  Organizations that collect and analyze data may wish or be mandated by
regulation to justify and explain their analysis results. At the same time, the
logic that they have followed to analyze the data, i.e., their queries, may be
proprietary and confidential. Data provenance, a record of the transformations
that data underwent, was extensively studied as means of explanations. In
contrast, only a few works have studied the tension between disclosing
provenance and hiding the underlying query.
  This tension is the focus of the present paper, where we formalize and
explore for the first time the tradeoff between the utility of presenting
provenance information and the breach of privacy it poses with respect to the
underlying query. Intuitively, our formalization is based on the notion of
provenance abstraction, where the representation of some tuples in the
provenance expressions is abstracted in a way that makes multiple tuples
indistinguishable. The privacy of a chosen abstraction is then measured based
on how many queries match the obfuscated provenance, in the same vein as
k-anonymity. The utility is measured based on the entropy of the abstraction,
intuitively how much information is lost with respect to the actual tuples
participating in the provenance. Our formalization yields a novel optimization
problem of choosing the best abstraction in terms of this tradeoff. We show
that the problem is intractable in general, but design greedy heuristics that
exploit the provenance structure towards a practically efficient exploration of
the search space. We experimentally prove the effectiveness of our solution
using the TPC-H benchmark and the IMDB dataset.
