Evaluating anonymity limitations with AnonPSI
Tags: research, privacy, tiktok, opensource
Published: 2024-02-20 00:43:03

_Last year, we announced [PrivacyGo](https://developers.tiktok.com/blog/privacy-go), one of the initiatives undertaken by Privacy Innovation at TikTok to research innovative ways of safeguarding the privacy and security of our users and protecting sensitive information for our partner organizations. PrivacyGo is the synergetic fusion of Privacy Enhancing Technologies (PETs), namely Private Set Intersection (PSI) and Differential Privacy (DP)._
_
## Introducing AnonPSI
Within the PrivacyGo ecosystem, we recently introduced [AnonPSI](https://arxiv.org/abs/2311.18118), an anonymity assessment framework for Private Set Intersection (PSI). AnonPSI shows that solely using PSI is not secure, therefore, motivating the PET fusion introduced by PrivacyGo.


PSI is a widely used protocol that enables two parties to securely compute a function over the intersected part of their shared datasets and has been a significant research focus over the years. However, recent studies have highlighted its vulnerability to Set Membership Inference Attacks (SMIA), where an adversary might deduce an individual's membership by invoking multiple PSI protocols. This presents a considerable risk, even in the most stringent versions of PSI, which only return the cardinality of the intersection.


We recently published a [research paper](http://sf16-va.tiktokcdn.com/obj/tiktok-open-platform/ttop_doc_files/AnonPSI%20-%20An%20Anonymity%20Assessment%20Framework%20for%20PSI.pdf) that explores the evaluation of anonymity within the PSI context.


Initially, we highlight the reasons why existing works fall short in measuring privacy leakage, and subsequently propose two attack strategies that address these deficiencies. Furthermore, we provide theoretical guarantees on the performance of our proposed methods. In addition to these, we illustrate how the integration of auxiliary information, such as the sum of payloads associated with members of the intersection (PSI-SUM), can enhance attack efficiency. We conducted a comprehensive performance evaluation of various attack strategies proposed utilizing two real datasets.


Our findings indicate that the methods we propose markedly enhance attack efficiency when contrasted with previous research endeavors. The effective attacking implies that depending solely on existing PSI protocols may not provide an adequate level of privacy assurance. It is recommended to combine privacy-enhancing technologies synergistically to enhance privacy protection even further.

![Membership information leakages in PSI-SUM under different attacks. Column 1 displays the overall membership leakage, while Column 2 represents
positive membership leakage, and Column 3 represents negative membership leakage. The first row corresponds to cases where the product company targets
the advertising company, and the second row corresponds to cases where the advertising company targets the product company.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p7rvr5347r48kb5c6k8n.jpg)

### Learn more about AnonPSI

For more information, check out the [AnonPSI research paper](https://arxiv.org/abs/2311.18118) and follow us on [GitHub](https://github.com/tiktok-privacy-innovation/PrivacyGo).