Privacy Against Brute-Force Inference Attacks

TL;DR

This paper introduces Guessing Leakage, a new privacy measure for data release that models adversaries using brute-force guessing, and derives optimal utility-privacy trade-offs using linear programming.

Contribution

It defines Guessing Leakage as a novel privacy measure and provides a method to compute optimal utility-privacy trade-offs for data release.

Findings

Optimal utility is a concave, piece-wise linear function of privacy budget.

Derived the utility-privacy trade-off using linear programming.

Validated properties of Guessing Leakage as a privacy measure.

Abstract

Privacy-preserving data release is about disclosing information about useful data while retaining the privacy of sensitive data. Assuming that the sensitive data is threatened by a brute-force adversary, we define Guessing Leakage as a measure of privacy, based on the concept of guessing. After investigating the properties of this measure, we derive the optimal utility-privacy trade-off via a linear program with any $f$-information adopted as the utility measure, and show that the optimal utility is a concave and piece-wise linear function of the privacy-leakage budget.

Figures

Equations

$$H_G(\tilde{\mathbf{p}})$$

$$=\lambda {\mathbf{r}}_{\tilde{\mathbf{p}}}^T\cdot \mathbf{p}+(1-\lambda ){\mathbf{r}}_{\tilde{\mathbf{p}}}^T\cdot \mathbf{q}$$

$$\ge \lambda {\mathbf{r}}_{\mathbf{p}}^T\cdot \mathbf{p}+(1-\lambda ){\mathbf{r}}_{\mathbf{q}}^T\cdot \mathbf{q}$$

$$=\lambda H_G(\mathbf{p})+(1-\lambda )H_G(\mathbf{q}),$$

$$GL(X⟶U)\triangleq H_G(X)-H_G(X|U).$$

$$GL(X⟶U)\ge 0,$$

$$H_G(X|U)$$

$$\le H_G\left(\sum p(u){\mathbf{p}}_{X|u}\right)$$

$$=H_G(X).$$

$$H_G(X|U^{\prime })$$

$$=\sum _{u^{\prime }}p(u^{\prime })H_G\left(\sum _{u}p(u|u^{\prime }){\mathbf{p}}_{X|u}\right)$$

$$\ge \sum _{u^{\prime }}p(u^{\prime })\sum _{u}p(u|u^{\prime })H_G({\mathbf{p}}_{X|u})$$

$$=\sum _{u}p(u)H_G({\mathbf{p}}_{X|u})$$

$$=H_G(X|U),$$

$$GL(X⟶U^{\prime })\le GL(X⟶U).$$

$$t(ϵ)\triangleq \underset{\begin{array}{c}{p}_{U|W}:\\ (X,Y)-W-U\\ GL(X⟶U)\le ϵ\end{array}}{\sup }{I}_f(Y;U),$$

$$t(ϵ)=\underset{\begin{array}{c}p(\cdot ),{\mathbf{p}}_{W|u}\in \mathcal{P}(\mathcal{W}):\\ \sum p(u){\mathbf{p}}_{W|u}={\mathbf{p}}_W,\\ \sum p(u)H_G\left({\mathbf{P}}_{X|W}{\mathbf{p}}_{W|u}\right)\ge H_G(X)-ϵ\end{array}}{\max }\sum _{u}p(u)D_f\left({\mathbf{P}}_{Y|W}{\mathbf{p}}_{W|u}||{\mathbf{p}}_Y\right).$$

$$\begin{array}{rl}t(ϵ)=\underset{p(\cdot )\ge 0}{\max }& \sum _{i=1}^{k}p(u_i)D_f\left({\mathbf{P}}_{Y|W}{\mathbf{q}}_i||{\mathbf{p}}_Y\right)\\ \text{s.t.}& \sum _{i=1}^{k}p(u_i){\text{r}}_{({\mathbf{P}}_{X|W}{\mathbf{q}}_i)}^T{\mathbf{P}}_{X|W}{\mathbf{q}}_i\ge H_G(X)-ϵ,\\ & \sum _{i=1}^{k}p(u_i){\mathbf{q}}_i={\mathbf{p}}_W,\end{array}$$

