{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,6]],"date-time":"2026-02-06T00:09:58Z","timestamp":1770336598629,"version":"3.49.0"},"reference-count":106,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2025,1,27]],"date-time":"2025-01-27T00:00:00Z","timestamp":1737936000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,1,27]],"date-time":"2025-01-27T00:00:00Z","timestamp":1737936000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2147061"],"award-info":[{"award-number":["2147061"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2016393"],"award-info":[{"award-number":["2016393"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2008107"],"award-info":[{"award-number":["2008107"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1703431"],"award-info":[{"award-number":["1703431"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1552538"],"award-info":[{"award-number":["1552538"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001738","name":"Ministry of Science, Technology and Space","doi-asserted-by":"publisher","award":["1702\/24"],"award-info":[{"award-number":["1702\/24"]}],"id":[{"id":"10.13039\/501100001738","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["The VLDB Journal"],"published-print":{"date-parts":[[2025,3]]},"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Differential privacy (DP) is the state-of-the-art and rigorous notion of privacy for answering aggregate database queries while preserving the privacy of sensitive information in the data. In today\u2019s era of data analysis, however, it poses new challenges for users to understand the trends and anomalies observed in the query results: Is the unexpected answer due to the data itself, or is it due to the extra noise that must be added to preserve DP? In the second case, even the observation made by the users on query results may be wrong. In the first case, can we still mine interesting explanations from the sensitive data while protecting its privacy? To address these challenges, we present a three-phase framework <jats:sc>DPXPlain<\/jats:sc>, which is the first system to the best of our knowledge for explaining group-by aggregate query answers with DP. In its three phases, <jats:sc>DPXPlain<\/jats:sc> (a) answers a group-by aggregate query with DP, (b) allows users to compare aggregate values of two groups and with high probability assesses whether this comparison holds or is flipped by the DP noise, and (c) eventually provides an explanation table containing the approximately \u2018top-k\u2019 explanation predicates along with their relative influences and ranks in the form of confidence intervals, while guaranteeing DP in all steps. We perform an extensive experimental analysis of <jats:sc>DPXPlain<\/jats:sc> with multiple use-cases on real and synthetic data showing that <jats:sc>DPXPlain<\/jats:sc> efficiently provides insightful explanations with good accuracy and utility.\n<\/jats:p>","DOI":"10.1007\/s00778-024-00895-4","type":"journal-article","created":{"date-parts":[[2025,1,27]],"date-time":"2025-01-27T20:07:47Z","timestamp":1738008467000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Differentially private explanations for aggregate query answers"],"prefix":"10.1007","volume":"34","author":[{"given":"Yuchao","family":"Tao","sequence":"first","affiliation":[]},{"given":"Amir","family":"Gilad","sequence":"additional","affiliation":[]},{"given":"Ashwin","family":"Machanavajjhala","sequence":"additional","affiliation":[]},{"given":"Sudeepa","family":"Roy","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,1,27]]},"reference":[{"key":"895_CR1","unstructured":"Codebase of DPXPlain. https:\/\/github.com\/yuchaotao\/Private-Explanation-System"},{"key":"895_CR2","unstructured":"DPXPlain: Explaining query results under differential privacy. https:\/\/arxiv.org\/abs\/2209.01286"},{"key":"895_CR3","unstructured":"New york city taxi and limousine commission (tlc) trip record data. https:\/\/www1.nyc.gov\/site\/tlc\/about\/tlc-trip-record-data.page. Accessed: 2022-01-01"},{"key":"895_CR4","doi-asserted-by":"crossref","unstructured":"Abowd, J.\u00a0M.: The us census bureau adopts differential privacy. