CoChat
Sign Up
Cited by 378Privacy-Preserving Technologies in DataInternet Traffic Analysis and Secure E-votingPrivacy, Security, and Data Protection

Prochlo: Strong Privacy for Analytics in the Crowd

Open access
Bittau, Andrea, Erlingsson, Úlfar, Maniatis, Petros, Mironov, Ilya, Raghunathan, Ananth, Lie, David, Rudominer, Mitch, Kode, Ushasree +2 more·2017·Proceedings of the 26th Symposium on Operating Systems Principles
DOI 10.1145/3132747.3132769
Open this paper in CoChat — free accountOpen PDF

Abstract

The large-scale monitoring of computer users' software activities has become commonplace, e.g., for application telemetry, error reporting, or demographic profiling. This paper describes a principled systems architecture---Encode, Shuffle, Analyze (ESA)---for performing such monitoring with high utility while also protecting user privacy. The ESA design, and its Prochlo implementation, are informed by our practical experiences with an existing, large deployment of privacy-preserving software monitoring.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3132747.3132769

Cites

43 of 43 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Hamer et al. [219] proposed a communication-efficient federated algorithm for learning mixture weights on an ensemble of pre-trained models, based on communicating only a subset of the models to any one device.

    “Hamer et al. [219] proposed a communication-efficient federated algorithm for learning mixture weights on an ensemble of pre-trained models, based on communicating only a subset of the models to any one device;”

    From Advances and Open Problems in Federated Learning (2021) · cites this paper as [219]

    The passages in §3.2 (Encoder) concern fragmenting user data for privacy, while §5.5 (Flix: Collaborative Filtering) concerns collecting movie-rating statistics. Searches for Hamer’s proposed algorithm and for sending only a subset of models to each device found no passage about learning mixture weights over pre-trained models. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

7 of the 50 references couldn’t be matched to a known paper.

