Towards bounding the effectiveness of statistical attacks in security and privacy

The security and privacy research attempts to expose potential risks of adversaries and to prevent them. This thesis focuses on their evaluation. Our goal is to describe tools than can formally bound the risk that an adversary breaks the security or the privacy of a system. For this purpose, we leverage a methodology established in the field of side-channel analysis against embedded systems and apply it to other fields. Namely, we focus on security and privacy breaches that can occur when using localization, preference or brain-computer interface data in an open data setting. As previous works, we observe that most publicly available data reveals private information even if it is simplified or reduced before publication. Preventing attacks exploiting these information leakages is therefore challenging. Compared to previous work, we show that bounding the risks of a worstcase attacks is even more challenging. Tight bounds are only observed in overly simplified settings that strongly limit the interest of the data. In concrete (practically-relevant) settings, the bounds we observe are usually untight, revealing a possibility that stronger attacks could be mounted with more training data. Positively, we therefore provide tools that can bound the longterm security and privacy risks for some systems and simple statistical models, opening the question of generalizing such results for other systems and more complex (but faster converging) statistical models.(FSA - Sciences de l'ingénieur) -- UCL, 202