Anonymized Local Privacy

TL;DR

This paper introduces Anonymized Local Privacy mechanisms that use linear noise and a three-value output space to protect individual privacy in distributed networks while maintaining data accuracy.

Contribution

It proposes a novel privacy mechanism with a simple output space and analyzes its effectiveness in distributed settings with real data.

Findings

Effective privacy protection through linear noise addition

Suitable for distributed on-demand networks

Maintains accuracy while safeguarding privacy

Abstract

In this paper, we introduce the family of Anonymized Local Privacy mechanisms. These mechanisms have an output space of three values "Yes", "No", or "$\perp$" (not participating) and leverage the law of large numbers to generate linear noise in the number of data owners to protect privacy both before and after aggregation yet preserve accuracy. We describe the suitability in a distributed on-demand network and evaluate over a real dataset as we scale the population.

Figures

Equations

$$\underset{D_1,D_2}{\sup }\frac{\mathrm{Pr}[San(D_1)\in O]}{\mathrm{Pr}[San(D_2)\in O]}\le exp(ϵ)$$

$$Privatized\text{leavevmode}Value=\{\begin{array}{ll}\perp & \text{with probability 1−πs}\\ Value& \text{with probability πs}\end{array}$$

$$Privatized\text{leavevmode}Value=\{\begin{array}{ll}\perp & \text{with probability 1−πsYes}\\ 1& \text{with probability }\\ \text{leavevmode}& \text{πsYes×(π1+(1−π1)×π2)}\\ 0& \text{otherwise}\end{array}$$

$$Privatized\text{leavevmode}Value=\{\begin{array}{ll}\perp & \text{with probability 1−πsNo}\\ 1& \text{with probability}\\ \text{leavevmode}& \text{πsNo×((1−π1)×π2)}\\ 0& \text{otherwise}\end{array}$$

$$\begin{array}{r}\min (Var(P(‘‘Yes"|Yes))+Var(P(‘‘Yes"|No)))\end{array}$$

$$Privatized\text{leavevmode}Value=\{\begin{array}{ll}\perp & \text{with probability}\\ \text{leavevmode}& \text{1−(πsYes1+πsYes2)}\\ 1& \text{with probability πsYes1×π1}\\ 1& \text{with probability πsYes2×π2}\\ 0& \text{with probability}\\ \text{leavevmode}& \text{πsYes1×(1−π1)+}\\ \text{leavevmode}& \text{πsYes2×(1−π2)}\end{array}$$

$$Privatized\text{leavevmode}Value=\{\begin{array}{ll}\perp & \text{with probability 1−πsNo}\\ 1& \text{with probability}\\ \text{leavevmode}& \text{πsNo×π3}\\ 0& \text{otherwise}\end{array}$$

$$\begin{array}{rl}E[‘‘Yes"]& ={\pi }_{Ye{s}_1}\times {\pi }_1\times YES+\\ & {\pi }_{Ye{s}_2}\times {\pi }_2\times YES+\\ & {\pi }_{No}\times {\pi }_3\times (DO-YES)\end{array}$$

$$\begin{array}{rl}YES& =\frac{E[‘‘Yes"]-({\pi }_{No}\times {\pi }_3\times DO)}{({\pi }_{Ye{s}_1}\times {\pi }_1)+({\pi }_{Ye{s}_2}\times {\pi }_2)-({\pi }_{No}\times {\pi }_3)}\end{array}$$

$$\begin{array}{rl}\widehat{YE{S}_{Yes}}& =\frac{E[‘‘Yes"]\pm \sigma (‘‘Yes")-({\pi }_{No}\times {\pi }_3\times DO)}{({\pi }_{Ye{s}_1}\times {\pi }_1)+({\pi }_{Ye{s}_2}\times {\pi }_2)-({\pi }_{No}\times {\pi }_3)}\end{array}$$

$$\begin{array}{rl}Var(‘‘Yes")& =(({\pi }_{Ye{s}_1}\times {\pi }_1+{\pi }_{Ye{s}_2}\times {\pi }_2)\times \\ & (1-({\pi }_{Ye{s}_1}\times {\pi }_1+{\pi }_{Ye{s}_2}\times {\pi }_2))\times \\ & YES)+\\ & ({\pi }_{No}\times {\pi }_3\times \\ & (1-({\pi }_{No}\times {\pi }_3))\times \\ & NO)\end{array}$$

$$\begin{array}{rl}\sigma (‘‘Yes")& =\sqrt{Var(‘‘Yes")}\end{array}$$

$$\begin{array}{rl}E[‘‘Yes"]& ={\pi }_{Ye{s}_1}\times (1-{\pi }_1)\times YES+\\ & {\pi }_{Ye{s}_2}\times (1-{\pi }_2)\times YES+\\ & {\pi }_{No}\times (1-{\pi }_3)\times (DO-YES)\end{array}$$

$$\begin{array}{rl}YES& =\frac{E[‘‘Yes"]-({\pi }_{No}\times (1-{\pi }_3)\times DO)}{({\pi }_{Ye{s}_1}\times (1-{\pi }_1))+({\pi }_{Ye{s}_2}\times (1-{\pi }_2))-({\pi }_{No}\times (1-{\pi }_3))}\end{array}$$

$$\begin{array}{rl}\widehat{YE{S}_{No}}& =\frac{E[‘‘Yes"]\pm \sigma (‘‘Yes")-({\pi }_{No}\times (1-{\pi }_3)\times DO)}{({\pi }_{Ye{s}_1}\times (1-{\pi }_1))+({\pi }_{Ye{s}_2}\times (1-{\pi }_2))-({\pi }_{No}\times (1-{\pi }_3))}\end{array}$$

$$\begin{array}{rl}Var(‘‘Yes")& =(({\pi }_{Ye{s}_1}\times (1-{\pi }_1)+{\pi }_{Ye{s}_2}\times (1-{\pi }_2))\times \\ & (1-({\pi }_{Ye{s}_1}\times (1-{\pi }_1)+{\pi }_{Ye{s}_2}\times (1-{\pi }_2)))\times \\ & YES)+\\ & ({\pi }_{No}\times (1-{\pi }_3)\times \\ & (1-({\pi }_{No}\times (1-{\pi }_3)))\times \\ & NO)\end{array}$$

$$\begin{array}{rl}\sigma (‘‘No")& =\sqrt{Var(‘‘No")}\end{array}$$

$$\begin{array}{rl}E[\perp ]& =(1-({\pi }_{Ye{s}_1}+{\pi }_{Ye{s}_2}))\times YES+\\ & (1-{\pi }_{No})\times (DO-YES)\end{array}$$

$$\begin{array}{rl}YES& =\frac{E[\perp ]-((1-{\pi }_{No})\times DO)}{(1-({\pi }_{Ye{s}_1}+{\pi }_{Ye{s}_2}))-(1-{\pi }_{No})}\end{array}$$

$$\begin{array}{rl}\widehat{YE{S}_{\perp }}& =\frac{E[\perp ]\pm \sigma (\perp )-((1-{\pi }_{No})\times DO)}{(1-({\pi }_{Ye{s}_1}+{\pi }_{Ye{s}_2}))-(1-{\pi }_{No})}\end{array}$$

$$\begin{array}{rl}Var(\perp )& =((1-({\pi }_{Ye{s}_1}+{\pi }_{Ye{s}_2}))\times \\ & ({\pi }_{Ye{s}_1}+{\pi }_{Ye{s}_2})\times \\ & YES)+\\ & ((1-{\pi }_{No})\times \\ & {\pi }_{No}\times \\ & NO)\end{array}$$

$$\begin{array}{rl}\sigma (\perp )& =\sqrt{Var(\perp )}\end{array}$$

$$E[‘‘Yes"]\pm \sigma =Observed(‘‘Yes")$$

$$E[\perp ]\pm \sigma =Observed(\perp )$$

$$E[‘‘Yes"]\pm \sigma +E[\perp ]\pm \sigma =DO$$

$$YE{S}_A\text{leavevmode}Privatized\text{leavevmode}Value=\{\begin{array}{ll}{\perp }_1& \text{with probability π⊥1}\\ {\perp }_1& \text{with probability πY}\\ {\perp }_2& \text{with probability 1−π⊥1−πY}\end{array}$$

$$N{O}_A\text{leavevmode}Privatized\text{leavevmode}Value=\{\begin{array}{ll}{\perp }_1& \text{with probability π⊥1}\\ {\perp }_1& \text{with probability π⊥N}\\ {\perp }_2& \text{with probability 1−π⊥1−π⊥N}\end{array}$$

