5 ms·

Do these methods provide any guarantees or is it assumed that a human reviews the output to verify that it was properly anonymized?

frankmcsherry 6y ago
> Data anonymized with Amnesia are statistically guaranteed that they cannot be linked to the original data. It looks like (from other text on their site) they use variants on k-anonymity. This can prevent re-linking attacks back to the original data, but we've also known for a decade that this isn't especially strong. For example, two independent k-anonymous releases can unique identify everyone in the dataset[0]. [0]: https://dl.acm.org/doi/10.1145/1401890.1401926 https://dl.acm.org/doi/10.1145/1401890.1401926
- La1n 6y ago
  However that statistical guarantee also requires your pseudoidentifiers to be picked correctly, i.e. it only holds true if you select all variables the attacker could possibly know about a subject. I think that is the hard part here, it's not something I would recommend someone doing without a lot of research and experience for highly dimensional data.
  - antisyzygy 6y ago
    Right. Even if you assume the worst-case-scenario there isn't some standard risk metric nor threshold to meet. I feel like differential privacy is the strongest definition we have, but it is also lacking from a practical standpoint. What does it mean to have N nats/bits of information gain from seeing the result of a query? How does this translate to my risk of a PII leak?
specialist 6y ago
The very best case for Amnesia: veneer of GDPR compliance, maybe survive an audit. Clients are buying plausible deniability, hedging their liability. "Yes, we regrettably leaked sensitive data. But we followed all the rules. What more could we possibly do?"
- teraku 6y ago
  "Not save my data in illegal ways" Edit: "Not save my data"
  - specialist 6y ago
    This product is for orgs sharing data.
    - corty 6y ago
      Even more illegal.
      - ghaff 6y ago
        There are plenty of valid reasons to share data, e.g. for medical research among others.
        iso1631 6y ago
        Then get informed consent
        jacquesm 6y ago
        That's a must. In some countries this is now automated at the government level, Belgium for instance has an excellent consent mechanism for medical data.
        ghaff 6y ago
        Right. But that still involves anonymizing data. I'd also point out that there is a huge amount of COVID data being shared at the moment and, outside of vaccine trials, I'd be pretty certain a lot of it is not under any sort of informed consent. (As is true of a lot of population statistics generally.)
      - jacquesm 6y ago

frankmcsherry 6y ago

> Data anonymized with Amnesia are statistically guaranteed that they cannot be linked to the original data. It looks like (from other text on their site) they use variants on k-anonymity. This can prevent re-linking attacks back to the original data, but we've also known for a decade that this isn't especially strong. For example, two independent k-anonymous releases can unique identify everyone in the dataset[0]. [0]: https://dl.acm.org/doi/10.1145/1401890.1401926 https://dl.acm.org/doi/10.1145/1401890.1401926

La1n 6y ago
However that statistical guarantee also requires your pseudoidentifiers to be picked correctly, i.e. it only holds true if you select all variables the attacker could possibly know about a subject. I think that is the hard part here, it's not something I would recommend someone doing without a lot of research and experience for highly dimensional data.
- antisyzygy 6y ago
  Right. Even if you assume the worst-case-scenario there isn't some standard risk metric nor threshold to meet. I feel like differential privacy is the strongest definition we have, but it is also lacking from a practical standpoint. What does it mean to have N nats/bits of information gain from seeing the result of a query? How does this translate to my risk of a PII leak?

specialist 6y ago

The very best case for Amnesia: veneer of GDPR compliance, maybe survive an audit. Clients are buying plausible deniability, hedging their liability. "Yes, we regrettably leaked sensitive data. But we followed all the rules. What more could we possibly do?"

teraku 6y ago
"Not save my data in illegal ways" Edit: "Not save my data"
- specialist 6y ago
  This product is for orgs sharing data.
  - corty 6y ago
    Even more illegal.
    - ghaff 6y ago
      There are plenty of valid reasons to share data, e.g. for medical research among others.
      - iso1631 6y ago
        Then get informed consent
        jacquesm 6y ago
        That's a must. In some countries this is now automated at the government level, Belgium for instance has an excellent consent mechanism for medical data.
        ghaff 6y ago
        Right. But that still involves anonymizing data. I'd also point out that there is a huge amount of COVID data being shared at the moment and, outside of vaccine trials, I'd be pretty certain a lot of it is not under any sort of informed consent. (As is true of a lot of population statistics generally.)
    - jacquesm 6y ago