Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions deployments/apple_iconic_scenes_photo_selections_2023.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -22,22 +22,22 @@ deployment:

privacy_loss:
# privacy_unit: ''
# privacy_unit_description: ''
# privacy_unit_details: ''
privacy_parameters:
epsilon: 1.0
delta: 1.5e-7
# privacy_parameters_description: ''
# privacy_parameters_details: ''

deployment_model:
model_name: Local
model_name_description: Local Differential Privacy
model_name_details: Local Differential Privacy
# actors: ''
release_type: Many releases
release_type_description: Image data is collected from users who opted in to the Analytics & Improvements feature on their Apple devices and be used for improving features in Apple’s Photos app.
release_type_details: Image data is collected from users who opted in to the Analytics & Improvements feature on their Apple devices and be used for improving features in Apple’s Photos app.
data_source_type: Dynamic
# data_source_type_description: ''
# data_source_type_details: ''
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

# accounting:
# post_processing: '' # Tier 3
Expand Down
12 changes: 6 additions & 6 deletions deployments/apple_popular_emojis.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -23,27 +23,27 @@ deployment:

privacy_loss:
privacy_unit: Event-level
privacy_unit_description: |
privacy_unit_details: |
Each individual record corresponds to a single emoji-typing event on a user’s device. The function that computes the distance between any two datasets in the data domain is the symmetric distance, and the maximum distance between any two datasets in the data domain is one.
privacy_parameters:
epsilon: 4.0
# privacy_parameters_description: ''
# privacy_parameters_details: ''

deployment_model:
model_name: Local
model_name_description: we choose not to collect raw data on the server which is required for central differential privacy; hence, we adopt local differential privacy, which is a superior form of privacy
model_name_details: we choose not to collect raw data on the server which is required for central differential privacy; hence, we adopt local differential privacy, which is a superior form of privacy
actors: |
- User’s device (client): Hosts raw emoji-selection events and applies the LDP randomizer before any transmission. Users must trust the device’s operating system and DP library to implement DP correctly.
- Network adversary: Any eavesdropper on the transmission channel. They rely on Transport Layer Security encryption. In the worst case, they will see the LDP version of the data, since each emoji event is randomized on device so no raw data ever leaves the user’s device.
- Restricted-access server: Receives privatized records, discards IPs and timestamps, permutes records, then runs sketch-based algorithms to build aggregate histograms. It is assumed that the server correctly strips metadata, but it is not trusted with raw data.
- Internal Apple teams: View the final aggregated, thresholded emoji-frequency histogram.

release_type: Many releases
release_type_description: The histogram is continually refreshed on a daily basis. Data transmission from a user's device occurs once per day, and there is a limit on the number of privatized records that can be transmitted daily.
release_type_details: The histogram is continually refreshed on a daily basis. Data transmission from a user's device occurs once per day, and there is a limit on the number of privatized records that can be transmitted daily.
data_source_type: Dynamic
data_source_type_description: The transmission of privatized records from a user's device to the server happens once per day.
data_source_type_details: The transmission of privatized records from a user's device to the server happens once per day.
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