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2867\u20132867, (2018)","DOI":"10.1145\/3219819.3226070"},{"key":"895_CR5","unstructured":"Alabi, D., Ben-Eliezer, O., Chaturvedi, A.: Bounded space differentially private quantiles. CoRR, abs\/2201.03380, (2022)"},{"key":"895_CR6","doi-asserted-by":"crossref","unstructured":"Amsterdamer, Y., Deutch, D., Tannen, V.: Provenance for aggregate queries. In PODS, pages 153\u2013164, (2011)","DOI":"10.1145\/1989284.1989302"},{"key":"895_CR7","unstructured":"Anderson, P., Cheney, J.: Toward provenance-based security for configuration languages. In U.\u00a0A. Acar and T.\u00a0J. Green, editors, 4th Workshop on the Theory and Practice of Provenance, TaPP, (2012)"},{"key":"895_CR8","doi-asserted-by":"crossref","unstructured":"Ankan, A., Panda, A.: pgmpy: Probabilistic graphical models using python. In Proceedings of the 14th Python in Science Conference (scipy 2015), pages 6\u201311. Citeseer, (2015)","DOI":"10.25080\/Majora-7b98e3ed-001"},{"key":"895_CR9","unstructured":"Bafna, M.,\u00a0Ullman, J.: The price of selection in differential privacy. In Conference on Learning Theory, pages 151\u2013168. PMLR, (2017)"},{"issue":"3","key":"895_CR10","doi-asserted-by":"publisher","first-page":"481","DOI":"10.1007\/s10844-014-0322-7","volume":"43","author":"E Bertino","year":"2014","unstructured":"Bertino, E., Ghinita, G., Kantarcioglu, M., Nguyen, D., Park, J., Sandhu, R.S., Sultana, S., Thuraisingham, B.M., Xu, S.: A roadmap for privacy-enhanced secure data provenance. J. Intell. Inf. Syst. 43(3), 481\u2013501 (2014)","journal-title":"J. Intell. Inf. Syst."},{"key":"895_CR11","doi-asserted-by":"crossref","unstructured":"Bhaskar, R., Laxman, S., Smith, A., Thakurta, A.: Discovering frequent patterns in sensitive data. In Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 503\u2013512, (2010)","DOI":"10.1145\/1835804.1835869"},{"issue":"12","key":"895_CR12","doi-asserted-by":"publisher","first-page":"1422","DOI":"10.14778\/2536274.2536329","volume":"6","author":"L Bonomi","year":"2013","unstructured":"Bonomi, L., Xiong, L.: Mining frequent patterns with differential privacy. Proc. VLDB Endow. 6(12), 1422\u20131427 (2013)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR13","unstructured":"Brawner, T., Honaker, J.: Bootstrap inference and differential privacy: Standard errors for free. Unpublished Manuscript, (2018)"},{"key":"895_CR14","unstructured":"Brownlee, J.: XGBoost With python: Gradient boosted trees with XGBoost and scikit-learn. Machine Learning Mastery, (2016)"},{"key":"895_CR15","doi-asserted-by":"publisher","first-page":"635","DOI":"10.1007\/978-3-662-53641-4_24","volume-title":"Theory of Cryptography Conference","author":"M Bun","year":"2016","unstructured":"Bun, M., Steinke, T.: Concentrated differential privacy: Simplifications, extensions, and lower bounds. In: Theory of Cryptography Conference, pp. 635\u2013658. Springer (2016)"},{"key":"895_CR16","unstructured":"Carvalho, R.\u00a0S., Wang, K., Gondara, L., Miao, C.: Differentially private top-k selection via stability on unknown domain. In Conference on Uncertainty in Artificial Intelligence, pages 1109\u20131118. PMLR, (2020)"},{"key":"895_CR17","unstructured":"Cesar, M., Rogers, R.: Bounding, concentrating, and truncating: Unifying privacy loss composition for data analytics. In Algorithmic Learning Theory, pages 421\u2013457. PMLR, (2021)"},{"key":"895_CR18","doi-asserted-by":"crossref","unstructured":"A.\u00a0Chapman and H.\u00a0V. Jagadish. Why not? In SIGMOD, pages 523\u2013534, 2009","DOI":"10.1145\/1559845.1559901"},{"key":"895_CR19","unstructured":"Chaudhuri, K., Hsu, D., Song, S.: The large margin mechanism for differentially private maximization. arXiv preprint arXiv:1409.2177, (2014)"},{"key":"895_CR20","first-page":"281","volume-title":"CSF","author":"J Cheney","year":"2011","unstructured":"Cheney, J.: A formal framework for provenance security. In: CSF, pp. 281\u2013293. Cernay-la-Ville, France (2011)"},{"issue":"10","key":"895_CR21","doi-asserted-by":"publisher","first-page":"1126","DOI":"10.14778\/3339490.3339496","volume":"12","author":"G Cormode","year":"2019","unstructured":"Cormode, G., Kulkarni, T., Srivastava, D.: Answering range queries under local differential privacy. Proc. VLDB Endow. 