This paper is motivated by applications of a Census Bureau interested in releasing aggregate socio-economic data about a large population without revealing sensitive information about any individual. The released information can be the number of individuals living alone, the number of cars they own, or their salary brackets. Recent events have identified some of the privacy challenges faced by these organizations [1]. To address them, this paper presents a novel differential-privacy mechanism for releasing hierarchical counts of individuals. The counts are reported at multiple granularities (e.g., the national, state, and county levels) and must be consistent across all levels. The core of the mechanism is an optimization model that redistributes the noise introduced to achieve differential privacy in order to meet the consistency constraints between the hierarchical levels. The key technical contribution of the paper shows that this optimization problem can be solved in polynomial time by exploiting the structure of its cost functions. Experimental results on very large, real datasets show that the proposed mechanism provides improvements of up to two orders of magnitude in terms of computational efficiency and accuracy with respect to other state-of-the-art techniques.

本文的动机是人口普查局的应用，他们有兴趣发布有关大量人口的总体社会经济数据，而又不透露任何个人的敏感信息。所发布的信息可以是单独居住的个人数量，拥有的汽车数量或薪水等级。最近的事件确定了这些组织面临的一些隐私挑战[1]。为了解决这些问题，本文提出了一种新颖的差异性隐私机制，用于释放个人的等级计数。报告的计数采用多种粒度（例如，国家，州和县级别），并且必须在所有级别上保持一致。该机制的核心是优化模型，该模型可以重新分配引入的噪声以实现差分隐私，从而满足分层级别之间的一致性约束。本文的关键技术贡献表明通过利用其成本函数的结构，可以在多项式时间内解决该优化问题。在非常大的真实数据集上的实验结果表明，相对于其他最新技术，该机制在计算效率和准确性方面最多可提高两个数量级。