Extending w-event Differential Privacy to the Publish-Subscribe Framework

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Internet of Things (IoT) devices have become ubiquitous, permeating both enterprises and homes, and they increasingly rely on publish-subscribe (pub-sub) frameworks that give subscribers real-time, high-fidelity access to device data. For privacy and confidentiality, however, today’s pub-sub systems largely stop at channel-level authentication, encryption, and access-control lists. These protect data in transit and restrict who may receive it, but place no quantitative limit on what a subscriber with legitimate access to messages can infer about its publishers. We close this gap by extending w-event differential privacy to the pub-sub setting. We generalize it from count queries to any aggregate queries over a topic hierarchy, and introduce a population-aware budget-allocation strategy that calibrates noise from an operator-declared value range, yielding a provable w-event ϵ-DP guarantee that protects publisher identity. We realize the mechanism as a plugin to an MQTT broker, so it is enforced transparently without modifying existing publishers, subscribers, or brokers.Evaluating on six real-world IoT datasets spanning energy, traffic, wearable health, air quality, mobility, and manufacturing, we show that the released error follows the predicted noise scale and that, at its tuned configuration, the mechanism delivers lower error than per-publisher local differential privacy while providing strong publisher privacy protections.