Chapter 9 A Survey of Utility-based Privacy-Preserving Data Transformation Methods

Chapter9A Survey of Utility-basedPrivacy-Preserving DataTransformation MethodsMing HuaSimon Fraser UniversitySchool of Computing Science8888University Drive,Burnaby,BC,Canada V5A1S6mhua@cs.sfu.caJian PeiSimon Fraser UniversitySchool of Computing Science8888University Drive,Burnaby,BC,Canada V5A1S6jpei@cs.sfu.caAbstract As a serious concern in data publishing and analysis,privacy preserving data processing has received a lot of attention.Privacy preservation often leads toinformation loss.Consequently,we want to minimize utility loss as long as theprivacy is preserved.In this chapter,we survey the utility-based privacy preser-vation methods systematically.Wefirst briefly discuss the privacy models andutility measures,and then review four recently proposed methods for utility-based privacy preservation.Wefirst introduce the utility-based anonymization method for maximiz-ing the quality of the anonymized data in query answering and discernability.Then we introduce the top-down specialization(TDS)method and the progres-sive disclosure algorithm(PDA)for privacy preservation in classification prob-st,we introduce the anonymized marginal method,which publishes theanonymized projection of a table to increase the utility and satisfy the privacyrequirement.Keywords:Privacy preservation,data utility,utility-based privacy preservation, k-anonymity,sensitive inference,l-diversity.208Privacy-Preserving Data Mining:Models and Algorithms 9.1IntroductionAdvanced analysis on data sets containing information about individuals poses a serious threat to individual privacy.Various methods have been pro-posed to tackle the privacy preservation problem in data analysis,such as anonymization and perturbation.The major goal is to protect some sensitive individual information(privacy)from being identified by the published data. For example,in k-anonymization,certain individual information is generalized or suppressed so that any individual in a released data set is indistinguishable from other k−1individuals.A natural consequence of privacy preservation is the information loss.For example,after the k-anonymization,the information describing an individual should be the same as at least other k−1individuals.The loss of the spe-cific information about certain individuals may affect the data quality.In the extreme case,the data may become totally useless.Example9.1(Utility loss in privacy preservation)Table9.1a is a data set used for customer analysis.Among the listed attributes,{Age,Ed-ucation,Zip Code}can be used to uniquely identify an individual.Such a set of attributes is called a quasi-identifier.Annual Income is a sensitive attribute. Target Customer is the class label of customers.In order to protect the annual income information for individuals,sup-pose2-anonymity is required so that any individual is indistinguishable from another one on the quasi-identifier.Table9.2b and9.3c are both valid2-anonymizations of9.1a.The tuples sharing the same quasi-identifier have the same gId.However,Table9.2b provides more accurate results than Table9.3c in answering the following two queries.Q1:“How many customers under age29are there in the data set?”Q2:“Is an individual with age=25,Education=Bachelor,Zip Code= 53712a target customer?”According to Table9.2b,the answers of Q1and Q2are“2”and“Y”,re-spectively.But according to Table9.3c,the answer to Q1is an interval[0,4], because29falls in the age range of tuple t1,t2,t4,and t6.The answer to Q2 is Y and N with50%probability each.From this example,we make two observations.First,different anonymiza-tion may lead to different information loss.Table9.2b and9.3c are in the same anonymization level,but Table9.2b provides more accurate answers to the queries.Therefore,it is crucial to minimize the information loss in privacy preservation.Second,the data utility depends on the applications using the data.In the above example,Q1is an aggregate query,thus the data is more useful if the attribute values are more accurate.Q2is a classification query,so the utilityUtility-based Privacy-Preserving Data Transformation Methods209Table9.1a.The original tabletId Age Education Zip Code Annual Income Target Customert124Bachelor5371140k Yt225Bachelor5371250k Yt330Master5371350k Nt430Master5371480k Nt532Master5371550k Nt632Doctorate53716100k NTable9.2b.A2-anonymized table with better utilitygId tId Age Education Zip Code Annual Income Target Customer g1t1[24-25]Bachelor[53711-53712]40k Yg1t2[24-25]Bachelor[53711-53712]50k Yg2t330Master[53713-53714]50k