public inbox for [email protected]
help / color / mirror / Atom feedFrom: Dalibo via PostgreSQL Announce <[email protected]>
To: PostgreSQL Announce <[email protected]>
Subject: PostgreSQL Anonymizer 3.1 : Introducing Local Differential Privacy
Date: Tue, 09 Jun 2026 11:25:24 +0000
Message-ID: <178100432407.1285956.14391588410993267145@wrigleys.postgresql.org> (raw)
_Eymoutiers, France, May 27th, 2026_
Dalibo is pleased to announce `PostgreSQL Anonymizer 3.1` introducing innovative
data masking techniques to protect your data !
Enhanced Privacy Protection for Your Data
--------------------------------------------------------------------------------
`PostgreSQL Anonymizer` is an extension that hides or replaces personally
identifiable information (PII) or commercially sensitive data from a PostgreSQL
database.
The extension offers 6 different masking strategies:
* [Dynamic Masking] - Real-time data protection
* [Static Masking] - Permanent data transformation
* [Replica Masking] - Anonymized logical replication
* [Backup Masking] - Privacy-protected database exports
* [Masking Views] - Controlled data visibility
* [Masking Data Wrappers] - Extended protection across systems
Each strategy is complemented by an enhanced suite of Masking Functions, including
advanced techniques such as: Substitution, Randomization, Faking, Pseudonymization,
Partial Scrambling, Shuffling, Noise Addition and Generalization.
The extension can be installed with Debian and RPM packages, an Ansible role, a Docker
image, etc. You can use it on most major DBaaS providers including : Alibaba Cloud,
Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon, Yandex
It is also available on some Postgres forks such as EDB Advanced Postgres, Greenplum
and Yugabyte.
See the [INSTALL] section of the documentation for more details!
[Masking Functions]: https://postgresql-anonymizer.readthedocs.io/en/latest/masking_functions/
[Backup Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/anonymous_dumps/
[Static Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/static_masking/
[Dynamic Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/dynamic_masking/
[Replica Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/replica_masking/
[Masking Views]: https://postgresql-anonymizer.readthedocs.io/en/stable/masking_views/
[Masking Data Wrappers]: https://postgresql-anonymizer.readthedocs.io/en/stable/masking_data_wrappers/
[INSTALL]: https://postgresql-anonymizer.readthedocs.io/en/latest/INSTALL/
Local Differential Privacy (LDP)
--------------------------------------------------------------------------------
**Local Differential Privacy** is a stronger approach to adding noise. Unlike
the regular noise functions, LDP provides a formal mathematical guarantee:
given the output, an observer cannot determine the original value with high
confidence, no matter what auxiliary information they have. The strength of
this guarantee is controlled by a parameter called **epsilon** -- a smaller
epsilon means stronger privacy but less accuracy.
This is particularly useful for **survey data** and **categorical values**
(e.g. ratings, age brackets, answer choices) where you want to collect
aggregate statistics while protecting individual responses.
Currently LDP is achieved using the Generalized Randomized Response Mechanism
(GRRM). Additional mechanisms may be introduced in the near future.
Important Security Update
--------------------------------------------------------------------------------
Version 3.1 includes fixes for a critical vulnerability allowing users to
gain superuser privileges under certains circumstances. The risk is very high
on PostgreSQL 14 and on instances upgrades from PostgreSQL 14 and earlier.
**All users should upgrade the extension to version 3.1 as soon as possible.**
If a quick upgrade is not possible, the workaround below can mitigate the risk:
CREATE OR REPLACE FUNCTION anon.k_anonymity(relid regclass)
RETURNS INTEGER AS $$ SELECT NULL::INTEGER $$ LANGUAGE SQL;
For more details see [issue 640] (CVE-2026-9617).
[issue 640]: https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/640
Acknowledgments
--------------------------------------------------------------------------------
This release includes code, bugfixes, documentation, code reviews and ideas
from Adem Bencheikh Lehocine, Benoit Lobréau, Buut, and other [contributors].
The Local Differential Privacy features are part of a larger research project
named [DIFPRIPOS] aiming at integrating differential privacy mechanisms
into PostgreSQL. This project is financed by ANR, the French National Research
Agency. Many thanks to Jean-François Couchot and Cedric Eichler for coordination
and oversight.
[DIFPRIPOS]: https://anr.fr/Project-ANR-23-CE23-0032
We would also like to thanks the people at [Efluid] who helped us with their
ideas, comments and testing.
[Efluid]: https://www.efluid.com/
And also special thanks to the [PGRX] team for their amazing work!
[contributors]: https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/master/AUTHORS.md
[PGRX]: https://github.com/pgcentralfoundation/pgrx
Join our community to improve data privacy!
--------------------------------------------------------------------------------
PostgreSQL Anonymizer is part of the [Dalibo Labs] initiative. It is mainly
developed by [Damien Clochard].
This is an open project, contributions are welcome. We need your feedback and
ideas! Let us know what you think of this tool, how it fits your needs and
what features are missing.
If you want to help, you can find a list of [Junior Jobs].
[Junior Jobs]: https://gitlab.com/dalibo/postgresql_anonymizer/issues?label_name%5B%5D=Junior+Jobs
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected]
Subject: Re: PostgreSQL Anonymizer 3.1 : Introducing Local Differential Privacy
In-Reply-To: <178100432407.1285956.14391588410993267145@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox