Prior-itizing Privacy: A Bayesian Approach to Setting the Privacy Budget in Differential Privacy
Authors: Zeki Kazan
Jerome Reiter
Venue: NeurIPS 2024 poster (2024)
Keywords: confidentiality
disclosure
risk
semantics
utility
Primary area: privacy
TL;DR: We propose a framework for setting epsilon for data releases satisfying differential privacy.

Abstract: When releasing outputs from confidential data, agencies need to balance the analytical usefulness of the released data with the obligation to protect data subjects' confidentiality. For releases satisfying differential privacy, this balance is reflected by the privacy budget, $\varepsilon$. We provide a framework for setting $\varepsilon$ based on its relationship with Bayesian posterior probabilities of disclosure. The agency responsible for the data release decides how much posterior risk it is willing to accept at various levels of prior risk, which implies a unique $\varepsilon$. Agencies can evaluate different risk profiles to determine one that leads to an acceptable trade-off in risk and utility.

Prior-itizing Privacy: A Bayesian Approach to Setting the Privacy Budget in Differential Privacy
Zeki Kazan
Jerome Reiter
Department of Statistical Science
Department of Statistical Science
Duke University
Duke University
Durham, NC 27708
Durham, NC 27708
zeki can kazandduke edu
jreiterdduke edu
Abstract
When releasing outputs from confidential data, agencies need to balance the ana- lytical usefulness of the released data with the obligation to protect data subjects' confidentiality. For releases satisfying differential privacy, this balance is reflected by the privacy budget, We provide framework for setting based on its relation- ship with Bayesian posterior probabilities disclosure. The agency responsible for the data release decides how much posterior risk it is willing to accept at various levels of prior risk, which implies a unique E. Agencies can evaluate different risk profiles to determine one that leads to an acceptable trade-off in risk and utility.
Introduction
Differential privacy (DP) 11 is gold standard definition of what it means for data curators, henceforth referred as agencies, protect individuals" confidentiality when releasing sensitive data. The confidentiality guarantee of DP is determined principally by parameter typically referred to as the privacy budget Smaller values generally imply greater confidentiality protection at the cost of injecting more noise into the released data. Thus, agencies must choose to balance confidentiality protection with analytical usefulness. This balancing act has resulted in a wide range of values practice. For example, early advice in the field recommends of "0.01, 0.1, or in some cases, log(2) or log(3)" [10]. whereas recent large-scale implementations use & = 8.6 in On TheMap [31], E = 14 in Apple's 's of local DP for iOS 10. 44), and equivalent of 17.14 in the 2020 decennial census redistricting data release I
in
Some decision makers may find interpreting and selecting difficult a recent study of practitioners using DP Creator 43 found that users wished for more explanation about how to select privacy parameters and better understanding of the effects of this choice. One potential path for providing guidance is to convert the task of selecting E to setting bounds on the allowable probabilities of adversaries learning sensitive information from the released data, as in the classical disclosure limitation literature [8] 41 There is precedent for this approach: prior work in the literature suggests that "privacy semantics in terms of Bayesian inference can shed more light privacy definition than privacy semantics in terms of indistinguishable pairs neighboring databases"
20
24
36
43
For example,
28 and prevailing advice for setting 8 in (s, 5D originates from such Bayesian semantics 25
We propose that agencies utilize relationships between DP and Bayesian semantics
25
28 29 33 to select values of e that accord with their desired confidentiality guarantees. The basic idea is as follows. First, the agency constructs function that summarizes the maximum posterior probability of disclosure permitted for any prior probability of disclosure. For example, for prior risk of 0.001, the agency may be comfortable with ten-fold (or more) increase in the ratio of posterior risk to prior risk, whereas for prior risk of 0.4, the agency may require the increase not exceed, say, 1.2. Second, for each prior risk value, the agency converts the posterior-to- pro-prooo ratio into the largest
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

that still ensures the ratio is satisfied. Third, the agency selects the smallest e among these values, using that value for the data release. Importantly, the agency does not use the confidential data in these computations- they are theoretical and data free-so so that they do not use up part of the overall privacy budget. Our main contributions include:
We propose framework for selecting under certain conditions (see Section 3) that applies to any DP mechanism, does not use additional privacy budget, and can account for disclosure risk from both an individual's inclusion and the sensitivity of values in the data.
We enable agencies to tune the choice of ε to achieve their desired posterior-to-pine risk profile. This can avoid setting e unnecessarily small if, for example, the agency tolerates larger posterior-to-prio ratios for certain prior risks. In turn, this can help agencies better manage trade-offs in disclosure risk and data utility.
We give theoretic justification for the framework and derive closed-form solutions for the implied by several risk profiles. For more complex risk profiles, we also provide general form for as a minimization problem.
To streamline the discussion, we focus the release of discrete-valued statistics computed on vasuue data. Extension to continuous-vallds statistics and data can be accomplished by replacing sums with integrals and PMFs with PDFs throughout the theorem statements and proofs.
2
Background and Motivation
We first describe some aspects of DP and Bayesian probabilities of disclosure relevant for our approach. We summarize all notation and definitions Tables 2 and Blin Appendix AA.
2.1 Differential Privacy
Let P represent a population of individuals. The agency has a subset of P. which we call Y, comprising individuals measured on d variables. For any individual i, let Y, be the length-d vector of values corresponding to individual i, and let I, = when individual is in Y and I, 0 otherwise. For all such that 4 let Y : be the (n - 1) matrix of values for the n 1 individuals Y excluding individual $ The agency wishes to release some function of the data, T(Y). We assume Y and T(Y) each have discrete support but may be many-dimensional. The agency turns to DP and will release 7 (Y), noisy version of T(Y) under c-D..
Our work focuses unbounded DP as defined in (9), which involves the removal or addition of one individual's ' information ?
If a function (Y with discrete support satisfies unbounded e-DP, then for all i, all y in the support of Y,, all y in the support of Y and all in the support of T (Y).
P to Y, 4 = 1, Y. - se. PIT
(I)
4 Y = y
In settings where the statistic of interest is count, commonly used algorithm to satisfy DP is the geometric mechanism 18.
Definition 1 (Geometric Mechanism). Let T(Y) Z. be count statistic and suppose wish to release a noisy count T (Y) E E satisfying s-DP. The geometric mechanism produces count centered T(Y) with noise from two-sided geometric distribution with parameter - That is,
PYT = T(Y) = =} Ite Ite-s -
E Z.
Under the geometric mechanism, the variance of T (Y) is 2e - = The variance increases as e decreases, reflecting the potential loss in data usefulness when setting to a small value.
Of course, data usefulness is only one side of the coin. Agencies also need to assess the implications of the choice of for disclosure risks
Prior works on setting focus on settings where (i)
1 For all such that J, = 0 we let - an (n - 1) x d matrix of individuals not including individual "Thi is in contrast to bounded DP M which involves the change of one individual's information.

---

the data have yet to be collected, and the goal is to simultaneously select and determine how much
compensate individuals for their loss in privacy 66 [5] 23 30 (ii) the population already public information, and the goal is to protect which subset of individuals is included in a release [29 35 or
(iii) data holders can utilize representative test data or the confidential data set itself 4
17 20 35
We focus on the common setting where data already have been collected, the population they are drawn from is not public information, and no data are available for tuning s.
2.2 Bayesian Measures of Disclosure Risk
Consider an adversary who desires to learn about some particular individual in Y using the release of T (Y). We suppose that the adversary has model, M,, for making predictions about the components of Y; that they do not already know For example, the adversary could know some demographic information about individual i but not some other sensitive variable. The adversary might predict this sensitive variable from the demographic information using a model estimated with proprietary information data from sources like administrative records. We assume that the release mechanism for TYY) is known to the adversary. that the DP release mechanism does not depend on M, and that, under M, the observations are independent but not necessarily identically distributed. These conditions are formalized in Section 3 For our ultimate purpose, i.e., helping agencies set e, the exact form of the adversary's 's M immaterial. In fact, as we shall discuss, we are not concerned whether the adversary's 's predictions from M are highly accurate or completely awful.
On technical note, make the distinction that the agency views Y and 1; fixed quantities, since it knows which rows are in the collected data and what values are associated to each row. The adversary, however, views Y and I; as random variables, and thus probabilistic statements about these quantities are well defined from the adversary's 's perspective. Notationally, we signify that a probabilistic statement from the adversary's 's perspective via the subscript M.
Let be the subset of the support of Y; that the agency considers a privacy violation. For example, d == 1 and Y is income data, then S may be the set of possible incomes within 5,000 or within 5% of the true income for individual i. Alternatively, if d = 1 and Y is binary, then S is subset of {0, 13. The selection of S must not depend on P. this might constitute privacy violation.
The agency may be concerned about the risk that the adversary determines individual i is in Y or the risk that the adversary makes disclosure for individual i: that is, 7, = and Y; E S, respectively. Assuming that the adversary's 's model puts nonzero probability mass on these events, we can express their relevant prior probabilities as follows.
PMI4 1] = pt>
PM 4- 91-
For fixed pr and qis we can measure the risk of disclosure for individual i in a number of ways. Drawing from [33], one measure is the relative disclosure risk, ri(p,. qt, t²) Writing the noisy statistic as T and suppressing the dependence on Y Y Y-s. this is defined as follows.
Definition 2 (Relative Disclosure Risk). For fixed data Y. individual i, adversary's 's model M, and released T = t", the relative disclosure risk is the posterior-to-prie risk ratio,
ry (Pr. qt, t*) PM[Y; S, 1 T =1]
The relative risk can be decomposed into the vosterior-to-prion ratio from inclusion (4, and the posterior-to- to-piorr ratio from the values (Y)). We have
(p qi 1²) PM 8 I 1,T -1] PM E 1,
PMLLi = 1 = [(]
(5)
PM []
The relative risk, however, does not tell the full story. As discussed in [22, the data holder also may care about absolute disclosure risks, o, (pt, tt,t").
Definition (Absolute Disclosure Risk). For fixed data Y, individual i, adversary's 's model M, and released T = t*,, the absolute disclosure risk is the posterior probability,
(pi, qt, t²) PM S, = 1|1"=
(6)
Since r. (p., 91, t²) a. (p. qr, t" /// (p.g). we can convert between these risk measures.
"To be technically precise, we suppose the adversary assigns zero probability to predictions of Y, with values of components that they know to be incorrect.
3

---

2.3 Risk Profiles
The quantities from Section 2.2 can inform the choice of E. For example, DP implies that
re Vs 1²) S e2s
The inequality in 7 implies a naive strategy for setting e: select a desired bound on the relative risk, r", and set = (og(r")) 1/2 Practically, however, this strategy suffers from two drawbacks that could result in a smaller recommended than necessary. First, for any particular P; and qi the bound in ( need not be tight. In fact, this bound is actually quite loose across a wide range of values. Second, this strategy does not account for agencies willing to tolerate different relative risks for different prior probabilities. For example, P.d = 0.25, an agency may wish to limit the adversary's 's posterior to a, (Ps: 9;, < 2 0.25 0.5, but for p:ę. 10 6 the same agency may find a limit of oz (p qt, t²) S 2 x 10 6 unnecessarily restrictive.
for all (pi, qt. )-
Rather than restricting to constant bound, the agency can consider tolerable relative risks as a function of hypothetical adversary's 's prior probabilities. We refer to this function as the agency's risk profile, denoted r" (pt, 9:). Thus, the agency establishes r" (pi, ()) so that, for all pi, qi and t",
(P qi t²) Sr" (p: (:).
(8)
As the following results show, the requirement in
g translates to a maximum value of E.
3 Theoretical Results
In this section, we describe our main theoretical results. To devote more space to examples and applications, we describe supporting results in Appendix [B.Ix and provide all proofs in Appendix E
We begin by formalizing the assumptions on the release mechanism for T and the adversary's model, M.. We emphasize that PYT*(Y)= L" Y, y, Y-; y-i. T 1] and PY = 1" Y-, y y- 7, = 0] are probabilities under the actual DP mechanism used for the release of T (Y) when is and is not included, respectively. We use these probabilities in two assumptions as follows.
Assumption 1. For all y in the support Yi, y-i in the support of Y ii and t in the support of T
PM[T = t' Y. y. Y- - y = 1 P[T (Y) t" Y, y. Y y-., (( = 1' Y = y-
= Y
=
Assumption | iiplies that the mechanism for releasing 7* given Y known to the adversary and that the adversary uses the actual release mechanism. An adversary who uses something other than the actual release mechanism to compute probabilities unlikely general to find more success than the adversary who does. Hence, Assumption I Jassures that the agency's 's computations are principled and cover a type of "worst-case" analysis.
Assumption 2. For all y in the support of
Y; and y-c in the support of Y
PM = 11 L, = y] = PMIY y =00- 0].
Assumption 2 implies that the adversary's beliefs about the distribution of Y- do not change whether individual i is included in the data or not, nor do they depend on individual i's confidential values. This assumption is similar to one explored in (28). who consider the case where "the of each individual is independent of the presence/absemccrrccontt values of other individuals." although we do not require that ( holds for all Since DP is designed to capture the effect that a single atomic unit of data has on the output distribution, assuming this type of independence structure ensures one atomic unit is single data point 5 We believe these two assumptions are weaker than those in related work on choosing E, which we discuss in Section 6
Under Assumption 1 and Assumption we can relate the distribution of T unconditional on Y_, via the following lemma. This result is similar, but not identical to, Theorem 6.1 in (8
show Corollary in the appendix that, under our assumptions, it holds for larger sets and for unbounded DP (with replaced by 28).
'This is proved [1] under bounded DP in the case where |S|
We thank referee for highlighting this rationale for Assumption 2