$$G{L}_m(X⟶U)\triangleq \frac{H_G(X)}{H_G(X|U)},$$

$${\log }_{2}G{L}_m(X⟶U)=I_{\frac{1}{2}}(X;U),$$

Full text

I Introduction

Large-scale data collection and analysis is a key component of many recent technological advances such as autonomous driving, online health monitoring, reliable energy grid, and intelligent IoT systems. While these data-driven applications provide better services by efficiently processing user data in massive scales, collection and sharing of personal data is increasingly creating privacy risks, especially with the advances in machine learning and data mining algorithms. Thus, developing privacy-preserving data release mechanisms that jointly consider the utility from shared data with the associated privacy leakage is key to the wide scale adoption of some of these emerging technologies. As a classic example, publishing a general purpose database, or even releasing its aggregate statistics, may threaten an individual’s privacy, which has led to the introduction of widely used techniques such as k-anonymity [1], and differential privacy [2].

The information-theoretic formulation of privacy provides a general statistical framework to model both the utility and privacy, and allows investigating their trade-off as an optimization problem. Modeling the available dataset with random variable (r.v.) $Y$ and the private/sensitive latent variable with $X$, the data that should be released, denoted by $U$ is obtained as the output of a privacy-preserving statistical kernel (transformation), and can be obtained as the solution of an optimization problem. Mutual information is the most common measure of both utility and privacy, whereby the trade-off becomes the privacy funnel [3]. However, there is no optimal/universal definition of privacy and it can either abstract away from the adversarial threats [1], [4], or depend on the vulnerability of the sensitive data to adversarial attacks [5, 6]. In this paper, we assume that the adversary is a brute-force attacker, i.e., it performs an exhaustive trial and error attack over all the possible realizations of the sensitive data. There are many examples of such brute-force attacks in real life, where criminals steal private information by determining a cipher key via an exhaustive search [7], or checking several potential shortened URLs to discover active links [8].

We assume that a brute-force adversary performs a number of guesses to successfully determine the value of private data $X$, modeled as a r.v. with finite support. A privacy-preserving mechanism is built against this brute-force adversary. To this end, we define guessing leakage, and investigate its properties as a privacy measure. Afterwards, we formulate the utility-privacy trade-off as a non-convex optimization problem, and derive the optimal data release mechanism via a linear program (LP).

The problem of guessing is a well-established area in information theory. In [9], Massey proposed a lower bound on the minimum expected number of guesses needed to find $X$ in terms of its Shannon entropy $H(X)$, while in [10], different moments of the guessing function are lower bounded in terms of the Renyi entropy of $X$, and the result is used to analyze the computational complexity of sequential decoding. Later works, such as [11], apply large deviation techniques to more general scenarios in this context. The problem of guessing also appears in Shannon-theoretic cryptography in [12], i.e., encryption against a brute-force wiretapper. The problem of computational security against a guessing attacker has been addressed in [7, 13]. The practical challenges of guessing passwords is studied in [14, 15]. However, limited attention has been devoted to the effect of data sharing on guessability of private information from a privacy-preserving point of view. In [16], a sub-optimal utility-privacy trade-off is found by using the lower bound provided in [10].

