Guarding Against User Misperceptions of Differential Privacy
Abstract
Differential privacy (DP) is a mathematically rigorous definition of privacy that has gained significant popularity since its formalization in 2006 [32]. It has become the leading technique used to meet the increasing consumer demand for digital privacy [8], and has been recently deployed by major societal actors in both industry and government, including Apple [29], Microsoft [30], Facebook [20], Google [34], Uber [49], and the U.S. Census Bureau [2]. While differential privacy is mathematically precise, it can be difficult to understand: the protections provided by differential privacy are not absolute and require contextualization for citizens and users. There is no clear consensus on how to effectively communicate the complicated technical guarantees of differential privacy to lay-users. This creates substantial risk of both malicious actors and well-intentioned organizations misleading users into disclosing their sensitive information. A malicious organization could, for example, implement a DP system with À = 100 (which provides near-meaningless privacy protection), and choose a misleading DP description that causes users incorrectly believe that they are receiving strong security guarantees. By rigorously examining how users understand and interpret descriptions of differential privacy, we will enable organizations implementing DP systems to (i) provide more transparent and trustworthy descriptions of differential privacy, which (ii) appropriately set user expectations and (iii) enable organizations to transparently and ethically increase necessary data collection. In the Base Period, we will conduct a series of user studies to determine how different, existing descriptions of DP affect user perceptions of the privacy guarantees they receive, and whether their perceptions align with the actual privacy provided by the mathematical definitions, and how their perceptions influence their willingness to share data. In the Option Period, we will develop quantitative metrics for evaluating descriptions of DP based on their accuracy and transparency, and develop tools for providing more interpretable DP descriptions. There is currently little to no work that has been done to standardize the informal descriptions of differentially private systems and prevent such misuse. If successful, the work will allow auditors and analysts to easily identify organizations that misuse DP through misleading descriptions of the privacy guarantees provided by their systems and enable to creation and enforcement of clear privacy laws and regulations. Most importantly, it will protect citizens and users who provide data to these systems by allowing them to make more informed decisions.
Document Details
- Document Type
- DoD Grant Award
- Publication Date
- Aug 01, 2023
- Source ID
- W911NF2110371
Entities
People
- Rachel Cummings
Organizations
- Army Contracting Command
- Columbia University
- Defense Advanced Research Projects Agency