12(10), 1126\u20131138 (2019)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR22","unstructured":"Covington, C., He, X., Honaker, J., Kamath, G.: Unbiased statistical estimation and valid confidence intervals under differential privacy. arXiv preprint arXiv:2110.14465, (2021)"},{"key":"895_CR23","doi-asserted-by":"publisher","DOI":"10.1145\/1989284.1989305","author":"SB Davidson","year":"2011","unstructured":"Davidson, S.B., Khanna, S., Milo, T., Panigrahi, D., Roy, S.: Provenance views for module privacy. In PODS (2011). https:\/\/doi.org\/10.1145\/1989284.1989305","journal-title":"In PODS"},{"key":"895_CR24","doi-asserted-by":"publisher","DOI":"10.1145\/1938551.1938554","author":"SB Davidson","year":"2011","unstructured":"Davidson, S.B., Khanna, S., Roy, S., Stoyanovich, J., Tannen, V., Chen, Y.: On provenance and privacy. In ICDT (2011). https:\/\/doi.org\/10.1145\/1938551.1938554","journal-title":"In ICDT"},{"key":"895_CR25","unstructured":"Davidson, S.\u00a0B., Khanna, S., Tannen, V., Roy, S., Chen, Y., Milo, T., Stoyanovich, J.: Enabling privacy in provenance-aware workflow systems. In CIDR, pages 215\u2013218, (2011)"},{"key":"895_CR26","doi-asserted-by":"publisher","DOI":"10.1145\/3448016.3452835","author":"D Deutch","year":"2021","unstructured":"Deutch, D., Frankenthal, A., Gilad, A., Moskovitch, Y.: On optimizing the trade-off between privacy and utility in data provenance. In SIGMOD (2021). https:\/\/doi.org\/10.1145\/3448016.3452835","journal-title":"In SIGMOD"},{"issue":"1","key":"895_CR27","doi-asserted-by":"publisher","first-page":"485","DOI":"10.1007\/s00778-019-00584-7","volume":"29","author":"D Deutch","year":"2020","unstructured":"Deutch, D., Frost, N., Gilad, A.: Explaining natural language query results. VLDB J. 29(1), 485\u2013508 (2020)","journal-title":"VLDB J."},{"key":"895_CR28","unstructured":"Deutch, D., Frost, N., Gilad, A., Haimovich, T.: Explaining missing query results in natural language. In EDBT, pages 427\u2013430, (2020)"},{"key":"895_CR29","unstructured":"D.\u00a0Deutch and A.\u00a0Gilad. Reverse-engineering conjunctive queries from provenance examples. In EDBT, pages 277\u2013288, 2019"},{"key":"895_CR30","unstructured":"Ding, B., Kulkarni, J., Yekhanin, S.: Collecting telemetry data privately. Advances in Neural Information Processing Systems, 30, (2017)"},{"key":"895_CR31","unstructured":"Z.\u00a0Ding, D.\u00a0Kifer, T.\u00a0Steinke, Y.\u00a0Wang, Y.\u00a0Xiao, D.\u00a0Zhang, et\u00a0al. The permute-and-flip mechanism is identical to report-noisy-max with exponential noise. arXiv preprint arXiv:2105.07260, 2021"},{"key":"895_CR32","first-page":"2597","volume":"119","author":"J Dong","year":"2020","unstructured":"Dong, J., Durfee, D., Rogers, R.: Optimal differential privacy composition for exponential mechanisms. Int. Conf. Mach. Learn. 119, 2597\u20132606 (2020)","journal-title":"Int. Conf. Mach. Learn."},{"key":"895_CR33","doi-asserted-by":"publisher","DOI":"10.1145\/3514221.3517844","volume-title":"R2t,: Instance-optimal truncation for differentially private query evaluation with foreign keys","author":"W Dong","year":"2022","unstructured":"Dong, W., Fang, J., Yi, K., Tao, Y., Machanavajjhala, A.: R2t,: Instance-optimal truncation for differentially private query evaluation with foreign keys. ACM SIGMOD Int. Conf. Manage. Data, Proc (2022). https:\/\/doi.org\/10.1145\/3514221.3517844"},{"key":"895_CR34","doi-asserted-by":"crossref","unstructured":"Dong, W., Yi, K.: Residual sensitivity for differentially private multi-way joins. In Proceedings of the 2021 International Conference on Management of Data, SIGMOD \u201921, page 432-444, New York, NY, USA, 2021","DOI":"10.1145\/3448016.3452813"},{"key":"895_CR35","doi-asserted-by":"crossref","unstructured":"Dong, W., Yi, K.: A nearly instance-optimal differentially private mechanism for conjunctive queries. In Proceedings of the 41st ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems, PODS \u201922, page 213-225, New York, NY, USA, 2022. Association for Computing Machinery","DOI":"10.1145\/3517804.3524143"},{"key":"895_CR36","unstructured":"Dua, D., Graff, C.: UCI machine learning repository, (2017)"},{"key":"895_CR37","unstructured":"Durfee, D., Rogers, R.: One-shot dp top-k mechanisms. DifferentialPrivacy.org, 08 2021. https:\/\/differentialprivacy.org\/one-shot-top-k\/"},{"key":"895_CR38","unstructured":"D.\u00a0Durfee and R.\u00a0M. Rogers. Practical differentially private top-k selection with pay-what-you-get composition. In H.\u00a0M. Wallach, H.\u00a0Larochelle, A.\u00a0Beygelzimer, F.\u00a0d\u2019Alch\u00e9-Buc, E.\u00a0B. Fox, and R.