RAPPOR

TLDR

RAPPOR is a privacy‑preserving crowdsourcing technology that aggregates client data anonymously, enabling analysis of large populations without exposing individual records. The paper aims to present RAPPOR, its differential‑privacy and utility guarantees, and evaluate its deployment against attack models using synthetic and real data. RAPPOR applies randomized response in a novel way to collect statistics on client‑side strings with strong per‑client privacy and unlinkability, enabling efficient, high‑utility analysis. Experiments on synthetic and real data demonstrate that RAPPOR achieves strong differential privacy while maintaining useful statistical accuracy.

Abstract

Randomized Aggregatable Privacy-Preserving Ordinal Response, or RAPPOR, is a technology for crowdsourcing statistics from end-user client software, anonymously, with strong privacy guarantees. In short, RAPPORs allow the forest of client data to be studied, without permitting the possibility of looking at individual trees. By applying randomized response in a novel manner, RAPPOR provides the mechanisms for such collection as well as for efficient, high-utility analysis of the collected data. In particular, RAPPOR permits statistics to be collected on the population of client-side strings with strong privacy guarantees for each client, and without linkability of their reports. This paper describes and motivates RAPPOR, details its differential-privacy and utility guarantees, discusses its practical deployment and properties in the face of different attack models, and, finally, gives results of its application to both synthetic and real-world data.