[Paper Review] Privacy Preserving Stream Analytics: The Marriage of Randomized Response and Approximate Computing

Do Le Quoc, Martín Beck+4 more|arXiv (Cornell University)|Jan 19, 2017

Privacy-Preserving Technologies in Data74 references15 citations

TL;DR

PrivApprox introduces a privacy-preserving stream analytics system that unifies randomized response and approximate computing via client-side sampling and local noise injection. It achieves stronger zero-knowledge privacy than differential privacy, near real-time low-latency processing, and systematic utility-balance control through a synchronization-free distributed architecture.

ABSTRACT

How to preserve users' privacy while supporting high-utility analytics for low-latency stream processing? To answer this question: we describe the design, implementation, and evaluation of PRIVAPPROX, a data analytics system for privacy-preserving stream processing. PRIVAPPROX provides three properties: (i) Privacy: zero-knowledge privacy guarantees for users, a privacy bound tighter than the state-of-the-art differential privacy; (ii) Utility: an interface for data analysts to systematically explore the trade-offs between the output accuracy (with error-estimation) and query execution budget; (iii) Latency: near real-time stream processing based on a scalable "synchronization-free" distributed architecture. The key idea behind our approach is to marry two existing techniques together: namely, sampling (used in the context of approximate computing) and randomized response (used in the context of privacy-preserving analytics). The resulting marriage is complementary - it achieves stronger privacy guarantees and also improves performance, a necessary ingredient for achieving low-latency stream analytics.

Motivation & Objective

• Address the tension between strong user privacy and high-utility real-time analytics in data stream processing.
• Overcome limitations of existing systems that either lack real-time support or assume centralized, trusted data.
• Design a system that enables privacy-preserving analytics without requiring coordination or trust in aggregators or proxies.
• Achieve a tighter privacy guarantee than differential privacy by introducing zero-knowledge privacy through combined sampling and noise injection.
• Provide analysts with a tunable interface to explore trade-offs between output accuracy, error estimation, and computational budget.

Proposed method

• Apply client-side sampling at the data source, where each user independently decides whether to participate in a query epoch based on a configurable sampling probability $ s $.
• Use local randomized response at the client to perturb truthful answers before transmission, ensuring local differential privacy and eliminating the need for trusted noise addition at the aggregator.
• Employ a synchronization-free distributed architecture where proxies forward anonymized, encrypted data streams without coordination, reducing latency and trust assumptions.
• Implement source-rewriting at proxies to achieve unlinkability and anonymity, preventing any component from linking responses to individual clients.
• Integrate a privacy-utility trade-off interface allowing analysts to configure sampling rates and noise parameters to balance accuracy and resource usage.
• Prove that the combined approach achieves zero-knowledge privacy, a stronger privacy model than differential privacy, with $ rac{ ho_{zk}}{ ho_{dp}} > 1 $ for all $ s eq 0 $, indicating higher adversary advantage in the zero-knowledge model.

Experimental results

Research questions

• RQ1 Can sampling and randomized response be jointly leveraged to achieve stronger privacy guarantees in real-time stream analytics?
• RQ2 How can a synchronization-free, decentralized architecture support low-latency stream processing while preserving privacy?
• RQ3 To what extent does combining sampling and local noise injection improve privacy beyond differential privacy?
• RQ4 Can analysts effectively trade off output accuracy and execution cost in a privacy-preserving stream analytics system?
• RQ5 What are the formal privacy bounds of the proposed system, and how do they compare to existing models like differential privacy?

Key findings

• The system achieves zero-knowledge privacy, a stronger privacy guarantee than differential privacy, as proven by the inequality $ rac{ ho_{zk}}{ ho_{dp}} > 1 $, which holds for all $ s eq 0 $.
• The ratio $ rac{ ho_{zk}}{ ho_{dp}} $ increases with decreasing sampling rate $ s $, indicating that lower sampling rates amplify the privacy advantage of the zero-knowledge model.
• The system enables near real-time stream processing through a synchronization-free architecture that avoids coordination overhead among proxies and aggregators.
• Anonymity and unlinkability are enforced via source-rewriting and encryption, ensuring no component can link responses to individual clients under the threat model assumptions.
• The system provides a practical interface for analysts to explore the trade-off between output accuracy (with error estimation) and computational budget via configurable sampling and noise parameters.
• The combination of sampling and randomized response results in a system that simultaneously improves privacy, performance, and utility in distributed stream analytics.