\u00a0Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 3527\u20133537, 2019"},{"key":"895_CR39","doi-asserted-by":"crossref","unstructured":"Dwork, C.: Differential privacy and the us census. In Proceedings of the 38th ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems, pages 1\u20131, (2019)","DOI":"10.1145\/3294052.3322188"},{"key":"895_CR40","doi-asserted-by":"crossref","unstructured":"Dwork, C., Lei, J.: Differential privacy and robust statistics. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 371\u2013380, (2009)","DOI":"10.1145\/1536414.1536466"},{"key":"895_CR41","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1007\/11681878_14","volume-title":"Theory of cryptography conference","author":"C Dwork","year":"2006","unstructured":"Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating noise to sensitivity in private data analysis. In: Theory of cryptography conference, pp. 265\u2013284. Springer (2006)"},{"issue":"3\u20134","key":"895_CR42","first-page":"211","volume":"9","author":"C Dwork","year":"2014","unstructured":"Dwork, C., Roth, A., et al.: The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci. 9(3\u20134), 211\u2013407 (2014)","journal-title":"Found. Trends Theor. Comput. Sci."},{"key":"895_CR43","unstructured":"Dwork, C., Rothblum, G.\u00a0N.: Concentrated differential privacy. arXiv preprint arXiv:1603.01887, (2016)"},{"issue":"1","key":"895_CR44","doi-asserted-by":"publisher","first-page":"61","DOI":"10.14778\/2735461.2735467","volume":"8","author":"K El Gebaly","year":"2014","unstructured":"El Gebaly, K., Agrawal, P., Golab, L., Korn, F., Srivastava, D.: Interpretable and informative explanations of outcomes. Proc. VLDB Endow. 8(1), 61\u201372 (2014)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR45","doi-asserted-by":"crossref","unstructured":"Erlingsson, \u00da., Pihur, V., Korolova, A.: Rappor: Randomized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pages 1054\u20131067, (2014)","DOI":"10.1145\/2660267.2660348"},{"key":"895_CR46","unstructured":"C.\u00a0Ferrando, S.\u00a0Wang, and D.\u00a0Sheldon. General-purpose differentially-private confidence intervals. arXiv preprint arXiv:2006.07749, 2020"},{"key":"895_CR47","unstructured":"Ferrando, C., Wang, S., Sheldon, D.: Parametric bootstrap for differentially private confidence intervals, (2021)"},{"key":"895_CR48","unstructured":"S.\u00a0Flood, M.\u00a0King, R.\u00a0Rodgers, S.\u00a0Ruggles, J.\u00a0R. Warren, and M.\u00a0Westberry. 2021 Integrated public use microdata series, current population survey: Version 9.0 [dataset]. Minneapolis, MN: IPUMS, https:\/\/doi.org\/10.18128\/D030.V9.0"},{"key":"895_CR49","unstructured":"J.\u00a0Gillenwater, M.\u00a0Joseph, and A.\u00a0Kulesza. Differentially private quantiles. In M.\u00a0Meila and T.\u00a0Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pages 3713\u20133722. PMLR, 2021"},{"key":"895_CR50","doi-asserted-by":"publisher","DOI":"10.1145\/1265530.1265535","author":"TJ Green","year":"2007","unstructured":"Green, T.J., Karvounarakis, G., Tannen, V.: Provenance semirings. PODS (2007). https:\/\/doi.org\/10.1145\/1265530.1265535","journal-title":"PODS"},{"key":"895_CR51","first-page":"2019","volume":"4","author":"U Groemping","year":"2019","unstructured":"Groemping, U.: South german credit data Correcting a widely used data set. Rep. Math. Phys. Chem. Berlin Germany Tech. Rep. 4, 2019 (2019)","journal-title":"Rep. Math. Phys. Chem. Berlin Germany Tech. Rep."},{"issue":"7825","key":"895_CR52","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1038\/s41586-020-2649-2","volume":"585","author":"CR Harris","year":"2020","unstructured":"Harris, C.R., Millman, K.J., van der Walt, S.J., Gommers, R., Virtanen, P., Cournapeau, D., Wieser, E., Taylor, J., Berg, S., Smith, N.J., Kern, R., Picus, M., Hoyer, S., van Kerkwijk, M.H., Brett, M., Haldane, A., del R\u00edo, J.F., Wiebe, M., Peterson, P., G\u00e9rard-Marchant, P., Sheppard, K., Reddy, T., Weckesser, W., Abbasi, H., Gohlke, C., Oliphant, T.E.: Array programming with NumPy. Nature 585(7825), 357\u2013362 (2020)","journal-title":"Nature"},{"issue":"2","key":"895_CR53","first-page":"21","volume":"47","author":"X He","year":"2024","unstructured":"He, X., Zhang, S.: Differential privacy with fine-grained provenance: Opportunities and challenges. IEEE Data Eng. Bull. 47(2), 21\u201349 (2024)","journal-title":"IEEE Data Eng. Bull."