Ng2t430Master[53713-53714]80k Ng3t532GradSchool[53715-53716]50k Ng3t632GradSchool[53715-53716]100k NTable9.3c.A2-anonymized table with poorer utilitygId tId Age Education Zip Code Annual Income Target Customer g1t1[24-30]ANY[53711-53714]40k Yg2t2[25-32]ANY[53712-53716]50k Yg3t3[30-32]Master[53713-53715]50k Ng1t4[24-30]ANY[53711-53714]80k Ng3t5[30-32]Master[53713-53715]50k Ng2t6[25-32]ANY[53712-53716]100k Nof data depends on how much the classification model is preserved in the anonymized data.In a word,utility is the quality of data for the intended use.9.1.1What is Utility-based Privacy Preservation?The utility-based privacy preservation has two goals:protecting the private information and preserving the data utility as much as possible.Privacy preser-vation is a hard requirement,that is,it must be satisfied,and utility is the mea-sure to be optimized.While privacy preservation has been extensively studied, the research of utility-based privacy preservation has just started.The chal-lenges include:210Privacy-Preserving Data Mining:Models and Algorithms Utility measure.One key issue in the utility-based privacy preservation is how to model the data utility in different applications.A good utility measure should capture the intrinsic factors that affect the quality of data for the specific application.Balance between utility and privacy.In some situation,preserving utility and privacy are not conflicting.But more often than not,hiding the privacy information may have to sacrifice some utility.How do we trade off between the two goals?Efficiency and scalability.The traditional privacy preservation is already computational challenging.For example,even simple restriction of optimized k-anonymity is NP-hard[3].How do we develop efficient algorithms if utility is involved?Moreover,real data sets often contains millions of high dimen-sional tuples,highly scalable algorithms are needed.Ability to deal with different types of attributes.Real life data often in-volve different types of attributes,such as numerical,categorical,binary or mixtures of these data types.The utility-based privacy preserving methods should be able to deal with attributes of different types.9.2Types of Utility-based Privacy Preservation MethodsIn this section,we introduce some common privacy models and recently proposed data utility measures.9.2.1Privacy ModelsVarious privacy models have been proposed in literature.This section intro-duces some of the privacy models that are often used as well as the correspond-ing privacy preserving methods.K-Anonymity.K-anonymity is a privacy model developed for the linking attack[18].Given a table T with attributes(A1,...,A n),a quasi-identifier isa minimal set of attributes(A i1,...,A il)(1≤i1<...<i l≤n)in T thatcan be joined with external information to re-identify individual records.Note that there may be more than one quasi-identifer in a table.A table T is said k-anonymous given a parameter k and the quasi-identiferQI=(A i1,...,A il)if for each tuple t∈T,there exist at least another(k−1)tuples t1,...,t k−1such that those k tuples have the same projection on the quasi-identifier.Tuple t and all other tuples indistinguishable from t on the quasi-identifier form an equivalence class.Utility-based Privacy-Preserving Data Transformation Methods211 Given a table T with the quasi-identifier and a parameter k,the problem of k-anonymization is to compute a view T that has the same attributes as T such that T is k-anonymous and as close to T as possible according to some quality metric.Data suppression and value generalization are often used for anonymization. Suppression is masking the attribute value with a special value in the domain. Generalization is replacing a specific value with a more generalized one.For example,the actual age of an individual can be replaced by an interval,or the city of an individual can be replaced by the corresponding province.Cer-tain quality measures are often used in the anonymization,such as the average equivalence class size.Theoretical analysis shows that the problem of opti-mal anonymization under many quality models is NP-hard[1,14,3].Various k-anonymization methods are proposed[19,20,29,12,11].One of the most important advantages of k-anonymity is that no additional noise or artificial perturbation is added into the original data.All the tuples in an anonymized data remains trustful.l-Diversity.l-diversity[13]is based on the observation that if the sensi-tive values in one equivalence class lacks diversity,then no matter how large the equivalence class is,attacker may still guess the sensitive value of an indi-vidual with high probability.For example,Table9.3c is a2-anonymous table. Particularly,t3and t5are generalized into the same equivalence class.How-ever,since their annual income is the same,an attacker can easily conclude that the annual income of t3is50k although the2-anonymity is preserved.Ta-ble9.2b has better diversity in the sensitive attribute.t3and t4are in the same equivalence class and their annual income is different.Therefore,the attacker only have a50%opportunity to know the real annual income of t3.l-diversity model addresses the above problem.By intuition,a table is l-diverse if each equivalence class contains at least l“well represented”sensitive values,that is,at least l most frequent values have very similar frequencies.Consider a table T=(A1,...,A n,S)and constant c and l, where(A1,...,A n)is a quasi-identifier and S is a sensitive attribute.Sup-pose an equivalence class EC contains value s1,...,s m with frequency f(s1),...,f(s m)(appearing in the frequency non-ascending order)on sen-sitive attribute S,EC satisfies(c,l)-diversity with respect to S iff(s1)<cmi=lf(s i)l-diversity complements k-anonymity by requiring certain diversity on the sensitive attributes.It is a more practical privacy model.212Privacy-Preserving Data Mining:Models and Algorithms Sensitive Inference.Sensitive inference[23]comes from the statistical analysis and data mining ability.The privacy inference occurs when the sen-sitive value can be determined from a set of other non-sensitive values with high confidence.The inference can be achieved by data mining abilities,such as association rule mining and classification.Given a table T=(M1,...,M m,S1,...,S n).S i(1≤i≤n)is called a sensitive attribute.Certain values in the sensitive attributes are not acces-sible.M j(1≤j≤m)is called a non-sensitive attribute and contains the non-sensitive information.M j’s and S i’s are disjoint.A sensitive inferenceis a rule{m i1,...,m il}→s j with high confidence,where m i1,...,m ilare attribute values on non-sensitive attributes M i1,...,M il,respectively,ands j is an inaccessible sensitive value on S j.For example,suppose in Ta-ble9.1a AnnualIncome is a sensitive attribute and the values lower than 60k in this attribute is confidential and should not be disclosed.However,rule Master→50k can be derived from Table9.1a with confidence66.7%.There-fore,although50k is not disclosed,an attacker can guess the value from the non-sensitive value Master with high probability.Data suppression can be used in eliminating the sensitive inference.The intuition is to mask some non-sensitive information causing the inference,so that the confidence of the inference rule decreases to below certain threshold.[2]deals with the sensitive inference caused by association mining.The objective is to hide a minimal set of entries so that the sensitivefields cannot be disclosed by the sensitive inferences.Other work on eliminating sensitive inference includes[15,22].Other Related Work.Another privacy model Anatomy is proposed in[26], which publishes the quasi-identifer and the sensitive information into two sep-arate tables.Equivalence classes are formed without generalizing the values in the quasi-identifier.The advantage is that more information in the quasi-identifier is preserved.[25]proposes a privacy model m-invariance in a dy-namic context,that is,a sequential releasing of table with any sequence of insertion and deletions.The main objective is to make each tuple indistinguish-able during its lifetime in the publication.In order to prevent the attacker from linking different versions of the released tables together to obtain the sensi-tive information,certain“invariance”(in terms of having the similar sensitive values)in each equivalence class is required.9.2.2Utility MeasuresIn the context of privacy preservation,the data utility is both relative and specific.First,we do not consider the absolute utility of a data set,instead, we measure how much utility is preserved in the published data after pri-vacy preservation compared to the original data.Second,different applicationsUtility-based Privacy-Preserving Data Transformation Methods213 require different information in a data set.We cannotfind a measure to quantify the amount of information contained in the data for all different applications. Therefore,the utility measure should be designed under the context of certain applications.Query Answering Accuracy.One common use of the published data is query answering,such as the aggregate queries including SUM,COUNT and AVERAGE.The data quality in query answering depends