---

Lemma 1. Under Assumption 7 and Assumption 2 if the release of = tt satisfies E-DP, then for any subset S of the domain of Y, we have
PM = t- 1 S, = se. c- S PM = Y $ S, = S 6
PM[T =t Y E S,
PM = 1 =
(10)
We emphasize that Lemma| I and all subsequent results require Assumption 2 Without it, gener- alizable knowledge from the release can lead to arbitrarily large relative risk, demonstrated by examples in 22 27].
For given function r" selected by the data holder, we can determine the e that should be used for the release. This due to the following result relating the relative risk to E.
Theorem 1. Under Assumption ? and Assumption
2
if the release of satisfies e-DP, then
1
relpi, tb 1')
(11)
4:P: + t 25 (1-4ppp e e pc)
One can solve for e5 in 11 to determine the recommended E, which is given by Theorem 2
Theorem 2. For any individual i, fix the prior probabilities, p; and qu and desired bound on the relative disclosure risk, r" (pi, 4.). Define E Ee(ps, 93) to be the function
log
(1-(1-
if0 < qi <
Es(pi,
(1 [llpp:) +4p (1-0:)
a:)( (...o p:9:) -11
(12)
log
if==1. =1
Under the conditions of Theorem any statistic = 1" released under s-DP with e S (pi, 4i)
will satisfy r (pi, qi, 15) < r (pi.k). R.)
By Theorem 2 to achieve r rp q, ta S r" (ps, q:) for all (ps, the agency should set æ via the
following minimization problem:
min S.(p,, q:)- P....((0.1]
(13)
Closed forms for the resulting from a few specific risk profiles are included in the appendix.
4 Using Posterior-to-prior Risks for Setting 8
In this section, we illustrate how agency can use the results of Section 3 to select e. Notationally, for a given quantity x, we use to indicate the agency has fixed x to a particular constant.
Given S, the agency must select form for (p, 9s). A default choice, equivalent to the naive strategy using (7) discussed above, is set the bound constant f > 1, i.e.
(pi. q:)
(14)
As we prove in Theorem 3 in the appendix, the bound in (14 implies the agency should e log(f)/2. / While a constant bound on relative risk is simple, agencies that tolerate different risk larger values, as we now illustrate.
profiles may be able
Consider an agency that seeks to bound the relative risks for high prior probabilities and bound the absolute disclosure risk for low prior probabilities. For example, the agency may not want adversaries whose prior probabilities are low to use t" to increase those probabilities beyond 0.10. Simultaneously, ensure adversaries with prior probabilities around, for example, 0.20 cannot use t* to triple their posterior probability. Such an agency can specify a risk profile that requires either the relative risk be less than some now illustrate via the following two examples.
the agency may
the absolute risk be less than à < 1,
The first example is setting inspired by case study in 13
5

---

Agency
Agency 2
30
r' 1)
10
r*00005
3-
0.0
0.1
0.2
0.3
0.00
0.25
0.50
0.75
1.00
Pi
qi
e,00.05 91)
0-
0.0
0.1
0.2
0.3
0.00
0.25
0.50
0.75
1.00
Di
qi
Figure I: Each column corresponds to a particular hypothetical agency. The first row presents the agency's ' risk profile and the second row presents the profile's 's implied maximal allowable at each point on the curve. Agency I's risk profile is given by (5)) with ā = 0.1, 7 = 1, and = 3, while Ageney 2's risk profile is given by (I6) with ā 0.1, 0.05, and f 3. For Agency 2, r and E are very large for small qs: large values are truncated for readability.
Agency
& Recommendation
Noise Std. Dev.
Prob. Exact
A
1.5
0.25
0.51
2.74
25%
B
3
0.25
1.30
1.02
57%
C
6
0.25
2.04
0.59
77%
Table I: The e recommended by our framework for three risk profiles of the form in 15 Also included are the standard deviations of the noise distribution and the probabilities that the exact value is released, i.e., the mass at zero, for geometric mechanisms that satisfy the corresponding e-DP.
Example 1. A healthcare provider possesses data set comprising demographic information about individuals diagnosed with a particular form of cancer in a region of interest. They plan to release the count of individuals diagnosed with this form cancer in various demographic groups via the geometric mechanism, but are concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. They wish to choose appropriately.
In this example, the primary concern is with respect to inclusion in the data set. That is, for a given individual i, the adversary's prior probability p; the key quantity, whereas the qi is not as important for any given S. The agency can fix some 7 E (0, 1]. for example ç = 1 to focus on adversaries who already know individual i's demographic information. To simplify the analysis, we set the risk profile to oo for adversaries with q & 1, which indicates these adversaries are not considered. A reasonable risk profile for this agency then might be of the form, for some F and 1
q: = 1 and
< < qF:
max
if q = qi
P.f
r" (p: q:) =
PLy
F
if q: q and
< 1
(15)
if q: +
oC,
q: + q.
An example visualization of this risk function is presented in the first column of Figure T The upper plot displays the risk profile as a function of p. when q = q, and the lower plot displays the maximal for which the relative risk bound holds for each p.. We can derive closed form for under this risk profile; see Table in Appendix A.2 for a summary and Theorem 5 in Appendix B. for details.
Suppose the agency is generally willing to accept maximum absolute disclosure risk of ā = 0.25 for adversaries with small prior probabilities. Table [ presents the maximal which satisfies the desired risk profile for three such agencies. Agency A is risk averse, agency C is utility seeking, and agency
'The second equality in 115 assumes > a/F. lf S a/F, then (pi, Φ) ā/(p.)) for all S 1.

