Connecting Randomized Response, Post-Randomization, Differential Privacy and t-Closeness via Deniability and Permutation

TL;DR

This paper uncovers deep connections between various privacy models like randomized response, differential privacy, t-closeness, and post-randomization, highlighting the role of deniability and permutation in understanding their guarantees.

Contribution

It reveals that these privacy models are interconnected through the principles of deniability and permutation, providing a unified understanding of their privacy guarantees.

Findings

Randomized response is a modern local anonymization method.

Large epsilon in differential privacy relates to increased deniability.

PRAM can be viewed as permutation, linking it to other models.

Abstract

We explore some novel connections between the main privacy models in use and we recall a few known ones. We show these models to be more related than commonly understood, around two main principles: deniability and permutation. In particular, randomized response turns out to be very modern in spite of it having been introduced over 50 years ago: it is a local anonymization method and it allows understanding the protection offered by $\epsilon$-differential privacy when $\epsilon$ is increased to improve utility. A similar understanding on the effect of large $\epsilon$ in terms of deniability is obtained from the connection between $\epsilon$-differential privacy and t-closeness. Finally, the post-randomization method (PRAM) is shown to be viewable as permutation and to be connected with randomized response and differential privacy. Since the latter is also connected with t-closeness, it follows that the permutation principle can explain the guarantees offered by all those models. Thus, calibrating permutation is very relevant in anonymization, and we conclude by sketching two ways of doing it.