Notations. R.v.’s are denoted by capital letters, and their realizations by lower case letters. Matrices and vectors are denoted by bold capital and bold lower case letters, respectively. For a positive integer $n$, we define $[n]\triangleq\{1,2,\ldots,n\}$. For a finite alphabet $\mathcal{X}$, the probability simplex $\mathcal{P}(\mathcal{X})$ is the standard $(|\mathcal{X}|-1)$-simplex. Furthermore, to each probability mass function (pmf) $p_{X}(\cdot)$ corresponds a probability vector $\mathbf{p}_{X}\in\mathcal{P}(\mathcal{X})$, whose $i$-th element is $p_{X}(x_{i})$ ($i\in[|\mathcal{X}|]$). Likewise, for a pair of r.v.’s $(X,Y)$ with joint pmf $p_{X,Y}$, the probability vector $\mathbf{p}_{X|y}$ corresponds to the conditional pmf $p_{X|Y}(\cdot|y),\forall y\in\mathcal{Y}$, and $\mathbf{P}_{X|Y}$ is an $|\mathcal{X}|\times|\mathcal{Y}|$ matrix with columns $\mathbf{p}_{X|y},\forall y\in\mathcal{Y}$. Statistical independence between $X$ and $Y$ is shown as X\mathchoice{\mathrel{\hbox to0.0pt{\displaystyle\perp\hss}\mkern 2.0mu{\displaystyle\perp}}}{\mathrel{\hbox to0.0pt{\textstyle\perp\hss}\mkern 2.0mu{\textstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptstyle\perp\hss}\mkern 2.0mu{\scriptstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptscriptstyle\perp\hss}\mkern 2.0mu{\scriptscriptstyle\perp}}}Y. For a convex function $f$ such that $f(1)=0$, and the probability mass functions $p,q$ on $\mathcal{X}$, the $f$-divergence is defined as111We assume that $p$ is absolutely continuous with respect to $q$, i.e., $q(x)=0$ implies $p(x)=0$. $D_{f}(p||q)\triangleq\sum_{x\in\mathcal{X}}q(x)f(\frac{p(x)}{q(x)})$. Finally, for a pair $(X,Y)\sim p_{X,Y}$, the $f$-information is defined as $I_{f}(X;Y)\triangleq D_{f}(p_{X,Y}||p_{X}\cdot p_{Y})$.

II System model

II-A Preliminaries

Consider a triplet of discrete r.v.’s $(X,Y,W)\in\mathcal{X}\times\mathcal{Y}\times\mathcal{W}$, with finite alphabets, and distributed according to $p_{X,Y,W}$. Let $Y$ and $X$ denote the useful data to be revealed, and the sensitive data to be concealed, respectively. As in [17], $W$ denotes what the user/curator directly observes, which may be a noisy representation of the pair $(X,Y)$. Assume that the privacy mapping/data release mechanism takes $W$ as input and maps it to the released data denoted by $U$. In this scenario, $(X,Y)-W-U$ form a Markov chain, and the privacy mapping is captured by the conditional distribution $p_{U|W}$.

The aim of the privacy mapping is to simultaneously preserve the fidelity of $Y$ and the privacy of $X$ by the release of $U$. In this paper, we measure the utility of the release by the $f$-information between $Y$ and $U$, i.e., $I_{f}(Y;U)$, which incorporates mutual information as a special case, and define the privacy measure in the sequel.

II-B Guessing

Consider the problem of guessing the realization of a discrete r.v. $X\in\mathcal{X}$ by asking questions of the form ”Is $X$ equal to $x$?”, until the answer is ”Yes.” As in [10], a guessing function/strategy of $X$ is denoted by a bijection $G(X):\mathcal{X}\to[|\mathcal{X}|]$. Hence, for a given guessing strategy $G(\cdot)$, $G(x)$ represents the number of required guesses when $X=x$. Likewise, for a pair of r.v.’s $(X,Y)$, $G(X|Y):\mathcal{X}\times\mathcal{Y}\to[|\mathcal{X}|]$ is the guessing function of $X$ given $Y$, i.e., $G(x|y)$ denotes the number of guesses required to determine $X=x$, when $Y=y$. For a given pmf $p_{X}$, let $G^{*}$ denote the minimizer(s)222It can be readily verified that $G^{*}$ is unique if and only if $p_{X}(x_{i})\neq p_{X}(x_{j}),\ \forall i\neq j.$ of $\mathds{E}[G(X)]$, which guesses the value of $X$ in decreasing order of probabilities as shown in [9]. The guessing entropy is defined as $H_{G}(X)\triangleq\mathds{E}[G^{*}(X)]$, which, from the guesser’s point of view, measures the uncertainty in $X$, as it denotes the minimum average number of guesses required to determine its realization. We have $H_{G}(X)\in[1,\frac{|\mathcal{X}|+1}{2}]$, where the minimum or maximum are attained when $X$ is, respectively, deterministic or uniformly distributed over $\mathcal{X}$. Throughout the paper, the guessing entropy $H_{G}(X)$ and $H_{G}(\mathbf{p}_{X})$ are written interchangeably333It is noteworthy to mention that $H_{G}(X)$ as the minimum number of guesses is not consistent with intuition when $|\mathcal{X}|=1$ or $2$, as in the former no guessing is needed, while $H_{G}(X)=1$, and in the latter, one guess is sufficient to determine the value of $X$, while $H_{G}(X)>1$. Although a more exact notion would be $H_{G}(X)\triangleq\min\{\mathds{E}[G^{*}(X)],|\mathcal{X}|-1\}$, one can always justify $H_{G}(X)$ as the minimum number of guesses by emphasizing on the need of receiving an affirmative answer, i.e., until the answer is ”Yes”. Having said that, the analysis of this paper remains valid in either cases..

