knock knock, who's there? membership inference on ......knock knock, who’s there? membership...
TRANSCRIPT
![Page 1: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/1.jpg)
Knock Knock, Who’s There? MembershipInference on Aggregate Location Data
NDSS 2018
Apostolos Pyrgelis 1, Carmela Troncoso 2 and Emiliano De Cristofaro 1
1UCL, 2EPFL
February 20, 2018San Diego, CA, USA
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 2: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/2.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 3: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/3.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 4: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/4.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 5: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/5.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 6: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/6.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 7: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/7.jpg)
Introduction
Location data enable mobility analytics in the context ofsmart cities
But, they are very privacy sensitive
Analysts use aggregate location statistics
e.g., Uber Movement or Telefonica Smart Steps
Recent works (PETS’17, WWW’17) show that aggregatelocation statistics might violate the privacy of individuals thatare part of the aggregates
We focus on membership inference attacks
i.e., an adversary attempts to determine whether or notlocation data of a target user is part of the aggregates
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 8: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/8.jpg)
Motivation
Membership inference is a first step to other types of attackson location aggregates, e.g., profiling or localization
Aggregates might be collected over sensitive locations /time-frame, or might relate to a group of users that share asensitive characteristic
Regulators can verify possible misuse of the data, e.g., whenaggregate location data has been released without permission
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 9: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/9.jpg)
Motivation
Membership inference is a first step to other types of attackson location aggregates, e.g., profiling or localization
Aggregates might be collected over sensitive locations /time-frame, or might relate to a group of users that share asensitive characteristic
Regulators can verify possible misuse of the data, e.g., whenaggregate location data has been released without permission
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 10: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/10.jpg)
Motivation
Membership inference is a first step to other types of attackson location aggregates, e.g., profiling or localization
Aggregates might be collected over sensitive locations /time-frame, or might relate to a group of users that share asensitive characteristic
Regulators can verify possible misuse of the data, e.g., whenaggregate location data has been released without permission
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 11: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/11.jpg)
Motivation
Membership inference is a first step to other types of attackson location aggregates, e.g., profiling or localization
Aggregates might be collected over sensitive locations /time-frame, or might relate to a group of users that share asensitive characteristic
Regulators can verify possible misuse of the data, e.g., whenaggregate location data has been released without permission
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 12: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/12.jpg)
In this work...
We reason about membership inference in the context oflocation data
We model the problem as a game in which an adversary aimsat distinguishing location aggregates that include data of atarget user from those that do not
We instantiate the distinguishing task with a machine learningclassifier trained on the adversarial prior knowledge and use itto infer membership in unseen aggregate statistics
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 13: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/13.jpg)
In this work...
We reason about membership inference in the context oflocation data
We model the problem as a game in which an adversary aimsat distinguishing location aggregates that include data of atarget user from those that do not
We instantiate the distinguishing task with a machine learningclassifier trained on the adversarial prior knowledge and use itto infer membership in unseen aggregate statistics
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 14: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/14.jpg)
In this work...
We reason about membership inference in the context oflocation data
We model the problem as a game in which an adversary aimsat distinguishing location aggregates that include data of atarget user from those that do not
We instantiate the distinguishing task with a machine learningclassifier trained on the adversarial prior knowledge and use itto infer membership in unseen aggregate statistics
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 15: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/15.jpg)
In this work...
We reason about membership inference in the context oflocation data
We model the problem as a game in which an adversary aimsat distinguishing location aggregates that include data of atarget user from those that do not
We instantiate the distinguishing task with a machine learningclassifier trained on the adversarial prior knowledge and use itto infer membership in unseen aggregate statistics
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 16: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/16.jpg)
Main Findings
We deploy membership inference attacks on two real-worldmobility datasets and find that releasing raw aggregates posesa significant privacy threat
We evaluate the privacy protection of defense mechanismsthat guarantee differential privacy and show how they areeffective at preventing inference at the cost of utility
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 17: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/17.jpg)
Main Findings
We deploy membership inference attacks on two real-worldmobility datasets and find that releasing raw aggregates posesa significant privacy threat
We evaluate the privacy protection of defense mechanismsthat guarantee differential privacy and show how they areeffective at preventing inference at the cost of utility
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 18: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/18.jpg)
Main Findings
We deploy membership inference attacks on two real-worldmobility datasets and find that releasing raw aggregates posesa significant privacy threat
We evaluate the privacy protection of defense mechanismsthat guarantee differential privacy and show how they areeffective at preventing inference at the cost of utility
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 19: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/19.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 20: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/20.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 21: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/21.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 22: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/22.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 23: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/23.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 24: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/24.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 25: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/25.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 26: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/26.jpg)
Distinguishability Game
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 27: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/27.jpg)
Distinguishing Function
Intuition : Membership inference can be modeled as a binaryclassification task
i.e., was the target’s data used to calculate the aggregatelocation time-series under examination?
