Asymptotic Conditional Probabilities for Conjunctive Queries

Two seemingly unrelated applications call for a renewed study of probabilistic properties of logical formulas. One is the study of information about a sensitive query which is disclosed by a public view [10]. The other is a study of queries with uncertain predicates [1]. Both have been studied using a certain probabilistic model, which, as we show here has some limitations. In this paper we propose a new probabilistic model of databases, considered before for random graphs [12, 9] but not for databases, and study properties of conjunctive queries under this new model. This model provides a characterization of information disclosure between a query and view, with query answerability at one end of the spectrum, and logical independence (or perfect security) at the other. Motivation 1: Information Disclosure We start by illustrating the limitation of the probabilistic model in [10]. The owner of a database I wishes to publish a view V (I) over the database, and would like to determine whether certain sensitive information is disclosed by the view. The sensitive data is expressed in terms of a query, called the sensitive query, Q(I). The query-view security problem requires one to check whether the view V does not leak any secret information about the query. In [10] this problem is modeled by comparing the a priori knowledge an adversary possesses about Q(I), with the knowledge about Q(I) given V (I). The adversary’s knowledge is described as the probability of Q(I) attaining a certain value, when I is chosen randomly. If both the view and the sensitive query are boolean, the a priori probability is P(Q), while the a posteriori probability is the conditional probability P(Q | V ). When the two values are identical, then the query is said to be perfectly secure w.r.t. the view. The work in [10] is focused on deciding, for conjunctive queries Q and V , when perfect security holds. Notice that the definition is for one fixed domain and probability distribution, although the results in [10] show that it is largely independent of both. The problem is that perfect security is often too restrictive for practical purposes, rejecting as insecure query-view pairs that are probably acceptable in practice. This is illustrated in the following example: