Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Differentially Private Health Tokens for Estimating COVID-19 Risk

David Butler, Chris Hicks, James Bell, Carsten Maple, Jon Crowcroft

TL;DR

This work tackles the problem of immunity-based discrimination in COVID-19 health certificates by proposing non-binding health tokens that encode transmission risk through a differential privacy framework. The method uses a three-phase process (issue, check, aggregate) with cryptographic signing and a randomized-response differential privacy protocol to produce tokens that preserve individual privacy while enabling unbiased aggregate risk estimation. The authors analyze potential attacks (Sybil variants, queue observers, malicious service providers) and propose privacy-preserving mitigations, including centralized heavy-hitter monitoring and batch admissions, alongside an open-source Python prototype. The results indicate that for groups of size 500 or more, the average error in aggregate estimates can be as low as 0.03, suggesting practical utility in identity-free contexts such as shops or venues. Overall, the approach offers a viable, privacy-preserving alternative to traditional immunity certificates, balancing public health insights with non-discrimination, albeit with limitations around aggregation error, non-binding usage, and national aggregation reporting.

Abstract

In the fight against Covid-19, many governments and businesses are in the process of evaluating, trialling and even implementing so-called immunity passports. Also known as antibody or health certificates, there is a clear demand for any technology that could allow people to return to work and other crowded places without placing others at risk. One of the major criticisms of such systems is that they could be misused to unfairly discriminate against those without immunity, allowing the formation of an `immuno-privileged' class of people. In this work we are motivated to explore an alternative technical solution that is non-discriminatory by design. In particular we propose health tokens -- randomised health certificates which, using methods from differential privacy, allow individual test results to be randomised whilst still allowing useful aggregate risk estimates to be calculated. We show that health tokens could mitigate immunity-based discrimination whilst still presenting a viable mechanism for estimating the collective transmission risk posed by small groups of users. We evaluate the viability of our approach in the context of identity-free and identity-binding use cases and then consider a number of possible attacks. Our experimental results show that for groups of size 500 or more, the error associated with our method can be as low as 0.03 on average and thus the aggregated results can be useful in a number of identity-free contexts. Finally, we present the results of our open-source prototype which demonstrates the practicality of our solution.

Differentially Private Health Tokens for Estimating COVID-19 Risk

TL;DR

This work tackles the problem of immunity-based discrimination in COVID-19 health certificates by proposing non-binding health tokens that encode transmission risk through a differential privacy framework. The method uses a three-phase process (issue, check, aggregate) with cryptographic signing and a randomized-response differential privacy protocol to produce tokens that preserve individual privacy while enabling unbiased aggregate risk estimation. The authors analyze potential attacks (Sybil variants, queue observers, malicious service providers) and propose privacy-preserving mitigations, including centralized heavy-hitter monitoring and batch admissions, alongside an open-source Python prototype. The results indicate that for groups of size 500 or more, the average error in aggregate estimates can be as low as 0.03, suggesting practical utility in identity-free contexts such as shops or venues. Overall, the approach offers a viable, privacy-preserving alternative to traditional immunity certificates, balancing public health insights with non-discrimination, albeit with limitations around aggregation error, non-binding usage, and national aggregation reporting.

Abstract

In the fight against Covid-19, many governments and businesses are in the process of evaluating, trialling and even implementing so-called immunity passports. Also known as antibody or health certificates, there is a clear demand for any technology that could allow people to return to work and other crowded places without placing others at risk. One of the major criticisms of such systems is that they could be misused to unfairly discriminate against those without immunity, allowing the formation of an `immuno-privileged' class of people. In this work we are motivated to explore an alternative technical solution that is non-discriminatory by design. In particular we propose health tokens -- randomised health certificates which, using methods from differential privacy, allow individual test results to be randomised whilst still allowing useful aggregate risk estimates to be calculated. We show that health tokens could mitigate immunity-based discrimination whilst still presenting a viable mechanism for estimating the collective transmission risk posed by small groups of users. We evaluate the viability of our approach in the context of identity-free and identity-binding use cases and then consider a number of possible attacks. Our experimental results show that for groups of size 500 or more, the error associated with our method can be as low as 0.03 on average and thus the aggregated results can be useful in a number of identity-free contexts. Finally, we present the results of our open-source prototype which demonstrates the practicality of our solution.

Paper Structure

This paper contains 27 sections, 2 equations, 4 figures.

Table of Contents

  1. Introduction
  2. Non Discriminatory Token System
  3. The Health Token System
  4. The Differential Privacy Protocol
  5. Use Cases
  6. Attacks and Analysis
  7. Attack Vectors
  8. Sybil-type A
  9. Sybil-type B
  10. Queue Observer
  11. Malicious Service Provider
  12. Analysis of Attacks
  13. Sybil-type A
  14. Sybil-type B
  15. Queue Observer
  16. ...and 12 more sections

Figures (4)

  • Figure 1: The high-level details of our health token system.
  • Figure 2: The average error introduced by our system for a given number of users. We let $\epsilon = \; \mathrel{log}(3)$ and plot the error for $k = 2, k = 3$ and $k = 4$.
  • Figure 3: The average error introduced by our system for a given number of users. We let $k = 2$ and plot the error for $\epsilon = \; \mathrel{log}(\frac{5}{3}), \epsilon = \; \mathrel{log}(3), \epsilon = \; \mathrel{log}(7)$ and $k = 2$.
  • Figure 4: Example token generated by our prototype.