Secure Noise Addition in Floating-Point Numbers

Secure noise addition in floating-point numbers is provided. It is determined whether digits of a mantissa of a summed floating-point number include a set of trailing zeros at an end of the mantissa of the summed floating-point number. In response to determining that the digits of the mantissa of the summed floating-point number include the set of trailing zeros at the end of the mantissa of the summed floating-point number, the set of trailing zeros at the end of the mantissa of the summed floating-point number is replaced with a set of digits selected from a group of random digits to form an output floating-point number that is free from traces of a sensitive non-integer input value satisfying differential privacy guarantee of data security immune from floating-point attack.

BACKGROUND

The disclosure relates generally to differential privacy and more specifically to adding noise to data.

Differential privacy is a mathematical framework for ensuring the security of data. Differential privacy guarantees data security by allowing data to be analyzed without revealing sensitive information contained within the data. This is done by making arbitrary changes to the data that do not change the statistics of interest. In other words, differential privacy provides computer scientists and data scientists a way to prevent individual data records from being identified by adding noise to the data in a controlled way while still allowing for the extraction of valuable insights from the data. Essentially, an algorithm that is differentially private injects a predetermined amount of noise into a dataset using, for example, a Gaussian distribution, Laplacian distribution, uniform distribution, or the like to inject the noise. This noise guarantees plausible deniability, and thus protection for the data that is being used.

SUMMARY

According to one illustrative embodiment, a computer-implemented method for secure noise addition in floating-point numbers is provided. A computer determines whether digits of a mantissa of a summed floating-point number include a set of trailing zeros at an end of the mantissa of the summed floating-point number. In response to the computer determining that the digits of the mantissa of the summed floating-point number include the set of trailing zeros at the end of the mantissa of the summed floating-point number, the computer replaces the set of trailing zeros at the end of the mantissa of the summed floating-point number with a set of digits selected from a group of random digits to form an output floating-point number that is free from traces of a sensitive non-integer input value satisfying differential privacy guarantee of data security immune from floating-point attack. According to other illustrative embodiments, a computer system and computer program product for secure noise addition in floating-point numbers are provided.

DETAILED DESCRIPTION

With reference now to the figures, and in particular, with reference to FIG. 1 and FIG. 2, diagrams of data processing environments are provided in which illustrative embodiments may be implemented. It should be appreciated that FIG. 1 and FIG. 2 are only meant as examples and are not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made.

FIG. 1 shows a pictorial representation of a computing environment in which illustrative embodiments may be implemented. Computing environment 100 contains an example of an environment for the execution of at least some of the computer code involved in performing the inventive methods of illustrative embodiments, such as secure floating-point number noise addition code 200. For example, secure floating-point number noise addition code 200 adds noise in the form of a random floating-point number to a floating-point number representing a sensitive non-integer input value, while preserving the known precision of the sensitive non-integer input value by taking into account the potential loss of precision caused by the addition of the noise to the floating-point representation of the sensitive non-integer input value. In other words, secure floating-point number noise addition code 200 takes into account input-dependent randomized injection when adding a random floating-point number to a fixed floating-point number. The sensitive non-integer input values represented by the floating-point numbers may be, for example, monetary amounts in bank statements, financial reports, billing statements, spreadsheets, or the like. It should be noted that the sensitive input value can be an integer (e.g., 1.0) or some non-integer type that is represented by a floating-point number.

EUD 103 is any computer system that is used and controlled by an end user (e.g., a data scientist utilizing the secure floating-point number noise addition services provided by computer 101), and may take any of the forms discussed above in connection with computer 101. EUD 103 typically receives helpful and useful data from the operations of computer 101. For example, in a hypothetical case where computer 101 is designed to provide an output of floating-point numbers that are free from traces or hints of sensitive non-integer input values satisfying the differential privacy guarantee of data security immune from floating-point attacks to the end user, this output would typically be communicated from network module 115 of computer 101 through WAN 102 to EUD 103. In this way, EUD 103 can display, or otherwise present, the output to the end user. In some embodiments, EUD 103 may be a client device, such as thin client, heavy client, mainframe computer, desktop computer, laptop computer, tablet computer, smart phone, and so on.

