3.1.1 Three way optimization between privacy and utility

One of the main problems in the design of privacy mechanisms is the preservation of the utility. In the case of local privacy, namely when the data are sanitized by the user before they are collected, the notion of utility is twofold:

• Utility as quality of service (QoS): The user usually gives his data in exchange of some service, and in general the quality of the service depends on the precision of such data. For instance, consider a scenario in which Alice wants to use a LBS (Location-Based Service) to find some restaurant near her location $x$. The LBS needs of course to know Alice's location, at least approximately, in order to provide the service. If Alice is worried about her privacy, she may send to the LBS an approximate location $x^{\text{'}}$ instead of $x$. Clearly, the LBS will send a list of restaurants near $x^{\text{'}}$, so if $x^{\text{'}}$ is too far from $x$ the service will degrade, while if it is too close Alice's privacy would be at stake.
• Utility as statistical quality of the data (Stat): Bob, the service provider, is motivated to offer his service because in this way he can collect Alice's data, and quality data are very valuable for the big-data industry. We will consider in particular the use of the data collections for statistical purposes, namely for extracting general information about the population (and not about Alice as an individual). Of course, the more Alice's data are obfuscated, the less statistical value they have.

We intend to consider both kinds of utility, and study the “three way” optimization problem in the context of $d$-privacy, our approach to local differential privacy  31. Namely, we want to develop methods for producing mechanisms that offer the best trade-off between $d$-privacy, QoS and Stat, at the same time. In order to achieve this goal, we will need to investigate various issues. In particular:

• how to best estimate the original distribution from a collection of noisy data, in order to perform the intended statistical analysis,
• what metrics to use for assessing the statistical value of a distributions (for a given application), in order to reason about Stat, and
• how to compute in an efficient way the best noise from the point of view of the trade-off between $d$-privacy, QoS and Stat.

Estimation of the original distribution

The only methods for the estimation of the original distribution from perturbed data that have been proposed so far in the literature are the iterative Bayesian update (IBU) and the matrix inversion (INV). The IBU is more general and based on solid statistical principles, but it is not ye well known in the in the privacy community, and it has not been studied much in this context. We are motivated to investigate this method because from preliminary experiments it seems more efficient on date obfuscated by geo-indistinguishability mechanisms (cfr. next section). Furthermore, we believe that the IBU is compositional, namely it can deal naturally and efficiently with the combination of data generated by different noisy functions, which is important since in the local model of privacy every user can, in principle, use a different mechanisms or a different level of noise. We intend to establish the foundations of the IBU in the context of privacy, and study its properties like the compositionality mentioned above, and investigate its performance in the state-of-the-art locally differentially private mechanisms.

Hybrid model

An interesting line of research will be to consider an intermediate model between the local and the central models of differential privacy (cfr. Figure 1). The idea is to define a privacy mechanism based on perturbing the data locally, and then collecting them into a dataset organized as an histogram. We call this model “hibrid” because the collector is trusted like in central differential privacy, but the data are sanitized according to the local model. The resulting dataset would satisfy differential privacy from the point of view of an external observer, while the statistical utility would be as high as in the local model. One further advantage is that the IBU is compositional, hence the datasets sanitized in this way could be combined without any loss of precision in the application of the IBU. In other words, the statistical utility of the union of sanitized datasets is the same as the statistical utility of the sanitized union of datasets, which is of course an improvement (for the law of large numbers) wrt each separate dataset. One important application would be the cooperative sharing of sanitized data owned by different different companies or institution, to the purpose of improving statistical utility while preserving the privacy of their respective datasets.

3.1.2 Geo-indistinguishability

We plan to further develop our line of research on location privacy, and in particular, enhance our framework of geo-indistinguishability 4 (cfr. Figure 2) with mechanisms that allow to take into account sanitize high-dimensional traces without destroying utility (or privacy). One problem with the geo-indistinguishable mechanisms developed so far (the planar Laplace an the planar geometric) is that they add the same noise function uniformly on the map. This is sometimes undesirable: for instance, a user located in a small island in the middle of a lake should generate much more noise to conceal his location, so to report also other locations on the ground, because the adversary knows that it is unlikely that the user is in the water. Furthermore, for the same reason, it does not offer a good protection with respect to re-identification attacks: a user who lives in an isolated place, for instance, can be easily singled out because he reports locations far away from all others. Finally, and this is a common problem with all methods based on DP, the repeated use of the mechanism degrades the privacy, and even when the degradation is linear, as in the case of all DP-based methods, it becomes quickly unacceptable when dealing with highly structured data such as spatio-temporal traces.

