{"id":"https://openalex.org/W7162202505","doi":"https://doi.org/10.1109/sp63933.2026.00225","title":"Auditing Apple's DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks","display_name":"Auditing Apple's DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks","publication_year":2026,"publication_date":"2026-05-18","ids":{"openalex":"https://openalex.org/W7162202505","doi":"https://doi.org/10.1109/sp63933.2026.00225"},"language":null,"primary_location":{"id":"doi:10.1109/sp63933.2026.00225","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00225","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2605.21378","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5049298311","display_name":"Rishav Chourasia","orcid":"https://orcid.org/0000-0001-7975-0530"},"institutions":[{"id":"https://openalex.org/I4210090392","display_name":"Universidade Federal de Jata\u00ed","ror":"https://ror.org/00cs91c30","country_code":"BR","type":"education","lineage":["https://openalex.org/I4210090392"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Rishav Chourasia","raw_affiliation_strings":["Betterdata.ai,Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Betterdata.ai,Singapore","institution_ids":["https://openalex.org/I4210090392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089624047","display_name":"Ergute Bao","orcid":"https://orcid.org/0000-0002-4438-8065"},"institutions":[{"id":"https://openalex.org/I4210113480","display_name":"Mohamed bin Zayed University of Artificial Intelligence","ror":"https://ror.org/0258gkt32","country_code":"AE","type":"education","lineage":["https://openalex.org/I4210113480"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Ergute Bao","raw_affiliation_strings":["Mohamed bin Zayed University of Artificial Intelligence,United Arab Emirates"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Mohamed bin Zayed University of Artificial Intelligence,United Arab Emirates","institution_ids":["https://openalex.org/I4210113480"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006869006","display_name":"Uzair Javaid","orcid":"https://orcid.org/0000-0001-6184-2867"},"institutions":[{"id":"https://openalex.org/I4210090392","display_name":"Universidade Federal de Jata\u00ed","ror":"https://ror.org/00cs91c30","country_code":"BR","type":"education","lineage":["https://openalex.org/I4210090392"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Uzair Javaid","raw_affiliation_strings":["Betterdata.ai,Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Betterdata.ai,Singapore","institution_ids":["https://openalex.org/I4210090392"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136395842","display_name":"Xiaokui Xiao","orcid":"https://orcid.org/0000-0003-0914-4580"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Xiaokui Xiao","raw_affiliation_strings":["National University of Singapore,Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore,Singapore","institution_ids":["https://openalex.org/I165932596"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63001912,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2230","last_page":"2249"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6699000000953674,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6699000000953674,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.10209999978542328,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.043299999088048935,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.7949000000953674},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.5235999822616577},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.5149999856948853},{"id":"https://openalex.org/keywords/differential-privacy","display_name":"Differential privacy","score":0.5044000148773193},{"id":"https://openalex.org/keywords/data-collection","display_name":"Data collection","score":0.4205000102519989},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.3357999920845032}],"concepts":[{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.7949000000953674},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6765999794006348},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5555999875068665},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.5235999822616577},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.5149999856948853},{"id":"https://openalex.org/C23130292","wikidata":"https://www.wikidata.org/wiki/Q5275358","display_name":"Differential privacy","level":2,"score":0.5044000148773193},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.4205000102519989},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.3357999920845032},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.31869998574256897},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3140000104904175},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.3077999949455261},{"id":"https://openalex.org/C2778775528","wikidata":"https://www.wikidata.org/wiki/Q5135432","display_name":"Closing (real estate)","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.29499998688697815},{"id":"https://openalex.org/C175801342","wikidata":"https://www.wikidata.org/wiki/Q1988917","display_name":"Data analysis","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.25360000133514404}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/sp63933.2026.00225","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00225","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2605.21378","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2605.21378","pdf_url":"https://arxiv.org/pdf/2605.21378","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2605.21378","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2605.21378","pdf_url":"https://arxiv.org/pdf/2605.21378","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.42984265089035034}],"awards":[{"id":"https://openalex.org/G1068363270","display_name":null,"funder_award_id":"MOE-000761-01","funder_id":"https://openalex.org/F4320320751","funder_display_name":"Ministry of Education - Singapore"},{"id":"https://openalex.org/G2342870495","display_name":null,"funder_award_id":"AcRF\u2010Tier2","funder_id":"https://openalex.org/F4320320751","funder_display_name":"Ministry of Education - Singapore"},{"id":"https://openalex.org/G6854926366","display_name":null,"funder_award_id":"Tier 2","funder_id":"https://openalex.org/F4320320751","funder_display_name":"Ministry of Education - Singapore"}],"funders":[{"id":"https://openalex.org/F4320320751","display_name":"Ministry of Education - Singapore","ror":"https://ror.org/01kcva023"},{"id":"https://openalex.org/F4320322724","display_name":"Ministry of Education, India","ror":"https://ror.org/048xjjh50"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Since":[0],"2016,":[1],"Apple":[2,44],"has":[3,45],"claimed":[4],"that":[5,88,132,205],"device":[6],"analytics":[7],"collected":[8],"to":[9,57,138,148,167,172,209],"improve":[10],"user":[11],"experience":[12],"are":[13],"protected":[14],"by":[15],"differential":[16],"privacy":[17,52,101],"(DP).":[18],"Apple's":[19,66,90],"DifferentialPrivacy":[20],"framework":[21,68],"is":[22],"deployed":[23,91,109],"across":[24],"its":[25,48,140],"operating":[26],"systems":[27],"and":[28,40,73,93,118,127,194,216],"handles":[29],"sensitive":[30],"signals":[31],"such":[32],"as":[33],"Safari":[34,214],"domains,":[35],"keyboard":[36,217],"events,":[37],"photo":[38],"attributes,":[39],"health-related":[41],"reports.":[42],"Because":[43],"not":[46],"open-sourced":[47],"privatization":[49],"algorithms,":[50],"these":[51],"claims":[53],"have":[54],"been":[55],"difficult":[56],"verify":[58],"independently.":[59],"We":[60,76,122,155,198],"present":[61],"a":[62],"client-side":[63],"audit":[64,104],"of":[65,182,188],"DP":[67,142,162,178],"on":[69,134],"macOS":[70,192],"Sonoma":[71,193],"14.2":[72],"Sequoia":[74],"15.6.":[75],"reverse":[77],"engineer":[78],"the":[79,99],"shipped":[80],"binaries,":[81],"recover":[82,210],"Objective-C":[83],"interfaces,":[84],"build":[85],"runtime":[86],"harnesses":[87],"execute":[89],"mechanisms,":[92,110,117,185],"test":[94],"whether":[95],"their":[96],"outputs":[97],"match":[98],"advertised":[100,141],"guarantees.":[102],"Our":[103],"covers":[105],"nearly":[106],"all":[107],"active":[108],"including":[111,213],"Count":[112],"Median":[113],"Sketch,":[114],"Hadamard-CMS,":[115],"randomized-response":[116],"Prio-style":[119],"secure":[120],"aggregation.":[121],"find":[123,157,177],"multiple":[124],"implementation":[125],"bugs":[126],"misconfigurations.":[128],"Every":[129],"audited":[130,184],"mechanism":[131],"relies":[133],"floating-point":[135,153],"noise":[136],"fails":[137],"meet":[139],"or":[143],"zero-knowledge":[144],"proof":[145],"guarantee,":[146],"due":[147],"insecure":[149],"samplers":[150],"with":[151,160,170],"known":[152],"vulnerabilities.":[154],"also":[156,199],"secure-aggregation":[158],"configurations":[159],"local":[161],"disabled,":[163],"exposing":[164],"pre-aggregation":[165],"records":[166],"any":[168],"party":[169],"access":[171],"those":[173],"logs.":[174],"Overall,":[175],"we":[176],"violations":[179],"in":[180,191,196],"5":[181],"9":[183],"affecting":[186],"87%":[187],"data":[189],"collection":[190],"68%":[195],"Sequoia.":[197],"identify":[200],"public":[201],"leaked":[202],"iPhone":[203],"logs":[204],"can":[206],"be":[207],"decoded":[208],"private":[211],"information,":[212],"domains":[215],"emoji":[218],"signals.":[219]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2026-05-24T00:00:00"}