$$YE{S}_B\text{leavevmode}Privatized\text{leavevmode}Value=\{\begin{array}{ll}{\perp }_1& \text{with probability π⊥1−πY}\\ {\perp }_2& \text{with probability πY}\\ {\perp }_2& \text{with probability 1−π⊥1}\end{array}$$

$$N{O}_B\text{leavevmode}Privatized\text{leavevmode}Value=\{\begin{array}{ll}{\perp }_1& \text{with probability π⊥1−π⊥N}\\ {\perp }_2& \text{with probability π⊥N}\\ {\perp }_2& \text{with probability 1−π⊥1}\end{array}$$

$$\begin{array}{rl}E[{\perp }_{1_A}]& =({\pi }_{{\perp }_1}+{\pi }_Y)\times YES+({\pi }_{{\perp }_1}+{\pi }_N)\times NO\\ & ={\pi }_{{\perp }_1}\times YES+{\pi }_Y\times YES+{\pi }_{{\perp }_1}\times NO+{\pi }_N\times NO\\ & ={\pi }_{{\perp }_1}\times TOTAL+{\pi }_Y\times YE{S}_A+{\pi }_N\times NO\\ & ={\pi }_{{\perp }_1}\times TOTAL+{\pi }_Y\times YE{S}_A+{\pi }_N\times TOTAL-{\pi }_N\times YES\end{array}$$

$$\begin{array}{rl}E[{\perp }_{1_B}]& =({\pi }_{{\perp }_1}-{\pi }_Y)\times YES+({\pi }_{{\perp }_1}-{\pi }_N)\times NO\\ & ={\pi }_{{\perp }_1}\times YES-{\pi }_Y\times YES+{\pi }_{{\perp }_1}\times NO-{\pi }_N\times NO\\ & ={\pi }_{{\perp }_1}\times TOTAL-{\pi }_Y\times YES-{\pi }_N\times NO\\ & ={\pi }_{{\perp }_1}\times TOTAL-{\pi }_Y\times YES-({\pi }_N\times TOTAL-{\pi }_N\times YES)\\ & ={\pi }_{{\perp }_1}\times TOTAL-{\pi }_Y\times YES-{\pi }_N\times TOTAL+{\pi }_N\times YES\end{array}$$

Full text

We describe the suitability in a distributed on-demand network and evaluate over a real dataset as we scale the population.

I Introduction

Personal mobile information is being continuously collected and analyzed with minimal regard to privacy. As we transition from small mobile personal devices to large-scale sensor collecting self-driving vehicles the needs of privacy increase.

Differential privacy has emerged as the gold standard for privacy protection. Differential privacy essentially states that whether or not a single data owner decides to participate in data collection, the final aggregate information will be perturbed only by a negligible amount. That is, the aggregate information released gives no hints to the adversary about a particular data owner. However, differential private techniques do not add noise linear in the number of data owners to protect. Techniques, such as the Laplace mechanism, add noise calibrated to the sensitivity of the query output, rather than linear in the number of data owners to protect, in order to preserve accuracy [7].

We introduce the family of Anonymized Local Privacy mechanisms and present constructions with better accuracy than randomized response.

Randomized response has been shown to be optimal in the local privacy setting [4]. However, in order to preserve accuracy with the randomized response mechanism, privacy must be sacrificed as the data owners must respond truthfully too frequently. For example, a data owner should respond truthfully more than 80% of the time to have decent accuracy which greatly minimizes any privacy gains [15, 14]. The reason is due to the high variance from the coin tosses [20]. As more aggressive sampling is performed, the variance quickly increases making it difficult to perform accurate estimation of the underlying distribution.

As a result of the accuracy problem, there have been various privacy-preserving systems which focus on the heavy-hitters only [9, 2]. These techniques ensure privacy only for large populations and can only detect or estimate the most frequently occurring distributions, rather than smaller or less frequently occurring populations.

Our contribution is the ability to maintain strong privacy while maintaining the fidelity of the data. The output space of Anonymized Local Privacy mechanisms is three values “Yes”, “No”, or “$\perp$” (not participating) as opposed to solely two values “Yes” or “No” . Three output values allows for robust estimation, as we show in Section §LABEL:sec:evaluation:accuracy.

We evaluate the accuracy of our privacy-preserving approach utilizing a vehicular crowdsourcing scenario comprising of approximately 50,000 records. In this dataset, each vehicle reports its location utilizing the California Transportation Dataset from magnetic pavement sensors (see Section §LABEL:sec:evaluation:accuracy).