Definition 1**.**

For a probability vector $\mathbf{p}\in\mathcal{P}(\mathcal{X})$, Let the rank vector of $\mathbf{p}$, denoted by $\mathbf{r}_{\mathbf{p}}$, be a vector that labels the elements of $[|\mathcal{X}|]$ according to their order induced by sorting $\mathbf{p}$ in descending order. For example, for $\mathbf{p}_{1}=\begin{bmatrix}0.6&0.1&0.3\end{bmatrix}^{T}$, we have $\mathbf{r}_{\mathbf{p}_{1}}=\begin{bmatrix}1&3&2\end{bmatrix}^{T}$. For $\mathbf{p}_{2}=\begin{bmatrix}0.5&0.25&0.25\end{bmatrix}^{T}$, either of $\begin{bmatrix}1&2&3\end{bmatrix}^{T}$ or $\begin{bmatrix}1&3&2\end{bmatrix}^{T}$ could be a candidate444It can be verified that by imposing the constraint $r_{i}<r_{j}$ ($i\neq j$) if and only if $p_{i}-p_{j}+\mathds{1}\{p_{i}=p_{j}\}(j-i)>0$, i.e., equal probabilities being ranked based on their index order, the rank vector is well defined. Nonetheless, the (possible) ambiguity in the definition of $\mathbf{r}$ is not problematic here. for $\mathbf{r}_{\mathbf{p}_{2}}$.

Definition 2**.**

The rank partition $\mathcal{P}_{\mathbf{r}}(\mathcal{X})$ is the set of all probability vectors $\mathbf{p}\in\mathcal{P}(\mathcal{X})$ with rank vector $\mathbf{r}$, where $\mathbf{r}$ is an arbitrary permutation of the elements in $[|\mathcal{X}|]$. Hence, the probability simplex $\mathcal{P}(\mathcal{X})$ can be divided into $|\mathcal{X}|!$ equal-rank partitions.

Proposition 1**.**

The guessing entropy $H_{G}(X)$ is a piece-wise linear and concave functional (see Figure 1) of $p_{X}(\cdot)$.

Proof.

Let $X\sim\mathbf{p}$, and it is immediate that $H_{G}(X)=\mathbf{r}_{\mathbf{p}}^{T}\cdot\mathbf{p}$, which proves the piece-wise linearity of $H_{G}(X)$ in $\mathbf{p}$. Furthermore, we have $\mathbf{r}_{\mathbf{p}}^{T}\cdot\mathbf{p}\leq\mathbf{r}^{T}\cdot\mathbf{p}$ for any rank vector $\mathbf{r}\neq\mathbf{r}_{\mathbf{p}}$, which follows from [9]. Hence, the concavity is proved as follows. For $\lambda\in[0,1]$ and two arbitrary $\mathbf{p},\mathbf{q}\in\mathcal{P}(\mathcal{X})$, let $\tilde{\mathbf{p}}\triangleq\lambda\mathbf{p}+(1-\lambda)\mathbf{q}$. We have,

[TABLE]

where the inequality is strict if and only if $\mathbf{p},\mathbf{q}$ belong to different rank partitions. ∎