3.1.3 Threats for privacy in machine learning

In recent years several researchers have observed that machine learning models leak information about the training data. In particular, in certain cases an attacker can infer with relatively high probability whether a certain individual participated in the dataset (membership inference attack) od the value of his data (model inversion attack). This can happen even if the attacker has nop access to the internals of the model, i.e., under the black box assumption, which is the typical scenario when machine learning is used as a service (cfr. Figure 3). We plan to develop methods to reason about the information-leakage of training data from deep learning systems, by identifying appropriate measures of leakage and their properties, and use this theoretical framework as a basis for the analysis of attacks and for the development of robust mitigation techniques. More specifically, we aim at:

• Developing compelling case studies based on state-of-the-art algorithms to perform attacks, showcasing the feasibility of uncovering specified sensitive information from a trained software (model) on real data.
• Quantifying information leakage. Based on the uncovered attacks, the amount of sensitive information present in trained software will be quantified and measured. We will study suitable notions of leakage, possibly based on information-theoretical concepts, and establish firm foundations for these.
• Mitigating information leakage. Strategies will be explored to avoid the uncovered attacks and minimize the potential information leakage of a trained model.

3.1.4 Relation between privacy and robustness in machine learning

The relation between privacy and robustness, namely resilience to adversarial attacks, is rather complicated. Indeed the literature on the topic seems contradictory: on the one hand, there are works that show that differential privacy can help to mitigate both the risk of inference attacks and of misclassification (cfr. 35). On the other hand, there are studies that show that there is a trade-off between protection from inference attacks and robustness 36. We intend to shed light on this confusing situation. We believe that the different variations of differential privacy play a role in this apparent contradiction. In particular, preprocessing the training data with $d$-privacy seems to go along with the concept of robustness, because it guarantees that small variations in the input cannot result in large variations in the output, which is exactly the principle of robustness. On the other hand, the addition of random noise on the output result (postprocessing), which is the typical method in central DP, should reduce the precision and therefore increase the possibility of misclassification. We intend to make a taxonomy of the differential privacy variants, in relation to their effect on robustness, and develop a principled approach to protect both privacy and security in an optimal way.

One promising research direction for the deployment of $d$-privacy in this context is to consider Bayesian neural networks (BNNs). These are neural networks with distributions over their weights, which can capture the uncertainty within the learning model, and which provide a natural notion of distance (between distributions) on which we can define a meaningful notion of $d$-privacy. Such neural networks allow to compute an uncertainty estimate along with the output, which is important for safety-critical applications.

3.1.5 Relation between privacy and fairness

Both fairness and privacy are multi-faces notions, assuming different meaning depending on the application domain, on the situation, and on what exactly we want to protect. Fairness, in particular, has received many different definitions, some even in contrast with each other. One of the definitions of fairness is the property that similar “similar” input data produce "similar" outputs. Such notion corresponds closely to $d$-privacy. Other notions of fairness, however, are in opposition to standard differential privacy. This is the case, notably, of Equalized Odds33 and of Equality of False Positives and Equality of False Negatives32. We intend to study a tassonomy of the relation between the main notions of fairness an the various variants of differential privacy. In particular, we intend to study the relation between the recently-introduced notions of causal fairness and causal differential privacy  37.

Another line of research related to privacy and fairness, that we intend to explore, is the design of to pre-process the training set so to obtain machine learning models that are both privacy-friendly and fair.

3.2.1 Non-0-sum games

The framework of $g$-leakage does not take into account two important factors: (a) the loss of the user, and (b) the cost of the attack for the adversary. Regarding (a), we observe that in general the goal of the adversary may not necessarily coincide with causing maximal damage to the user, i.e., there may be a mismatch between the aims of the attacker and what the user tries to protect the most. To model this more general scenario, we had started investigating the interplay between defender and attacker in a game-theoretic setting, starting with the simple case of 0-sum games which corresponds to $g$-leakage. The idea was that, once the simple 0-sum case would be well understood, we would extend the study to the non-0-sum case, that is needed to represent (a) and (b) above. However, we had first to invent and lay the foundations of a new kind of games, the information leakage games29 because the notion of leakage cannot be expressed in terms of payoff in standard game theory. Now that the theory of these new games is well established, we intend to go ahead with our plan, namely study costs and damages of attacks in terms of non-0-sum information leakage games.

3.2.2 Black-box estimation of leakage via machine learning

Most of the works in QIF rely on the so-called white-box assumption, namely, they assume that it is possible to compute exactly the (probabilistic) input-output relation of the system, seen as an information-theoretic channel. This is necessary in order to apply the formula that expresses the leakage. In practical situations, however, it may not be possible to compute the input-output relation, either because the system is too complicated, or simply because it is not accessible. Such scenario is called black-box. The only assumption we make is that the adversary can interact with the system, by feeding to it inputs of his choice and observing the corresponding outputs.

Given the practical interest of the black-box model, we intend to study methods to estimate its leakage. Clearly the standard QIF methods are not applicable. We plan to use, instead, a machine learning approach, continuing the work we started in 20. In particular, we plan to investigate whether we can improve the efficiency of the method proposed by leveraging on the experience that we have acquired with the GANs 19. The idea is to construct a training set and a testing set from the input-output samples collected by interacting with the system, and then build a classifier that learns from the training set to classify the input from the output so to maximize its gain. The measure of its performance on the testing set should then give an estimation of the posterior $g$-vulnerability.

