privacy impact assessment

Recent critiques have challenged the differential privacy guarantees of PATE-GAN and PrivBayes, questioning the validity of their privacy-utility trade-offs. However, these critiques rely on restrictive assumptions—such as synthetic or simplistic data distributions—and limited experimental settings, potentially biasing their conclusions. Method: We propose a more general privacy-utility evaluation framework that integrates privacy game analysis and theoretical verification, and conduct k-anonymity benchmarking experiments on real-world datasets without distributional assumptions. Contribution/Results: Under identical privacy budgets, both PATE-GAN and PrivBayes significantly outperform k-anonymity in statistical utility while maintaining strong differential privacy guarantees. We demonstrate that prior claims of “privacy failure” stem from flawed evaluation premises—specifically, the absence of rigorous privacy accounting and realistic data assumptions. Our empirical analysis refutes these criticisms and establishes synthetic data generation as a robust and effective privacy-enhancing technology.

This work addresses the challenge non-technical users face in understanding the trade-off between privacy loss parameters and the reliability of statistical inference in differential privacy. By reframing the privacy–utility trade-off within a hypothesis testing framework, the paper introduces the concept of “relative disclosure risk,” which directly links privacy loss parameters to the validity of statistical inference. Through theoretical analysis of how differentially private mechanisms affect the significance of hypothesis tests, the study quantifies the uncertainty introduced by randomization and its effectiveness in mitigating membership inference attacks. The resulting insights yield an actionable guideline for non-expert users to select appropriate privacy mechanisms, thereby promoting transparent deployment and principled configuration of differential privacy in practical applications.

Balancing privacy preservation and data utility remains a critical challenge in sharing sensitive behavioral health data. Method: We propose a high-utility synthetic data generation framework grounded in differential privacy (DP), integrating physiological signals from Oura rings with self-reported survey data and employing an Adaptive Iterative Mechanism (AIM) to produce ε=5-DP-compliant synthetic datasets. Contribution/Results: We introduce a task-oriented utility evaluation framework that quantitatively characterizes the trade-off between privacy budget and statistical/predictive utility across high-dimensional, large-scale behavioral health data. Experiments demonstrate that the synthetic data retain downstream modeling performance—e.g., depression risk prediction—nearly equivalent to the original data, while substantially reducing re-identification risk. To our knowledge, this is the first empirical validation in a real-world behavioral health setting that strong privacy protection (ε ≤ 5) and high data usability can be simultaneously achieved. Our work provides a reproducible technical pathway and evidence-based guidance for secure, privacy-preserving open sharing of sensitive health data.

This study addresses a fundamental tension between differential privacy and data valuation: the former requires insensitivity to individual records, while the latter demands precise quantification of each data point’s contribution. The work systematically analyzes how mainstream valuation methods—such as Shapley values and influence functions—fail under differential privacy constraints, identifying high-sensitivity components within these algorithms. It proposes design principles for privacy-friendly valuation mechanisms and employs sensitivity analysis alongside privacy-utility trade-off evaluations to reveal the limitations of current approaches in preserving the discriminative power of rare samples. By delineating the feasible boundaries of private data valuation, this research lays a theoretical foundation for developing practical mechanisms that jointly uphold privacy guarantees and valuation utility.

Existing mainstream privacy models suffer from fundamental limitations: k-anonymity operates syntactically, rendering it vulnerable to background knowledge attacks and lacking semantic constraints; differential privacy faces a sharp utility–privacy trade-off—small privacy budgets cause severe data distortion, while large budgets degrade privacy guarantees. Method: We propose Semantic k-Anonymity, which formally incorporates domain-specific semantic constraints and dependencies among sensitive attributes to reconstruct the equivalence-class partitioning mechanism—enhancing disclosure resistance without compromising data utility. Contribution/Results: Through rigorous formal modeling, principled semantic constraint design, and empirical risk assessment, we demonstrate that Semantic k-Anonymity achieves more robust privacy protection and higher data utility than conventional k-anonymity and differential privacy in realistic settings, thereby reducing reliance on post-hoc risk evaluation.

This paper addresses the lack of transparency and reusability in differential privacy (DP) practice by introducing the first public, structured DP deployment registry. Methodologically, it proposes a hierarchical DP deployment description framework spanning use cases, mechanisms, parameters, evaluation methodologies, and governance; designs an interactive platform supporting multidimensional search and visualization; and populates it with 21 real-world deployments. Key contributions include: (1) the first systematic definition of a DP deployment metadata model, enhancing technical interpretability; (2) positioning the registry as an interdisciplinary community hub to foster experience sharing and accountability; and (3) empirically validating its utility for knowledge dissemination and deployment guidance through a user study with 16 practitioners—while identifying critical adoption barriers, including insufficient parameter disclosure and absence of standardized evaluation criteria.

This study investigates how data users comprehend and respond to statistical noise introduced by privacy-preserving techniques—particularly differential privacy (DP)—focusing on cognitive challenges in constructing confidence intervals and navigating utility–privacy trade-offs. Through scenario-based interviews, we observed users analyzing Wikipedia browsing data perturbed by DP and rounding mechanisms. Results indicate that users prefer simple uncertainty metrics but struggle to robustly construct confidence intervals under compound noise sources; DP-perturbed data, compared to rounded data, more frequently elicits simulation-based inferential practices. Based on these findings, we propose a simulation-driven paradigm for uncertainty assessment and provide empirically grounded, actionable recommendations for privacy-aware data documentation and the design of interactive analytical tools.

Financial data sharing faces a fundamental trade-off between privacy preservation and utility retention, as conventional anonymization techniques often fail to meet both regulatory compliance and analytical requirements. This work proposes a “privacy-first” framework that innovatively decouples identity from utility by integrating differentially private synthetic data generation. It introduces two complementary paradigms: direct tabular synthesis for high-fidelity static analysis, and a differentially private seed-driven agent-based modeling (DP-Seeded ABM) approach to simulate dynamic market behaviors and black swan events. By rigorously guaranteeing privacy while preserving analytical utility, the framework overcomes the limitations of static datasets, effectively dismantles institutional barriers to data sharing, and enables compliant cross-organizational research and forward-looking decision-making.

This work systematically uncovers an inherent privacy vulnerability in data curation pipelines: even when the final model is trained exclusively on publicly available data, the process of using private data to guide dataset selection can inadvertently leak membership information about the private data. To demonstrate this risk, we propose a novel membership inference attack targeting three distinct stages of the curation pipeline—score computation, subset selection, and final model training—and validate its effectiveness across mainstream data selection algorithms. Furthermore, we design a tailored defense mechanism integrating differential privacy into the curation process. Empirical evaluations show that our approach significantly mitigates information leakage at each stage while preserving utility.

This study addresses the dual challenges of privacy leakage from real user interaction data in AI training and insufficient representativeness of public datasets. We propose an end-to-end differentially private synthetic data generation framework for multimodal data (images, tabular, and text). Methodologically, it integrates sensitive data preprocessing, adaptive privacy budget allocation, generative-model-driven synthesis, and empirical privacy auditing, supporting both centralized and decentralized deployment. Our key contributions are: (1) the first systematic formulation of a synthetic data generation paradigm that jointly ensures distributional fidelity and rigorous (ε,δ)-differential privacy; (2) substantially improved cross-modal applicability and deployment trustworthiness; and (3) empirical validation demonstrating high data utility—even under stringent privacy constraints (ε ≤ 2)—enabling secure data sharing and reuse as a robust alternative to conventional anonymization techniques.