},{"issue":"1","key":"895_CR54","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1145\/963770.963772","volume":"22","author":"JL Herlocker","year":"2004","unstructured":"Herlocker, J.L., Konstan, J.A., Terveen, L.G., Riedl, J.T.: Evaluating collaborative filtering recommender systems. ACM Transa. Inf. Syst. (TOIS) 22(1), 5\u201353 (2004)","journal-title":"ACM Transa. Inf. Syst. (TOIS)"},{"issue":"1","key":"895_CR55","first-page":"185","volume":"3","author":"M Herschel","year":"2010","unstructured":"Herschel, M., Hern\u00e1ndez, M.A.: Explaining missing answers to SPJUA queries. PVLDB 3(1), 185\u2013196 (2010)","journal-title":"PVLDB"},{"issue":"1","key":"895_CR56","first-page":"736","volume":"1","author":"J Huang","year":"2008","unstructured":"Huang, J., Chen, T., Doan, A., Naughton, J.F.: On the provenance of non-answers to queries over extracted data. PVLDB 1(1), 736\u2013747 (2008)","journal-title":"PVLDB"},{"key":"895_CR57","first-page":"521","volume":"9","author":"B Jiang","year":"2008","unstructured":"Jiang, B., Zhang, X., Cai, T.: Estimating the confidence interval for prediction errors of support vector machine classifiers. J. Mach. Learn. Res. 9, 521\u2013540 (2008)","journal-title":"J. Mach. Learn. Res."},{"issue":"5","key":"895_CR58","doi-asserted-by":"publisher","first-page":"526","DOI":"10.1145\/3187009.3177733","volume":"11","author":"N Johnson","year":"2018","unstructured":"Johnson, N., Near, J.P., Song, D.: Towards practical differential privacy for sql queries. Proc. VLDB Endow. 11(5), 526\u2013539 (2018)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR59","unstructured":"Kaplan, H., Schnapp, S., Stemmer, U.: Differentially private approximate quantiles. CoRR, abs\/2110.05429, (2021)"},{"issue":"41","key":"895_CR60","doi-asserted-by":"publisher","first-page":"eabk3283","DOI":"10.1126\/sciadv.abk3283","volume":"7","author":"CT Kenny","year":"2021","unstructured":"Kenny, C.T., Kuriwaki, S., McCartan, C., Rosenman, E.T., Simko, T., Imai, K.: The use of differential privacy for census data and its impact on redistricting: The case of the 2020 us census. Sci. Adv. 7(41), eabk3283 (2021)","journal-title":"Sci. Adv."},{"issue":"11","key":"895_CR61","doi-asserted-by":"publisher","first-page":"1371","DOI":"10.14778\/3342263.3342274","volume":"12","author":"I Kotsogiannis","year":"2019","unstructured":"Kotsogiannis, I., Tao, Y., He, X., Fanaeepour, M., Machanavajjhala, A., Hay, M., Miklau, G.: Privatesql: a differentially private sql query engine. Proc. VLDB Endow. 12(11), 1371\u20131384 (2019)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR62","doi-asserted-by":"crossref","unstructured":"Kotsogiannis, I., Tao, Y., Machanavajjhala, A., Miklau, G., Hay, M.: Architecting a differentially private sql engine. In CIDR, (2019)","DOI":"10.14778\/3342263.3342274"},{"key":"895_CR63","doi-asserted-by":"crossref","unstructured":"J.\u00a0Lee and C.\u00a0W. Clifton. Top-k frequent itemsets via differentially private fp-trees. In Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 931\u2013940, 2014","DOI":"10.1145\/2623330.2623723"},{"key":"895_CR64","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2017.105","volume-title":"A sql-middleware unifying why and why-not provenance for first-order queries","author":"S Lee","year":"2017","unstructured":"Lee, S., K\u00f6hler, S., Lud\u00e4scher, B., Glavic, B.: A sql-middleware unifying why and why-not provenance for first-order queries. In ICDE, San Diego, CA, USA (2017)"},{"issue":"1","key":"895_CR65","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1007\/s00778-018-0518-5","volume":"28","author":"S Lee","year":"2019","unstructured":"Lee, S., Lud\u00e4scher, B., Glavic, B.: PUG: a framework and practical implementation for why and why-not provenance. VLDB J. 28(1), 47\u201371 (2019)","journal-title":"VLDB J."},{"key":"895_CR66","unstructured":"Lei, J.: Differentially private m-estimators. Advances in Neural Information Processing Systems, (2011)"},{"key":"895_CR67","doi-asserted-by":"publisher","DOI":"10.1145\/3448016.3459246","author":"C Li","year":"2021","unstructured":"Li, C., Miao, Z., Zeng, Q., Glavic, B., Roy, S.: Putting things into context: rich explanations for query answers using join graphs. In SIGMOD (2021). https:\/\/doi.org\/10.1145\/3448016.3459246","journal-title":"In SIGMOD"},{"issue":"11","key":"895_CR68","doi-asserted-by":"publisher","first-page":"1340","DOI":"10.14778\/2350229.2350251","volume":"5","author":"N Li","year":"2012","unstructured":"Li, N., Qardaji, W.H., Su, D., Cao, J.: Priv\u2018basis: frequent itemset mining with differential privacy. Proc. VLDB Endow. 