We utilize a supervised machine learning classifier trained ondata that is included in the adversarial prior knowledge
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 28: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/28.jpg)
Distinguishing Function
Intuition : Membership inference can be modeled as a binaryclassification task
i.e., was the target’s data used to calculate the aggregatelocation time-series under examination?
We utilize a supervised machine learning classifier trained ondata that is included in the adversarial prior knowledge
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 29: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/29.jpg)
Distinguishing Function
Intuition : Membership inference can be modeled as a binaryclassification task
i.e., was the target’s data used to calculate the aggregatelocation time-series under examination?
We utilize a supervised machine learning classifier trained ondata that is included in the adversarial prior knowledge
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 30: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/30.jpg)
Adversarial Prior Knowledge
Subset of Locations : The adversary knows the reallocations for a subset of users that includes her target
e.g., a telecommunications provider
Participation in Past Groups : The adversary knows thetarget’s participation for location aggregate time-seriesobserved in the past
Same Groups as Released : continuous data release overstable groupsDifferent Groups than Released : continuous data releaseover dynamic user groups
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 31: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/31.jpg)
Adversarial Prior Knowledge
Subset of Locations : The adversary knows the reallocations for a subset of users that includes her target
e.g., a telecommunications provider
Participation in Past Groups : The adversary knows thetarget’s participation for location aggregate time-seriesobserved in the past
Same Groups as Released : continuous data release overstable groupsDifferent Groups than Released : continuous data releaseover dynamic user groups
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 32: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/32.jpg)
Adversarial Prior Knowledge
Subset of Locations : The adversary knows the reallocations for a subset of users that includes her target
e.g., a telecommunications provider
Participation in Past Groups : The adversary knows thetarget’s participation for location aggregate time-seriesobserved in the past
Same Groups as Released : continuous data release overstable groupsDifferent Groups than Released : continuous data releaseover dynamic user groups
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 33: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/33.jpg)
Adversarial Prior Knowledge
Subset of Locations : The adversary knows the reallocations for a subset of users that includes her target
e.g., a telecommunications provider
Participation in Past Groups : The adversary knows thetarget’s participation for location aggregate time-seriesobserved in the past
Same Groups as Released : continuous data release overstable groups
Different Groups than Released : continuous data releaseover dynamic user groups
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 34: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/34.jpg)
Adversarial Prior Knowledge
Subset of Locations : The adversary knows the reallocations for a subset of users that includes her target
e.g., a telecommunications provider
Participation in Past Groups : The adversary knows thetarget’s participation for location aggregate time-seriesobserved in the past
Same Groups as Released : continuous data release overstable groupsDifferent Groups than Released : continuous data releaseover dynamic user groups
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 35: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/35.jpg)
Privacy Loss
For a target, we play the distinguishability game multiple times
Privacy Loss : The adversary’s advantage in winning it overa random guess
We utilize the Area Under Curve (AUC) score to evaluate theclassifier’s performance
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 36: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/36.jpg)
Privacy Loss
For a target, we play the distinguishability game multiple times
Privacy Loss : The adversary’s advantage in winning it overa random guess
We utilize the Area Under Curve (AUC) score to evaluate theclassifier’s performance
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 37: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/37.jpg)
Privacy Loss
For a target, we play the distinguishability game multiple times
Privacy Loss : The adversary’s advantage in winning it overa random guess
We utilize the Area Under Curve (AUC) score to evaluate theclassifier’s performance
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 38: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/38.jpg)
Privacy Loss
For a target, we play the distinguishability game multiple times
Privacy Loss : The adversary’s advantage in winning it overa random guess
We utilize the Area Under Curve (AUC) score to evaluate theclassifier’s performance
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 39: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/39.jpg)
Datasets
Tranport For London (TFL):