Remote server 104 is any computer system that serves at least some data and/or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents the machine(s) that collect and store helpful and useful data for use by other computers, such as computer 101. For example, in a hypothetical case where computer 101 is designed and programmed to provide floating-point numbers that are free from traces or hints of sensitive non-integer input values satisfying the differential privacy guarantee of data security immune from floating-point attacks based on historical data, then this historical data may be provided to computer 101 from remote database 130 of remote server 104.

Public cloud 105 and private cloud 106 are programmed and configured to deliver cloud computing services and/or microservices (not separately shown in FIG. 1). Unless otherwise indicated, the word “microservices” shall be interpreted as inclusive of larger “services” regardless of size. Cloud services are infrastructure, platforms, or software that are typically hosted by third-party providers and made available to users through the internet. Cloud services facilitate the flow of user data from front-end clients (for example, user-side servers, tablets, desktops, laptops), through the internet, to the provider's systems, and back. In some embodiments, cloud services may be configured and orchestrated according to as “as a service” technology paradigm where something is being presented to an internal or external customer in the form of a cloud computing service. As-a-Service offerings typically provide endpoints with which various customers interface. These endpoints are typically based on a set of application programming interfaces (APIs). One category of as-a-service offering is Platform as a Service (PaaS), where a service provider provisions, instantiates, runs, and manages a modular bundle of code that customers can use to instantiate a computing platform and one or more applications, without the complexity of building and maintaining the infrastructure typically associated with these things. Another category is Software as a Service (SaaS) where software is centrally hosted and allocated on a subscription basis. SaaS is also known as on-demand software, web-based software, or web-hosted software. Four technological sub-fields involved in cloud services are: deployment, integration, on demand, and virtual private networks.

As used herein, when used with reference to items, “a set of” means one or more of the items. For example, a set of clouds is one or more different types of cloud environments. Similarly, “a number of,” when used with reference to items, means one or more of the items. Moreover, “a group of” or “a plurality of” when used with reference to items, means two or more of the items.

Differential privacy adds random noise to safeguard output values. Computers commonly represent non-integer numbers in a floating-point format. The normalization step in floating-point arithmetic can leak sensitive information corresponding to the output values because the precision loss results in a deterministic number of zeros at the end of the mantissa (also known as the significand) in the floating-point representation of the sensitive information. An unauthorized user can exploit this leakage to obtain the sensitive information. Illustrative embodiments change the trailing zeros at the end of the mantissa with random digits thereby preventing the leakage of the sensitive information, while preserving the differential privacy guarantee of data security.

Differential privacy adds specially-calibrated random noise (i.e., random floating point numbers) to floating-point numbers representing sensitive non-integer input values to protect the sensitive non-integer input values against unwanted inference and exploitation. However, current floating-point arithmetic solutions can leak traces, clues, suggestions, or hints about the sensitive non-integer input values that unauthorized users can exploit breaking the differential privacy guarantee of data security. By intervening in the noise addition operation and changing the lower-order digits of the floating-point number representing the sensitive non-integer input value, illustrative embodiments prevent the leakage and potential exploitation by an unauthorized user.

Illustrative embodiments can apply to any differential privacy solution where noise is added directly to floating-point numbers representing sensitive non-integer input values. Further, illustrative embodiments can apply to any other type of solutions where guarantees are needed when adding noise to floating-point numbers. In other words, illustrative embodiments can have universal applicability across many types of solutions, such as, for example, half-, single-, double-, quad-, and the like precision IEEE 754 floating point standards as well as other non-IEEE standards, which add random noise to floating-point numbers.

Floating-point numbers are the standard representation of non-integer numbers by a computer. Floating-point numbers use a sign, a mantissa or significand, and an exponent to represent a large range of real numbers, with varying granularity, using a finite number of bits. For example, 12.345=12345×10−3, where 12345 represents the mantissa, 10 is the base, and −3 is the exponent. The IEEE 754 standard represents a double-precision floating point number (i.e., a double or binary64) using 1 bit for the sign, 11 bits for the exponent, and 52 bits for the mantissa.

