Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Flexible and scalable privacy assessment for very large datasets, with an application to official governmental microdata

Mário S. Alvim, Natasha Fernandes, Annabelle McIver, Carroll Morgan, Gabriel H. Nunes

TL;DR

A systematic refactoring of the conventional treatment of privacy analyses is presented, basing it on mathematical concepts from the framework of Quantitative Information Flow (QIF), allowing for precise quantification and comparison of privacy risks for attacks both known and novel.

Abstract

We present a systematic refactoring of the conventional treatment of privacy analyses, basing it on mathematical concepts from the framework of Quantitative Information Flow (QIF). The approach we suggest brings three principal advantages: it is flexible, allowing for precise quantification and comparison of privacy risks for attacks both known and novel; it can be computationally tractable for very large, longitudinal datasets; and its results are explainable both to politicians and to the general public. We apply our approach to a very large case study: the Educational Censuses of Brazil, curated by the governmental agency INEP, which comprise over 90 attributes of approximately 50 million individuals released longitudinally every year since 2007. These datasets have only very recently (2018-2021) attracted legislation to regulate their privacy -- while at the same time continuing to maintain the openness that had been sought in Brazilian society. INEP's reaction to that legislation was the genesis of our project with them. In our conclusions here we share the scientific, technical, and communication lessons we learned in the process.

Flexible and scalable privacy assessment for very large datasets, with an application to official governmental microdata

TL;DR

A systematic refactoring of the conventional treatment of privacy analyses is presented, basing it on mathematical concepts from the framework of Quantitative Information Flow (QIF), allowing for precise quantification and comparison of privacy risks for attacks both known and novel.

Abstract

We present a systematic refactoring of the conventional treatment of privacy analyses, basing it on mathematical concepts from the framework of Quantitative Information Flow (QIF). The approach we suggest brings three principal advantages: it is flexible, allowing for precise quantification and comparison of privacy risks for attacks both known and novel; it can be computationally tractable for very large, longitudinal datasets; and its results are explainable both to politicians and to the general public. We apply our approach to a very large case study: the Educational Censuses of Brazil, curated by the governmental agency INEP, which comprise over 90 attributes of approximately 50 million individuals released longitudinally every year since 2007. These datasets have only very recently (2018-2021) attracted legislation to regulate their privacy -- while at the same time continuing to maintain the openness that had been sought in Brazilian society. INEP's reaction to that legislation was the genesis of our project with them. In our conclusions here we share the scientific, technical, and communication lessons we learned in the process.
Paper Structure (26 sections, 2 figures, 10 tables)

This paper contains 26 sections, 2 figures, 10 tables.

Table of Contents

  1. Introduction
  2. The challenge of flexibility
  3. The challenge of scalability
  4. The challenge of explainability
  5. Overview of the INEP case-study
  6. Our principal contributions
  7. Rationalizing the landscape of privacy attack models
  8. An empirical classification of models
  9. An orthogonal classification of models
  10. Quantitative information flow: what it is, and how it induces rationalization
  11. Application of QIF to a large-scale privacy problem: INEP's datasets
  12. Instantiating QIF to INEP's scenario
  13. Concrete example: col-lec-tive-target attribute-inference attack on a longitudinal collection (CAL)
  14. Outline of the developed software
  15. Privacy analyses of the INEP datasets
  16. ...and 11 more sections

Figures (2)

  • Figure 1: General schema of an attribute-inference attack on a longitudinal collection, which generalizes all attacks in Tbl. \ref{['tab:attack-class']}.
  • Figure 2: Adversary's success in re-identification (CRS) and attribute-inference (CAS) attacks on the School Census of 2018. In each graph, the horizontal axis indicates the number of QIDs used by the adversary, and the vertical axis indicates the adversary's success. Each dot is the posterior success of a distinct adversary having as auxiliary knowledge one of the 2,047 possible combinations of QIDs. The horizontal "a priori" line represents the adversary's success before the attack.

Theorems & Definitions (1)

  • Example 1: Running example based on Tbl. \ref{['tab:leading-example-long']}