3.3.1 Privacy protection

In 14 we have investigated potential leakage in social networks, namely, the unintended propagation and collection of confidential information. We intend to enrich this model with epistemic aspects, in order to take into account the belief of the users and how it influences the behavior of agents with respect the transmission of information.

Furthermore, we plan to investigate attack models used to reveal a user’s private information, and explore the framework of $g$-leakage to formalize the privacy threats. This will provide the basis to study suitable protection mechanisms.

3.3.2 Polarization and Belief in influence graphs

In social scenarios, a group may shape their beliefs by attributing more value to the opinions of influential figures. This cognitive bias is known as authority bias. Furthermore, in a group with uniform views, users may become extreme by reinforcing one another’s opinions, giving more value to opinions that confirm their own beliefs; another common cognitive bias known as confirmation bias. As a result, social networks can cause their users to become radical and isolated in their own ideological circle causing dangerous splits in society (polarization). We intend to study these dynamics in a model called influence graph, which is a weighted directed graph describing connectivity and influence of each agent over the others. We will consider two kinds of belief updates: the authority belief update, which gives more value to the opinion of agents with higher influence, and the confirmation bias update, which gives more value to the opinion of agents with similar views.

We plan to study the evolution of polarization in these graphs. In particular, we aim at defining a suitable measure of polarization, characterizing graph structures and conditions under which polarization eventually converges to 0 (vanishes), and methods to compute the change in the polarization value over time.

Another purpose of this line of research is how the bias of the agents whose data are being collected impacts the fairness of learning algorithms based on these data.

3.3.3 Concurrency models for the propagation of information

Due to their popularity and computational nature, social networks have exacerbated group polarization. Existing models of group polarization from economics and social psychology state its basic principles and measures 34. Nevertheless, unlike our computational ccp models, they are not suitable for describing the dynamics of agents in distributed systems. Our challenge is to coherently combine our ccp models for epistemic behavior with principles and techniques from economics and social psychology for GP. We plan to develop a ccp-based process calculus which incorporates structures from social networks, such as communication, influence, individual opinions and beliefs, and privacy policies. The expected outcome is a computational model that will allow us to specify the interaction of groups of agents exchanging epistemic information among them and to predict and measure the leakage of private information, as well as the degree of polarization that such group may reach.

6.1.1 libqif - A Quantitative Information Flow C++ Toolkit Library

• Keywords: Information leakage, Privacy, C++, Linear optimization
• Functional Description:

  The goal of libqif is to provide an efficient C++ toolkit implementing a variety of techniques and algorithms from the area of quantitative information flow and differential privacy. We plan to implement all techniques produced by Com$\setminus$`ete in recent years, as well as several ones produced outside the group, giving the ability to privacy researchers to reproduce our results and compare different techniques in a uniform and efficient framework.

  Some of these techniques were previously implemented in an ad-hoc fashion, in small, incompatible with each-other, non-maintained and usually inefficient tools, used only for the purposes of a single paper and then abandoned. We aim at reimplementing those – as well as adding several new ones not previously implemented – in a structured, efficient and maintainable manner, providing a tool of great value for future research. Of particular interest is the ability to easily re-run evaluations, experiments, and case-studies from QIF papers, which will be of great value for comparing new research results in the future.

  The library's development continued in 2020 with several new added features. 68 new commits were pushed to the project's git repository during this year. The new functionality was directly applied to the experimental results of several publications of COMETE.

• URL: https://github.com/chatziko/libqif
• Contact: Konstantinos Chatzikokolakis

6.1.2 Location Guard

• Keywords: Privacy, Geolocation, Browser Extensions
• Scientific Description: The purpose of Location Guard is to implement obfuscation techniques for achieving location privacy, in a an easy and intuitive way that makes them available to the general public. Various modern applications, running either on smartphones or on the web, allow third parties to obtain the user's location. A smartphone application can obtain this information from the operating system using a system call, while web application obtain it from the browser using a JavaScript call.
• Functional Description:

  Websites can ask the browser for your location (via JavaScript). When they do so, the browser first asks for your permission, and if you accept, it detects your location (typically by transmitting a list of available wifi access points to a geolocation provider such as Google Location Services, or via GPS if available) and gives it to the website.

  Location Guard is a browser extension that intercepts this procedure. The permission dialog appears as usual, and you can still choose to deny it. If you give permission, then Location Guard obtains your location and adds "random noise" to it, creating a fake location. Only the fake location is then given to the website.

  Location Guard is by now a stable tool with a large user base. No new features were added in 2020, however, the tool is still actively maintained.

