Personalized w-Event Privacy for Infinite Stream Estimation

Published 9 May 2026 in cs.DB, cs.CR, and cs.IR | (2605.09054v1)

Abstract: In applications such as event monitoring, log analysis, and video querying, $w$-event privacy protects individual data within a sliding time window while supporting accurate stream statistics. Existing studies on infinite data streams mainly assume homogeneous privacy requirements for all users, which cannot capture user-specific privacy preferences. This paper studies personalized $w$-event privacy for private data stream estimation. We first design the Personalized Window Size Mechanism (PWSM), which supports personalized privacy requirements at each time slot. Based on PWSM, we propose Personalized Budget Distribution (PBD) and Personalized Budget Absorption (PBA) to estimate streaming statistics under $\boldsymbol{w}$-Event $\boldsymbol{\mathcal{E}}$ Personalized Differential Privacy (($\boldsymbol{w}$, $\boldsymbol{\mathcal{E}}$)-EPDP). PBD guarantees that the budget reserved for the next time step is no smaller than the budget consumed in the previous release, while PBA improves the current budget by absorbing unused budgets from the previous $k$ time slots and borrowing from the next $k$ time slots. We further develop Dynamic Personalized Budget Distribution (DPBD) and Dynamic Personalized Budget Absorption (DPBA), which allow users to dynamically adjust privacy requirements while satisfying $(τ, \boldsymbol{w}_B, \boldsymbol{w}_F)$-Event $(\boldsymbol{\mathcal{E}}_B, \boldsymbol{\mathcal{E}}_F)$-Personalized Differential Privacy. We prove that all proposed methods achieve the corresponding personalized differential privacy guarantees and derive their error upper bounds. Experiments show that our methods reduce estimation error by at least $53.6\%$ compared with state-of-the-art algorithms.

Abstract PDF Upgrade to Chat

Authors (7)

Summary

The paper introduces mechanisms that tailor privacy parameters per user and per timestep in infinite data streams, ensuring optimal privacy-utility tradeoffs.
It designs fixed and dynamic personalization methods to optimize noise injection and budget allocation while satisfying overlapping, time-varying privacy constraints.
Experimental results show over 53% error reduction and demonstrate scalability on real and synthetic datasets, validating the framework's effectiveness.

Personalized w-Event Differential Privacy for Infinite Data Streams

Problem Statement and Motivation

The paper addresses the core challenge of enforcing personalized $w$ -event differential privacy (EPDP) in infinite data streams. In contrast to traditional homogeneous $w$ -event DP—where all users have identical privacy budgets and window sizes—the proposed setting enables per-user (and per-timestep) specification of privacy parameters. Motivations include the mismatch between one-size-fits-all policies and actual privacy needs, which commonly produces suboptimal utility and/or privacy. For example, certain users (such as celebrities) may require stronger protection over longer windows, while others benefit from lower distortion and more flexible sharing.

The introduced framework generalizes prior event-DP and user-DP stream models by permitting arbitrary, possibly time-varying, backward and forward privacy requirements $(w_{B, i, t}, \epsilon_{B, i, t}, w_{F, i, t}, \epsilon_{F, i, t})$ at each time and for each user. The primary technical contributions involve the design and analysis of mechanisms for transforming these heterogeneous, overlapping, and time-varying user constraints into a feasible, system-level release schedule for the stream’s aggregate statistics, all while maintaining formal privacy and utility guarantees.

Methods and Mechanistic Contributions

The main technical results are embodied in four mechanisms grouped into fixed- and dynamic-personalization settings.

Fixed Personalized Window Mechanisms

Personalized Window Size Mechanism (PWSM): At each time step, the curator collects all users' fixed $(w_{i}, \epsilon_{i})$ requirements. Release feasibility is characterized by per-user composition constraints: the privacy budget consumed over any sliding window of length $w_{i}$ cannot exceed $\epsilon_{i}$ . The core technical challenge is that only one aggregate release occurs per time slot, but window and budget parameters may vary per user.
Optimal Budget Selection (OBS): This component finds a noise scale (privacy threshold $\epsilon_{opt}$ ) that minimizes total expected reporting error, consisting of: (1) sampling noise (from sub-sampling users whose budgets are below the threshold); (2) DP mechanism noise (e.g., Laplace). OBS is non-trivial since minimizing global error in an aggregate statistic involves accounting for the distribution of user budgets.
Personalized Budget Distribution (PBD): The privacy budget is split at each slot: half for dissimilarity testing (to decide whether meaningful data drift occurred and a fresh release is warranted), half for actual noise injection. This is an allocation-driven strategy, similar in spirit to sliding-window DP release, but generalized over the heterogeneous budget/window parameters.
Personalized Budget Absorption (PBA): This approach allows the mechanism to "borrow" future privacy budget shares to make releases when necessary, skipping (or nullifying) releases at time slots where updates are non-informative, thus increasing the efficiency of budget usage for stable streams.