II-C Brute-force inference attack

A brute-force adversary aims at inferring the private data, i.e., $X$, via trial and error, or equivalently, guessing. Here, we adopt a model similar to the cost function-based inference in [18] by defining the cost of inference attack as the number of trials which lead to a correct guess. Prior to observing any realization of the released data $U$, the adversary uses the optimal guessing strategy $G^{*}(\cdot)$ to minimize its cost of inference, i.e., $C^{*}_{0}=H_{G}(X)$. After observing $U=u$, the adversary can update its belief about the private data as the posterior $p_{X|U}(\cdot|u)$, which in turn leads to an updated555Note that knowledge of the posterior is not necessary in the sense that the adversary could also get the same updated strategy by only knowing the rank vector associated to it, i.e., $\mathbf{r}_{\mathbf{p}_{X|u}}$. guessing strategy $G^{*}(\cdot|u)$. Therefore, the minimum cost of inference is now $C^{*}_{u}=H_{G}(X|U=u)$. Considering the average additive gain (where the average is over $U$) that the adversary sees in its inference cost, we are ready to define the privacy leakage measure and investigate some of its properties as follows.

Definition 3**.**

The guessing leakage is defined as:

[TABLE]

Proposition 2**.**

We have

[TABLE]

with equality if and only if the rank vector associated with $p_{X|U}(\cdot|u)$, i.e., $\mathbf{r}_{\mathbf{p}_{X|u}}$, does not change with $u,\;\forall u\in\mathcal{U}$. Note that this is a weaker condition than statistical independence.

Proof.

From Proposition 1, we have

[TABLE]

where the inequality is tight if and only if all the $\mathbf{p}_{X|u}$’s ($\forall u$) belong to the same rank partition. Alternatively, (2) can be proved by [10, Corollary 1]. ∎

Remark 1**.**

The difference in (1) is reminiscent of the mutual information expanded in terms of entropies, which follows from its logarithmic nature. Nonetheless, one can observe that $GL(X\longrightarrow U)$ has no relation with mutual information in terms of one being a lower/upper bound to the other. Let $X,U$ be binary random variables with $X|\{U=u_{i}\}\sim\mbox{Bern}(\frac{i}{i+3}),\ i=1,2$. It is immediate that X\not\mathchoice{\mathrel{\hbox to0.0pt{\displaystyle\perp\hss}\mkern 2.0mu{\displaystyle\perp}}}{\mathrel{\hbox to0.0pt{\textstyle\perp\hss}\mkern 2.0mu{\textstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptstyle\perp\hss}\mkern 2.0mu{\scriptstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptscriptstyle\perp\hss}\mkern 2.0mu{\scriptscriptstyle\perp}}}U, and hence, $I(X;U)>0$. Also, since we have $\mathbf{r}_{\mathbf{p}_{X|u_{1}}}=\mathbf{r}_{\mathbf{p}_{X|u_{2}}}$, we get $GL(X\longrightarrow U)=0$. Therefore, $I(X;U)>GL(X\longrightarrow U)$. In another example, let $X=U$, which results in $I(X;U)=H(X)$, and $GL(X\longrightarrow U)=H_{G}(X)-1$. According to [9, Section III], we can have distributions for which $H(X)$ is vanishingly small, while $H_{G}(X)$ is large. As a result, $I(X;U)<GL(X\longrightarrow U)$.

A privacy measure can be investigated in terms of data processing inequalities.

Definition 4**.**

A privacy measure $J(X;U)$ is said to satisfy the post-processing inequality [17] if and only if for any Markov chain $X-U-U^{\prime}$, we have $J(X;U^{\prime})\leq J(X;U)$, and the linkage inequality, if and only if $J(X;U^{\prime})\leq J(U;U^{\prime})$.

Theorem 1**.**

Guessing leakage satisfies the post-processing inequality, but not the linkage inequality.

Proof.

Consider the Markov chain $X-U-U^{\prime}$. We have

[TABLE]

where (3) follows from the concavity of $H_{G}$. Hence, we have

[TABLE]

In other words, no independent processing of the released data, $U$, can increase the privacy leakage.