• URL: https://github.com/chatziko/location-guard
• Contact: Konstantinos Chatzikokolakis
• Participants: Catuscia Palamidessi, Konstantinos Chatzikokolakis, Marco Stronati, Miguel Andrés, Nicolas Bordenabe

6.1.3 IBU: A java library for estimating distributions

• Keywords: Privacy, Statistic analysis, Bayesian estimation
• Functional Description:

  The main objective of this library is to provide an experimental framework for evaluating statistical properties on data that have been sanitized by obfuscation mechanisms, and for measuring the quality of the estimation. More precisely, it allows modeling the sensitive data, obfuscating these data using a variety of privacy mechanisms, estimating the probability distribution on the original data using different estimation methods, and measuring the statistical distance and the Kantorovich distance between the original and estimated distributions. This is one of the main software projects of Palamidessi's ERC Project HYPATIA.

  We intend to extend the software with functionalities that will allow estimating statistical properties of multi-dimensional (locally sanitized) data and using collections of data locally sanitized with different mechanisms.

• URL: https://gitlab.com/locpriv/ibu
• Contact: Ehab ElSalamouny

6.1.4 F-BLEAU

• Name: F-BLEAU
• Keywords: Information leakage, Machine learning, Privacy
• Functional Description:

  F-BLEAU is a tool for estimating the leakage of a system about its secrets in a black-box manner (i.e., by only looking at examples of secret inputs and respective outputs). It considers a generic system as a black-box, taking secret inputs and returning outputs accordingly, and it measures how much the outputs "leak" about the inputs.

  F-BLEAU is based on the equivalence between estimating the error of a Machine Learning model of a specific class and the estimation of information leakage.

  This code was also used for the experiments of a COMETE publication that appeared in S&P 2019 , on the following evaluations: Gowalla, e-passport, and side-channel attack to finite field exponentiation.

  The software is maintained and some new features were added in 2020.

• Release Contributions: First F-BLEAU release. Supports frequentist and k-NN estimates with several parameters, and it allows stopping according to delta-convergence criteria.
• URL: https://github.com/gchers/fbleau
• Contacts: Giovanni Cherubin, Konstantinos Chatzikokolakis, Catuscia Palamidessi

6.1.5 MILES

• Name: ML Leakage Estimation
• Keywords: Information leakage, Machine learning
• Functional Description:

  This software provides a tool for estimating the g-leakage of a system in the black-box setting, i.e., when the true posterior distributions of the outputs given the inputs are unknown, and the only available knowledge comes from observing input-output examples.

  The tool is based on two methods: The first one relies on the Artificial Neural Networks' ability to output probability distributions, which can be used to directly estimate the g-leakage. The second method is based on a preprocessing of the data to be used for the training phase. In practice, the pre-processing reduces the problem of g-leakage estimation to that of estimating the Bayes risk, a task that can be achieved by generating an approximation of the Bayes classifier, using any universally consistent learning rule.

  This package is a software project of Palamidessi's ERC Project HYPATIA.

• URL: https://gitlab.com/marcoromane.gitlab.public/miles_server_version
• Contacts: Catuscia Palamidessi, Marco Romanelli

6.1.6 MIPAN

• Name: Mutual Information Privacy Adversarial Networks
• Keywords: Privacy, Neural networks
• Functional Description:

  This package provides a GAN (Generative Adversarial Network) to produce an optimal mechanism for privacy protection.

  The system consists of two nets: the generator, which tries to produce an optimal obfuscation mechanism to protect the data, and the classifier, which tries to de-obfuscate the data. By letting the two nets compete against each other, the mechanism improves its degree of protection, until an equilibrium is reached.

  The package contains an application to the case of location privacy, and experiments performed on synthetic data and on real data from the Gowalla dataset (https://snap.stanford.edu/data/loc-gowalla_totalCheckins.txt.gz).

  This package is a software project of Palamidessi's ERC Project HYPATIA.

• URL: https://gitlab.com/MIPAN/mipan
• Contacts: Catuscia Palamidessi, Marco Romanelli

6.1.7 MinEntropyFeatureSelection

• Name: Feature Selection for Machine Learning
• Keywords: Machine learning, Entropy
• Functional Description:

  This is a library for feature selection, namely a tool to reduce the number of features to be considered by an algorithm for machine learning. It can be used to make the learning phase more efficient and more accurate.

  The idea is to try to find a minimal set of features that contain the maximal information about the labeling task. The tool works iteratively in a greedy fashion, and at each step, it adds to the set a feature that is as independent as possible from those that have been selected. The metric for the independence test is mutual information, and the user can choose between Shannon or Rényi mutual information.

• URL: https://gitlab.com/marcoromane.gitlab.public/minentropyfeatureselection
• Contact: Marco Romanelli

6.1.8 dspacenet

• Name: Distributed-Spaces Network.
• Keywords: Social networks, Distributed programming
• Functional Description:

  DSpaceNet is a tool for social networking based on multi-agent spatial and timed concurrent constraint language.

  I - The fundamental structure of DSPaceNet is that of *space*: A space may contain

  (1) spatial-mobile-reactive tcc programs, and (2) other spaces.

