repository·main·Indexed 25 days ago
https://github.com/google/differential-privacyA collection of libraries and frameworks for implementing differential privacy (DP) in Go, C++, Java, Python, Kotlin, and Scala. It provides low-level mathematical building blocks, high-level data pipelines, and Privacy Loss Distributions (PLDs) for accounting tools. The project includes a PostgreSQL extension (anon_func) that provides epsilon-DP aggregate functions such as ANON_COUNT, ANON_SUM, ANON_AVG, ANON_VAR, ANON_STDDEV, and ANON_NTILE.
Privacy on Beam is an end-to-end differential privacy solution built on Apache Beam. It is designed to be accessible to developers without deep differential privacy expertise by automating essential steps such as noise addition, partition selection, and contribution bounding.
Note: Privacy on Beam is currently only available in Go.
This repository provides several tools for generating ε- and (ε, δ)-differentially private (DP) statistics. The tools are categorized into high-level frameworks and low-level building blocks:
This library provides a collection of algorithms for computing differentially private statistics over data. The algorithms are designed to be used without requiring deep mathematical knowledge, as the mathematical complexity is encapsulated within the algorithms themselves.
Differential privacy manages the tradeoff between the accuracy of aggregations (e.g., mean) and the privacy of individual records. Unlike other anonymization schemes, differential privacy degrades gracefully as more data is released.
DP-Auditorium is a library for auditing differential privacy guarantees. The core components are:
dp_auditorium/testers/): Contains PropertyTesters that check if a privacy guarantee holds on a fixed pair of datasets.dp_auditorium/generators/): Contains DatasetGenerators that output pairs of neighboring datasets (e.g., under the add/remove relation).dp_auditorium/mechanisms/): Contains examples of private and non-private mechanisms.privacy_test_runner.py): A module that specializes a tester and a generator to conduct tests on datasets' trials.dp_auditorium/examples/): Contains usage examples combining these tools.The Differential Privacy Accounting tools provide implementations of Privacy Loss Distributions (PLDs). These tools help compute accurate estimates of the total privacy budget (ε, δ) across multiple executions of differentially private aggregations.
Supported mechanisms include:
The dp_accounting library provides tools for tracking differential privacy budgets. It allows you to describe complex mechanisms (like Laplace, Gaussian, and subsampling mechanisms) and their compositions using DpEvent classes. The PrivacyAccountant classes can then ingest these events to calculate the ε (epsilon) and δ (delta) of the composite mechanism.
Supported accounting methods include:
Requirements:
The DP Building Block Libraries are designed to provide differentially private output under specific security assumptions. To use these libraries safely, developers must ensure their higher-level framework addresses the following constraints:
epsilon and delta must be configured to ensure the output does not reveal specific individual contributions.To build the PipelineDP4j sources and dependencies, use bazelisk. Navigate to the pipelinedp4j directory and run the build command.
cd pipelinedp4j
bazelisk build ...After starting the container, connect to the database using psql and load the differential privacy extension by executing the CREATE EXTENSION command.
psql -U postgres -h localhost -p 5432password when prompted.CREATE EXTENSION anon_func;For algorithms like BoundedSum, the library assumes maxContributionsPerPartitions is 1. If a single privacy unit (e.g., a visitor) can contribute multiple times to the same partition (e.g., multiple visits in one day), you should pre-aggregate those values manually before calling addEntry().
This prevents the library from overestimating sensitivity and adding unnecessary noise. When pre-aggregating, ensure you adjust the upper bound of your BoundedSum to reflect the maximum possible cumulative amount a user can contribute to a single partition.
// For each visitor, pre-aggregate their spending for the day.
Map<String, Integer> visitorToDaySpending = new HashMap<>();
for (Visit v : boundedVisits.getVisitsForDay(d)) {
String visitorId = v.visitorId();
if (visitorToDaySpending.containsKey(visitorId)) {
int newAmount = visitorToDaySpending.get(visitorId) + v.eurosSpent();
visitorToDaySpending.put(visitorId, newAmount);
} else {
visitorToDaySpending.put(visitorId, v.eurosSpent());
}
}
// Then use the aggregated values in BoundedSum with an appropriate upper bound
private static final int MAX_EUROS_SPENT = 65; // Adjusted for cumulative spending
...
BoundedSum dpSum =
BoundedSum.builder()
.epsilon(LN_3)
.maxPartitionsContributed(MAX_CONTRIBUTED_DAYS)
.lower(MIN_EUROS_SPENT)
.upper(MAX_EUROS_SPENT)
.build();