When summing (e.g., adding or subtracting) two floating-point numbers, the floating-point arithmetic operation performs the following steps: 1) match exponents by converting the smaller exponent to the larger exponent; 2) perform the arithmetic operation; and 3) renormalize the floating-point number to ensure that a non-zero leading digit exists in the floating-point number. However, precision loss can occur when the arithmetic operation results in a lower exponent number (i.e., when two floating-point numbers are subtracted), which leaves a trace or hint of the original input value. As an illustrative example:

It should be noted that all examples herein are given in a decimal format for ease-of-understanding only. Also, it should be noted that this illustrative example uses 5 digits of precision. In this illustrative example, precision loss occurs at 0.8452×100 and 1.7930×10−1. The IEEE 754 standard allows for a guard digit to ensure one fewer digit of precision loss in such cases.

Differential privacy adds noise to a floating-point number representing a sensitive non-integer input value using a selected probability distribution (e.g., Gaussian distribution, Laplacian distribution, uniform distribution, or the like), which is coded into the differential privacy algorithm, to protect the sensitive integer input value from information leakage and potential exploitation by an unauthorized user. However, when floating-point arithmetic operations are performed, information leakage is possible. For example, an unauthorized user can utilize a precision-based attack to exploit the information leakage. Current defenses to precision-based attacks and other types of attacks exploiting floating-point vulnerabilities in differential privacy rely on at least one of the following: 1) discretizing the data to scaled integer values; 2) using complex sampling procedures based on non-standard libraries; and 3) using computationally costly sampling procedures. Illustrative embodiments take into account and address these issues. Additionally, and specific to differential privacy, illustrative embodiments safeguard the operations of floating-point arithmetic to ensure that the differential privacy data security guarantee is maintained.

When summing two floating-point numbers of different signs (i.e., a subtraction operation), loss of precision can occur in the output value, which an unauthorized user can exploit. For example, given an input value of 1.0 with noise added, any output value in the open interval (0, 1.0) is guaranteed to have trailing zero digits at the end of the mantissa. In contrast, given an input value of 0.0 with noise added, the output value in the open interval (0.0, 1.0) is not guaranteed to have trailing zero digits at the end of the mantissa of the floating-point number (although it may still have, by the randomness of the added noise). An unauthorized user can exploit these deterministic contrasts at an arbitrarily low privacy budget to distinguish between different input values. Similar conditions can be given for numbers of arbitrary orders of magnitude. This loss of precision occurs irrespective of any representation error (i.e., error in 0.1+0.2).

Illustrative examples of floating point numbers with 5 digits of precision:

In these illustrative examples above, loss of precision occurs at 6.6670×10−1, 7.6600×10−2, and 9.9990×10−1.

The same vulnerability does not exist under floating-point number addition operations (e.g., no loss of precision). For example:

When subtracting similar floating-point numbers, the granularity around zero is greatly affected by the input value. As an illustrative example:

In this illustrative example above, the smallest non-zero value that can be realized from 1.0 is 10−4. Therefore, it is possible to deduce from the second output value (1.0×10−14) that its input value could not have been 1.0, which allows an unauthorized user to distinguish between the two input values. As a result, there is no plausible deniability. However, information leakage is less likely than that of loss of precision.

Illustrative embodiments enable secure addition of noise to floating-point numbers. Illustrative embodiments receive as input a floating-point number representing a sensitive input value. Illustrative embodiments generate a random floating-point number representing a noise value and a group of random digits. Illustrative embodiments add the random floating-point number representing the noise value to the floating-point number representing the sensitive input value. Subsequently, illustrative embodiments return an output value that is a floating-point number satisfying differential privacy, which is immune from floating-point attacks, such as, for example, precision-based attacks.

Illustrative embodiments take into account and address two issues of current floating-point arithmetic solutions. One issue is loss of precision. For example, illustrative embodiments determine the number of trailing digits that are zeros in the floating-point number representing the sensitive non-integer input value. Illustrative embodiments then replace the trailing zero digits with other digits using the generated group of random digits. The randomly generated digits can include non-zero digits and/or zero digits. It could by chance be that illustrative embodiments replace the trailing zeros with zeros again, as the process is random. The other issue is granularity near zero. For example, when an output value is precisely zero (0), illustrative embodiments generate a new output value, which is a new floating-point number, near or close to zero.