  Furthermore, (3) each space belongs to a given agent. Thus, a space of an agent j within the space of agent i means that agent i allows agent j to use a computation sub-space within its space.

  II - The fundamental operation of DSPaceNet is that of *program posting*: In each time unit, agents can post spatial-mobile-reactive tcc programs in the spaces they are allowed to do so (ordinary message posting corresponds to the posting of tell processes). Thus, an agent can for example post a watchdog tcc process to react to messages in their space, e.g. whenever (*happy b*frank*) do tell("thank you!"). More complex mobile programs are also allowed (see below).

  The language of programs is a spatial mobile extension of tcc programs:

  $P,Q...:={tell\left(c\right)\left|whencdoP\right|\left|nextP\right|P\left|\right|Q\left|unlesscnextP\right|\left[P\right]}_i{|\uparrow }_{i}P|recX.P$

  Computation of timed processes proceeds as in tcc. The spatial construct ${\left[P\right]}_i$ runs $P$ in the space of agent $i$ and the mobile process ${\uparrow }_{i}P$, extrudes $P$ from the space of $i$. By combining space and mobility, arbitrary processes can be moved from one a space into another. For example, one could send a trojan watchdog to another space for spying for a given message and report back to one's space.

  III- Constraint systems can be used to specify advance text message deduction, arithmetic deductions, scheduling, etc.

  IV - Epistemic Interpretation of spaces can be used to derive whether they are users with conflicting/inconsistent information, or whether a group of agents may be able to deduce certain message.

  V - The scheduling of agent requests for program posts, privacy settings, friendship lists are handled by an external interface. For example, one could use type systems to check whether a program complies with privacy settings (for example checking that the a program does not move other program into a space it is not allowed into).

• URL: http://dspacenet.javerianacali.edu.co/
• Contact: Frank Valencia
• Partner: Pontificia Universidad Javeriana Cali

8.1.1 Equipe Associée

• Achronym: LOGIS
• Title: Logical and Formal Methods for Information Security
• Program: Inria Associate Teams
• Duration: Jan 1 2019 - Dec 31, 2021
• Coordinator: Catuscia Palamidessi
• Partners:
  • Keio University (Japan), Mitsuhiro Okada
  • AIST (Japan), Yusuke Kawamoto
  • JAIST (Japan), Tachio Terauchi
  • University of Tokyo (Japan), Masami Hagiya
  • Inria (France), Catuscia Palamidessi
  • LSV, UPS (France), Hubert Comon
• Inria contact: Catuscia Palamidessi
• Description:

  With the ever-increasing use of internet-connected devices, such as computers, IoT appliances and GPS-enabled equipments, personal data are collected in larger and larger amounts, and then stored and manipulated for the most diverse purposes. Although privacy is of fundamental importance for the users of these systems, the protection of personal data is challenging for a variety of reasons.

  First, personal data can be leaked due to numerous attacks on cryptographic protocols, often affecting those that were long thought to be secure. Second, partially releasing personal data is often desirable, either to access a desired service (e.g. Location-Based Services), or to collect statistics, which provides enormous benefits to individuals and society.

  To address these challenges, our project aims at advancing the state of the art of (A) protocol verification and (B) privacy control. The two approaches are complementary, addressing different types of information leaks: those caused by flaws in the protocol (A) and those caused by the partial (voluntary or not) release of information (B).

8.1.2 International partners

COMETE has several international partners. In the following, we list these collaborations according to the various topics.

8.1.3 Participation in other international programs

• Achronym: FACTS
• Title: Foundational Approach to Cognition in Today's Society
• Program: ECOS NORD
• Duration: Jan 1 2019 - Dec 31, 2021
• Coordinator: Frank Valencia, CNRS, Ecole Polytechnique.
• Partners:
  • Inria (France), Frank Valencia
  • LIP6, Sorbonne University (France), Jean-Gabriel Ganascia
  • Universidad Javeriana de Cali (Colombia), Camilo Rueda
• Inria contact: Frank Valencia
• Description: This projects aims at studying the phenomenon of “Group Polarization”; the tendency for a group to learn or acquire beliefs or to make decisions that are more extreme than the initial inclinations of its members.

8.3.1 ERC grant

• Achronym: HYPATIA
• Title: Privacy and Utility Allied
• Program: European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme.
• Duration: October 2019 – September 2024
• Principal Investigator: Catuscia Palamidessi
• URL: https://project.inria.fr/hypatia/
• Description: The objective of this project is to develop the theoretical foundations, methods and tools to protect the privacy of the individuals while letting their data to be collected and used for statistical purposes. We aim in particular at developing mechanisms that can be applied and controlled directly by the user thus avoiding the need of a trusted party, are robust with respect to combination of information from different sources, and provide an optimal trade-off between privacy and utility.

