Auditing Categorical SUM, MAX and MIN Queries

Abstract

Auditing consists in logging answered queries and checking, each time that a new query is submitted, that no sensitive information is disclosed by combining responses to answered queries with the response to the current query. Such a method for controlling data disclosure naturally raises the following inference problem: Given a set Q of answered queries and a query q, is the information asked by q determined by responses to queries in Q? We solve this inference problem for sum-queries (of real type and nonnegative real type), max-queries and min-queries and provide tests running in polynomial time. To achieve this, we introduce an inference model which, unlike previous inference models, is sound and complete in that the answer to the question of the inference problem comes out to be affirmative if and only if the information asked by q coincides exactly with the value of q determined by Q.