Chorus: Differential Privacy via Query Rewriting.

We present Chorus, a system with a novel architecture for providing differential privacy for statistical SQL queries. The key to our approach is to embed a differential privacy mechanism into the query before execution so the query automatically enforces differential privacy on its output. Chorus is compatible with any SQL database that supports standard math functions, requires no user modifications to the database or queries, and simultaneously supports many differential privacy mechanisms. To the best of our knowledge, no existing system provides these capabilities. We demonstrate our approach using four general-purpose differential privacy mechanisms. In the first evaluation of its kind, we use Chorus to evaluate these four mechanisms on real-world queries and data. The results demonstrate that our approach supports 93.9% of statistical queries in our corpus, integrates with a production DBMS without any modifications, and scales to hundreds of millions of records. Chorus is currently being deployed at Uber for its internal analytics tasks. Chorus represents a significant part of the company's GDPR compliance efforts, and can provide both differential privacy and access control enforcement. In this capacity, Chorus processes more than 10,000 queries per day.