5(11), 1340\u20131351 (2012)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR69","first-page":"20","volume":"155","author":"E Livshits","year":"2020","unstructured":"Livshits, E., Bertossi, L.E., Kimelfeld, B., Sebag, M.: The shapley value of tuples in query answering. ICDT 155, 20 (2020)","journal-title":"ICDT"},{"issue":"1","key":"895_CR70","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1145\/1217299.1217302","volume":"1","author":"A Machanavajjhala","year":"2007","unstructured":"Machanavajjhala, A., Kifer, D., Gehrke, J., Venkitasubramaniam, M.: L-diversity: Privacy beyond k-anonymity. TKDD 1(1), 3 (2007)","journal-title":"TKDD"},{"issue":"10","key":"895_CR71","doi-asserted-by":"publisher","first-page":"1206","DOI":"10.14778\/3231751.3231769","volume":"11","author":"R McKenna","year":"2018","unstructured":"McKenna, R., Miklau, G., Hay, M., Machanavajjhala, A.: Optimizing error of high-dimensional statistical queries under differential privacy. Proc. VLDB Endow. 11(10), 1206\u20131219 (2018)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR72","first-page":"193","volume":"33","author":"R McKenna","year":"2020","unstructured":"McKenna, R., Sheldon, D.R.: Permute-and-flip: A new mechanism for differentially private selection. Adv. Neural. Inf. Process. Syst. 33, 193\u2013203 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"895_CR73","doi-asserted-by":"crossref","unstructured":"McSherry, F., Talwar, K.: Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS\u201907), pages 94\u2013103. IEEE, (2007)","DOI":"10.1109\/FOCS.2007.66"},{"key":"895_CR74","doi-asserted-by":"crossref","unstructured":"McSherry, F.\u00a0D.: Privacy integrated queries: an extensible platform for privacy-preserving data analysis. In Proceedings of the 2009 ACM SIGMOD International Conference on Management of data, pages 19\u201330, 2009","DOI":"10.1145\/1559845.1559850"},{"issue":"1","key":"895_CR75","doi-asserted-by":"publisher","first-page":"34","DOI":"10.14778\/1880172.1880176","volume":"4","author":"A Meliou","year":"2010","unstructured":"Meliou, A., Gatterbauer, W., Moore, K.F., Suciu, D.: The complexity of causality and responsibility for query answers and non-answers. Proc. VLDB Endow. 4(1), 34\u201345 (2010)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR76","doi-asserted-by":"crossref","unstructured":"A.\u00a0Meliou, W.\u00a0Gatterbauer, S.\u00a0Nath, and D.\u00a0Suciu. Tracing data errors with view-conditioned causality. In T.\u00a0K. Sellis, R.\u00a0J. Miller, A.\u00a0Kementsietsidis, and Y.\u00a0Velegrakis, editors, Proceedings of the ACM SIGMOD International Conference on Management of Data, SIGMOD 2011, Athens, Greece, June 12-16, 2011, pages 505\u2013516. ACM, 2011","DOI":"10.1145\/1989323.1989376"},{"key":"895_CR77","doi-asserted-by":"publisher","DOI":"10.1145\/3299869.3300066","author":"Z Miao","year":"2019","unstructured":"Miao, Z., Zeng, Q., Glavic, B., Roy, S.: Going beyond provenance: Explaining query answers with pattern-based counterbalances. SIGMOD (2019). https:\/\/doi.org\/10.1145\/3299869.3300066","journal-title":"SIGMOD"},{"key":"895_CR78","doi-asserted-by":"crossref","unstructured":"I.\u00a0Mironov. R\u00e9nyi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pages 263\u2013275. IEEE, 2017","DOI":"10.1109\/CSF.2017.11"},{"key":"895_CR79","unstructured":"P.\u00a0Nanayakkara, M.\u00a0A. Smart, R.\u00a0Cummings, G.\u00a0Kaptchuk, and E.\u00a0M. Redmiles. What are the chances? explaining the epsilon parameter in differential privacy. In J.\u00a0A. Calandrino and C.\u00a0Troncoso, editors, 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pages 1613\u20131630. USENIX Association, 2023"},{"key":"895_CR80","doi-asserted-by":"crossref","unstructured":"Nguyen, T.\u00a0D.\u00a0T., Lai, P., Phan, H., Thai, M.\u00a0T.: Xrand: Differentially private defense against explanation-guided attacks. In B.\u00a0Williams, Y.\u00a0Chen, and J.\u00a0Neville, editors, AAAI, pages 11873\u201311881. AAAI Press, (2023)","DOI":"10.1609\/aaai.v37i10.26401"},{"key":"895_CR81","unstructured":"G.