Tunable Measures for Information Leakage and Applications to Privacy-Utility Tradeoffs

We introduce a tunable measure for information leakage called <italic>maximal</italic> <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula><italic>-leakage</italic>. This measure quantifies the maximal gain of an adversary in inferring any (potentially random) function of a dataset from a release of the data. The inferential capability of the adversary is, in turn, quantified by a class of adversarial loss functions that we introduce as <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-loss, <inline-formula> <tex-math notation="LaTeX">$\alpha \in [1,\infty) \cup \{\infty \}$ </tex-math></inline-formula>. The choice of <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> determines the specific adversarial action and ranges from refining a belief (about any function of the data) for <inline-formula> <tex-math notation="LaTeX">$\alpha =1$ </tex-math></inline-formula> to guessing the most likely value for <inline-formula> <tex-math notation="LaTeX">$\alpha = \infty $ </tex-math></inline-formula> while refining the <inline-formula> <tex-math notation="LaTeX">$\alpha ^{\text {th}}$ </tex-math></inline-formula> moment of the belief for <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> in between. Maximal <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-leakage then quantifies the adversarial gain under <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-loss over all possible functions of the data. In particular, for the extremal values of <inline-formula> <tex-math notation="LaTeX">$\alpha =1$ </tex-math></inline-formula> and <inline-formula> <tex-math notation="LaTeX">$\alpha =\infty $ </tex-math></inline-formula>, maximal <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-leakage simplifies to mutual information and maximal leakage, respectively. For <inline-formula> <tex-math notation="LaTeX">$\alpha \in (1,\infty)$ </tex-math></inline-formula> this measure is shown to be the Arimoto channel capacity of order <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>. We show that maximal <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-leakage satisfies data processing inequalities and a sub-additivity property thereby allowing for a weak composition result. Building upon these properties, we use maximal <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-leakage as the privacy measure and study the problem of data publishing with privacy guarantees, wherein the utility of the released data is ensured via a <italic>hard distortion</italic> constraint. Unlike average distortion, hard distortion provides a deterministic guarantee of fidelity. We show that under a hard distortion constraint, for <inline-formula> <tex-math notation="LaTeX">$\alpha >1$ </tex-math></inline-formula> the optimal mechanism is independent of <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>, and therefore, the resulting optimal tradeoff is the same for all values of <inline-formula> <tex-math notation="LaTeX">$\alpha >1$ </tex-math></inline-formula>. Finally, the tunability of maximal <inline-formula> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula>-leakage as a privacy measure is also illustrated for binary data with average Hamming distortion as the utility measure.