II Related Work

Differential privacy [5, 7, 6, 8] has been proposed as a mechanism to privately share data such that anything that can be learned if a particular data owner is included in the database can also be learned if the particular data owner is not included in the database. To achieve this privacy guarantee, differential privacy mandates that only a sublinear number of queries have access to the database and that noise proportional to the global sensitivity of the counting query is added (independent of the number of data owners).

Distributional privacy [1] is a privacy mechanism which says that the released aggregate information only reveals the underlying ground truth distribution and nothing else. This protects individual data owners and is strictly stronger than differential privacy. However, it is computationally inefficient though can work over a large class of queries known as Vapnik-Chervonenkis (VC) dimension.

Zero-knowledge privacy [12] is a cryptographically influenced privacy definition that is strictly stronger than differential privacy. Crowd-blending privacy [11] is weaker than differential privacy; however, with a pre-sampling step, satisfies both differential privacy and zero-knowledge privacy. However, these mechanisms do not add noise linear in the number of data owners and rely on aggressive sampling, which negatively impact the accuracy estimations.

The randomized response based mechanisms [22, 10, 13, 21] satisfies the differential privacy mechanism as well as stronger mechanisms such as zero-knowledge privacy. However, the accuracy of the randomized response mechanism quickly degrades unless the coin toss values are configured to large values (e.g., greater than 80%).

III Preliminaries

Differential Privacy. Differential privacy has become the gold standard privacy mechanism which ensures that the output of a sanitization mechanism does not violate the privacy of any individual inputs.

Definition 1** ([5, 7]).**

($\epsilon$-Differential Privacy). A privacy mechanism $San()$ provides $\epsilon$-differential privacy if, for all datasets $D_{1}$ and $D_{2}$ differing on at most one record (i.e., the Hamming distance $H()$ is $H(D_{1},D_{2})\leq 1$), and for all outputs $O\subseteq Range(San())$:

[TABLE]

That is, the probability that a privacy mechanism $San$ produces a given output is almost independent of the presence or absence of any individual record in the dataset. The closer the distributions are (i.e., smaller $\epsilon$), the stronger the privacy guarantees become and vice versa.

Private Write. More generally, we assume some class of private information storage [19] mechanisms are utilized by the data owner to cryptographically protect their writes to cloud services.

IV Anonymized Local Privacy

First, we define the structure of an anonymized local private mechanism. We then illustrate various mechanisms that satisfy Anonymized Local Privacy. Finally, we provide the mechanism for preserving accuracy in the Anonymized Local Privacy model.

IV-A Structure

An anonymized local privacy mechanism answers “Yes”, “No”, or $\perp$ (not participating). For our purposes, we use the notation of the $Yes$ population as the ground truth and the remaining data owners are the $No$ population. Each population should blend with each other such that the aggregate information that is released is unable to be used to increase the confidence or inference of an adversary that is trying to determine the value of a specific data owner.

Data owners are aggressively sampled (e.g., 5%). To overcome the estimation error due to the large variance, the estimation of the noisy “Yes” counts and sampled counts are combined to offset each other and effectively cancel the noise, allowing for the aggressive sampling.

IV-B Sampling

Sampling whereby a centralized aggregator randomly discards responses has been previously formulated as a mechanism to amplify privacy [3, 18, 16, 17, 11]. The intuition is that when sampling approximates the original aggregate information, an attacker is unable to distinguish when sampling is performed and which data owners are sampled. These privacy mechanisms range from sampling without a sanitization mechanism, sampling to amplify a differentially private mechanism, sampling that tolerates a bias, and even sampling a weaker privacy notion such as k-anonymity to amplify the privacy guarantees.

However, sampling alone has several issues. First, data owners that answer “Yes” do not have the protection of strong plausible deniability as they never respond “No” or are “forced“ to respond “Yes” (e.g., via coin tosses). Data owners that answer “No” do not provide privacy protection as they never answer “Yes”. Second, as we increase the sampling rate the variance will increase rapidly, thus weakening accuracy. Finally, the privacy strength of the population does not increase as the population increases. The $Yes$ population is fixed (e.g., those at a particular location) and we can only increase the $No$ population. The $No$ population should also contribute noise by answering “Yes” in order to strengthen privacy.

IV-C Sampling and Noise

We could leverage the $No$ population by use the same sampling rate though for the $No$ population have a portion respond “Yes”. To perform the final estimation we simply subtract the estimated added noise.

