Experiments \& Analysis of Privacy-Preserving SQL Query Sanitization Systems
Loïs Ecoffet, Veronika Rehn-Sonigo, Jean-François Couchot, Catuscia Palamidessi
TL;DR
The paper addresses the privacy risks of analytical SQL queries and proposes a systematic framework to classify and evaluate privacy-preserving SQL sanitization systems. It combines a qualitative taxonomy (privacy model, privacy unit, architecture, and query support) with a targeted quantitative study of leading DP-based systems to assess data utility, latency, and privacy guarantees. The findings reveal that no single system provides comprehensive SPJA coverage, with broader query support often accompanied by higher latency and degraded utility, and that many complex SQL constructs remain unsupported in practice. The authors propose practical improvements, including subexpression elimination and privacy-by-design engine architectures, to bridge the gap between theoretical privacy guarantees and real-world usability, complemented by artifacts to enable reproducibility.
Abstract
Analytical SQL queries are essential for extracting insights from relational databases but concurrently introduce significant privacy risks by potentially exposing sensitive information. To mitigate these risks, numerous query sanitization systems have been developed, employing diverse approaches that create a complex landscape for both researchers and practitioners. These systems vary fundamentally in their design, including the underlying privacy model, such as k-anonymity or Differential Privacy; the protected privacy unit, whether at the tuple- or user-level; and the software architecture, which can be proxy-based or integrated. This paper provides a systematic classification of state-of-the-art SQL sanitization systems based on these qualitative criteria and the scope of queries they support. Furthermore, we present a quantitative analysis of leading systems, empirically measuring the trade-offs between data utility, query execution overhead, and privacy guarantees across a range of analytical queries. This work offers a structured overview and performance assessment intended to clarify the capabilities and limitations of current privacy-preserving database technologies.