60M trips - 4M unique oyster cards - 582 stations (regions ofinterest - ROIs)
Monday, March 1 - Sunday, March 28, 2010
Sample the top 10K oyster ids per total # of trips, beingactive for 115 ± 21 out of the 672 timeslots and reporting171 ± 26 ROIs in total (sparse, regular)
San Francisco Cabs (SFC):
11M GPS coordinates - 534 cabs in SF - May 19 to June 8,2008
Grid 10 × 10 = 100 ROIs of 0.5 × 0.37 mi2
Taxis are active for 340 ± 94 out of the 504 timeslots andreport 3, 663 ± 1, 116 ROIs in total (dense, irregular)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 40: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/40.jpg)
Datasets
Tranport For London (TFL):
60M trips - 4M unique oyster cards - 582 stations (regions ofinterest - ROIs)
Monday, March 1 - Sunday, March 28, 2010
Sample the top 10K oyster ids per total # of trips, beingactive for 115 ± 21 out of the 672 timeslots and reporting171 ± 26 ROIs in total (sparse, regular)
San Francisco Cabs (SFC):
11M GPS coordinates - 534 cabs in SF - May 19 to June 8,2008
Grid 10 × 10 = 100 ROIs of 0.5 × 0.37 mi2
Taxis are active for 340 ± 94 out of the 504 timeslots andreport 3, 663 ± 1, 116 ROIs in total (dense, irregular)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 41: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/41.jpg)
Datasets
Tranport For London (TFL):
60M trips - 4M unique oyster cards - 582 stations (regions ofinterest - ROIs)
Monday, March 1 - Sunday, March 28, 2010
Sample the top 10K oyster ids per total # of trips, beingactive for 115 ± 21 out of the 672 timeslots and reporting171 ± 26 ROIs in total (sparse, regular)
San Francisco Cabs (SFC):
11M GPS coordinates - 534 cabs in SF - May 19 to June 8,2008
Grid 10 × 10 = 100 ROIs of 0.5 × 0.37 mi2
Taxis are active for 340 ± 94 out of the 504 timeslots andreport 3, 663 ± 1, 116 ROIs in total (dense, irregular)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 42: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/42.jpg)
Experimental Setup
Target Users : For each dataset, we randomly pick 50 usersfrom 3 mobility groups (highly, mildly, somewhat) and runmembership inference attacks
Sample & Aggregate : Sample groups that include andexclude the target user to create a balanced dataset of labeledaggregate location time-series
Feature Extraction : Extract various statistics from thetime-series of each ROI
i.e., mean, variance, std, median, min, max, sum
Classification : Train and test the classifier
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 43: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/43.jpg)
Experimental Setup
Target Users : For each dataset, we randomly pick 50 usersfrom 3 mobility groups (highly, mildly, somewhat) and runmembership inference attacks
Sample & Aggregate : Sample groups that include andexclude the target user to create a balanced dataset of labeledaggregate location time-series
Feature Extraction : Extract various statistics from thetime-series of each ROI
i.e., mean, variance, std, median, min, max, sum
Classification : Train and test the classifier
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 44: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/44.jpg)
Experimental Setup
Target Users : For each dataset, we randomly pick 50 usersfrom 3 mobility groups (highly, mildly, somewhat) and runmembership inference attacks
Sample & Aggregate : Sample groups that include andexclude the target user to create a balanced dataset of labeledaggregate location time-series
Feature Extraction : Extract various statistics from thetime-series of each ROI
i.e., mean, variance, std, median, min, max, sum
Classification : Train and test the classifier
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 45: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/45.jpg)
Experimental Setup
Target Users : For each dataset, we randomly pick 50 usersfrom 3 mobility groups (highly, mildly, somewhat) and runmembership inference attacks
Sample & Aggregate : Sample groups that include andexclude the target user to create a balanced dataset of labeledaggregate location time-series
Feature Extraction : Extract various statistics from thetime-series of each ROI
i.e., mean, variance, std, median, min, max, sum
Classification : Train and test the classifier
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 46: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/46.jpg)
Experimental Setup
Target Users : For each dataset, we randomly pick 50 usersfrom 3 mobility groups (highly, mildly, somewhat) and runmembership inference attacks
Sample & Aggregate : Sample groups that include andexclude the target user to create a balanced dataset of labeledaggregate location time-series
Feature Extraction : Extract various statistics from thetime-series of each ROI
i.e., mean, variance, std, median, min, max, sum
Classification : Train and test the classifier
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 47: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/47.jpg)
Evaluating Raw Aggregates
TFL
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Oys
ters
LR
k-NN
RF
MLP
BEST
Prior : Same Groups As Released
Group Size : 1,000
Inference Period : 1 Week
SFC
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Cab
s
LR
k-NN
RF
MLP
BEST
Prior : Subset of Locations
Group Size : 100
Inference Period : 1 Week
* More experimental results in the paper
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 48: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/48.jpg)
