Private Equilibrium Computation for Analyst Privacy ?????? ?????? ?????? ?????? Justin Hsu, Aaron Roth,1 Jonathan Ullman2 1UniversityofPennsylvania 2HarvardUniversity June 2, 2013 Data privacy: protect the consumer’s privacy • Analyst privacy [DNV’12]: protect the analyst’s privacy • Requirements A market survey scenario Data privacy: protect the consumer’s privacy • Analyst privacy [DNV’12]: protect the analyst’s privacy • Requirements A market survey scenario ?? ?? ?? ?? ?? ?? ?????? ?????? Data privacy: protect the consumer’s privacy • Analyst privacy [DNV’12]: protect the analyst’s privacy • Requirements A market survey scenario ?? ?? ?? ?? ?? ?? ?????? ?????? Analyst privacy [DNV’12]: protect the analyst’s privacy • A market survey scenario ?? ?? ?? ?? ?? ?? ?????? ?????? Requirements Data privacy: protect the consumer’s privacy • Analyst privacy [DNV’12]: protect the analyst’s privacy • A market survey scenario ?? ?? ?? ?? ?? ?? ?????? ?????? Requirements Data privacy: protect the consumer’s privacy • A market survey scenario ?? ?? ?? ?? ?? ?? ?????? ?????? Requirements Data privacy: protect the consumer’s privacy • Analyst privacy [DNV’12]: protect the analyst’s privacy • (SDtainfdfearrde)nDtiiffaelr ePnrtiiavlapcriyva cy [DMNS’06] [Dwork-McSherry-Nissim-Smith 06] D Alice Bob CXahvriiser Donna Ernie Algorithm ratio bounded Pr [r] More formally Definition (DMNS’06) Let M be a randomized mechanism from databases to range , R and let D,D(cid:48) be databases differing in one record. M is (cid:15)-differentially private if for every r , ∈ R Pr[M(D) = r] e(cid:15) Pr[M(D(cid:48)) = r]. ≤ · Useful properties Very strong, worst-case privacy guarantee • Well-behaved under composition, post-processing • Many-to-one-analyst privacy [DNV’12] Intuition A single analyst can’t tell if other analysts change their queries •