8.3.2 Collaboration with major European organizations

• Achronym: CRYPTECS
• Title: Cloud-Ready Privacy-Preserving Technologies
• Program: ANR-BMBF French-German Joint Call on Cybersecurity
• Duration: June 1, 2021 - May 31, 2024
• Coordinators: Baptiste Olivier and Sven Trieflinger
• Partners:
  • Orange (France), Baptiste Olivier
  • The Bosch Group (Germany) Sven Trieflinger
  • Inria (France), Catuscia Palamidessi
  • University of Stuttgart (Germany), Ralf Kuesters
  • Zama (SME spin-off of CryptoExperts, France), Pascal Paillier and Matthieu Rivain
  • Edgeless Systems (SME, Germany), Felix Schuster
  • Aircloak (SME, Germany), Felix Bauer
• Inria contact: Catuscia Palamidessi
• Description: The project aims at building an open source cloud platform promoting the adoption of privacy-preserving computing (PPC) technology by offering a broad spectrum of business-ready PPC techniques (Secure Multiparty Computation, Homomorphic Encryption, Trusted Execution Environments, and methods for Statistical Disclosure Control, in particular Differential Privacy) as reusable and composable services.

9.1.1 Executive and Steering Committees

Catuscia Palamidessi has been / is involved in the following committees:

• (2019-) Member of the Scientific Advisory Board of ANSSI, the French National Cybersecurity Agency.
• (2019-) Member of the Scientific Advisory Board of CISPA, the Helmholtz Center for Information Security.
• (2016-) Member of the Steering Committee of CONCUR, the International Conference in Concurrency Theory.
• (2015-) Member of the Steering Committee of EACSL, the European Association for Computer Science Logics.
• (2014-) Member of the Executive Committee of SIGLOG, the ACM Special Interest Group on Logic and Computation.
• (2005-20) Member of the Steering Committee of ETAPS, the European Joint Conferences on Theory and Practice of Software.
• (1997-) Member of the Steering Committee of EXPRESS, the international workshop on Expressiveness in Concurrency.

Frank Valencia has been a member of the Steering Committee of EXPRESS, the international workshop on Expressiveness in Concurrency (2011-).

9.1.2 Scientific Associations

Catuscia Palamidessi is member of the following associations:

• (2010-) Member of the IFIP Working Group 1.7 – Theoretical Foundations of Security Analysis and Design.
• (2007-20) Member of the IFIP Technical Committee 1. Foundations of Computer Science.
• (2005-) Member of the IFIP Working Group 1.8 – Concurrency Theory.

9.1.3 Editorial boards

Catuscia Palamidessi is member of the following boards:

• (2020-) Member of the Editorial Board of the IEEE Transactions on Dependable and Secure Computing. IEEE Computer Society.
• (2020-) Member of the Editorial Board of the Journal of Logical and Algebraic Methods in Programming, Elsevier.
• (2019-) Member of the Editorial Board of the Journal of Computer Security. IOS Press.
• (2017-20) Member of the Editorial Board of Proceedings on Privacy Enhancing Technologies (PoPETs), De Gruyter.
• (2015-) Member of the Editorial Board of Acta Informatica, Springer.
• (2014-) Member of the Advising Board of LIPIcs: Leibniz International Proceedings in Informatics, Schloss Dagstuhl–Leibniz Center for Informatics.
• (2006-) Member of the Editorial Board of Mathematical Structures in Computer Science, Cambridge University Press.

9.1.4 Program committee member for conferences and workshops

Catuscia Palamidessi has been / is member of the following program committees:

9.1.5 Invited speaker at international conferences and workshops

Catuscia Palamidessi has been invited speaker at the following events:

• CONCUR 2020. The 31st International Conference on Concurrency Theory Vienna, Austria, September 1-4, 2020.
• PPAI 2020. The AAAI Workshop on Privacy-Preserving Artificial Intelligence. New York, USA, February 7, 2020.
• Federated Learning and Privacy-Preserving Machine Learning. Société Française de Statistique. Virtual workshop. 24 November 2020.
• Journées Nationales du GDR Sécurité Informatique. Paris, France, June 2019.