To show that $GL$ does not satisfy the linkage inequality, let $U^{\prime}\sim\mbox{Bern}(\theta)$ for some $\theta\in(0,1)$. Also, let $\mathcal{U}=[3]$ with $\mathbf{p}_{U|u^{\prime}_{0}}=[.35\ .4\ .25]^{T}$ and $\mathbf{p}_{U|u^{\prime}_{1}}=[.3\ .6\ .1]^{T}$. By setting $X=U\mbox{ mod }2$, we have $X-U-U^{\prime}$ form a Markov chain, and $GL(X\longrightarrow U^{\prime})>GL(U\longrightarrow U^{\prime})=0$. ∎

III Utility-privacy trade-off

Having defined the utility and privacy measures, the utility-privacy trade-off can be written as666We assume that Y\not\mathchoice{\mathrel{\hbox to0.0pt{\displaystyle\perp\hss}\mkern 2.0mu{\displaystyle\perp}}}{\mathrel{\hbox to0.0pt{\textstyle\perp\hss}\mkern 2.0mu{\textstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptstyle\perp\hss}\mkern 2.0mu{\scriptstyle\perp}}}{\mathrel{\hbox to0.0pt{\scriptscriptstyle\perp\hss}\mkern 2.0mu{\scriptscriptstyle\perp}}}W, since otherwise, $t(\epsilon)=0,\ \forall\epsilon.$:

[TABLE]

where $\epsilon\in[0,GL(X\longrightarrow W)]$. By the routine application of cardinality bounding techniques [19], it becomes sufficient to have $|\mathcal{U}|\leq|\mathcal{W}|+1$. Furthermore, the supremum can be replaced by maximum, since a continuous objective function attains its supremum over a compact set. Also, searching over $p_{U|W}$ can be equivalent777Trivially, for any pair $(p_{U},\mathbf{p}_{W|u})$, $(X,Y)-W-U$ can be constructed. to searching over the pair $(p_{U},\mathbf{p}_{W|u})$, such that $\mathbf{p}_{W}=\sum_{u}p_{U}(u)\mathbf{p}_{W|u}$. Therefore, the problem reduces to

[TABLE]

For an arbitrary rank vector $\mathbf{r}$, let $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$ denote the inverse image of $\mathcal{P}_{\mathbf{r}}(\mathcal{X})$ under $\mathbf{P}_{X|W}$, which is a linear transformation from $\mathcal{P}(\mathcal{W})$ to $\mathcal{P}(\mathcal{X})$. For a given $\mathbf{r}$, $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$ is a convex polytope with a finite number of extreme points, since it can be written as the intersection of a finite number of closed half-spaces in $\mathcal{P}(\mathcal{W})$888Depending on the transformation $\mathbf{P}_{X|W}$, $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$ could be an empty set for some values of $\mathbf{r}$. Note that the empty set can be viewed as a null polytope.. For example, with $\mathbf{r}=[1\ 3\ 2]^{T}$, we have $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})=\{\mathbf{p}\in\mathcal{P}(\mathcal{W})|\mathbf{v}_{1}\cdot\mathbf{p}\geq\mathbf{v}_{3}\cdot\mathbf{p},\ \mathbf{v}_{3}\cdot\mathbf{p}\geq\mathbf{v}_{2}\cdot\mathbf{p}\}$, which forms the intersection of $\mathcal{P}(\mathcal{W})$ with two closed half-spaces, where $\mathbf{v}_{i}$ denotes the $i$th row of $\mathbf{P}_{X|W}$. Let $\mathbb{Q}_{r}$ denote the set of extreme points of $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$. As a result, any element of $\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$ can be written as a convex combination of the elements of $\mathbb{Q}_{r}$.

