The post-processed Differential Privacy (DP) framework has been routinely adopted to preserve privacy while maintaining important invariant characteristics of datasets in data-release applications such as census data. Typical invariant characteristics include non-negative counts and total population. Subspace DP has been proposed to preserve total population while guaranteeing DP for sub-populations. Non-negativity post-processing has been identified to inherently incur fairness issues. In this work, we study privacy and unfairness (i.e., accuracy disparity) concerns in the post-processed DP framework. On one hand, we propose the post-processed DP framework with both non-negativity and accurate total population as constraints would inadvertently violate privacy guarantee desired by it. Instead, we propose thepost-processed subspace DP frameworkto accurately define privacy guarantees against adversaries. On the other hand, we identify unfairness level is dependent on privacy budget, count sizes as well as their imbalance level via empirical analysis. Particularly concerning is severe unfairness in the setting of strict privacy budgets. We further trace unfairness back touniform privacy budget setting over different population subgroups. To address this, we propose avarying privacy budget settingmethod and develop optimization approaches using ternary search and golden ratio search to identify optimal privacy budget ranges that minimize unfairness while maintaining privacy guarantees. Our extensive theoretical and empirical analysis demonstrates the effectiveness of our approaches in addressing severe unfairness issues across different privacy settings and several canonical privacy mechanisms. Using datasets of Australian Census data, Adult dataset, and delinquent children by county and household head education level, we validate both our privacy analysis framework and fairness optimization methods, showing significant reduction in accuracy disparities while maintaining strong privacy guarantees.

With the wide use of GPS enabled devices and Location-Based Services, location privacy has become an increasingly worrying challenge to our community. Existing approaches provide solid bases for addressing this challenge. However, they mainly focus on independent location perturbation or whole trajectory perturbation with little attention to location dependency based perturbation between two successive locations. This may result in that perturbed successive locations lose mutual distance and direction dependency, which in turn can lead to significant data utility loss. To address this problem, we propose a new location dependency based privacy notion named as vector-indistinguishability (vector-ind). Vector-ind defines a vector to represent the dependency relationship between two successive locations. Correspondingly, it consists of distance-indistinguishability for distance dependency and direction-indistinguishability for direction dependency. Noise generation for applying Differential Privacy is based on the distance and direction, hence can reflect the location dependency to ensure data utility after perturbation. We also present four mechanisms to achieve vector-ind notion. Finally, we evaluate the empirical privacy and utility of vector-ind in real-world GPS data to demonstrate how our proposed mechanisms for vector-ind can protect location privacy with high data utility in successive location data.

Blockchain has gradually attracted widespread attention from the research community of the IoT, due to its decentralization, consistency, and other attributes. It builds a secure and robust system by generating a backup locally for each participant node to collectively maintain the network. However, this feature brings some privacy concerns since all nodes can access the chain data, users’ sensitive information under risk of leakage. The local differential privacy (LDP) mechanism can be a promising way to address this issue as it implements data perturbation before uploading to the chain. While traditional LDP mechanisms cannot fit well with the blockchain since the requirements of a fixed input range, large data volume, and using the same privacy budget, which are practically difficult in a decentralized environment. To overcome these problems, we propose a novel LDP mechanism to split input numerical data and implement perturbation by digital bits, which does not require a fixed input range and large data volume. In addition, we use an iteration approach to adaptively allocate the privacy budget for different perturbation procedures that minimize the total deviation of perturbed data and increase the data utility. We employ mean estimation as the statistical utility metric under the same and randomized privacy budgets to evaluate the performance of our novel LDP mechanism. The experiment results indicate that the proposed LDP mechanism performs better in different scenarios, and our adaptive privacy budget allocation model can significantly reduce the deviation of the perturbation function to provide high data utility while maintaining privacy.

Directional distribution analysis has long served as a fundamental functionality in abstracting dispersion and orientation of spatial datasets. Spatial datasets that describe sensitive information of individuals such as health status and home addresses must be used and shared cautiously to protect individuals' privacy. There is an inherent tension between the need of accurate directional distribution result and the requirement of individuals' location privacy. Plenty of excellent location privacy protection approaches such as geo-indistinguishability can provide strong protection for locations but considerably at the expense of statistical quality of subsequent directional distribution analysis. In this paper, to protect individual location data for directional distribution, we define the geographic feature of community with covariance matrix and then propose ageo-ellipse-indistinguishabilityprivacy notion incorporating this covariance matrix. As an instantiation of metric differential privacy,geo-ellipse-indistinguishabilityguarantees pairwise inputs cannot be distinguishable with the level proportional to privacy budget and Mahalanobis distance between them, given a randomized output. We also present elliptical privacy mechanisms to achieve this privacy definition on the basis of gamma distribution and multivariate normal distribution. We finally evaluate the empirical utility of the proposed mechanism in New York home addresses database. Our experiments demonstrate that under the same privacy level, our proposed elliptical approach can achieve significantly higher directional distribution utility than circular noise function based method.