9.2.1 Supervision of PhD students

• (2020-) Sayan Biswas. IPP. Thesis subject: On the tradeoff between Local Differential Privacy and Statistical Utility.
• (2020-) Ruta Binkite-Saudaskiene. IPP. Co-supervised by Catuscia Palamidessi and Frank Valencia. Thesis subject: Fairness issues in Social Networks.
• (2020-) Carlos Pinzon. IPP. Co-supervised by Catuscia Palamidessi, Pablo Piantanida and Frank Valencia. Thesis subject: On the tradeoff between Privacy and Fairness in Machine Learning.
• (2019-) Federica Granese. IPP and Università di Roma "La Sapienza". Co-supervised by Catuscia Palamidessi, Daniele Gorla and Pablo Piantanida. Thesis subject: Security in Machine Learning.
• (2019-) Ganesh Del Grosso Guzman. IPP. Co-supervised by Catuscia Palamidessi and Pablo Piantanida. Thesis subject: Privacy in Machine Learning.
• (2018-) Santiago Quintero Pabón. IPP. Co-supervised by Frank Valencia and Catuscia Palamidessi. Thesis subject: Foundational Models for Group Polarization, Lies and Privacy in Social Networks.
• (2018-) Natasha Fernandez. IPP and University of Maquaire. Co-supervised by Catuscia Palamidessi and Annabelle McIver. Thesis subject: Privacy Protection Methods for Textual Documents.
• (2017-) Anna Pazii. Co-supervised by Catuscia palamidessi and Konstantinos Chatzikokolakis. Thesis subject: Local Differential Privacy.
• (2017-20) Marco Romanelli. IPP and Università di Siena. Co-supervised by catuscia Palamidessi and Moreno Falaschi, University of Siena, Italy. Thesis subject: Machine Learning and Private Information Flow. Marco defended his thesis in October 2020 and after the thesis defense he took a postdoc position at Centrale Supélec, France.
• (2017-2020) Sergio Ramirez. Co-supervised by Frank Valencia and Camilo Rueda, Universidad Javeriana Cali. Thesis subject: Constraint Systems to Reason About Distributed Knowledge. Thesis has been submitted and it is expected to be defended in April, 2021.

9.2.2 Supervision of Master students

COMETE has hosted as an intern Lucas Bouju, Master student at ENSAI (France), from Mar 2020 until Sep 2020.

9.2.3 Supervision of postdocs

• (Nov 2020-) Gangsoo Zeong (aka Kangsoo Jung), supervised by Catuscia palamidessi.
• (Nov 2020-) Marco Romanelli, co-supervised by Catuscia Palamidessi and Pablo Piantanida.
• (Nov 2020-) Sergio Ramirez, supervised by Frank Valencia.

9.2.4 Advisory boards for PhD programs and thesis

Catuscia Palamidessi is:

• (2012-) External member of the scientific council for the PhD in Computer Science at the University of Pisa, Italy.
• (2020-) Member of the advising committee of Abhishek Sharma, PhD student supervised by Maks Ovsjanikov, IPP, France.

9.2.5 Examination of PhD thesis

Catuscia Palamidessi has been president of the committee board at the PhD defense of Sammy Khalife (IPP, Palaiseau). Title of the thesis: Graphs, geometry and representations for language and networks of entities. Supervised by Michalis Vazirgiannis. Defended in June 2020.

9.2.6 Teaching

Catuscia Palamidessi has designed and been responsible for the MPRI course 2.3.2: Foundations of privacy on the protection of privacy and control of information leakage. The course consists of 24 hours of lectures, and is worth 3 ECTS. She has also been teaching the course during the academic years 2015-16, 2016-17, 2017-18 and 2019-20. Frank Valencia has been teaching the following courses at Pontificia Universidad Javeriana: Two masters courses, one on Foundations of Computation and the other on Concurrency Theory, and two undergraduate courses, one on Discrete Math and the other on Computability and Complexity. Each course consists 42 hours of lectures.

9.3.1 Promotion of scientific activities

Since 2020, Catuscia Palamidessi is animating the DATAIA Expert Group on Digital Trust. The objective of this EG is to set up projects and initiatives of various kind aimed at facilitating the development of practical solutions for the application of the GDPR, with particular focus on differential privacy and homomorphic encryption.

9.4.1 Service to the department and college

Catuscia Palamidessi is:

• (2020-) Vice-president of the Commission Scientifique du Centre de Recherche Inria Saclay.
• (2019-) Deputy Member of the Commission Consultatives Paritaire de l’Inria.
• (2018-20) Member of the Commission Scientifique du Centre de Recherche Inria Saclay.
• (2017-) Member of the committee for the assignment of the INRIA International Chairs.

9.4.2 Evaluation committees

Catuscia Palamidessi has been involved in the following evaluation committees:

• (2020-) Member of the EAPLS PhD Award Committee.
• (2020) Member of the KON-NT panel for natural and engineering sciences, Sweden.
• (2020) Member of the committee for a professor position at the Scuola Normale Superiore, Pisa.
• (2020) Member of the committee for a professor position at the CS department of the University of Pisa.
• (2020) Member of the evaluation commitee for Assistant professor positions at the Department of Computer Science (DIX), Ecole Polytechnique.
• (2020) External Member of the committee for the promotion to full professor of Prof. Kévin Huguenin. HEC Lausanne, Switzerland.
• (2005-) Reviewer for the project proposals for the program PRIN, sponsored by the Italian MIUR (“Ministero dell'Istruzione, dell'Università e della Ricerca”).

Frank Valencia has been a member of the committee for for the 2020 full professor and assistant professor positions at the Department of Computer Science (DIX), Ecole Polytechnique.