In what follows, we show that there is no loss of optimality in replacing $\mathbf{p}_{W|u}\in\mathcal{P}(\mathcal{W})$ in (5) with $\mathbf{p}_{W|u}\in\mathbb{Q}$, where $\mathbb{Q}\triangleq\cup_{r}\mathbb{Q}_{r}$. It is already known that the $f$-divergence, $D_{f}(p||q)$, is convex in $(p,q)$, and in $p$ for a fixed $q$, which implies the convexity of the objective function of (5) in $\mathbf{p}_{W|u}$. For an arbitrary $\mathbf{p}_{W|u}\in\mathcal{P}(\mathcal{W})$, we have $\mathbf{p}_{W|u}\in\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$ for some $\mathbf{r}$. Writing this $\mathbf{p}_{W|u}$ as a convex combination of the elements of $\mathbb{Q}_{r}$ does not alter $H_{G}(\cdot)$, which follows from the piece-wise linearity of $H_{G}(\cdot)$, i.e., $H_{G}\left(\mathbf{P}_{X|W}\mathbf{z}\right)$ is linear in $\mathbf{z}$ for $\mathbf{z}\in\mathcal{Q}_{\mathbf{r}}(\mathcal{W})$. Furthermore, this does not decrease the objective function, which is a direct consequence of the convexity of $D_{f}\left(\mathbf{P}_{Y|W}\mathbf{z}||\mathbf{p}_{Y}\right)$ in $\mathbf{z}$. Therefore, in (5), $\mathbf{p}_{W|u}\in\mathcal{P}(\mathcal{W})$ can be replaced with $\mathbf{p}_{W|u}\in\mathbb{Q}$, which leads to the following theorem.

Theorem 2**.**

The utility-privacy trade-off in (5) can be solved by a linear program (LP).

Proof.

Let $\{\mathbf{q}_{i}\}_{i=1}^{k}$ denote the elements of $\mathbb{Q}$. The problem reduces to

[TABLE]

which is an LP999Note that the constraint $\sum_{i}p(u_{i})=1$ is redundant, as it is implicitly implied by $\sum_{i}p(u_{i})\mathbf{q}_{i}=\mathbf{p}_{W}$.. ∎

Corollary 1**.**

The utility-privacy trade-off in (4) is a concave and piece-wise linear function of $\epsilon$ (see Fig. 2).

Proof.

This follows from the LP sensitivity analysis [20, Lemma 2]. ∎

Remark 2**.**

If the elements of $\mathbf{p}_{X}$ are distinct, it is always possible to reveal some information with no privacy leakage, i.e., $t(0)>0$. Moreover, if all the columns of $\mathbf{P}_{X|W}$ belong to the same rank partition, no data release can cause any leakage of privacy, i.e., $t(\epsilon)=I_{f}(W;W),\forall\epsilon.$

Proof.

If the elements of $\mathbf{p}_{X}$ are distinct, we have $\mathbf{p}_{X}\in\mbox{int}(\mathcal{P}_{\mathbf{r}}(\mathcal{X}))$ for some $\mathbf{r}$. Since $Y$ and $W$ are not independent, there exists a vector $\mathbf{v}$ such that i) $\mathbf{p}_{Y}\neq\mathbf{P}_{Y|W}(\mathbf{p}_{W}+\eta\mathbf{v})$ for sufficiently small $\eta>0$ and ii) $\mathbf{1}^{T}\cdot\mathbf{v}=0$. Let $U^{\prime}\sim\mbox{Bern}(\frac{1}{2})$, and set $\mathbf{p}_{W|u^{\prime}_{i}}=\mathbf{p}_{W}+(-1)^{i}\eta\mathbf{v}$ for $i=1,2.$ As a result, $p_{Y,U^{\prime}}\neq p_{Y}\cdot p_{U^{\prime}}$, which results in $I_{f}(Y;U^{\prime})>0$. Also, for sufficiently small $\eta$, $\mathbf{p}_{X|u^{\prime}_{i}}$ ($=\mathbf{P}_{X|W}\mathbf{p}_{W|u^{\prime}_{i}},i=1,2$) lie in the same rank partition as $\mathbf{p}_{X}$, which results in $GL(X\longrightarrow U^{\prime})=0$. Therefore, we have $t(0)\geq I_{f}(Y;U^{\prime})>0$ The second claim is proved by setting $U=W$, using the data-processing inequality for $f$-information, and noting that $GL(X\longrightarrow W)=0$. ∎

Remark 3**.**

In order to specify the LP for a particular setting, it is sufficient to identify the elements of $\mathbb{Q}$. The procedure of finding the extreme points of a convex polytope is a classical problem, which is omitted here due to lack of space. In the special case of $W=X$, i.e., when the curator has direct access only to the sensitive data, these points are already known as $(1,0,\ldots,0)^{T}$, $(\frac{1}{2},\frac{1}{2},0,\ldots,0)^{T}$, $(\frac{1}{3},\frac{1}{3},\frac{1}{3},0,\ldots,0)^{T}$ and so on, and their permutations, which are nothing but the extreme points of all the rank partitions of $\mathcal{P}(\mathcal{W})$.