on how far away each attribute value is from the original one after applying the privacy preserving methods.For example,if generalization is used in privacy preservation,then a specific value is replaced by a more general one in the published data.In-tuitively,in order to maximize the query answering accuracy,the generalized value in the published data should be as close to the original value as possible.A quantitative measure is proposed in[28,27].It uses the normalized interval size to measure the utility loss for numeric attributes,and the normalized num-ber of descendants in the generalization hierarchy to measure the utility loss for categorical attributes.More details will be discussed in Section9.3. Classification Accuracy.In classification analysis,the published data are often used to train a classifier.Thus,the data quality depends on how well the class structure is preserved.More specifically,we want to minimize the uncertainty of classification within a group of tuples indistinguishable from each other.[5,6]propose a utility score that measures the entropy change during the anonymization.Ideally,the entropy of an equivalence class with respect to class label distribution should be minimized in the published data. Other utility measures for classification are proposed in[7,24]. Distribution Similarity.Distribution is a fundamental characteristic of a data set.Many data analysis try to make certain conclusions about the data distribution.Therefore,how well the published data preserve the distribution of the original data is crucial for those applications.[8]develops a utility model which measures the difference between the distribution of the original data and that of the anonymized data.Other Utility Measures.Other utility measures include generalization height[17],which measures the total number of generalization steps applied on the original data set.The idea behind is that,since the generalization steps cause information loss,the number of generalization steps represents the total amount of information loss.[3]considers the discernability of the anonymized data.It tries to minimize the average equivalence class size,because the more tuples are in the same group,the less specific information is preserved for those tuples.214Privacy-Preserving Data Mining:Models and Algorithms 9.2.3Summary of the Utility-Based Privacy PreservingMethodsIn this chapter,we introduce four utility-based privacy preservation meth-ods.They are the utility-based anonymization method[28],the top-down spe-cialization(TDS)method[5],the progressive Disclosure Algorithm(PDA)[23] and the anonymized marginal method[8].The privacy models and utility mea-sures used in the four methods are summarized in Table9.4.Table9.4.Summary of utility-based privacy preserving methodsMethod Privacy model Utility measureUtility-based anonymization k-Anonymity Query answering accuracy TDS k-Anonymity Classification accuracy PDA Sensitive Inference Classification accuracy Anonymized marginal k-Anonymity&l-Diversity Distribution similarity The utility-based anonymization method will be discussed in Section9.3. The top-down specialization(TDS)method and the progressive Disclosure Al-gorithm(PDA)both deal with data used in classification problems,and will be discussed in Section9.4.Section9.5introduces the anonymized marginal method.Section9.6concludes this chapter.9.3Utility-Based Anonymization Using Local RecodingThe utility-based anonymization method proposed in[28]aims at improv-ing the query answering accuracy on anonymized tables.The utility measure proposed captures two aspects.First,the less generalized attribute value gives more accurate answers in query answering on the anonymized table.For ex-ample,Table9.2b and9.3c are both2-anonymous,but the age attribute is less generalized in Table9.2b.If we perform the aggregate query on this attribute, Table9.2b gives more accurate answers.Second,different attributes may have different utility in data analysis.For example,in Table9.1a,suppose that the information about annual income is more related to age and education than the other attributes,in order to preserve the correlation among the data in anonymization,it is better to generalize other attributes which are not so re-lated to annual income,such as“Zip Code”.Based on the above observations,the weighted normalized certainty penalty is proposed to measure the utility of attributes in the anonymization.For a numeric attribute value,the normalized certainty penalty(NCP)measures its normalized interval size after generalization;for a categorical attribute value, NCP