[Paper Review] Slicing: A New Approach to Privacy Preserving Data Publishing

Tiancheng Li, Ninghui Li+2 more|ArXiv.org|Sep 12, 2009

Privacy-Preserving Technologies in Data29 references8 citations

TL;DR

This paper introduces slicing, a novel privacy-preserving data anonymization technique that partitions data both vertically (grouping highly correlated attributes into columns) and horizontally (clustering tuples into buckets), preserving attribute correlations within columns while breaking associations across columns. Slicing outperforms generalization and bucketization in data utility and effectively prevents both attribute and membership disclosure, especially in high-dimensional datasets.

ABSTRACT

Several anonymization techniques, such as generalization and bucketization, have been designed for privacy preserving microdata publishing. Recent work has shown that generalization loses considerable amount of information, especially for high-dimensional data. Bucketization, on the other hand, does not prevent membership disclosure and does not apply for data that do not have a clear separation between quasi-identifying attributes and sensitive attributes. In this paper, we present a novel technique called slicing, which partitions the data both horizontally and vertically. We show that slicing preserves better data utility than generalization and can be used for membership disclosure protection. Another important advantage of slicing is that it can handle high-dimensional data. We show how slicing can be used for attribute disclosure protection and develop an efficient algorithm for computing the sliced data that obey the l-diversity requirement. Our workload experiments confirm that slicing preserves better utility than generalization and is more effective than bucketization in workloads involving the sensitive attribute. Our experiments also demonstrate that slicing can be used to prevent membership disclosure.

Motivation & Objective

• To address the limitations of generalization and bucketization in preserving data utility and preventing privacy breaches in high-dimensional microdata.
• To develop a technique that maintains attribute correlations within groups of correlated attributes while disrupting links between uncorrelated attributes to reduce re-identification risk.
• To provide a solution that protects against both attribute disclosure (via ℓ-diversity) and membership disclosure, which existing methods fail to address comprehensively.
• To enable effective data analysis on anonymized data by preserving meaningful correlations and minimizing information loss.
• To demonstrate that slicing offers superior utility compared to generalization and greater privacy than bucketization in real-world workloads.

Proposed method

• Vertical partitioning groups attributes into columns based on their correlation strength, ensuring that highly correlated attributes are kept together to preserve data utility.
• Horizontal partitioning clusters tuples into buckets, where each bucket contains a set of tuples with similar QI values, enabling k-anonymity-like protection.
• Within each bucket, values in each column are randomly permuted to break associations between columns, reducing the risk of attribute and membership disclosure.
• The method enforces ℓ-diversity by ensuring that each bucket contains at least ℓ distinct sensitive attribute values, preventing attribute disclosure.
• An efficient algorithm is developed to compute sliced data that satisfies the ℓ-diversity requirement while minimizing information loss.
• The approach avoids the uniform distribution assumption of generalization and preserves cross-attribute correlations at the bucket level, unlike bucketization.

Experimental results

Research questions

• RQ1 Can a data anonymization technique preserve higher data utility than generalization while preventing attribute disclosure in high-dimensional datasets?
• RQ2 Does slicing effectively prevent membership disclosure, a vulnerability that exists in bucketization?
• RQ3 How does slicing compare to generalization and bucketization in terms of utility and privacy in real-world workloads involving sensitive attributes?
• RQ4 Can slicing maintain attribute correlations between quasi-identifiers and sensitive attributes, which are lost in bucketization?
• RQ5 What is the trade-off between privacy and utility when allowing overlapping slicing, where an attribute appears in multiple columns?

Key findings

• Slicing preserves significantly better data utility than generalization, especially in high-dimensional datasets, due to the preservation of attribute correlations within columns.
• Slicing outperforms bucketization in workloads involving the sensitive attribute, as it maintains correlations between quasi-identifiers and sensitive attributes.
• Slicing effectively prevents membership disclosure, unlike bucketization, which is vulnerable to such attacks due to the publication of original QI values.
• The experimental results confirm that slicing maintains higher utility than generalization and is more effective than bucketization in protecting privacy in sensitive attribute workloads.
• Random tuple grouping in slicing is less effective for membership disclosure protection, indicating a need for smarter bucketing algorithms in future work.
• Slicing can be extended to overlapping slicing, where attributes appear in multiple columns, potentially improving utility at the cost of increased privacy analysis complexity.