This paper is motivated by applications of a Census Bureau interested in releasing aggregate socio-economic data about a large population without revealing sensitive information about any individual. The released information can be the number of individuals living alone, the number of cars they own, or their salary brackets. Recent events have identified some of the privacy challenges faced by these organizations. To address them, this paper presents a novel differential-privacy mechanism for releasing hierarchical counts of individuals. The counts are reported at multiple granularities (e.g., the national, state, and county levels) and must be consistent across all levels. The core of the mechanism is an optimization model that redistributes the noise introduced to achieve differential privacy in order to meet the consistency constraints between the hierarchical levels. The key technical contribution of the paper shows that this optimization problem can be solved in polynomial time by exploiting the structure of its cost functions. Experimental results on very large, real datasets show that the proposed mechanism provides improvements of up to two orders of magnitude in terms of computational efficiency and accuracy with respect to other state-of-the-art techniques.

中文翻译：

---

分层人口普查数据的差分隐私：一种优化方法

这篇论文的动机是人口普查局有兴趣发布关于大量人口的社会经济综合数据而不泄露任何个人的敏感信息。发布的信息可以是独居人数、他们拥有的汽车数量或他们的工资等级。最近的事件已经确定了这些组织面临的一些隐私挑战。为了解决这些问题，本文提出了一种新的差异隐私机制，用于发布个人的分层计数。计数以多个粒度（例如，国家、州和县级）报告，并且必须在所有级别上保持一致。该机制的核心是一个优化模型，该模型重新分配引入的噪声以实现差异隐私，以满足层次级别之间的一致性约束。该论文的关键技术贡献表明，该优化问题可以通过利用其成本函数的结构在多项式时间内解决。在非常大的真实数据集上的实验结果表明，相对于其他最先进的技术，所提出的机制在计算效率和准确性方面提供了多达两个数量级的改进。