Bistochastic privacy

TL;DR

This paper introduces bistochastic privacy, a new privacy model based on bistochastic matrices that unify existing privacy frameworks and leverage information theory to better understand the utility-privacy trade-off.

Contribution

It proposes a novel privacy model using bistochastic matrices, connecting k-anonymity, differential privacy, and information theory, and offers insights into parameterization for privacy guarantees.

Findings

Bistochastic privacy unifies multiple privacy models.

The model uses bits to quantify privacy-utility trade-offs.

Provides a framework for parameterizing privacy guarantees.

Abstract

We introduce a new privacy model relying on bistochastic matrices, that is, matrices whose components are nonnegative and sum to 1 both row-wise and column-wise. This class of matrices is used to both define privacy guarantees and a tool to apply protection on a data set. The bistochasticity assumption happens to connect several fields of the privacy literature, including the two most popular models, k-anonymity and differential privacy. Moreover, it establishes a bridge with information theory, which simplifies the thorny issue of evaluating the utility of a protected data set. Bistochastic privacy also clarifies the trade-off between protection and utility by using bits, which can be viewed as a natural currency to comprehend and operationalize this trade-off, in the same way than bits are used in information theory to capture uncertainty. A discussion on the suitable parameterization of bistochastic matrices to achieve the privacy guarantees of this new model is also provided.