Ambiguity: Hide the Presence of Individuals and Their Privacy with Low Information Loss

Publishing a database instance containing individual information poses two kinds of privacy risk: presence leakage, by which the attackers can explicitly identify individuals in (or not in) the database, and association leakage, by which the attackers can unambiguously associate individuals with sensitive information. However, the existing privacy-preserving data publishing techniques that can protect both presence privacy and association privacy have considerable amounts of information loss, while the techniques that produce better utility fail to protect the presence privacy. In this paper, we propose a novel technique, ambiguity, to protect both presence privacy and association privacy with low information loss. We formally define the privacy model and quantify the privacy guarantee of our ambiguity technique against both presence leakage and association leakage. We investigate the information loss of the ambiguity technique and theoretically prove that it always has less information loss than the generalization-based techniques. We accompany the theory with an efficient algorithm that constructs the ambiguity scheme that provides sufficient protection of both presence privacy and association privacy with low information loss. Extensive experiments demonstrate that compared with generalization approach, our ambiguity technique always achieves better accuracy of data analysis.