\u00a0Qiao, W.\u00a0J. Su, and L.\u00a0Zhang. Oneshot differentially private top-k selection. arXiv preprint arXiv:2105.08233, 2021"},{"key":"895_CR82","doi-asserted-by":"crossref","unstructured":"Reshef, A., Kimelfeld, B., Livshits, E.: The impact of negation on the complexity of the shapley value in conjunctive queries. In D.\u00a0Suciu, Y.\u00a0Tao, and Z.\u00a0Wei, editors, PODS, pages 285\u2013297, (2020)","DOI":"10.1145\/3375395.3387664"},{"key":"895_CR83","unstructured":"R.\u00a0Rogers and T.\u00a0Steinke. A better privacy analysis of the exponential mechanism. DifferentialPrivacy.org, 07 2021. https:\/\/differentialprivacy.org\/exponential-mechanism-bounded-range\/"},{"key":"895_CR84","unstructured":"Rosenblatt, L., Liu, X., Pouyanfar, S., de\u00a0Leon, E., Desai, A., Allen, J.: Differentially private synthetic data: Applied evaluations and enhancements. arXiv preprint arXiv:2011.05537, (2020)"},{"issue":"4","key":"895_CR85","doi-asserted-by":"publisher","first-page":"348","DOI":"10.14778\/2856318.2856329","volume":"9","author":"S Roy","year":"2015","unstructured":"Roy, S., Orr, L.J., Suciu, D.: Explaining query answers with explanation-ready databases. Proc. VLDB Endow. 9(4), 348\u2013359 (2015)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR86","doi-asserted-by":"crossref","unstructured":"Roy, S., Suciu, D.: A formal approach to finding explanations for database queries. In C.\u00a0E. Dyreson, F.\u00a0Li, and M.\u00a0T. \u00d6zsu, editors, SIGMOD, pages 1579\u20131590, (2014)","DOI":"10.1145\/2588555.2588578"},{"issue":"9","key":"895_CR87","doi-asserted-by":"publisher","first-page":"975","DOI":"10.14778\/3329772.3329775","volume":"12","author":"P Ruan","year":"2019","unstructured":"Ruan, P., Chen, G., Dinh, A., Lin, Q., Ooi, B.C., Zhang, M.: Fine-grained, secure and efficient data provenance for blockchain. Proc. VLDB Endow. 12(9), 975\u2013988 (2019)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR88","doi-asserted-by":"publisher","first-page":"403","DOI":"10.1257\/pandp.20191107","volume":"109","author":"S Ruggles","year":"2019","unstructured":"Ruggles, S., Fitch, C., Magnuson, D., Schroeder, J.: Differential privacy and census data: implications for social and economic research. AEA Paper. Proc. 109, 403\u201308 (2019)","journal-title":"AEA Paper. Proc."},{"key":"895_CR89","volume-title":"Towards privacy preserving data provenance for the internet of things","author":"JLC Sanchez","year":"2018","unstructured":"Sanchez, J.L.C., Bernab\u00e9, J.B., Skarmeta, A.F.: Towards privacy preserving data provenance for the internet of things. In WF-IoT, Singapore (2018)"},{"key":"895_CR90","doi-asserted-by":"crossref","unstructured":"Smith, A.: Privacy-preserving statistical estimation with optimal convergence rates. In Proceedings of the forty-third annual ACM symposium on Theory of computing, pages 813\u2013822, (2011)","DOI":"10.1145\/1993636.1993743"},{"issue":"5","key":"895_CR91","doi-asserted-by":"publisher","first-page":"557","DOI":"10.1142\/S0218488502001648","volume":"10","author":"L Sweeney","year":"2002","unstructured":"Sweeney, L.: K-anonymity: a model for protecting privacy. Int. J. Uncertain. Fuzziness. Knowl.-Based Syst. 10(5), 557\u2013570 (2002)","journal-title":"Int. J. Uncertain. Fuzziness. Knowl.-Based Syst."},{"key":"895_CR92","doi-asserted-by":"crossref","unstructured":"Y.\u00a0S. Tan, R.\u00a0K.\u00a0L. Ko, and G.\u00a0Holmes. Security and data accountability in distributed systems: A provenance survey. In HPCC\/EUC, pages 1571\u20131578, 2013","DOI":"10.1109\/HPCC.and.EUC.2013.221"},{"key":"895_CR93","unstructured":"Tang, J., Korolova, A., Bai, X., Wang, X., Wang, X.: Privacy loss in apple\u2019s implementation of differential privacy on macos 10.12. arXiv preprint arXiv:1709.02753, 2017"},{"issue":"1","key":"895_CR94","doi-asserted-by":"publisher","first-page":"113","DOI":"10.14778\/3561261.3561271","volume":"16","author":"Y Tao","year":"2022","unstructured":"Tao, Y., Gilad, A., Machanavajjhala, A., Roy, S.: Dpxplain: privately explaining aggregate query answers. Proc. VLDB Endow. 16(1), 113\u2013126 (2022)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR95","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Tao, X.\u00a0He, A.\u00a0Machanavajjhala, and S.