Dynamic Personalized Window Mechanisms

Dynamic Personalized Budget Distribution (DPBD): This mechanism supports forward/backward, time-varying constraints. At each step, it enforces online feasibility by ensuring that, for each user, the cumulative privacy cost over the pertinent backward and forward sub-streams stays within the announced budgets. This requires resolving overlapping, possibly conflicting requirements in a way that permits online release without violating any user’s constraints.
Dynamic Personalized Budget Absorption (DPBA): This extends PBA to the dynamic setting. It calculates at each slot whether current/future privacy obligations permit a non-null release (potentially skipping slots), and manages the tracking and allocation of borrowed/shrunk budgets for both forward and backward windows dynamically.

Theoretical Analysis

Rigorous proofs are presented for:

Privacy Guarantees: All mechanisms are shown to satisfy the appropriate instantiations of $(w, \epsilon)$ -EPDP or $(T, \mathbf{w}_{B}, \mathbf{w}_{F}, \boldsymbol{\epsilon}_B, \boldsymbol{\epsilon}_F)$ -EPDP. This is formalized by bounding the cumulative privacy cost for each user across all feasible windows covering a given release, employing composition theorems and careful accounting in the presence of overlapping, variable-length user windows.
Utility Bounds: The paper derives upper bounds on the average per-slot error, accounting for both "distributional" error (for distribution-based strategies) and "absorption" error (for slots where releases are purposely skipped/nullified). The exact bounds depend on the interplay between the distribution of user budgets, the frequency and size of non-null releases, and the structure of the assignment algorithm employed (OBS). The bounds match or generalize previous results for the homogeneous $w$ -event case and exhibit correct limiting behavior in extremal cases (all budgets identical, or highly disparate).
Computational Complexity: For $w$ 0 users and maximum window size $w$ 1, time and memory complexities per slot are $w$ 2 (fixed setting) and $w$ 3 (dynamic), where window sizes control the storage/lookup cost for tracking privacy consumption/history. The mechanisms are practically implementable for large scale streaming scenarios with hundreds of thousands of users.

Experimental Results and Empirical Findings

Benchmarks on both real (Taxi, Foursquare) and synthetic (Sin, Log, TLNS) infinite streams confirm that the proposed mechanisms:

Achieve significantly lower mean squared error and Jensen-Shannon divergence relative to state-of-the-art homogeneous $w$ 4-event baselines (e.g., BD, BA, SPAS), especially as user requirements become more heterogeneous and/or when the proportion of high-budget users rises.
Outperform personalized LDP baselines in utility, consistent with the theoretical gap between LDP and centralized DP under identical budget.
PBD and DPBD excel on "bursty" datasets with high-frequency changes, while PBA/DPBA favor smoother streams due to their efficiency in budget absorption and reduced redundant releases.

Empirically, the error reductions can exceed 53.6% in AMRE against the best non-personalized methods. Scalability is demonstrated via time/memory analysis, and parameter sweeps show error remains stable (decreases) as a larger proportion of users select stricter (looser) privacy settings, confirming effective exploitation of the flexibility offered by personalization.

Implications and Future Directions

From a systems standpoint, this work establishes a general framework for integrating arbitrary user-level privacy preferences into continual stream release protocols, enabling fine-grained privacy/utility tradeoffs unavailable to classical DP methods. The formalization of dynamic personalized event-DP addresses realistic requirements where privacy profiles evolve over time, with explicit constraints protecting both past and anticipated future usage.

Potential future research avenues include:

Extending the dynamic framework to the untrusted curator (LDP or shuffled DP) setting, where the server cannot be trusted with private user parameters or data.
Integrating adaptive mechanisms that automatically switch between distribution and absorption paradigms based on observed stream volatility or utility statistics.
Applying these mechanisms in real-world platforms (e.g., mobile crowd sensing, social media analysis), possibly with integration of user-facing interfaces for privacy preference selection.

At a theoretical level, the introduced notion of online feasibility for the reconciliation of overlapping, time-varying, heterogeneous constraints is likely relevant for other privacy-preserving online aggregation tasks and for broader resource allocation problems with user-dependent, non-homogeneous requirements.

Conclusion

This paper provides a comprehensive mechanistic and analytical foundation for personalized $w$ 5-event privacy in infinite stream estimation, advancing both privacy and utility for heterogeneous data streams. Its contributions in formulating, analyzing, and empirically evaluating fixed and dynamic personalized EPDP mechanisms set a new standard in privacy-aware streaming analytics, with broad implications for practical deployments and future research in data privacy.