Sampling and Noise Response. Each data owner privatizes their actual value $Value$ by performing the following Bernoulli trial. Let $\pi_{s}$ be either the sampling probability for the $Yes$ population as $\pi_{s_{Yes}}$ or for the $No$ population as $\pi_{s_{No}}$.

[TABLE]

That is, a percentage of the $Yes$ population responds “Yes” and a percentage of the $No$ population responds “Yes” (providing noise). However, the $Yes$ data owners do not answer “No” and also do not have plausible deniability (that is being forced via coin toss to respond “Yes”).

IV-D Sampling and Plausible Deniability

We would like to have a percentage of each population respond opposite of their actual value, provide plausible deniability, and have outputs from the space of “Yes”, “No”, and $\perp$ (not participating) in order for the data owners to blend with each other.

To achieve plausible deniability via coin tosses we have a small percentage of the “Yes” population be “forced” to respond “Yes”. The other output values follow from the sampling and noise scenario.

[TABLE]

[TABLE]

A benefit of plausible deniability is that the estimation of the population will provides privacy protection via noise. However, it is difficult to estimate the underlying ground truth due to the added noise. We desire better calibration over the privacy mechanism.

IV-E Mechanism

The optimal mechanism for anonymized local privacy should have the following characteristics. The output space should be three values of “Yes”, “No”, and $\perp$. A fraction of each of the $Yes$ and $No$ population should be included. Each population should have some notion of plausible deniability. The total number of data owners $DO$ can be computed by summing the total number of “Yes”, “No”, and $\perp$ responses. It should be noted that if the data owners would not write $\perp$ it would be difficult to estimate and calculate the underlying $Yes$ count.

Definition 2**.**

(Minimal Variance Parameters) We model the sum of independent Bernoulli trials that are not identically distributed, as the poisson binomial distribution (we combine “No” and $\perp$ into the same output space for modeling purposes). Let $Yes^{\prime}$ represent those that respond “Yes”, regardless if they are from the $Yes$ or $No$ population.

The success probabilities are due to the contributions from the $Yes$ and $No$ populations. We then sum and search for the minimum variance.

Utility is maximized when:

[TABLE]

There are a couple observations. The first is that uniform sampling across both populations ($Yes$ and $No$) limits the ability to achieve optimal variance. As we increase the $No$ population by increasing the queries and the number of data owners that participate, the variance will correspondingly increase. For example, 10% sampling will incur a large variance for a population of one million data owners. To address this, the sampling parameters should be separately tuned for each population. We desire a small amount of data owners to be sampled from the $Yes$ population to protect privacy and an even smaller amount from the $No$ population (as this population will be large and only a small amount is required for linear noise). The other observation is that for the plausible deniability, by fixing the probabilities the same across the $Yes$ and $No$ population also restricts the variance that can be achieved.

Thus, the optimal anonymized local privacy mechanism is one that tunes both populations.

Mechanism. Let $\pi_{s}$ be either the sampling probability for the $Yes$ population as $\pi_{s_{Yes}}$ or for the $No$ population as $\pi_{s_{No}}$. Let $\pi_{p}$ be either the plausible deniability parameter for the $Yes$ population as $\pi_{1}$ or the $No$ population $\pi_{2}$ respectively. The mechanism that we use which satisfies Anonymized Local Privacy is as follows:

[TABLE]

[TABLE]

It should be noted that $\pi_{s_{Yes_{1}}}\times\pi_{1}$ are the percentage of data owners that answer truthfully “Yes” and $\pi_{s_{Yes_{2}}}\times\pi_{2}$ are the percentage of data owners that are “forced” to respond “Yes” providing the plausible deniability. Each case has its own coin toss parameters in order to be able to fine tune the variance and reduce the estimation error as opposed to the prior examples where the variance cascades across terms adding error.

V Accuracy

Let $DO$ be the total number of data owners. Let $YES$ and $NO$ be the population count of those that truthfully respond “Yes” and “No” respectively such that $YES+NO=DO$.

