records and ( ) is the loss function.
7. The method of claim 1 , wherein each column in the set of records represents one of a label feature and an observable feature describing the restricted data.
8. A non-transitory computer-readable storage medium storing computer program instructions executable by a processor to perform operations for returning differentially private results in response to a query to a database storing restricted data as records comprising rows and columns, the operations comprising:
receiving a database query from a client device, the database query requesting a linear model describing correlations among values of columns in a set of records in the database, the database query identifying a level of differential privacy corresponding to the request, the identified level of differential privacy comprising privacy parameters ε and δ, wherein ε describes a degree of information released about the restricted data stored in the database due to the query, and δ describes an improbability of the query satisfying (ε)-differential privacy;
performing the database query on the set of records in the database to produce a differentially private version of the linear model that maintains the identified level of differential privacy for the restricted data, performing the query comprising:
modeling the values of the columns in the set of records in the database to produce a linear model comprising a set of parameters θ that describe correlations among the values;
minimizing a loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ; and
perturbing the optimal set of parameters θ to produce the differentially private version of the linear model, the set of parameters θ produced by optimizing a loss function perturbed by an additive term defined by:
θ
T
v
(
G
(
4
·
K
2
·
R
2
2
·
(
log
1
δ
+
ϵ
)
ϵ
2
)
)
where K is a constant, R 2 is a value based on the columns in the set of records, G( ) denotes a Gaussian random variable, and v denotes a unit vector; and
returning the differentially private version of the linear model to the client device in response to the query.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the client device is used by a user, the operations further comprising:
identifying a privacy budget associated with the user, the privacy budget representing remaining queries available to the user in terms of the privacy parameters ε and δ;
decrementing the privacy budget associated with the user responsive to performing the database query and based on the privacy parameters corresponding to the request to produce a decremented privacy budget.
10. The non-transitory computer-readable storage medium of claim 9 , further comprising:
receiving a subsequent query of the database from the user, the subsequent query identifying a corresponding level of differential privacy;
checking whether the corresponding level of differential privacy can be accommodated by the decremented privacy budget; and
denying the subsequent query responsive to the check indicating that the corresponding level of differential privacy cannot be accommodated by the decremented privacy budget.
11. The non-transitory computer-readable storage medium of claim 8 , wherein the linear model is at least one of a linear regression classifier, a logistic regression classifier, and a support vector machine classifier.
12. The non-transitory computer-readable storage medium of claim 8 , wherein K is the Lipschitz constant and wherein R 2 is a radius value representing a radius of a hypersphere that includes values of the columns in the set of records.
13. The non-transitory computer-readable storage medium of claim 8 , wherein minimizing the loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ comprises:
minimizing
according
to
θ
=
arg
min
θ
(
X
train
,
y
train
;
θ
)
.
where X train and Y train are training data comprising columns in the set of records and ( ) is the loss function.
14. The non-transitory computer-readable storage medium of claim 8 , wherein each column in the set of records represents one of a label feature and an observable feature describing the restricted data.
15. A system comprising:
a processor for executing computer program instructions; and
a non-transitory computer-readable storage medium storing computer program instructions executable by the processor to perform operations for returning differentially private results in response to a query to a database storing restricted data as records comprising rows and columns, the operations comprising:
receiving a database query from a client device, the database query requesting a linear model describing correlations among values of columns in a set of records in the database, the database query identifying a level of differential privacy corresponding to the request, the identified level of differential privacy comprising privacy parameters ε and δ, wherein ε describes a degree of information released about the restricted data stored in the database due to the query, and δ describes an improbability of the query satisfying (δ)-differential privacy;
performing the database query on the set of records in the database to produce a differentially private version of the linear model that maintains the identified level of differential privacy for the restricted data, performing the query comprising:
modeling the values of the columns in the set of records in the database to produce a linear model comprising a set of parameters θ that describe correlations among the values;
minimizing a loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ; and
perturbing the optimal set of parameters θ to produce the differentially private version of the linear model, the set of parameters θ produced by optimizing a loss function perturbed by an additive term defined by:
θ
T
v
(
G
(
4
·
K
2
·
R
2
2
·
(
log
1
δ
+
ϵ
)
ϵ
2
)
)
where K is a constant, R 2 is a value based on the columns in the set of records, G( ) denotes a Gaussian random variable, and v denotes a unit vector; and
returning the differentially private version of the linear model to the client device in response to the query.
16. The system of claim 15 , wherein the client device is used by a user, the operations further comprising:
identifying a privacy budget associated with the user, the privacy budget representing remaining queries available to the user in terms of the privacy parameters ε and δ;
decrementing the privacy budget associated with the user responsive to performing the database query and based on the privacy parameters corresponding to the request to produce a decremented privacy budget.
17. The system of claim 16 , the operations further comprising:
receiving a subsequent query of the database from the user, the subsequent query identifying a corresponding level of differential privacy;
checking whether the corresponding level of differential privacy can be accommodated by the decremented privacy budget; and
denying the subsequent query responsive to the check indicating that the corresponding level of differential privacy cannot be accommodated by the decremented privacy budget.
18. The system of claim 15 , wherein the linear model is at least one of a linear regression classifier, a logistic regression classifier, and a support vector machine classifier.
19. The system of claim 15 , wherein K is the Lipschitz constant and R 2 is a radius value representing a radius of a hypersphere that includes values of the columns in the set of records.
20. The system of claim 15 , wherein minimizing the loss function on the linear model over possible values of the set of parameters θ to produce an optimal set of parameters θ comprises:
minimizing
according
to
θ
=
arg
min
θ
(
X
train
,
y
train
;
θ
)
.
where X train and Y train are training data comprising columns in the set of records and ( ) is the loss function.