Illustrative embodiments generate a summed floating-point number by adding a random floating-point number representing a noise value to a floating-point number representing a sensitive non-integer input value using standard floating-point arithmetic operations. After generating the summed floating-point number by adding the random floating-point number representing the noise value to the floating-point number representing the sensitive non-integer input value, illustrative embodiments determine the number of trailing zero digits at the end of the mantissa of the summed floating-point number. The number of trailing zero digits at the end of the mantissa of the summed floating-point number is the difference between (i) one of a higher exponent of the floating-point number representing the sensitive input value or the random floating point number representing the noise value and (ii) the exponent of the summed floating-point number. As an illustrative example:

Illustrative embodiments replace the trailing zero digits of the summed floating-point number with a set of randomly selected digits. In the second example above, 1.0000×100 is the floating-point number representing the sensitive non-integer input value. The digits 92345 represent the random noise value, which illustrative embodiments scale to the appropriate floating point number in order to be added to the floating-point number representing the sensitive non-integer input value. In the second example, 7.6600×10−2 represents the summed floating-point number. Illustrative embodiments replace the two trailing zero digits of the mantissa with the randomly selected digits, such as, for example, 8 and 9, which illustrative embodiments scale to the appropriate floating-point number in order to replace the two trailing zero digits. For example:

Afterward, illustrative embodiments return an output floating point number of 7.6689×10−2 to the user instead of 7.6600×10−2, which an unauthorized user could possibly exploit to obtain information or hints regarding the sensitive non-integer input value.

It is possible for illustrative embodiments to generate a summed floating-point number, which is zero, by summing floating point number representing the noise value and the floating-point number representing the sensitive non-integer input value using standard floating-point arithmetic operations. As an illustrative example:

When the summed floating-point number is zero, illustrative embodiments generate a new random floating point number in the open space (−1, 1) taking into account the digit or unit in the last place of the floating-point number representing the sensitive non-integer input value. In the illustrative example above, the digit or unit in the last place of the floating-point number (i.e., 5) is at 10−4. In this example, the new random number is −0.58271 or −5.8271×10−1. Illustrative embodiments scale the new random floating-point number with respect to the unit in the last place of the floating-point number representing the sensitive non-integer input value, such as, for example, (−5.8271×10−1)×10−4=−5.8271×10−5. If the output floating-point number is not zero, then illustrative embodiments return the output to the user for analysis. If the output floating-point number is still zero, then illustrative embodiments generate another random floating point number in the open space (−1, 1) taking into account a new unit in the last place of the output floating-point number, which in this example is 10−9. As a result, all floating-point numbers close to zero (e.g., 1.0000×10−4, 1.0000×10−14, or the like) are now reachable from any non-integer input value.

Illustrative embodiments are equivalent to a linear interpolation of the cumulative distribution function over very small intervals. The discrepancy between the interpolated cumulative distribution function and the true cumulative distribution function is very small (e.g., on the order of 2−104≈10−32, when randomly changing two digits with the differential privacy parameter (6) being equal to 1). Using Rolle's Theorem and the Dvoretzky-Kiefer-Wolfowitz inequality, at least 1063 draws from the distribution would be needed to distinguish the interpolated cumulative distribution function from the true cumulative distribution function with 95% confidence, which would take orders of magnitude longer than the age of the universe to sample. As a result, because this is sufficiently close to the original distribution and is computationally infeasible to perceive, illustrative embodiments satisfy the differential privacy guarantee of data security.

Thus, illustrative embodiments provide one or more technical solutions that overcome a technical problem with current floating-point arithmetic solutions inability to prevent information leakage and loss of precision in floating-point numbers when performing floating-point arithmetic operations. As a result, these one or more technical solutions provide a technical effect and practical application in the field of differential privacy.

With reference now to FIG. 2, a diagram illustrating an example of a secure floating-point number noise addition system is depicted in accordance with an illustrative embodiment. Secure floating-point number noise addition system 201 may be implemented in a computing environment, such as computing environment 100 in FIG. 1. Secure floating-point number noise addition system 201 is a system of hardware and software components for outputting floating-point numbers that are free from traces or hints of sensitive non-integer input values satisfying the differential privacy guarantee of data security immune from floating-point attacks by unauthorized users.