measures its normalized number of descendants in the hierarchy tree after generalization.A weight is assigned to each attribute to reflect its utility in theUtility-based Privacy-Preserving Data Transformation Methods215 analysis on the anonymized data.Given a table and the anonymity requirement, such as k-anonymity,the utility-based anonymization aims at computing a k-anonymous table that minimizes the weighted normalized certainty penalty.In order to tackle the problem,two algorithms are proposed.The bottom-up method iteratively groups the tuples with similar attribute values together until each group has at least k tuples.The top-down method works in the opposite way.It put all tuples into one group at the beginning,and then iteratively par-titions the tuples in a group into two groups,trying to maximize the difference of attribute values between the two groups.The partitioning stops when further splitting violates the k-anonymity.To give some details,first we introduce the local recoding method in the anonymization.Then,we define the utility measure,weighted normalized cer-tainty penalty,formally.The bottom-up method and top-down method are in-troduced last.9.3.1Global Recoding and Local RecodingTwo methods have been proposed for anonymization:global recoding and local recoding.Global recoding maps a given value in a single domain to an-other one globally,while local recoding maps a given tuple to some recoded tuple.Clearly,global recoding can be regarded as a specific type of local re-coding.Table9.5a.3-anonymous table by global recodinggId tId Age Education Zip Code Annual Income Target Customer g1t1[24-32]ANY[53711-53713]40k Yg1t2[24-32]ANY[53711-53713]50k Yg1t3[24-32]ANY[53711-53713]50k Ng2t4[24-32]ANY[53714-53716]80k Ng2t5[24-32]ANY[53714-53716]50k Ng2t6[24-32]ANY[53714-53716]100k NTable9.6b.3-anonymous table by local recodinggId tId Age Education Zip Code Annual Income Target Customer g1t1[24-30]ANY[53711-53713]40k Yg1t2[24-30]ANY[53711-53713]50k Yg1t3[24-30]ANY[53711-53713]50k Ng2t4[30-32]GradSchool[53714-53716]80k Ng2t5[30-32]GradSchool[53714-53716]50k Ng2t6[30-32]GradSchool[53714-53716]100k N216Privacy-Preserving Data Mining:Models and AlgorithmsExample9.2(Global recoding v.s.local recoding)Consider Table9.1a.Attribute{Age,Education,Zip Code}is a quasi-identifer. Table9.5a and9.6b are3-anonymous tables by global recoding and local re-coding,respectively.t3and t4have the same attribute values on Age(30)and Education(Master).In global recoding,30is mapped to interval[24−32] globally,while Master is mapped to the most generalized value ANY.In local recoding,the value30and Master in t3is mapped to[24−30]and ANY,respectively;but the same values30and Master in t4are mapped to [30−32]and GradSchool,respectively.After the global recoding,the only knowledge about Age and Education in Table9.5a is the full range[24−32] in the domain and the most generalized value ANY,respectively;while Table9.6b shows more specific information about Age and Education.From the above example,we can see that the local recoding may lead to less information loss than the global recoding.9.3.2Utility MeasureThe information loss caused by the anonymization can be measured by how well the generalized tuples approximate the original ones.After the generaliza-tion,some attribute values of a tuple are generalized to an interval.The interval size reflects the accuracy loss in query answering.Therefore,we use the sum of interval size on all attributes of the generalized tuples to measure the certainty loss.The total certainty loss of the anonymized table is the sum of certainty loss of all the tuples.Utility Measure for Numerical Attributes.Consider table T with quasi-identifier(A1,...,A n).Suppose a tuple t=(x1,...,x n)is generalized to tuple t =([y1,z1],...,[y n,z n])such that y i≤x i≤z i(1≤i≤n).Then, we define the normalized certainty penalty(NCP)of tuple t on attribute A i asNCP Ai (t)=z i−y i|A i|,where|A i|=maxt∈Tt.A i−mint∈Tt.A iUtility Measure for Categorical Attributes.The generalization on a cat-egorical attribute often follows a hierarchy tree,which specifies the attribute values with different granularity.Suppose a tuple t has value v on categori-cal attribute A i,v is generalized to a set of values v1,...,v m.Wefind the common ancestor of v1,...,v m,denoted by ancestor(v1,...,v m)in the hi-erarchy tree,and use the size of ancestor(v1,...,v m),that is,the number of leaf nodes that are descendants of ancestor(v1,...,v m),to measure the gen-eralization quantitatively.That isNCP Ai (t)=|ancestor(v1,...,v m)||A i|where |A i |is the number of distinct