---

B sits in between in terms of risk and utility. For adversaries with high prior probabilities, agencies A, B, and bound the relative disclosure risk F 1.5, F = 3, and Appendix C.I plots the forms of each agency's risk profile. To provide intuition on the amount of noise implied by these 8, in Table D we display the standard deviation of the noise distribution for each statistic under the geometric mechanism and the probability that the geometric mechanism will output the exact value of each statistic. The risk averse agency is recommended an e that results in a release with high standard deviation and fairly low probability of releasing the exact value of the statistic, The utility seeking agency is recommended an e that results in release with a fairly low standard deviation and high probability of releasing the exact value of the statistic.
respectively. Figure B in
The recommendations from these risk profiles, which are tailored the setting and agency preferences, are higher than the recommendations from a corresponding simple risk profile of r" (Pt. q.) = F for all prior probabilities. This simple profile yields R 0.20, & R 0.55, and & R 0.90 for f 1.5, i = 3, and f = 6, respectively, less than half the corresponding values in Table 1
We now consider a second example, inspired by Example 16 in [45], that alters Example !
Example 2. A survey is performed on sample of individuals in the region of interest. 5% of the region is surveyed, and respondents are asked whether they have this particular form of cancer along with a series of demographic questions. The agency plans to release the counts of surveyed individuals who have and do not have the cancer in various demographic groups via the geometric mechanism, but is concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. The agency wishes to choose E appropriately.
In this example, the primary concern is with respect to the values in the data set. For ease of notation, let Y; be a d-vector of binary values, and let the first element, Y,,, be an indicator for whether individual i has this form of cancer. Set S to be the subset of the support of Y; for which individual i has the cancer, i.e., S = {y E (0, 134 yn = 1]. For individual i, the adversary's quantity, and their pa not of interest. The agency can fix some p E (0, 1]: for example, if the agency is most concerned about ad adversaries whose only prior knowledge is that individual i is in the population, but not whether they were surveyed, they might set p 0.05. Alternatively, they might set p = to imply an adversary that knows priori that individual i is included in Y. A reasonable risk profile for this agency might be of the form, for some
is the key
and F > 1.
if p: = 0 and 0 < q: < a.
max x0,
if P; if p: + P. CC,
pFi
r" r"(p 96)
pq.
F,
if p. p and
q: S 1;
(16)
p + P.
An example visualization of this risk function presented in the second column of Figure The upper plot displays the risk profile maximal e for which the relative risk bound holds for each pi. The agency can select the smallest e on this curve for their release. We can derive a closed form the minimum; see Table|Tin Appendix A.2 for a summary and Theorem in Appendix for for details. Notably, it can be shown that the e selected under these two profiles is bounded below by log(r)/2 and may be much larger. We provide further exploration and visualizations for this example in Appendix
function of qi when p; = p, and the lower plot displays the
As demonstrated by these examples, the gap between the baseline strategy of 114 and our recommen- dation can be large. To further illustrate, suppose an agency has a simple, "point" risk profile, where r" (O(O.,,1) 1) r' for r' < 2 (and xo elsewhere). The baseline recommends & = log (r') /2 < 0.35, while the recommendation from Theorem can be shown to have the form = log (r'/ (2 - (2)r)),, which diverges as r' + 2. Thus, the gap between the recommendations can be arbitrarily large. While this likely does not represent a realistic disclosure risk profile of real-world agency, it is instructive. In general, the baseline's 's recommendation is smaller because it is enforcing relative risk of r' for adversaries with small priors. If < 2, then an adversary with prior probability p.q. = 0.001 is restricted to a posterior probability at most 0.002, lcading small E recommendation. If adversries with small priors are ignored or allowed to have large relative risks, the recommendation from our method will outperform the baseline, and possibly by substantial amount.
partieular agency's 's risk profile may not be characterized by one of the forms described above. For example, an agency may be equally concerned about p; and q. rather than focusing on one; see
Thhe second equality in (16 assumes 5 > ā/F. 1f S o/F, then r" (p. qi) ā/(ig) for all 0 q: S 1.
7

---

Appendix C.3 for an example of this setting. Or, as argued in [2), in some settings, agencies might be most concerned about the difference between the posterior and prior probabilities (rather than their In such settings, it is straightforward to write down the corresponding risk function, r ('p R.)
ratio) R and the optimal & can be determined by numerically solving the minimization problem in (3)
Regardless of the agency's 's desiderata for a risk profile, we recommend that they keep the following in mind when setting its functional form. First, for any region where r* (pi..:) > 1/ (p(iq)), the risk profile generates a bound on the posterior probability that exceeds 1. Of course, the posterior probabilities themselves cannot exceed 1; thus, in these regions. the risk profile effectively does not bound the posterior risk. For example, an agency that sets r" (ps. 1) = 3 in the region where p; 2 1/3 (as in the left column of Figure implicitly is willing to accept an unbounded = for prior probabilittes P: 2 1/3. Second, when bounding the absolute disclosure risk below some ā in some region of (pt, the agency should require P:q: < â in that region. When P:q: = o the recommended e = since the data holder requires T to offer no information about Y, This also suggests that an agency bounding absolute disclosure risk a region of (pi. qi) that sets à close to some value of p:o: the region is willing accept only small values.
5 Managing the Trade-off in Privacy and Utility
Agencies can use the framework to manage trade-off's in disclosure risk and data utility. In particular, the agency can evaluate potential impacts of the DP algorithm using data quality metrics under different risk profiles, choosing an e that leads to satisfactory trade-off. We demonstrate this in the below example, using data on infant mortality in Durham county, N.C. We note that these data may not require the use of DP in reality, but they do allow us to illustrate the process with public data.
Example 3. Suppose that an agency in Durham county, N.C. wishes to release differentially private version of the number of infant deaths the county experienced in the year 2020. The agency plans to use the geometric mechanism to release this value. Of particular interest is whether the county infant death rate meets the U. S. Department of Health and Human Services' Healthy People 2020 target of 6.0 fewer deaths per 1,000 live births (21.. The agency wishes minimize the probability that they release a noisy count that changes whether or not the 6.0 target is met; their goal is ensure this probability is below 10%. It is public information that there were 4,012 live births in Durham county in 2020 [8]..
The primary concern in Example iss with respect to inclusion in the data. Thus, the agency focuses on adversaries with gi = and varying ps- The agency is generally willing to incur large relative risks if is small and small relative risks if p; is large. Furthermore, due to possible policy ramifications of appearing not to meet the target rate, the agency is open to accepting greater privacy risks for greater accuracy in the released count, within reason as determined by agency decision makers.
The agency's 's privacy experts determine that they can characterize the agency's 's risk profiles reasonably well using the following general class of risk profiles.
max à oo,
if q = 1;
r (p:, 9:)
ps
(17)
if q + 1.
To allow for consideration of the effects on accuracy of different specifications of [7). the agency considers combinations of f E 2,5) and à E {0.1, 0.25, 0.5). They also examine à O, which corresponds to a constant risk profile r" (P:, q:) = F. The ageney could consider other combinations of parameters or risk profiles classes should these not lead to satisfactory trade-off in risk and utility,
Figure summarizes an analysis of the risk/utility trade-offs. For all F, the recommended is larger when à > 0 than under the corresponding constant risk profile. Similar increases in e also are evident for the risk profiles of Section 4 see Appendix C Naturally, increases in and ā decrease the RMSE. 10 of the noisy counts due to larger s. The switching probabilities in the top panel do not use
'Requiring the difference between the posterior and prior probabilities to be bounded by some i E (0,1) is equivalent to requiring the relative risk be bounded by (p.q: + 6) (pp..). See Appendix B.2 for details.
'We provide code at wllhtts:/// /tap::///gthht //tggttttu./tge///g//// cwm/zeki cankazan/ choosing_dp.... dp_s_ddpepppoooons determine the recommended e for a provided risk profile. This code was used to determine closed forms
the additional risk profiles described in Appendix B3.2 The example in Appendix CC.3 demonstrates the use this code.
Since 1 is unbiased for the count, the RMSE is the standard deviation of the noise distribution.
8

