Hi! My name is Shufan Zhang. I am currently a second-year PhD student in Computer Science at University of Waterloo (Waterloo, Canada), working on database security & privacy supervised by Prof. Xi He, as part of the Data System Group (DSG). I am looking for research internships in 2024.

My research interests mainly lie in the field of computer security & data privacy, on both theory and system aspects, as well as its intersections with database systems and machine learning. I am so fortunate to work with many nice professors and talented colleagues, on projects related to machine learning (robustness), access control, location privacy, and others. Our research results have appeared on conferences ACM SIGMOD, ITCS, VLDB, IEEE ICDE, ICDCS, TPDP, and journals IEEE TIT, TKDE, TMC, TVT, DEBull, and Int. J. Inf. Secur.

Selected Projects [Full List of Publications]

  • Privacy Provenance for Multi-Analyst Differential Privacy [tech report@arXiv]
    Project Description:
    • Existing DP systems are "stateless": they do not record query metadata and therefore cannot distinguish data analysts of different trust levels. This design can have an unfair apportion of privacy budget or waste much more budget than necessary if answering queries independently.
    • We propose the first "stateful" DP query processing framework, that use provenance information to keep track of each analyst's budget limit and consumption over time. We design new DP algorithms to add correlated noise to query answers. Our use study empirically shows that this new system can answer more queries of magnitude.
    Publications:
    • (Survey/Position Paper) with Xi He. "Differential Privacy with Fine-Grained Provenance: Opportunities and Challenges", in IEEE Data Engineering Bulletin (DEBull). [paper]
    • (Conference Version) with Xi He. "DProvDB: Differentially Private Query Processing with Multi-Analyst Provenance", in Proc. ACM Manag. Data (SIGMOD 2024). [paper] [bibtex] [poster]
    • (Preliminary Presentation) with Runchao Jiang and Xi He. "DProvSQL: Privacy Provenance Framework for Differentially Private SQL Engine", in TPDP, part of ICML 2022. [short paper] [bibtex] [talk video]
    Artifact: (Artifact Available)
  • Recovery from Non-Decomposable Distance Oracles. [tech report@arXiv] [Tweetorial]
    Project Description:
    • Alice and Bob are playing a game: Bob has a secret binary string; Alice wants to guess it by submitting strings to Bob – Bob returns the distance between the query and his string. What is the query complexity for Alice to win the game?
    • We instantiate Bob, the distance oracle, on a number of non-decomposable distances and obtain lower/upper bounds. The outcomes of this project would be useful in building Lipschitz-continuous and information-preserving embeddings for non-metric domain.
    Publications:
  • Preventing Inference for Access Control [tech report@arXiv]
    Project Description:
    • Data can be sensitive (protected by access control policies) and non-sensitive. The adversaries can, however, infer information about sensitive data by querying the non-sensitive part through data dependencies.
    • In this work, we study Database Constraints as the inference channel and propose a new instance-dependent security model for inference control. We develop Tattle-Tale condition, the sufficient conditions to satisfy the proposed security model and build an efficient heuristic-based system to achieve the security goal.
    Publications:
    • (Journal Extension) with Primal Pappachan, Xi He, Sharad Mehrotra. "Preventing Inferences through Data Dependencies on Sensitive Data", in IEEE Trans. on Knowledge and Data Engineering, to appear. [paper] [bibtex]
    • (Conference Version) with Primal Pappachan, Xi He, Sharad Mehrotra. "Don’t be a Tattle-Tale: Preventing Leakages through Data Dependencies on Access Control Protected Data", in VLDB 2022. [paper] [bibtex] [slides] [poster]
    Artifact: (Artifact Available, Results Reproduciable)
  • Longitudinal Differential Privacy for Location-Based Services
    Project Description:
    • We study the longitudinal use of perturbed locations, under geo-indistinguishability, in location-based services. Our findings on real-world RTB dataset show significant privacy degradation and the reconstructability of real locations.
    • We build a new system, PrivLocAd, that resorts to building user statisitcal location profile and adding permanent noise to the profile via a proposed n-fold Gaussian mechanism. Due to its tight composition and utility-driven optimization, we show the efficacy, though empirical evaluation, of PrivLocAd in location-based advertisements.
    Publications:
    • (Conference Version) with Le Yu, Lu Zhou, Yan Meng, Suguo Du and Haojin Zhu. "Thwarting Longitudinal Location Exposure Attacks in Advertising Ecosystem via Edge Computing", in ICDCS 2022. [paper] [bibtex] [slides]
    Artifact: (Artifact Available)

Teaching

  • Guest Lecturer:
    • "Differentially Private Big Data Analytics and Machine Learning", CS 480/680, University of Waterloo (Spring 2023)
  • Teaching Assistant:
    • CS 245 – Logic and Computation, University of Waterloo (Fall 2023.)
    • CS 480/680 – Introduction to Machine Learning, University of Waterloo (Spring 2023, Winter 2024).
    • CS 458/658 – Computer Security and Privacy, University of Waterloo (Winter 2023, Winter-Spring-Fall 2022).
    • CS 115 – Introduction to Computer Science, University of Waterloo (Fall 2021).
    • CS 338 – Computer Applications in Business: Databases, University of Waterloo (Spring 2021).

Services

  • Data System Group (DSG) Lab Committee Member, University of Waterloo (2022-present).
  • Student Volunteering, VLDB 2023.
  • Program Committee Member:
    • CCS 2024
    • ASTRIDE Workshop @ICDE 2023
  • Subreviewer for Conferences:
    • ICALP 2022; PODS 2021, 2022; SIGMOD 2021, 2023, 2024; VLDB 2021, 2022; CCS 2021; USENIX Security 2022, 2024; ICDE 2021, 2024; FAccT 2022; ESA 2023; PoPETS 2022; INFOCOM 2020; EDBT 2020.
  • Reviewer for Journals:
    • IEEE Trans. on Industrial Informatics
    • IEEE Trans. on Intelligent Transportation Systems
    • IEEE Journal of Biomedical and Health Informatics
    • IEEE Internet of Things Journal
    • Future Generation Computer Systems

Awards

  • PhD Travel Award, SuRI Workshop @EPFL (2023)
  • Travel Award, VLDB Endowment (2022)
  • NIST Differential Privacy Temporal Map Challenge, Sprint 3 (5th Prize, GooseDP Team, 2021)
  • University of Waterloo Entrance Scholarship (2020, 2022)

Misc.

If you want to know me, feel free to drop an e-mail on me. Minds are like parachutes — they only function when open. We may have fun talks and generate sparks of ideas. Discussions and recommendations of interesting books, movies, and researches are always welcome.

My Dijkstra number is 4 and my Erdős number is 3.


This page is still under construction.

Design Copyright © Shufan Zhang, 2019 - 2024
Last Modified: Jan. 10, 2024