With the ever-increasing amount of data collected, there is also an increased demand for data analysis and machine learning methods, which are consequently frequently deployed. However, many of the data collected are very sensitive and of a personal nature – thus, data confidentiality and privacy become important considerations. In the wake of this, the use of synthetic data as a privacy-preserving measure for micro-data is gaining more and more popularity, especially due to its ability to maintain a high level of data utility. Synthetic data is artificially generated by a model that has been trained on real data. This means that the observations in the synthetic data do not directly correspond to any individual in the original dataset. While there are many tools for creating synthetic data available, only a little research has focused on specifically treating sensitive attributes and generating synthetic data in a way that concentrates on protecting these selected attributes from inference attacks while keeping the data utility as high as possible. This can be achieved done by setting certain constraints when learning the model from the original data. Earlier work proposed a modification to extend the DataSynthesizer, an approach for synthetic data generation that uses Bayesian Networks to capture the underlying structures in the original data, to protect one sensitive attribute. In this paper, we investigate two different techniques for extending this approach to protect multiple attributes from inference and analyse the subsequent effects on the data utility.

Federated Learning (FL) is a method that allows multiple entities to jointly train a machine learning model using data located in various places. Unlike the conventional approach of gathering private data from distributed locations to a central place, federated learning involves solely exchanging and aggregating the machine learning models. Each party shares only a machine learning model trained locally on their private data, ensuring that the sensitive data remains within the respective silos throughout the process. However, these shared models in FL may still leak sensitive information about the training data in the form of e.g. membership disclosure. To mitigate these residual privacy risks in federated learning, one has to use additional defence techniques such as Differential Privacy (DP), which introduces noise into the training data or the model. Differential Privacy provides a mathematical definition of privacy and can be applied in machine learning via different perturbation mechanisms. This work focuses on the analysis of Differential Privacy in federated learning through (i) output perturbation of the trained machine learning models and (ii) a differentially-private form of stochastic gradient descent (DP-SGD). We consider these two approaches in various settings and analyse their performance in terms of model utility and achieved privacy. To evaluate a model’s privacy risk, we empirically measure the success rate of a membership inference attack. We observe that DP-SGD allows for a better trade-off between privacy and utility in most of the considered settings. In some settings, however, output perturbation can provide a better or similar privacy-utility trade-off and at the same time better communication and computational efficiency.

Federated learning is an important technique for training language models, which are frequently used for next-word prediction since federated learning allows utilising large quantities of real-life data without compromising the privacy of the data owners. Training a model that generalises well in this setting is a challenging task due to the inherent statistical heterogeneity of the training data, and due to the hardware limitations of private mobile devices. There are different approaches that address these issues, e.g. through model selection, different aggregation and learning strategies, and update compression. In this paper, two popular model architectures, namely Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU), are evaluated in centralised and federated settings. For federated learning, the vanilla Federated Averaging algorithm and two alternatives that try to address statistical heterogeneity, namely FedProx, which uses a proximal term to restrict the divergence from the global model during local model training, and Federated Attention, which has similar aims of reducing the distance between models as well to ensure faster convergence and improve generalisation, but is performing this during the aggregation station, are evaluated for their achieved perplexity and accuracy in various settings on two datasets. Based on these results, we provide guidelines on which methods to use, depending on the scenario.

Since many types of data nowadays contain personally identifiable information about individuals, it is important to apply privacy protection techniques to mitigate disclosure risks. One approach is k-anonymity, where hiding the identity within a group of k similar entities reduces the risk of re-identification. Another risk when distributing data is the loss of control over their further re-distribution and sharing. This risk is frequently addressed by fingerprinting, a method that allows to identify the recipient of a specific copy of the data, by embedding a generally invisible mark.In this paper, we specifically implement and adapt an intrinsic fingerprint scheme that makes use of k-anonymity and the fact that multiple, differently perturbed versions of a dataset can be found that all fulfil a certain k-anonymity, and share a rather similar level of data precision. Thus, these different datasets can be seen each as a fingerprinted version of the original.One research question we address in this paper is the evaluation of the most common generalisation algorithms according to their generalisation strategy and their influence on data utility and the number of resulting release candidates, i.e. fingerprints and execution time. In addition, we investigate the properties and robustness of these fingerprints against intentional (adversarial) manipulation through attack simulations. We further provide recommendations and guidelines on how fingerprinting can be best achieved based on the results of our evaluation.

The use of synthetic data is a widely acknowledged privacy-preserving measure that reduces identity and attribute disclosure risks in micro-data. The idea is to learn the statistical properties of an original dataset, store this information in a model, and then use this model to generate artificial samples and build a synthetic dataset that resembles the original. One of the many different approaches of synthetization tools relies on describing the original dataset by using a Bayesian network. This method is implemented in the open-source tool DataSynthesizer and has proven particularly suitable for datasets with a small to moderate number of attributes. In this paper, we will substitute the greedy algorithm used for learning the Bayesian network by a substantially faster genetic algorithm. In addition, our goal is to protect particularly sensitive attributes by decreasing specific correlations in the synthetic data that may reveal personal information. We will thus show how to customize the network structures for specific machine learning tasks. Our experiments demonstrate that this technique allows to further decrease the disclosure risks and, hence, add to the applicability of synthetic data as technique for privacy preservation.

Personal, sensitive information contained in data sets is often discouraging the exchange and sharing of data, or even rendering it impossible. To still enable data sharing, anonymisation is a strategy often employed to avoid possible record identification o r i nference. A nonymisation s trategies are often data-type or modality dependent, as besides the actual attributes contained within a dataset, also certain other aspects might reveal information on the data subjects. For example in graph data, such as knowledge graphs, the structure within the graph, i.e. the connection between nodes, might allow to re-identify a specific p erson, e .g. b y k nowledge o f t he n umber of connections for some individuals within the dataset.Therefore, also the structure needs to undergo anonymisation to achieve privacy. In this paper, we optimise an algorithm that extended previous state of the art by considering multiple, different types of connections (relations) between nodes to achieve anonymity among each of these types. Our novel, open-source implementation scales to much larger graphs than previous work, which is important for efficiently a nonymising ever-increasing volumes of big, linked data.

Fingerprinting is a method of embedding a traceable mark into digital data to (i) verify the owner and (ii) identify the recipient of a released copy of a data set. This is crucial when releasing data to third parties, especially if it involves a fee, or if the data is of sensitive nature and further sharing and leaks should be discouraged and deterred from. A fingerprint is required to (i) be robust against modifications t o t he d ata to achieve successful ownership protection, while (ii) affecting the quality and utility of the data as little as possible.So far, literature mostly assumes attackers with rather limited capabilities who perform random modification t o t he dataset. With a certain task in mind to perform on the data, the attacker can however perform an adaptive and targeted attack that maximises its chances of removing or invalidating the fingerprint, while reducing the data utility the least. In the same line, the data owner can optimise the robustness of the scheme by anticipating a specific f ocus o f t he a ttacker a nd f ocusing t he fingerprint embedding on the most valuable parts of the data. In this paper, we, therefore, provide an in-depth discussion on threat models, targeted attacks and adaptive defences. We further demonstrate the impact of targeted attacks on classical and, in comparison, adaptive fingerprinting i n a n e mpirical manner.

Digitalization of knowledge work in communication-intensive domains such as intellectual property protection poses great challenges but also opportunities to improve today’s working environments. The legal domain is strongly characterized by knowledge work, whereby, despite a common legal framework, creativity of individual experts is decisive. This knowledge-intensive work deals with a great amount of data objects, not only as a working basis, but also as a result. While experts heavily follow individual working styles, they still rely on a vast amount of administrative tasks, which are carried out by the supporting staff. These tasks are expected to be performed regularly, reliably and without errors, despite necessary adjustments to the current case and the changing legal framework. Today, knowledge work and administrative tasks are typically supported by different tools that are hardly integrated. Therefore, the tracing of continuous work processes based on exchanged data objects is a great challenge. This traceability is crucial, not only for legal security reasons, but also to enable mining and learning of applicable knowledge about processes. In this paper, we propose a bottom-up approach, which applies a continuously evolving graph of integrated data objects and tasks to model and store static and dynamic aspects of administrative as well as knowledge work, and test the approach in a real-world setting in the domain of intellectual property. We further present initial results of a novel dependency-based mining approach to learn data-dependent task sequences in the graph-based model and discuss several methods for enabling privacy-preserving sharing and mining.

With ever increasing capacity for collecting, storing, and processing of data, there is also a high demand for intelligent data analysis methods. While there have been impressive advances in machine learning and similar domains in recent years, this also gives rise to concerns regarding the protection of personal and otherwise sensitive data, especially if it is to be analysed by third parties. Besides anonymisation, which becomes challenging with high dimensional data, one approach for privacy-preserving data mining lies in the usage of synthetic data, which comes with the promise of protecting the users' data and producing analysis results close to those achieved by using real data. In this paper, we analyse a number of different approaches for creating synthetic data, and study the utility of the created datasets for regression tasks, i.e. the prediction of a numeric value. We further investigate the similarity of real and synthetic data samples. Finally, we contribute to privacy assessments and measurements of the risk of attribute disclosure on synthetic data by extending an approach developed for categorical data.

Many business and scientific processes make extensive use of service-oriented architectures, using distributed services. These are often provided by third parties and are thus not under direct control of process owners. In this paper we discuss the issues of ensuring continuous and faithful execution of processes in distributed environments, focusing specifically on Web Services. Recently, we introduced a specification of Resilient Web Services, that makes current Web Services more robust, and a framework for the monitoring of Web Services, that allows detecting anomalies. In this paper, we describe alternative implementations of the framework for monitoring of Web Services. We also present possible approaches easing the deployment of Resilient Web Services: a framework consisting of tools deployable at the Web Service operator site enabling easy transformation of a regular Web Service into a Resilient Web Service, and a registry with notifications that decorates existing Web Services with resilient methods.