International journals

• 11 articleValentinaV. Castiglioni, KonstantinosK. Chatzikokolakis and CatusciaC. Palamidessi. A Logical Characterization of Differential PrivacyScience of Computer Programming1882020, 102388
  HALDOIback to text
• 12 articleKonstantinosK. Chatzikokolakis, NatashaN. Fernandes and CatusciaC. Palamidessi. Refinement Orders for Quantitative Information Flow and Differential PrivacyJournal of Cybersecurity and Privacy1December 2020, 40 - 77
  HALDOIback to text
• 13 articleMorenoM. Falaschi, MaurizioM. Gabbrielli, CarlosC. Olarte and CatusciaC. Palamidessi. Dynamic slicing for Concurrent Constraint LanguagesFundamenta Informaticae1773-4December 2020, 331-357
  HALDOIback to text
• 14 article DanieleD. Gorla, FedericaF. Granese and CatusciaC. Palamidessi. Enhanced Models for Privacy and Utility in Continuous-Time Diffusion Networks International Journal of Information Security 2021
  HAL DOI back to text back to text
• 15 article MichellM. Guzmán, SophiaS. Knight, SantiagoS. Quintero, CamiloC. Rueda and FrankF. Valencia. Algebraic Structures from Concurrent Constraint Programming Calculi for Distributed Information in Multi-Agent Systems Journal of Logical and Algebraic Methods in Programming 2021
  HAL

International peer-reviewed conferences

• 16 inproceedingsEhabE. Elsalamouny and CatusciaC. Palamidessi. Full Convergence of the Iterative Bayesian Update and Applications to Mechanisms for Privacy ProtectionEuroS&P 2020 - 5th IEEE European Symposium on Security and PrivacyGenova, ItalySeptember 2020, 490-507
  HALback to text
• 17 inproceedingsCatusciaC. Palamidessi and MarcoM. Romanelli. Modern Applications of Game-Theoretic PrinciplesCONCUR 2020 - 31st International Conference on Concurrency Theory171Leibniz International Proceedings in Informatics (LIPIcs)Vienne / Virtual, AustriaSeptember 2020, 4:1–4:9
  HALDOIback to text
• 18 inproceedings SantiagoS. Quintero, SergioS. Ramírez, CamiloC. Rueda and Frank D.F. Valencia. Counting and Computing Join-Endomorphisms in Lattices RAMICS 2020 - 18th International Conference on Relational and Algebraic Methods in Computer Science Lecture Notes in Computer Science Paris, France April 2020
  HAL back to text
• 19 inproceedingsMarcoM. Romanelli, KonstantinosK. Chatzikokolakis and CatusciaC. Palamidessi. Optimal Obfuscation Mechanisms via Machine LearningCSF 2020 - 33rd IEEE Computer Security Foundations SymposiumOnline, United StatesJune 2020, 153-168
  HALback to textback to text
• 20 inproceedingsMarcoM. Romanelli, KonstantinosK. Chatzikokolakis, CatusciaC. Palamidessi and PabloP. Piantanida. Estimating g-Leakage via Machine LearningCCS '20 - 2020 ACM SIGSAC Conference on Computer and Communications SecurityOnline, United StatesNovember 2020, 697-716
  HALback to textback to textback to text

Scientific books

• 21 bookMário S.M. Alvim, KonstantinosK. Chatzikokolakis, AnnabelleA. McIver, CarrollC. Morgan, CatusciaC. Palamidessi and GeoffreyG. Smith. The Science of Quantitative Information Flow2020, XXVIII, 478
  HALDOIback to textback to text

Scientific book chapters

• 22 inbookMorenoM. Falaschi, CatusciaC. Palamidessi and MarcoM. Romanelli. Derivation of Constraints from Machine Learning Models and Applications to Security and Privacy86Recent Developments in the Design and Implementation of Programming LanguagesOASICS2020, 11:1-11:20
  HALDOIback to text

Reports & preprints

• 23 misc Mário S.M. Alvim, BernardoB. Amorim, SophiaS. Knight, SantiagoS. Quintero and FrankF. Valencia. Polarization and Belief Convergence of Agents in Strongly-Connected Influence Graphs August 2020
  HAL
• 24 misc Mário S.M. Alvim, KonstantinosK. Chatzikokolakis, YusukeY. Kawamoto and CatusciaC. Palamidessi. Information Leakage Games: Exploring Information as a Utility Function December 2020
  HAL
• 25 misc KonstantinosK. Chatzikokolakis, GiovanniG. Cherubin, CatusciaC. Palamidessi and CarmelaC. Troncoso. The Bayes Security Measure December 2020
  HAL
• 26 misc SophiaS. Knight, PrakashP. Panangaden and FrankF. Valencia. Computing with Epistemic and Spatial Modalities February 2020
  HAL
• 27 misc KarimaK. Makhlouf, SamiS. Zhioua and CatusciaC. Palamidessi. On the Applicability of ML Fairness Notions December 2020
  HAL
• 28 misc KarimaK. Makhlouf, SamiS. Zhioua and CatusciaC. Palamidessi. Survey on Causal-based Machine Learning Fairness Notions December 2020
  HAL