Evaluating Raw Aggregates
TFL
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Oys
ters
LR
k-NN
RF
MLP
BEST
Prior : Same Groups As Released
Group Size : 1,000
Inference Period : 1 Week
SFC
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Cab
s
LR
k-NN
RF
MLP
BEST
Prior : Subset of Locations
Group Size : 100
Inference Period : 1 Week
* More experimental results in the paper
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 49: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/49.jpg)
Evaluating Raw Aggregates
TFL
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Oys
ters
LR
k-NN
RF
MLP
BEST
Prior : Same Groups As Released
Group Size : 1,000
Inference Period : 1 Week
SFC
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Cab
s
LR
k-NN
RF
MLP
BEST
Prior : Subset of Locations
Group Size : 100
Inference Period : 1 Week
* More experimental results in the paper
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 50: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/50.jpg)
Evaluating Raw Aggregates
TFL
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Oys
ters
LR
k-NN
RF
MLP
BEST
Prior : Same Groups As Released
Group Size : 1,000
Inference Period : 1 Week
SFC
0.0 0.2 0.4 0.6 0.8 1.0Area Under Curve (AUC)
0.0
0.2
0.4
0.6
0.8
1.0
CD
F-
Cab
s
LR
k-NN
RF
MLP
BEST
Prior : Subset of Locations
Group Size : 100
Inference Period : 1 Week
* More experimental results in the paper
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 51: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/51.jpg)
Take Aways
Membership inference is successful when the adversary knowsthe locations of a subset of users or the past aggregates forthe same groups on which she performs inference
Privacy leakage on the commuter dataset (TFL) is highercompared to the cab one (SFC)
Users enjoy more privacy on larger groups
Inference is easier if aggregates of longer periods are releasedand at times when mobility patterns are more regular
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 52: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/52.jpg)
Take Aways
Membership inference is successful when the adversary knowsthe locations of a subset of users or the past aggregates forthe same groups on which she performs inference
Privacy leakage on the commuter dataset (TFL) is highercompared to the cab one (SFC)
Users enjoy more privacy on larger groups
Inference is easier if aggregates of longer periods are releasedand at times when mobility patterns are more regular
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 53: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/53.jpg)
Take Aways
Membership inference is successful when the adversary knowsthe locations of a subset of users or the past aggregates forthe same groups on which she performs inference
Privacy leakage on the commuter dataset (TFL) is highercompared to the cab one (SFC)
Users enjoy more privacy on larger groups
Inference is easier if aggregates of longer periods are releasedand at times when mobility patterns are more regular
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 54: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/54.jpg)
Take Aways
Membership inference is successful when the adversary knowsthe locations of a subset of users or the past aggregates forthe same groups on which she performs inference
Privacy leakage on the commuter dataset (TFL) is highercompared to the cab one (SFC)
Users enjoy more privacy on larger groups
Inference is easier if aggregates of longer periods are releasedand at times when mobility patterns are more regular
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 55: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/55.jpg)
Take Aways
Membership inference is successful when the adversary knowsthe locations of a subset of users or the past aggregates forthe same groups on which she performs inference
Privacy leakage on the commuter dataset (TFL) is highercompared to the cab one (SFC)
Users enjoy more privacy on larger groups
Inference is easier if aggregates of longer periods are releasedand at times when mobility patterns are more regular
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 56: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/56.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregatesnoisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 57: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/57.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregatesnoisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 58: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/58.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregatesnoisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 59: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/59.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregatesnoisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 60: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/60.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregates
noisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 61: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/61.jpg)
Evaluating Differentially Private (DP) Mechanisms
We choose a worst-case adversary that obtains perfect priorknowledge for the users
i.e., given raw aggregates she can train a classifier thatachieves AUC score of 1.0
We modify the game, so that the challenger applies a DPmechanism before sending her challenge to the adversary