values on A i in the most specific level.Intuitively,for a numeric attribute A i ,NCP A i (t )measures how much t is generalized on attribute A i in terms of the generalized interval size ;for a cat-egorical attribute A i ,NCP A i (t )measures how much t is generalized on A i in terms of the number of distinct values the generalized value covers .Consider both the numeric and categorical attributes,we define the weighted normalized certainly penalty of a tuple t asNCP (t )=ni =1(w i ·NCP A i (t )),where n i =1w i =1Moreover,the weighted normalized certainly penalty of a table T is de-fined as NCP (T )=t ∈TNCP (t )Since in many data analysis applications,different attributes may have dif-ferent utility,we assign each attribute a weight to reflect the different impor-tance of the attribute.Therefore,NCP (t )is the weighted sum of the normal-ized certainty penalty on all attributes.The certainty penalty on the whole table is the sum of penalty on all the tuples.Example 9.3(Weighted normalized certainty penalty)Consider Table 9.1a and the corresponding 3-anonymous Table 9.6b.Suppose the weights of attributes Age ,Education and Zip Code are 0.5,0.4and 0.1,respectively.Then,we haveNCP Age (t 1)=30−2432−24=68=0.75NCP Edu (t 1)=33=1NCP ZipCode (t 1)=53713−5371153716−53711=25=0.4NCP (t 1)=W Age ×NCP Age (t 1)+W Edu ×NCP Edu (t 1)+W ZipCode ×NCP ZipCode (t 1)=0.5×0.75+0.4×1+0.1×0.4=0.8159.3.3Anonymization MethodsAs shown in [3],optimal k -anonymization under simple restrictions is NP-hard.As a generalization,the utility-based anonymization is also NP-hard.Two heuristic local recoding algorithms are proposed to solve the problem.The Bottom-up Method.The bottom-up method puts a tuple in a group at the beginning,and then iteratively merges the small groups into larger ones.In each iteration,a group whose population is less than k is combined with another group such that the combined group has the minimal utility loss.Theiteration terminates when each group has at least k tuples.Each group forms an equivalence class.The algorithm is illustrated using the following example.Example9.4(The bottom-up method)Consider Table9.1a.The2-anonymization using the bottom-up method works as follows.First,each tuple forms a group.For each group whose size is smaller than2, merge it with another group which minimizes the certainty penalty.For exam-ple,since|g1|=|{t1}|<2,we calculate the certainty penalty NCP(g1,gi) for2≤i≤6andfind that merging g1with g2minimizes NCP(g1,gi).Sim-ilarly,g3is merged with g4,and g5is merged with g6.Thefinal anonymized table is shown in Table9.2b.The Top-down Method.The top-down methodfirst treats the whole ta-ble as an equivalence class(group).The utility of the table is minimal since all tuples are generalized to the same.It then recursively partitions a group into two groups if each subset contains at least k tuples and the utility is im-proved.The algorithm stops when further partitioning leads to the violation of the k-anonymity.Example9.5(The top-down method)Consider the2-anonymiza-tion of Table9.1a.The top-down method iteratively partitions the tuples into two groups G u and G v,trying to minimize the certainty penalty.Itfirstfinds a pair of tuples(as the seeds)that maximize the normalized certainty penalty. t1and t6are the tuples.Thus,t1and t6are added into G u and G v,respec-tively.Then,we assign all the other tuples to one of the two groups.For each tuple t,we calculate NCP(G u,t)and NCP(G v,t),and assign t to the group with the smaller NCP value.For example,t2is assigned into G u because NCP(G u,t2)is smaller than NCP(G v,t2).After all tuples are assigned,we have G u={t1,t2}and G v= {t3,t4,t5,t6}.Since|G u|=2,we only partition G v in the next iteration. Similarly,the seeds found in the next iteration are t3and t6.G v is partitioned into{t3,t4}and{t5,t6}.Thefinal anonymized table is shown in Table9.2b.Finding the seeds u,v with the maximum NCP(u,v)requires O(|T|2).A heuristic method can be used to accelerate the computation.It randomly picks a tuple t1and scans the table once tofind another tuple t2maximizing NCP(t1,t2).Then,by another scan,itfinds the third tuple t3that maximizes NCP(t2,t3).The process is repeated several times until NCP(t i,t i+1)does not increase significantly.Then we use t i and t i+1as the seeds.During the top-down partition,some groups may have fewer than k tuples, we adjust such a group by combining it with another group which minimizes the certainty penalty.The bottom-up method and the top-down method both provide satisfactory results.The top-down method is faster than the bottom-up method.This is。