In this example, secure floating-point number noise addition system 201 includes computer 202. Computer 202 may be, for example, computer 101 in FIG. 1. Computer 202 includes differential privacy component 204. Computer 202 utilizes differential privacy component 204 to provide floating-point numbers that are free from traces or hints of sensitive non-integer input values satisfying the differential privacy guarantee of data security. Differential privacy component 204 includes floating-point arithmetic module 206. Floating-point arithmetic module 206 can be implemented by, for example, secure floating-point number noise addition code 200 in FIG. 1. Differential privacy component 204 utilizes floating-point arithmetic module 206 to perform arithmetic summing operations on floating-point numbers while preserving the known precision of sensitive non-integer input values by taking into account the potential loss of precision caused by the addition of random floating-point numbers representing noise values to floating-point numbers representing sensitive non-integer input values. Floating-point arithmetic module 206 receives sensitive non-integer input value 208 and returns secure floating-point output value 210, which is immune from floating-point attacks by unauthorized user 212.

With reference now to FIGS. 3A-3B, a flowchart illustrating a process for secure noise addition in floating-point numbers is shown in accordance with an illustrative embodiment. The process shown in FIGS. 3A-3B may be implemented in a computer, such as, for example, computer 101 in FIG. 1 or computer 202 in FIG. 2. For example, the process shown in FIGS. 3A-3B may be implemented by secure floating-point number noise addition code 200 in FIG. 1 or floating-point arithmetic module 206 in FIG. 2.

The process begins when the computer receives a floating-point number representing a sensitive non-integer input value (step 302). In response to receiving the floating-point number representing the sensitive non-integer input value, the computer generates a random floating-point number representing a noise value and a group of random digits (step 304). It should be noted that the group of random digits can include at least one of non-zero digits and zero digits. The computer adds the random floating-point number representing the noise value to the floating-point number representing the sensitive non-integer input value to generate a summed floating-point number corresponding to the sensitive non-integer input value (step 306).

The computer performs an analysis of the summed floating-point number (step 308). The computer identifies digits of a mantissa of the summed floating-point number based on the analysis of the summed floating-point number (step 310).

The computer makes a determination as to whether the digits of the mantissa of the summed floating-point number are all zeros (step 312). If the computer determines that the digits of the mantissa of the summed floating-point number are all zeros, yes output of step 312, then the computer generates a new random floating-point number in an open space from negative one to positive one taking into account a digit in a last place of a mantissa of the floating-point number representing the sensitive non-integer input value (step 314). In addition, the computer scales the new random floating-point number in the open space from negative one to positive one to the digit in the last place of the mantissa of the floating-point number representing the sensitive non-integer input value to form a scaled new random floating-point number (step 316). The computer adds the scaled new random floating-point number to the floating-point number representing the sensitive non-integer input value to generate a new summed floating-point number (step 318). Thereafter, the process returns to step 308 where the computer performs an analysis of the new summed floating-point number.

Returning again to step 312, if the computer determines that the digits of the mantissa of the summed floating-point number are not all zeros, no output of step 312, then the computer makes a determination as to whether the digits of the mantissa of the summed floating-point number include a set of trailing zeros at an end of the mantissa of the summed floating-point number (step 320). If the computer determines that the digits of the mantissa of the summed floating-point number include a set of trailing zeros at an end of the mantissa of the summed floating-point number, yes output of step 320, then the computer replaces the set of trailing zeros at the end of the mantissa of the summed floating-point number with a set of digits selected from the group of random digits to form an output floating-point number that is free from traces of the sensitive non-integer input value satisfying differential privacy guarantee of data security immune from floating-point attack (step 322). Afterward, the computer returns the output floating-point number that is free from traces of the sensitive non-integer input value satisfying differential privacy guarantee of data security immune from floating-point attack to an authorized user for analysis (step 324). Thereafter, the process terminates.

Returning again to step 320, if the computer determines that the digits of the mantissa of the summed floating-point number do not include a set of trailing zeros at an end of the mantissa of the summed floating-point number, no output of step 320, then the computer returns the summed floating-point number to the authorized user for analysis (step 326). Thereafter, the process terminates.