accounting:
post_processing: |
Expand Down
4 changes: 2 additions & 2 deletions deployments/assistive_ai.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ deployment:
unprotected_quantities: '' # TODO
privacy_loss:
privacy_unit: User-level
# privacy_unit_description: TODO
# privacy_unit_details: TODO
privacy_parameters:
epsilon: 4.0
delta: 1.0e-07
privacy_parameters_description: '"Currently we use differentially private algorithms with privacy parameters (\\(\epsilon\\)=4, \\(\delta\\)< 10-7)."'
privacy_parameters_details: '"Currently we use differentially private algorithms with privacy parameters (\\(\epsilon\\)=4, \\(\delta\\)< 10-7)."'
deployment_model:
model_name: Central
implementation:
Expand Down
8 changes: 4 additions & 4 deletions deployments/audience_engagement.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,17 +18,17 @@ deployment:
unprotected_quantities: '' # TODO
privacy_loss:
privacy_unit: User-month-level
privacy_unit_description: |
privacy_unit_details: |
"insights about members' content engagements while ensuring member (user) data is protected."
privacy_parameters:
epsilon: 34.9
delta: 7.0e-09
privacy_parameters_description: '"With these proposed parameter values (...) and applying Theorem 2, we get a final (34.9, 7 × 10−9)-DP monthly guarantee."'
privacy_parameters_details: '"With these proposed parameter values (...) and applying Theorem 2, we get a final (34.9, 7 × 10−9)-DP monthly guarantee."'
deployment_model:
model_name: Central
model_name_description: '"The privacy model we are interested in for this work is the global privacy setting, where data is already stored centrally, but we want to ensure each result computed on the data is privatized."'
model_name_details: '"The privacy model we are interested in for this work is the global privacy setting, where data is already stored centrally, but we want to ensure each result computed on the data is privatized."'
release_type: Many releases
release_type_description: The data are refreshed on a monthly basis. The budget also resets on a monthly basis.
release_type_details: The data are refreshed on a monthly basis. The budget also resets on a monthly basis.
access_type: Non-interactive # TODO: Is this correct?
implementation:
preprocessing_and_hyperparameter_tuning: '' # TODO: Fill in correct value
Expand Down
8 changes: 4 additions & 4 deletions deployments/autoplay_intent.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,15 @@ deployment:
unprotected_quantities: '' # TODO
privacy_loss:
privacy_unit: User-level
# privacy_unit_description: TODO
# privacy_unit_details: TODO
privacy_parameters:
epsilon: 8.0
privacy_parameters_description: '"For this use case, we set the parameters for CMS to be m = 1024, k = 65,536, and \\(\epsilon\\) = 8."'
privacy_parameters_details: '"For this use case, we set the parameters for CMS to be m = 1024, k = 65,536, and \\(\epsilon\\) = 8."'
deployment_model:
model_name: Local
model_name_description: '"[W]e choose not to collect raw data on the server which is required for central differential privacy; hence, we adopt local differential privacy, which is a superior form of privacy..."'
model_name_details: '"[W]e choose not to collect raw data on the server which is required for central differential privacy; hence, we adopt local differential privacy, which is a superior form of privacy..."'
release_type: One release # TODO: Is this correct?
release_type_description: Daily
release_type_details: Daily
access_type: Non-interactive # TODO: Is this correct?
implementation:
preprocessing_and_hyperparameter_tuning: '' # TODO: Fill in correct value
Expand Down
8 changes: 4 additions & 4 deletions deployments/birth_dataset.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,19 +16,19 @@ deployment:
variant_name: Pure DP
privacy_loss:
privacy_unit: Birth-level
# privacy_unit_description: TODO
# privacy_unit_details: TODO
privacy_parameters:
epsilon: 9.98
privacy_parameters_description: |
privacy_parameters_details: |
"The privacy loss budget was allocated as follow: \\(\epsilon = 4\\) for fitting the generative model;
\\(\epsilon = 0.99\\) for evaluating of the dataset with a list of predefined of acceptance criteria;
and a factor 2 is applied due to the private selection process. Therefore, the overall privacy loss budget
is \\(\epsilon = 9.98\\)."
deployment_model:
model_name: Central
# model_name_description: TODO
# model_name_details: TODO
release_type: One release
release_type_description: Static
release_type_details: Static
access_type: Non-interactive
implementation:
preprocessing_and_hyperparameter_tuning: '' # TODO: Fill in correct value
Expand Down
12 changes: 6 additions & 6 deletions deployments/broadband_coverage.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,24 +21,24 @@ deployment:
privacy_loss:
privacy_unit: |
User-level
privacy_unit_description: Neighboring datasets are defined to be the addition or deletion of a single user in the data and all possible records of that user. The function that computes the distance between any two datasets in the data domain is the symmetric distance, and the maximum distance between any two datasets in the data domain is 1.
privacy_unit_details: Neighboring datasets are defined to be the addition or deletion of a single user in the data and all possible records of that user. The function that computes the distance between any two datasets in the data domain is the symmetric distance, and the maximum distance between any two datasets in the data domain is 1.
privacy_parameters:
epsilon: 0.2
# privacy_parameters_description: ''
# privacy_parameters_details: ''

deployment_model:
model_name: Central
# model_name_description: ''
# model_name_details: ''
actors: |
- Users whose devices connect to Microsoft services. They must trust Microsoft to handle their data and apply the DP protections as described.
- Microsoft (Curator): collects the raw telemetry data, applies the Laplace mechanism to produce differentially private counts, and publishes the final data product.
- Data Consumers: includes “researchers and policy makers” and “federal, state, and local agencies” who only have access to the final, public data product and cannot see the underlying private data. They do not need to be trusted, as they only ever access the data product produced under DP.
release_type: One release
# release_type_description: ''
# release_type_details: ''
data_source_type: Dynamic
data_source_type_description: Microsoft collects data “as part of our ongoing work to improve our software and services performance and security”. The data is generated continuously, as “every time a device receives an update or connects to a Microsoft service, we can estimate the throughput speed”.
data_source_type_details: Microsoft collects data “as part of our ongoing work to improve our software and services performance and security”. The data is generated continuously, as “every time a device receives an update or connects to a Microsoft service, we can estimate the throughput speed”.
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

accounting:
post_processing: |
Expand Down
12 changes: 6 additions & 6 deletions deployments/census_demographic_and_housing.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ deployment:

privacy_loss:
privacy_unit: Person-level; housing-unit-level
privacy_unit_description: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_unit_details: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_parameters:
rho: 15.29
privacy_parameters_description: |
privacy_parameters_details: |
- The final global privacy-loss budget for the 2020 Demographic and Housing Characteristics Data was \\(\rho\\) = 15.29, which was split between the person and the housing unit data:
- Person Tables: \\(\rho\\) = 4.96 was used (corresponding to \\(\epsilon\\)=26.34 and \\(\delta = 10^{-10}\\).
- Housing Unit Tables: \\(\rho\\) = 7.70 was used (corresponding to \\(\epsilon\\) = 34.33 and \\(\delta = 10^{-10}\\).
Expand All @@ -42,7 +42,7 @@ deployment:

deployment_model:
model_name: Central
# model_name_description: ''
# model_name_details: ''
actors: |
- Curator: U.S. Census Bureau: collects, stores, and protects the confidential data
- Data subjects: The respondents of the 2020 Census, comprising over 331 million people in the United States. Their trust in the curator's ability to protect their data is essential for the quality of the census. This trust is rationalized by the Bureau's legal mandate under Title 13 of the U.S. Code to protect respondent confidentiality, a requirement reinforced by a lifelong oath taken by every employee.
Expand All @@ -51,11 +51,11 @@ deployment:


release_type: One release
# release_type_description: ''
# release_type_details: ''
data_source_type: Static
# data_source_type_description: ''
# data_source_type_details: ''
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

accounting:
post_processing: |
Expand Down
12 changes: 6 additions & 6 deletions deployments/census_detailed_demographic_and_housing_a.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -30,17 +30,17 @@ deployment:

privacy_loss:
privacy_unit: Person-level
privacy_unit_description: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_unit_details: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_parameters:
rho: 19.776
privacy_parameters_description: |
privacy_parameters_details: |
- The final global privacy-loss budget for the 2020 Detailed Demographic and Housing Characteristics A data was \\(\rho\\) = 19.776.
- This global budget is not applied uniformly. It is strategically allocated across different geographic levels (e.g., state, county, tract, block, tribal area) and then further divided among specific data queries (e.g., total population, race, voting age) at each of those levels. The precise allocation proportions are detailed on page 4-3 of the Detailed DHC-A Technical Documentation paper.


deployment_model:
model_name: Central
# model_name_description: ''
# model_name_details: ''
actors: |
- Curator: U.S. Census Bureau: collects, stores, and protects the confidential data
- Data subjects: The respondents of the 2020 Census, comprising over 331 million people in the United States. Their trust in the curator's ability to protect their data is essential for the quality of the census. This trust is rationalized by the Bureau's legal mandate under Title 13 of the U.S. Code to protect respondent confidentiality, a requirement reinforced by a lifelong oath taken by every employee.
Expand All @@ -49,11 +49,11 @@ deployment:


release_type: One release
# release_type_description: ''
# release_type_details: ''
data_source_type: Static
# data_source_type_description: ''
# data_source_type_details: ''
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

accounting:
post_processing: |
Expand Down
12 changes: 6 additions & 6 deletions deployments/census_detailed_demographic_and_housing_b.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -30,17 +30,17 @@ deployment:

privacy_loss:
privacy_unit: Person-level
privacy_unit_description: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_unit_details: The privacy unit is person-level records for Person tables and housing-unit-level records for Housing Unit tables. The system uses a “bounded neighbors” definition of adjacency because the total population count of the United States and Puerto Rico is held invariant. Therefore, adjacent datasets are two CEFs that differ by the modification of a single person's record (e.g., a change to a person’s census block location), while the total number of records remains the same. The function that computes the distance between any two datasets in the data domain is the change-one distance, and the maximum distance between any two datasets in the data domain is one.
privacy_parameters:
rho: 17.79
privacy_parameters_description: |
privacy_parameters_details: |
- The final global privacy-loss budget for the 2020 Detailed Demographic and Housing Characteristics B data was \\(\rho\\) = 17.79.
- This global budget is not applied uniformly. It is strategically allocated across different detailed and regional geographic levels (e.g., state, county, Census tract) and then further divided household type and tenure at each of those levels. The precise allocation proportions are detailed on page 4-3 of the Detailed DHC-B Technical Documentation paper.


deployment_model:
model_name: Central
# model_name_description: ''
# model_name_details: ''
actors: |
- Curator: U.S. Census Bureau: collects, stores, and protects the confidential data
- Data subjects: The respondents of the 2020 Census, comprising over 331 million people in the United States. Their trust in the curator's ability to protect their data is essential for the quality of the census. This trust is rationalized by the Bureau's legal mandate under Title 13 of the U.S. Code to protect respondent confidentiality, a requirement reinforced by a lifelong oath taken by every employee.
Expand All @@ -49,11 +49,11 @@ deployment:


release_type: One release
# release_type_description: ''
# release_type_details: ''
data_source_type: Static
# data_source_type_description: ''
# data_source_type_details: ''
access_type: Non-interactive
# access_type_description: ''
# access_type_details: ''

accounting:
post_processing: |
Expand Down
Loading
Loading