\u00a0Roy. Computing local sensitivities of counting queries with joins. In Proceedings of the 2020 ACM SIGMOD International Conference on Management of Data, pages 479\u2013494, 2020","DOI":"10.1145\/3318464.3389762"},{"key":"895_CR96","unstructured":"Thakurta, A.\u00a0G., Smith, A.: Differentially private feature selection via stability arguments, and the robustness of the lasso. In Conference on Learning Theory, pages 819\u2013850. PMLR, 2013"},{"key":"895_CR97","unstructured":"The pandas development team. pandas-dev\/pandas: Pandas, Feb. 2020"},{"key":"895_CR98","doi-asserted-by":"crossref","unstructured":"Tran, Q.\u00a0T., Chan, C.-Y.: How to conquer why-not questions. In SIGMOD, pages 15\u201326, (2010)","DOI":"10.1145\/1807167.1807172"},{"key":"895_CR99","doi-asserted-by":"crossref","unstructured":"G.\u00a0Vandenbroucke. Married men sit atop the wage ladder. 24, 2018","DOI":"10.20955\/es.2018.24"},{"key":"895_CR100","doi-asserted-by":"publisher","first-page":"261","DOI":"10.1038\/s41592-019-0686-2","volume":"17","author":"P Virtanen","year":"2020","unstructured":"Virtanen, P., et al.: Fundamental algorithms for scientific computing in python. Nature Method. 17, 261\u2013272 (2020)","journal-title":"Nature Method."},{"issue":"12","key":"895_CR101","doi-asserted-by":"publisher","first-page":"3962","DOI":"10.14778\/3611540.3611596","volume":"16","author":"T Wang","year":"2023","unstructured":"Wang, T., Tao, Y., Gilad, A., Machanavajjhala, A., Roy, S.: Explaining differentially private query results with dpxplain. Proc. VLDB Endow. 16(12), 3962\u20133965 (2023)","journal-title":"Proc. VLDB Endow."},{"key":"895_CR102","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-21736-9","volume-title":"All of statistics: a concise course in statistical inference","author":"L Wasserman","year":"2004","unstructured":"Wasserman, L.: All of statistics: a concise course in statistical inference. Springer (2004)"},{"key":"895_CR103","doi-asserted-by":"crossref","unstructured":"R.\u00a0J. Wilson, C.\u00a0Y. Zhang, W.\u00a0Lam, D.\u00a0Desfontaines, D.\u00a0Simmons-Marengo, and B.\u00a0Gipson. Differentially private sql with bounded user contribution. arXiv preprint arXiv:1909.01917, 2019","DOI":"10.2478\/popets-2020-0025"},{"issue":"8","key":"895_CR104","doi-asserted-by":"publisher","first-page":"553","DOI":"10.14778\/2536354.2536356","volume":"6","author":"E Wu","year":"2013","unstructured":"Wu, E., Madden, S.: Scorpion: Explaining away outliers in aggregate queries. Proc. VLDB Endow. 6(8), 553\u2013564 (2013)","journal-title":"Proc. VLDB Endow."},{"issue":"10","key":"895_CR105","doi-asserted-by":"publisher","first-page":"1492","DOI":"10.1002\/int.22261","volume":"35","author":"Z Yan","year":"2020","unstructured":"Yan, Z., Li, G., Liu, J.: Private rank aggregation under local differential privacy. Int. J. Intell. Syst. 35(10), 1492\u20131519 (2020)","journal-title":"Int. J. Intell. Syst."},{"issue":"4","key":"895_CR106","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3134428","volume":"42","author":"J Zhang","year":"2017","unstructured":"Zhang, J., Cormode, G., Procopiuc, C.M., Srivastava, D., Xiao, X.: Privbayes: private data release via bayesian networks. ACM Trans. Database Syst. (TODS) 42(4), 1\u201341 (2017)","journal-title":"ACM Trans. Database Syst. (TODS)"}],"container-title":["The VLDB Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00778-024-00895-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00778-024-00895-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00778-024-00895-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,10]],"date-time":"2025-04-10T07:32:28Z","timestamp":1744270348000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00778-024-00895-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,27]]},"references-count":106,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,3]]}},"alternative-id":["895"],"URL":"https:\/\/doi.org\/10.1007\/s00778-024-00895-4","relation":{},"ISSN":["1066-8888","0949-877X"],"issn-type":[{"value":"1066-8888","type":"print"},{"value":"0949-877X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1,27]]},"assertion":[{"value":"19 September 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 December 2024","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 December 2024","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"27 January 2025","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"20"}}