Implementations of differentially private analyses

Research Projects and Prototypes

• PINQ: An API implemented in C#.
• Airavat: A MapReduce-based system implemented in Java hardened with SELinux-like access control.
• Fuzz: Time-constant implementation in Caml Light of a domain-specific language.
• GUPT: Implementation of the sample-and-aggregate framework.
• KTELO: A framework and system for answering linear counting queries.

  Real-World Deployments

• OnTheMap: Interactive tool for exploration of US commute patterns.
• RAPPOR: Google Chrome telemetry implementing local differential privacy.
• PSI : A Private data Sharing Interface developed as part of the Harvard University Privacy Tools Project.
• iOS and macOS keyboard statistics with local differential privacy.
• Application usage statistics in Microsoft Windows 10.
• Flex: A SQL-based system developed for internal Uber analytics.
• TensorFlow Privacy: An open-source library for differentially private machine learning.
• Census 2020 synthetic microdata.

  Attacks on Implementations

• Subtle algorithmic or analytical mistakes.
• Timing side-channel attacks. In contrast with timing attacks against implementations of cryptographic algorithms that typically have low leakage rate and must be followed with non-trivial cryptanalysis, a timing channel may lead to a catastrophic compromise of a differentially private system, since a targeted attack can be used to exfiltrate the very bit that the system is designed to hide.
• Leakage through floating-point arithmetic. Differentially private algorithms are typically presented in the language of probability distributions, which most naturally lead to implementations using floating-point arithmetic. The abstraction of floating-point arithmetic is leaky, and without careful attention to details, a naive implementation may fail to provide differential privacy. For example, the support of a textbook sampler of the Laplace distribution is less than 80% of all double-precision floating point numbers; moreover, the support for distributions with different means are not identical. A single sample from a naïve implementation of the Laplace mechanism allows distinguishing between two adjacent datasets with probability more than 35%.
• Timing channel through floating-point arithmetic. Unlike operations over integers that are typically constant-time on modern CPUs, floating-point arithmetic exhibits significant input-dependent timing variability. Handling of subnormals can be particularly slow, as much as by ×100 compared to the typical case.