LPA, GSM, FPA, EFPAG
We evaluate the privacy protection offered by DP mechanismsagainst an adversary that trains the classifier on:
raw aggregatesnoisy aggregates using the defense mechanism underexamination
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 62: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/62.jpg)
Privacy vs. Utility
Privacy Gain : The relative decrease in the adversary’sperformance when challenged on perturbed aggregates vs.raw aggregates
Utility : Mean Relative Error (MRE)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 63: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/63.jpg)
Privacy vs. Utility
Privacy Gain : The relative decrease in the adversary’sperformance when challenged on perturbed aggregates vs.raw aggregates
Utility : Mean Relative Error (MRE)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 64: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/64.jpg)
Privacy vs. Utility
Privacy Gain : The relative decrease in the adversary’sperformance when challenged on perturbed aggregates vs.raw aggregates
Utility : Mean Relative Error (MRE)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 65: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/65.jpg)
Experimental Results - TFL - Group Size: 9,500
Utility (MRE):
Privacy Gain :
Train on Raw Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
Train on Noisy Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 66: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/66.jpg)
Experimental Results - TFL - Group Size: 9,500
Utility (MRE):
Privacy Gain :
Train on Raw Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
Train on Noisy Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 67: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/67.jpg)
Experimental Results - TFL - Group Size: 9,500
Utility (MRE):
Privacy Gain :
Train on Raw Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
Train on Noisy Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 68: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/68.jpg)
Experimental Results - TFL - Group Size: 9,500
Utility (MRE):
Privacy Gain :
Train on Raw Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
Train on Noisy Aggregates
0.01 0.1 1.0 10.0ε
0.00
0.25
0.50
0.75
1.00
Pri
vacy
Gai
n
LPA(∆ / ε) GSM FPA EFPAG LPA(1 / ε)
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 69: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/69.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 70: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/70.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 71: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/71.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 72: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/72.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 73: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/73.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 74: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/74.jpg)
Take Aways
DP mechanisms are overall successful at preventingmembership inference
But, with significant reduction in the utility of the aggregates
A strategic adversary that mimics the behavior of thedefender can reduce the privacy gain offered by a mechanism
Mechanisms specifically designed for time-series settings (e.g.,FPA) achieve better utility
Our methods can be used to evaluate defense mechanisms!
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 75: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/75.jpg)
In Conclusion
We propose a methodology geared to evaluate membershipinference on aggregate location data
We define the adversarial task as a distinguishability gameand use machine learning classification to achieve it
We quantify the inference power with different kinds of priorknowledge and on datasets with different characteristics andshow that raw aggregates leak information about usermembership
We utilize our methods to evaluate the privacy protectionprovided by mechanisms that guarantee differential privacyand find that they prevent membership inference but withsignificant cost in utility
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 76: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/76.jpg)
Future Work
Evaluate membership inference attacks on other location (andnot only) datasets
Examine the mobility characteristics of users that are affectedby the attack more than others
Obtain insights about the design of defenses with better utility
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 77: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/77.jpg)
The end...
Thanks for your attention! Any questions?
Contact Details: [email protected]
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 78: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/78.jpg)
The end...
Thanks for your attention! Any questions?
Contact Details: [email protected]
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data
![Page 79: Knock Knock, Who's There? Membership Inference on ......Knock Knock, Who’s There? Membership Inference on Aggregate Location Data NDSS 2018 Apostolos Pyrgelis 1, Carmela Troncoso](https://reader034.vdocument.in/reader034/viewer/2022052120/6051165ebfa56545053acac4/html5/thumbnails/79.jpg)
The end...
Thanks for your attention! Any questions?
Contact Details: [email protected]
A. Pyrgelis, C. Troncoso, E. De Cristofaro Membership Inference on Aggregate Location Data