Collecting Telemetry Data Privately
arXiv:1712.01524
Abstract
The collection and analysis of telemetry data from users' devices is routinely performed by many software companies. Telemetry collection leads to improved user experience but poses significant risks to users' privacy. Locally differentially private (LDP) algorithms have recently emerged as the main tool that allows data collectors to estimate various population statistics, while preserving privacy. The guarantees provided by such algorithms are typically very strong for a single round of telemetry collection, but degrade rapidly when telemetry is collected regularly. In particular, existing LDP algorithms are not suitable for repeated collection of counter data such as daily app usage statistics. In this paper, we develop new LDP mechanisms geared towards repeated collection of counter data, with formal privacy guarantees even after being executed for an arbitrarily long period of time. For two basic analytical tasks, mean estimation and histogram estimation, our LDP mechanisms for repeated data collection provide estimates with comparable or even the same accuracy as existing single-round LDP collection mechanisms. We conduct empirical evaluation on real-world counter datasets to verify our theoretical results. Our mechanisms have been deployed by Microsoft to collect telemetry across millions of devices.
To appear in NIPS 2017
References in corpus (2)
Cited by in corpus (32)
- LoPub: High-Dimensional Crowdsourced Data Publication with Local Differential Privacy
- A Comprehensive Survey on Local Differential Privacy Toward Data Statistics and Analysis
- LDP-IDS: Local Differential Privacy for Infinite Data Streams
- The Internet of Federated Things (IoFT): A Vision for the Future and In-depth Survey of Data-driven Approaches for Federated Learning
- Improving the utility of locally differentially private protocols for longitudinal and multidimensional frequency estimates
- Successive Point-of-Interest Recommendation with Local Differential Privacy
- Random Sampling Plus Fake Data: Multidimensional Frequency Estimates With Local Differential Privacy
- CoinPress: Practical Private Mean and Covariance Estimation
- PriPeARL: A Framework for Privacy-Preserving Analytics and Reporting at LinkedIn
- On the Risks of Collecting Multidimensional Data Under Local Differential Privacy
- Deep Learning with Gaussian Differential Privacy
- Federated Bandit: A Gossiping Approach
- Understanding Unintended Memorization in Federated Learning
- Practical Differentially Private Top- Selection with Pay-what-you-get Composition
- Aggregation and Transformation of Vector-Valued Messages in the Shuffle Model of Differential Privacy
- OptStream: Releasing Time Series Privately
- Network Shuffling: Privacy Amplification via Random Walks
- Private Prediction Sets
- Gradient Perturbation is Underrated for Differentially Private Convex Optimization
- Differentially Private Confidence Intervals for Proportions under Stratified Random Sampling
- Revealing the True Cost of Locally Differentially Private Protocols: An Auditing Perspective
- Calibrate: Frequency Estimation and Heavy Hitter Identification with Local Differential Privacy via Incorporating Prior Knowledge
- A Members First Approach to Enabling LinkedIn's Labor Market Insights at Scale
- A Communication-efficient Local Differentially Private Algorithm in Federated Optimization
- DiPPS: Differentially Private Propensity Scores for Bias Correction
- Improving Utility and Security of the Shuffler-based Differential Privacy
- Answering Multi-Dimensional Range Queries under Local Differential Privacy
- Task-aware Privacy Preservation for Multi-dimensional Data
- Locally Differentially Private Bayesian Inference
- Meta Clustering for Collaborative Learning
- Improving Frequency Estimation under Local Differential Privacy
- Asymmetric Differential Privacy