---

Deviation
0.25
Prohability
Decision
0.5
0.2
Changes
0.1
0.0
8
RMSE
4-
0
2.0
1.5
Implied
1.0
0.5
0.0
1.2
1.2
1.2
1.2
7=2
1=2
7-2
i=5 a--
i=5
7-5
0
am.1
8-
.25
a am.1
.25
am.1
a
Figure 2: The top panel presents the probability that the differentially private algorithm switches whether Durham county's released rate is above or below the 6.0 target e.g.. the added noise makes the released rate 6.5 but the actual rate is 5.5. Each color represents a different hypothetical absolute difference between the true and target rate. The middle panel presents RMSEs of the noisy count of infant deaths. The bottom panel presents the implied Each bar corresponds different risk profile of the form in I7
the true count of infant deaths; rather, they consider hypothetical deviations of 0.25, 0.5, 1, and in the true rate from the target rate of 6.0. In this way, the agency avoids additional privacy leakage. The probability differs substantially for each of the four deviations, with the deviation of 0.25 leading the largest probability of a switch. To ensure the probability is below 10% for the deviation of 0.25, the agency would need to use the most aggressive of the risk profiles, which allows absolute disclosure risk of à 0.5 relative disclosure risk of 5. This leads to E = 2.20 with RMSE = 0.53. If they are willing to allow the probability to exceed 10% or to place priority on deviations exceeding 0.25, the agency could select a less aggressive risk profile that yields a smaller E.
In actuality, there were 6.2 infant deaths per 1,000 live births Durham County in 2020 (37]. As the truth is close to the 6.0 target, the agency would need to large achieve their goal.
Relationship to Prior Work
The most similar work we are aware of is Lee and Clifton (2)'s s "How Much is Enough? Choosing for Differential Privacy," which also
e. The authors focus settings where the population is public information and the adversary's 's goal is to determine which subset of
Bayesian approach
individuals the population was used for differentially private release of a statistic. Their method
for selecting is tailored to the setting where only disclosure of an individual's inclusion in the data is
of concern and the values of the entire population can be used inform the choice of [29] focuses on the setting where the Laplace mechanism is used and the population size is known; their proposal was extended any DP mechanism by (24 39 and settings where the population size is unknown by 34 In Appendix D.I. we compare the recommended from the proposal in 29 and our framework several examples. We find that the approach of (29), for particular statistics and populations, can recommend larger than the one resulting from our approach. However, our framework may be used in settings where the values of the entire population are not public and settings where the privacy of the values in the release is of primary concern.

---

Another series of related work involves using Bayesian semantics to communicate the meaning of E to potential study participants. For an overview of recent work in this area, see [66, [36], and citations therein. We highlight an example in 45 (corrected in 46)), which considers an individual deciding whether or not to participate in a survey for which results will be released via DP with a particular c. The authors suggest that the individual consider bound on
siteeriortto-osteerii ratio similar to the bound in [T] to make an informed decision about whether to participate in the survey. We describe the advice of 45] using our notation in Appendix D.2 While their and our bounds have similar expressions, the goal in 45] differs from ours, They use the bound to characterize the individual's 's disclosure risks for fixed E, whereas establish the agency's 's disclosure risk profile in order to set E.
There are a number of other works that examine Bayesian semantics of E-DP, which we now briefly summarize. In their seminal work proposing DP, [I]] showed that, under some conditions, bounded DP is equivalent to bound on the relative risk when all but one data point is fixed. [25] showed that bounded DP implies bound on the total variation distance between the posterior distribution with all data points included and the posterior distribution with one data point removed. (28] showed that both bounded and unbounded DP are equivalent to a bound on the posterior-to -orioor odds ratio exactly when the aaaeencce/abenn/errrorroo individuals. Finally, (27) showed that both bounded and unbounded DP imply bounds on the ratio of the posterior distribution with all data points included to the posterior with one observation replaced with a draw from the posterior with their observation removed. These works do not discuss how these semantic characterizations of DP can be used to select E.
of each individual is independent of that of other
7 Commentary
In this article, we propose a framework for selecting for DP by establishing disclosure risk profiles. Essentially, we provide a method for agencies to trade the problem of selecting e for a release for the problem of specifying their desired disclosure risk profile. This process involves focusing on particular classes of adversaries the agency is most concerned about-represented by the set anand tuning e to ensure the risk from these adversaries is sufficiently low. We emphasize that, once applied, DP will protect against all attacks with the guarantee of DP, not just the attack used to tune e.
We primarily focus the risk from one class of adversary attacks one individual, assuming all individuals are exchangeable. If agencies assign different risk profiles for different classes of adversaries, they could repeat the analysis for each class For example, the agency might assign different risk profiles to adversaries targeting different characteristics, e.g., they may consider whether an individual has a disease more sensitive than their age. Similarly, if an agency does not treat individuals in the data as exchangeable-for example, if an agency seeks to ensure lesser disclosure risks for groups with some characteristics than for not--ecesssarll-diisie characteristics -the agency could repeat this analysis for each group. In both of these settings, the agency has a decision problem on its hands. As with designing DP solutions in general, the agency must prioritize some risks over others, e.g., using decision-theorets criteria. This is an important topic for future work and raises ethical questions regarding how assigning different risk profiles for individuals with different characteristics could affect data equity.
groups without those
One avenue for future work involves incorporating a version of this framework into differentially private data analysis tools. Recently developed interfaces for DP data releases such as 24 and [35 use the framework of [29] guide users in setting e. Our framework could be similarly incorporated
to provide guidance in settings that do not satisfy the assumption of 22 that the values of the population are public. Another avenue for future work involves examining how an agency can set the risk profile appropriate for particular release. We envision agencies could do so analogously to the elicitation of utility functions in decision theory, e.g., by considering series of bets [40]. Other future extensions involve examining whether similar results follow under weaker assumptions. This includes settings with multiple differentially private releases via existing results that relate the relative risk to DP composition theorems (e.g.. S5 of (26)). This also includes extension to variants of Ducsuch as zero-concentrated DP 55] or approximate DP [1 bb deriving Bayesian semantics analogous to Theorem [ or leveraging existing results 25 27 Additionally, it may be possible to
extend the results in this article from posterior-to-prio risks to the sorts of posterior-to-posterr risks
discussed in Section 6
10