Lemma 1**.**

(Yes Estimate From Aggregated Count)

Expected value of “Yes” responses is:

[TABLE]

Solving for $YES$ results in:

[TABLE]

The estimator $\mathit{\hat{YES}_{Yes}}$ accounting for the standard deviation $\sigma(``Yes")$ is:

[TABLE]

Lemma 2**.**

Standard Deviation of the Aggregated “Yes” Count

The standard deviation $\sigma(``Yes")$ is:

[TABLE]

[TABLE]

Lemma 3**.**

(Yes Estimate From Aggregated “No” Count)

Expected value of “Yes” responses is:

[TABLE]

Solving for $YES$ results in:

[TABLE]

The estimator $\mathit{\hat{YES}_{No}}$ accounting for the standard deviation $\sigma(``No")$ is:

[TABLE]

Lemma 4**.**

Standard Deviation of the Aggregated “No” Count

The standard deviation $\sigma(``No")$ is:

[TABLE]

[TABLE]

Lemma 5**.**

*(Yes Estimate From Sampled Population)  

Expected value of $\perp$ (not participating) responses is:*

[TABLE]

Solving for $YES$ results in:

[TABLE]

The estimator $\mathit{\hat{YES}_{\perp}}$ accounting for the standard deviation $\sigma(\perp)$ is:

[TABLE]

Lemma 6**.**

Standard Deviation of the Sampled Population

The standard deviation $\sigma(\perp)$ is:

[TABLE]

[TABLE]

Lemma 7**.**

Solving for $YES$

There are two approaches we can take. We can either use the “Yes” estimators to estimate the underlying population as described earlier. Or we can treat the equations as a system of linear equations.

The observation is that setting $\pi_{1}=\pi_{2}=\pi_{3}=1$ results in the standard deviation being equal for $\sigma(``Yes")$, $\sigma(``No")$, and $\sigma(\perp)$. This has the effect of resulting in no “No” responses and the two equations are thus dependant.

We have the following system of linear equations of two unknown variables $YES$ and $\sigma$ as follows:

[TABLE]

We then solve for $YES$ and $\sigma$ for each combination of varying $\pm$ signs using a solver. We eliminate the solutions which assign $YES$ a negative value.

It would be nice if we could cancel out the error. It would also be nice if the system of linear equations above would have exactly one solution. However, it’s not clear that we can immediately guarantee this.

VI First Attempt Cancelling the Noise

As we control the randomization, can we construct a mechanism whereby the error introduced by the $NO$ population cancels out? Performing uniform sampling across both $YES$ and $NO$ populations allows us to cancel the population error though we are not able to precisely estimate the $YES$ population as it also cancels out the $YES$ terms.

One observation is that the error terms potentially could cancel out if the signs were flipped. Thus, we construct our mechanism as follows. Each data owner responds twice for the same query, though slightly flips a single term to allow for the error cancelation.

[TABLE]

[TABLE]

[TABLE]

[TABLE]

The expected values are as follows:

[TABLE]

[TABLE]

[TABLE]

[TABLE]

We should now be able to subtract either pairs of expected values and solve for $YES$. Either $E[\perp_{1_{A}}]-E[\perp_{1_{B}}]$ or $E[\perp_{2_{A}}]-E[\perp_{2_{B}}]$. However, the variance of the total population multiplied by the $\pi_{N}$ contributes error as the $NO$ population grows.

One option is to simply create a third output where the value $\pi_{N}\times\mathit{TOTAL}$. We then can eliminate this value from both systems of equations and solve for $YES$.

VII Cancelling the Noise

The observation is that we are shifting fractions of the population across two outputs. By expanding to three outputs we can shift the population to isolate the $YES$ population for estimation. We shift the $YES$ and $NO$ population to the third output space to blend these crowds.

[TABLE]

[TABLE]

[TABLE]

[TABLE]

The expected values are as follows:

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

We should now be able to subtract the pairs of expected values, scale the $NO$ population, eliminate the error due to the population variance, and solve for $YES$. by $E[\perp_{1_{A}}]-E[\perp_{1_{B}}]$.

The estimation error is now only due to estimating the sampled $YES$ population, so need to choose accordingly when $YES$ is known to be small.

VII-A Privacy Algebra

To simplify reasoning regarding “shifting” the populations to protect privacy and cancel the noise due to the population variance, we introduce privacy algebra notation to simplify our expressions.

[TABLE]

VII-B Plausible Deniability

While we are able to cancel the noise and estimate the $YES$ population, there is no plausible deniability as the $YES$ population is exposed. We achieve this by utilizing an output space of three with three separate answers.

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Working backwards we can start with solving for $NO_{f_{2_{1}}}$ to eventually solve for $YES$.

VIII Conclusion

In this paper we demonstrate that we can add noise linear in the number of data owners to protect while preserving privacy. We introduce the family of Anonymized Local Privacy mechanisms.