Research works printed but not linked: 32

  1. ABADI, M., BARHAM, P., CHEN, J., CHEN, Z., DAVIS, A., DEAN, J., DEVIN, M., GHEMAWAT, S., IRVING, G., ISARD, M., KUDLUR, M., LEVENBERG, J., MONGA, R., MOORE, S., MURRAY, D. G., STEINER, B., TUCKER, P., VASUDEVAN, V., WARDEN, P., WICKE, M., YU, Y., AND ZHENG, X. Tensorflow: A system for large-scale machine learning. In Proc. of 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI) (2016), pp. 265- 283.
  2. ABADI, M., BONEH, D., MIRONOV, I., RAGHUNATHAN, A., AND SEGEV, G. Message-Locked Encryption for Lock- Dependent Messages. In Advances in Cryptology-CRYPTO (2013), pp. 374-391.
  3. ABADI, M., ERLINGSSON, Ú., GOODFELLOW, I., MCMA- HAN, H. B., PAPERNOT, N., MIRONOV, I., TALWAR, K., AND ZHANG, L. On the Protection of Private Information in Machine Learning Systems: Two Recent Approaches. In Proc. of IEEE 30th Computer Security Foundations Sympo- sium (CSF) (2017), pp. 1-6.
  4. AVENT, B., KOROLOVA, A., ZEBER, D., HOVDEN, T., AND LIVSHITS, B. BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model. In Proc. of the 26th USENIX Security Symposium (2017), pp. 747-764.
  5. BASSILY, R., NISSIM, K., STEMMER, U., AND THAKURTA, A. Practical Locally Private Heavy Hitters. CoRR abs/1707.04982 (2017). http://arxiv.org/abs/1707.04982. · arXiv
  6. BELLARE, M., KEELVEEDHI, S., AND RISTENPART, T. Message-Locked Encryption and Secure Deduplication. In Advances in Cryptology-EUROCRYPT (2013), pp. 296- 312.
  7. BULCK, J. V., WEICHBRODT, N., KAPITZA, R., PIESSENS, F., AND STRACKX, R. Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Exe- cution. In Proc. of 26th USENIX Security Symposium (2017), pp. 1041-1056.
  8. BUSE, R. P. L., AND ZIMMERMANN, T. Information Needs for Software Development Analytics. In Proc. of the 34th International Conference on Software Engineering (ICSE) (2012), pp. 987-996.
  9. CHEN, R., REZNICHENKO, A., FRANCIS, P., AND GEHRKE, J. Towards Statistical Queries over Distributed Private User Data. In Proc. of the 9th USENIX Conference on Networked Systems Design and Implementation (NSDI) (2012), pp. 169- 182.
  10. CORRIGAN-GIBBS, H., AND BONEH, D. Prio: Private, Robust, and Scalable Computation of Aggregate Statistics. In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NDSI) (2017), pp. 259-282.
  11. DANG, H., DINH, T. T. A., CHANG, E.-C., AND OOI, B. C. Privacy-Preserving Computation with Trusted Computing via Scramble-then-Compute. Proceedings on Privacy Enhancing Technologies, 3 (2017), 18-35.
  12. DENNING, D. E. R. Cryptography and Data Security. Addison-Wesley, Boston, MA, USA, 1982.
  13. DINH, T. T. A., SAXENA, P., CHANG, E.-C., OOI, B. C., AND ZHANG, C. M2R: Enabling Stronger Privacy in MapRe- duce Computation. In Proc. of the 24th USENIX Security Symposium (2015), pp. 447-462.
  14. DWORK, C. Differential Privacy: A Survey of Results. In In- ternational Conference on Theory and Applications of Mod- els of Computation (TAMC) (2008), pp. 1-19.
  15. GABOARDI, M., HONAKER, J., KING, G., NISSIM, K., ULLMAN, J., AND VADHAN, S. P. PSI (Ψ): A Private data Sharing Interface. CoRR abs/1609.04340 (2016). http: //arxiv.org/abs/1609.04340. · arXiv
  16. JOHNSON, N., NEAR, J. P., AND SONG, D. Towards Practi- cal Differential Privacy for SQL Queries. CoRR abs/1706.09479 (2017). https://arxiv.org/abs/1706.09479. · arXiv
  17. LEE, S., SHIH, M.-W., GERA, P., KIM, T., KIM, H., AND PEINADO, M. Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing. In Proc. of the 26th USENIX Security Symposium (2017), pp. 557-574.
  18. LIE, D., AND MANIATIS, P. Glimmers: Resolving the Pri- vacy/Trust Quagmire. In Proc. of the 16th Workshop on Hot Topics in Operating Systems (HotOS) (2017), pp. 94-99.
  19. MANIATIS, P., AND BAKER, M. Secure History Preserva- tion Through Timeline Entanglement. In Proc. of the 11th USENIX Security Symposium (2002), pp. 297-312.
  20. MANIATIS, P., MIRONOV, I., AND TALWAR, K. Oblivious Stash Shuffle. CoRR abs/1709.07553 (2017). https:// arxiv.org/abs/1709.07553. · arXiv
  21. MOHAN, P., THAKURTA, A., SHI, E., SONG, D., AND CULLER, D. GUPT: Privacy Preserving Data Analysis Made Easy. In Proc. of the 2012 ACM SIGMOD International Con- ference on Management of Data (2012), pp. 349-360.
  22. OHRIMENKO, O., GOODRICH, M. T., TAMASSIA, R., AND UPFAL, E. The Melbourne Shuffle: Improving Oblivious Storage in the Cloud. In Automata, Languages, and Pro- gramming: 41st International Colloquium, ICALP 2014, Part II (2014), pp. 556-567.
  23. RAVINDRANATH, L., PADHYE, J., AGARWAL, S., MAHA- JAN, R., OBERMILLER, I., AND SHAYANDEH, S. AppIn- sight: Mobile App Performance Monitoring in the Wild. In Proc. of the 10th USENIX Conference on Operating Systems Design and Implementation (OSDI) (2012), pp. 107-120.
  24. ROY, I., SETTY, S. T. V., KILZER, A., SHMATIKOV, V., AND WITCHEL, E. Airavat: Security and Privacy for MapRe- duce. In Proc. of the 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2010), pp. 297- 312.
  25. SALTZER, J. H., AND SCHROEDER, M. D. The Protection of Information in Computer Systems. Proc. of the IEEE 63, 9 (1975), 1278-1308.
  26. TANG, J., KOROLOVA, A., BAI, X., WANG, X., AND WANG, X. Privacy Loss in Apple's Implementation of Dif- ferential Privacy on macOS 10.12. arXiv:1709.02753 (2017). https://arxiv.org/abs/1709.02753. · arXiv
  27. VALLINA-RODRIGUEZ, N., SUNDARESAN, S., RAZAGH- PANAH, A., NITHYANAND, R., ALLMAN, M., KREIBICH, C., AND GILL, P. Tracking the Trackers: Towards Under- standing the Mobile Advertising and Tracking Ecosystem. CoRR abs/1609.07190 (2016). http://arxiv.org/abs/ 1609.07190. · arXiv
  28. VAN DEN HOOFF, J., LAZAR, D., ZAHARIA, M., AND ZEL- DOVICH, N. Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis. In Proc. of the 25th Symposium on Oper- ating Systems Principles (SOSP) (2015), pp. 137-152.
  29. VIEGA, J., CHANDRA, P., AND MESSIER, M. Network Security with OpenSSL, 1st ed. O'Reilly & Associates, Inc., Sebastopol, CA, USA, 2002.
  30. WANG, T., BLOCKI, J., LI, N., AND JHA, S. Locally Differ- entially Private Protocols for Frequency Estimation. In Proc. of the 26th USENIX Security Symposium (2017), pp. 729- 745.
  31. WARNER, S. L. Randomized Response: A Survey Technique for Eliminating Evasive Answer Bias. J. of the American Statistical Association 60, 309 (1965), 63-69.
  32. ZHENG, W., DAVE, A., BEEKMAN, J. G., POPA, R. A., GONZALEZ, J. E., AND STOICA, I. Opaque: An Oblivious and Encrypted Distributed Analytics Platform. In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2017), pp. 283-298.

Cited by

Sorted by citations

Related

Authors
Bittau, A., Erlingsson, Ú., Maniatis, P., Mironov, I., Raghunathan, A., Lie, D., Rudominer, M., Kode, U., Tinnes, J., & Seefeld, B.
Affiliations
  • Google (United States) (US)
  • University of Toronto (CA)
ORCID
Venue
Proceedings of the 26th Symposium on Operating Systems Principles
Publisher
ACM
Published
2017-10-14
Pages
441-459
DOI
10.1145/3132747.3132769
OpenAlex
W2761138375
Cited by
378
References
50
Citations by year
2026: 22 · 2025: 37 · 2024: 55 · 2023: 46 · 2022: 50 · 2021: 70 · 2020: 46 · 2019: 36 · 2018: 12 · 2017: 4
FWCI
11.96
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
  • ACM SIGOPS Symposium on Operating Systems Principles (SOSP) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • TSpace (University of Toronto) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
user privacy, privacy-preserving monitoring, telemetry, error reporting, demographic profiling, system architecture

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review