---

Acknowledgments and Disclosure of Funding
This research was supported by NSF grant SES-2217456. We would like to thank the anonymous reviewers for their helpful feedback as well as Salil Vadhan and Jörg Drechsler for insightful discussion about a preliminary version of this work.
References
[1] John M Abowd, Robert Ashmead, Ryan Cumings- Menoon, Simson Garfinkel, Micah Heineck, Christine Heiss, Robert Johns, Daniel Kifer. Philip Leclere, Ashwin Machanavajjhala, et al. The 2020 census disclosure avoidance system topdown algorithm. arXiv preprint S.Ni:22004089866 2022.
[2] John M Abowd and Lars Vilhuber. How protective are synthetic data? Conference on Privacy in Statistical Databases, pages 239-2466 Springer, 2008.
International
[3] Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in Neural Information Processing Systems, 31, 2018.
[4] Mihai Budiu, Pratiksha Thaker, Parikshit Gopalan, Udi Wieder, and Matei Zaharia. Over- look: Differentially private exploratory visualization for big data. Journal of Privacy and Confidentiality, 12(1), 2022.
[5] Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography Conference, pages 635-658. Springer, 2016.
[6] Pranav Dandekar, Nadia Fawaz, and Stratis loannidis. Privacy auctions for recommender systems. ACM Transactions on Economics and Computation (TEAC), 2(3):1-22, 2014.
[7] Jörg Drechsler. Differential privacy for government agencies-are are there yet? Journal of the American Statistical Association, I 118(541)761-777, 2023.
[8] George T Duncan and Diane Lambert. Disclosure-lmmited data dissemination. Journal of the American Statistical Association, 81 81(393):10-18, 1986.
[9] Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and programming, pages 1-12. Springer, 2006.
[10] Cynthia Dwork. A firm foundation for private data analysis. Communications of the ACM, 54(1):86-95 2011.
[11] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference, pages 265-284. Springer, 2006.
[12] Cynthia Dwork. Guy N Rothblum, and Salil Vadhan. Boosting and differential privacy. In 2010 IEEE 51st annual symposium on foundations of computer science, pages 51-60. IEEE, 2010.
[13] Amalic Dyda, Michael Purcell, Stephanie Curtis, Emma Field, Priyanka Pillai, Kieran Ricardo, Haotian Weng, Jessica C Moore, Michael Hewett, Graham Williams, et al. Differential privacy for public health data: An innovative tool to optimize information sharing while protecting data confidentiality. Patterns, 2(12):100366, 2021.
[14] Stephen E Fienberg and Ashish Sanil. A Bayesian approach to data disclosure: Optimal intruder behavior for continuous data. Journal of Official Statistics, 13(1):75, 1997.
[15] Lisa K Fleischer and Yu-Han Lyu. Approximately optimal auctions for selling privacy when costs are correlated with data. In Proceedings of the 13th ACM Conference on Electronic Commerce, pages 588, 2012.
11