Remark 4**.**

Theorem 2 is a direct consequence of the convexity of the objective function, and the piece-wise linearity of the privacy measure. Hence, a similar analysis applies when the utility is measured by the minimum mean square error (MMSE), minimum probability of error, or $GL(Y\longrightarrow U)$.

Remark 5**.**

Guessing leakage is defined in (1) as the additive gain in the inference cost of a brute-force attacker. Alternatively, one could define the following multiplicative gain as the privacy-leakage measure:

[TABLE]

which belongs to $[1,\frac{|\mathcal{X}|+1}{2}]$. It can be readily verified that the two theorems of this paper remain valid when (7) replaces (1). When the adversary is a memoryless guesser, i.e., each new guess is independent of the previous guesses, we have

[TABLE]

where $I_{\alpha}(X;U)$ denotes the Arimoto mutual information of order $\alpha(\geq 0)$, which follows from [21, Theorem 1]. However, this does not hold in general, and is only pertinent to the special case of a memoryless guesser.

IV Numerical Results

Suppose an attacker has access to a list of user IDs that potentially belong to individuals with highly sensitive job positions. The goal of the attacker is to discover whether any of these IDs are related to a person working for a list of presumed government agencies. Each organization has a registered domain name, hence the attacker can build all of the possible email addresses by combining user IDs with domain names, and exhaustively checking the existence of emails, which can potentially be used for consequent social engineering. Assuming that checking a large number of emails is a risky task for the attacker, they will try to minimize the number of attempts. Again, assuming the attacker has access to the location check-ins of users in a social network and also knows the exact location of all branches of the organizations, they can wisely reorder the emails and check them in a manner that minimizes the number of trials.

Based on this scenario, suppose we are interested in three organizations, $x_{1}$, $x_{2}$ and $x_{3}$, with 500, 300 and 200 employees, respectively. Let $X$ denote the organization variable with probability vector $\mathbf{p}_{X}=[0.5,0.3,0.2]$. Considering 100 user IDs and without any side information, the average number of trials is 170 ($=100*H_{G}(X)$). Now assume we have 3 cities, $y_{1}$, $y_{2}$ and $y_{3}$, and each organization has offices in 2 of them (for example, $x_{1}$ has 300 employees in $y_{1}$ and 200 employees in $y_{2}$, $x_{2}$ has 150 employees in $y_{1}$ and 150 employees in $y_{3}$, and $x_{3}$ has 60 employees in $y_{2}$ and 140 employees in $y_{3}$.). In this way, we have defined $P_{Y|X}$ where $Y$ denotes the city variable. If the attacker knows the city variable for all users, the minimum number of trials is $100*H_{G}(X|Y)=135$, which is less than 170 ($GL(X\longrightarrow Y)=0.35$). Hence, a privacy preserving mapping is needed for check-ins of the people with sensitive positions, which can be done by intentionally creating wrong check-ins. This is equivalent to sampling $U$ from $P_{U|Y}$, which obviously increases the level of privacy while it decreases the correctness of location check-ins (utility). Therefore, we should build a trade-off between utility and leakage. Figure 2 shows the optimal utility-privacy trade-off for this example, when the utility is measured by three variants of $f$-information corresponding to the $\mathcal{X}^{2}$-divergence, $KL$-divergence, and total variation ($TV$) distance.

V Conclusions and future work

We considered the problem of privacy against brute-force adversaries. By investigating the properties of guessing entropy, we introduced guessing leakage as a privacy measure. We studied the optimal utility-privacy trade-off with $f$-information as the utility measure, and showed it to be the solution of an LP. Unless the curator has direct access only to the private data, we need to identify the extreme points of a convex polytope, whose complexity grows exponentially. Hence, sub-optimal algorithms are to be sought, such as restricting the search space to the set of all deterministic mappings, which is the subject of our ongoing work. Another practical direction is to address this problem when the curator is uncertain (or even unaware) of the underlying distribution.