Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12
Jun Tang, Aleksandra Korolova, Xiaolong Bai, Xueqiang Wang, Xiaofeng, Wang

TL;DR
This paper analyzes Apple's implementation of differential privacy on macOS Sierra, revealing privacy budget management practices, actual privacy loss levels, and advocating for greater transparency and user control.
Contribution
It provides a detailed analysis of Apple's differential privacy approach, including privacy parameters, data pipeline, and privacy loss, which was previously unclear.
Findings
Apple's privacy loss per datum is 1 or 2.
Overall daily privacy loss can reach up to 16.
Privacy budget renews daily, accumulating over time.
Abstract
In June 2016, Apple announced that it will deploy differential privacy for some user data collection in order to ensure privacy of user data, even from Apple. The details of Apple's approach remained sparse. Although several patents have since appeared hinting at the algorithms that may be used to achieve differential privacy, they did not include a precise explanation of the approach taken to privacy parameter choice. Such choice and the overall approach to privacy budget use and management are key questions for understanding the privacy protections provided by any deployment of differential privacy. In this work, through a combination of experiments, static and dynamic code analysis of macOS Sierra (Version 10.12) implementation, we shed light on the choices Apple made for privacy budget management. We discover and describe Apple's set-up for differentially private data processing,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPrivacy-Preserving Technologies in Data · Privacy, Security, and Data Protection · Internet Traffic Analysis and Secure E-voting