---

[16] Daniel Franzen, Saskia Nuñez von Voigt, Peter Sörries, Florian Tschorsch, and Claudia Müller- Birn. Am i private and if so, how many? communicating privacy guarantees of differential privacy with risk communication formats. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1125-1139, 2022.
[17] Marco Gaboardi, James Honaker, Gary King, Jack Murtagh, Kobbi Nissim, Jonathan Ull- man, and Salil Vadhan. Psi (((Psi)): private data sharing interface. arXiv preprini arXiv:1609.04340 2016.
[18] Arpita Ghosh, Tim Roughgarden, and Mukund Sundararajan. Universally atility-maximan privacy mechanisms. SIAM Journal on Computing, (atenng...11)))) 41(6):1673-1693, 2012.
[19] Ruobin Gong and Xiao-Li Meng. Congenial differential privacy under mandated disclosure. In Proceedings of the 2020 ACM-IMS CMMSSS on Foundations of Data Science Conference, pages 59-70, 2020.
[20] Michael Hay, Ashwin Machanavajjhala, Gerome Miklau, Yan Chen, Dan Zhang, and George Bissias, Exploring privacy-accuracy tradeoffs using dpcomp. In Proceedings of the 2016 International Conference on Management of Data, pages 2101-2104, 2016.
[21] HHS. Healthy people 2020. Office of Disease Prevention and Health Promotion, U.S. Depart- ment of Health and Human Services, 2020. Accessed on 22 April 2024.
[22] Joseph Hotz, Christopher R Bollinger, Tatiana Komarova, Charles F Manski, Robert A Moffitt, Denis Nekipelov, Aaron Sojourner, and Bruce D Spencer. Balancing data privacy and usability in the federal statistical system. Proceedings of the National Academy of Sciences, 119(31), 2022.
[23] Justin Hsu, Marco Gaboardi, Andreas Haeberlen, Sanjeev Khanna, Arjun Narayan, Benjamin C Pierce, and Aaron Roth. Differential privacy: An economic method for choosing epsilon. In 2014 IEEE 27th Computer Security Foundations Symposium, pages 398-410 IEEE, 2014.
[24] Mark F St John, Grit Denker, Peeter Laud, Karsten Martiny, Alisa Pankova, and Dusko Pavlovic. Decision support for sharing data using differential privacy. In 2021 IEEE Symposium Visualization for Cyber Security ( (VizSec), pages 26-35. IEEE, 2021.
[25] Shiva P Kasiviswanathan and Adam Smith. On the semantics' of differential privacy: A Bayesian formulation. Journal of Privacy and Confidentiality, 6(1), 2014.
[26] Zeki Kazan and Jerome Reiter. Assessing statistical disclosure risk for differentially private, hierarchical count data, with application to the 2020 decennial census. Statistica Sinica, 34:to appear, 2024.
[27] Daniel Kifer, John M Abowd, Robert Ashmead, Ryan Mamings-Menon, Philip Leclere, Ashwin Machanavajihala, William Sexton, and Pavel Zhuravlev. Bayesian and frequentist semantics for common variations of differential privacy: Applications the 2020 census. arXiv preprint arXiv:2209.033100 2022.
[28] Daniel Kifer and Ashwin Machanavajihala. Pufferfish: A framework for mathematical privacy definitions. ACM Transactions on Database Systems (TODS), 39(1):1-36, 2014.
[29] Jaewoo Lee and Chris Clifton. How much is enough? choosing for differential privacy. In International Conference Information Security, pages 325-340. Springer, 2011.
[30] Chao Li, Daniel Yang Li, Gerome Miklau, and Dan Suciu. theory of pricing private data. ACM Transactions on Database Systems (TODS), 39(4):1-28, 2014.
[31] Ashwin Machanavajjhala, Daniel Kifer, John Abowd, Johannes Gehrke, and Lars Vilhuber. Privacy: Theory meets practice on the map. In 2008 IEEE 24th International Conference on Data Engineering, pages 277-286. IEEE, 2008
[32] Charles F Manski. The lure of incredible certitude, Economics Philosophy, 36(2):216-245. 2020.
12

---

[33] David McClure and Jerome P Reiter. Differential privacy and statistical disclosure risk measures: An investigation with binary synthetic data. Transactions on Data Privacy, 5(3):535 552, 2012.
[34] Luise Mehner, Saskia Nuñez von Voigt, and Florian Tschorsch. Towards explaining epsilon: A worst-case study of differential privacy risks. In 2021 IEEE European Symposium Security and Privacy Workshops (EuroS&PW), pages 328-331 JEEE, 2021.
[35] Priyanka Nanayakkara, Johes Bater, Xi He, Jessica Hullman, and Jennie Rogers. Visualiz- ing privacy-utility trade-offs in differentially private data releases. Proceedings Privacy Enhancing Technologies, 2022.
[36] Priyanka Nanayakkara, Mary Anne Smart, Rachel Cummings, Gabriel Kaptchuk, and Elissa M Redmiles. What are the chances? explaining the epsilon parameter in differential privacy, In 32nd USENIX Security Symposium (USENIX Security 23), pages 1613-1630, 2023.
[37] NCDHHS. 2020 north carolina infant mortality report, table 1. NC State Center for Health Statistics, 2020. Accessed on 22 April 2024.
[38] NCDHHS. Cy2020 north carolina resident births by county of residence and month. NC State Center for Health Statistics, 2020. Accessed on 22 April 2024.
[39] Alisa Pankova and Peeter Laud. Interpreting epsilon of differential privacy in terms of advantage in guessing or approximating sensitive attributes. In 2022 IEEE 35th Computer Security Foundations Symposium (CSF), pages 96-111. IEEE, 2022.
[40] Giovanni Parmigiani and Lurdes Inoue. Decision theory: Principles and approaches. John Wiley & Sons, 2009.
[41] Jerome P Reiter. Estimating risks of identification disclosure in microdata. Journal of the American Statistical Association, 103-11122 2005.
[42] Jerome P Reiter. Differential privacy and federal data releases. Anmual Review of Statistics and Its Application, 6015-101, 2019.
[43] Jayshree Sarathy, Sophia Song, Audrey Haque, Tania Schlatter, and Salil Vadhan. Don't look at the data! how differential privacy reconfigures the practices of data science. arXiv preprint arXiv:2302.1 1775, 2023.
[44] Jun Tang, Aleksandra Korolova, Xiaolong Bai, Xueqiang Wang, and Xiaofeng Wang. Pri- vacy loss in Apple's implementation of differential privacy on macos 10.12. arXiv preprint arXiv:170.002553, 2017.
[45] Alexandra Wood, Micah Altman, Aaron Bembenek, Mark Bun, Marco Gaboardi, James Honaker, Kobbi Nissim, David R O' O'Brien, Thomas Steinke, and Salil Vadhan. Differen- tial privacy: primer for a non-technical audience. Vanderbilt Journal of Entertainment & Technology Law, 21:209, 2018.
[46] Alexandra Wood, Micah Altman, Kobbi Nissim, and Salil Vadhan. Designing access with differential privacy. In Handbook on Using Administrative Data for Research and Evidence- based Policy, Abdul Latif Jameel Poverty Action Lab, Cambridge, MA, 2020.
13

---

A Supplemental Tables
A.1
Notation Summary
Table
2 summarizes the notation of Section 2
Table 3
summarizes the definitions of key probabilistic
quantities.
Symbol
Description
P
Population of individuals the data is drawn from n x d confidential data set Length-d vector of values for individual i Indicator for whether individual is included in
Y
(n 1n-11 1) d matrix of the values in Y excluding those for individual i Subset of the support of Yú constituting privacy violation
S
(pi, nb)
Function describing the agency's ' desired relative risk bound
M
Adversary's 's model for predicting Y;
T
Noisy estimate of (Y). the function being released Table 2: Summary of notation.
Symbol Pi Pi(pi, Qi, (*)
Definition
Description
Prior probability of inclusion Prior probability values disclosed
PM E 1==11
PMIliES I-1T" ..S. U,S.S.
Relative disclosure risk
P Table 3: Summary of definitions.
T
Absolute disclosure risk
14

---

A.2 Closed Forms for
In this section, we provide reference for all derived closed forms for E. Corresponding formal theorem statements are provided in Appendix and the main text is provided in Appendix B.2 Table provides the closed forms.
and discussion of closed forms not referenced in
Risk Profile
Condition
Recommended
140:
log
< S
log
a(1-9) R)
7(1 1-
15)
1 S
and
q
log
max
6 PLy
< <
and
<
q
log
28(1 4)
(P9-8)=4444) 7)(1 11-
(Fg
i = 1
log
F-a
166
0 0<
log
0(1-7)
8 R(1-a)
max
<
log
2(pF-ū)
v P( (1(11-))0 (( -(1))
(25)
0 40 -
log
241 (1 Gn)
(1 - A 1 00) - 0100 - (1-51)
1 < 90 < 1 and pu >
0
log
25 5p)
F+1
(1-Po)² 4.48011 60) 1o - (1-Po)
Pu $ P: $ P1
1 < q0 < 1 and Ao =
log (f)
F+1
and Φ0 E 9: $ 91
0o =
log
28 ; P.ttà
log
Table Closed forms for e for various r" (pt. 91).
15

---

B Additional Results
B.1
Omitted Results
In this section, we present all results omitted from the paper. Proofs of these results are included in Appendix
First, we state corollary to Theorem which generalizes Theorem 1.3 in 19 to sets where [ > 1 and to unbounded DP.
Corollary 1. Under the conditions of Theorem 7 for all Pi, (0, 1] and all t",
Pe qi 6
(18)
Next, state corollary Theorem 2 which considers the special case where p; 1. This corresponds to a setting where individual i's inclusion in the data is known a priori by the adversary, for example data from census or public social media platform.
Corollary 2. Under the conditions of Theorem 2 released under 6-DP with
if Pi and q 1, any statistic T
1
1 1 4
E 2
log
(19)
(1(2))) 96
will satisfy (1, S <r (1,
For particular forms of , the optimization in (13) has a closed form solution. This is detailed by the following theorems, which are preceded by two lemmas used in the proofs.
Lemma 2. Fix Ps (0, 1) and let r" (pi, qi)
Then the function p:q
à
2p:(1 9:)
e 9:) log
(20)
p=)2 + 4pr(1 - 9:) (Fr(ii - p:9s) - (1 - -pi)
has partial derivatives such that
1. ae(p..u.)
< 0 for all 0 < < 1 and 0 < <
Op:
2. @e(p..g) 0 for all 0 < p: <1 and 0 < q < 1.
Sq.
Lemma 3. Fix Ps. d (0, 1) and let r" (p; 9:) F. Then the function
2p: - -g))
E(pr, 9:) log
(21)
p1)2 + 4p:(1 - q:)
(PTpLiq p..:.) - -(1-pt)
-1
has partial derivatives such that
1. 0e(p..g.) Op:
< <0 < qi < --1 and 0 <1
2. de(pe.9.)
0 if = + and P4
Op:
3. De(pL.g.)
if 1
#41 4 and P:
Op:
4. Be(p..h)
> for all 0 < < 1 and 0 < < 1.
dg:
Theorem 3. Under the conditions of Theorem tion problem in 73 is
if ifr q:) = F> 1, the solution to the minimiza-
1 log (f).
(22)
2
16

---

Theorem 4. Under the conditions of Theorem 2 let ā < 1, - 1, and i 1, and 0 < qi < 1. the
function r" such that r" (p.q. 9:) max (pq:), and r" (p. 9:) 0o if p: # p. then the solution to the minimization problem in 13 is
log
f0 < < $:
P[1 2]
(23)
log
2(p a)
<
(1) -11---1--))()-----0010-- -)(1-)))
Theorem 5. Under the conditions of Theorem 2 let ā < 1, 9 S 1, and i > 1, and < p: < 1. If
the function r" is such that r" (p:: q) max (p:0/. 8) and r" (Ps. 9:) = 0c for qi F q. then the solution to the minimization problem in 73 is
log
R(1-0)
f/0 < q :;
log
<0< and <パ<l;
(24)
log
20 0)
if / < q <
and <
()
48g
01 a) 2 a)
log
=- 1.
B.2 Additional Closed Forms
In this section, we present closed form results for the implied by additional disclosure risk profiles not discussed in the main text. Proofs of these results are not provided, although we note that proofs would have a structure similar to the proofs of Theorems 5 It is straightforward to verify these results empirically.
First, consider an agency that requires a constant relative risk bound to hold on a subset of the (p: q:) space and does not have any bounds outside that space. That is, rather than enforcing r" (pi: qi)
for all 0 < pi, qi S 1, the agency only enforces this condition for po S p: S fí and ão S q S 71
where 0 I Po S P1 and 0 do क (for P1, `1 > 0). Formally,
F, if po S p S pı and qo S q: 91:
r (p,, 4)
(25)
0o, otherwise.
The recommended E for an agency with the risk profile in 25 is
log
21-(1-6p
if0 S 90 S 7
(1 -1 (1 (1--00 5o) -p 1 (1--i)
log
(1 (110000) 5o)
if 1
qu
< 1 and pu > 0;
(26)
(1 (1-ra))+ (1 40) po - -11-80)
log (7)
if
F+1 q0 and po 0;
1
log
if go 1.
Next, consider an agency that desires a constant bound on the difference between the posterior and the prior. That is, for some E (0, 1), they would like to enforce
Pu S, I, = 1 T t- PM E S, 1] < b. This constraint corresponds to the following risk profile.
(27)
r' (pi, q:) P:q. + b
b
1 +
(28)
P:
Piqi
The recommended & for an agency with this risk profile is
+ b
= log
(29)
1 - b
Notably, by Taylor series approximation, - log(1 (1 - b) Rs + 82/2. Thus, for small 6, it follows that the recommended can be approximated by
82
8²
= log(1 + 8) - log(1 - 8) Rv
b
+
0 +
= 26.
(30)
2
2
17

---

Baseline A
Buseline B
Buseline C
10
(Ps
s(Pi 1)
Agency
Agency B
Ageney
2
30
10
(Pu
1
.01
.03
.01 .03 .1
3
.01 .03
Pi
Figure 3: The risk profiles for three agencies with risk profile given by (31) The lines in the lower panels represent the risk profiles for qi as a function of p;. and the colors represent the implied each point the curve. The lines in the upper panels represent the corresponding baseline r* (pi, 1) = F. The left plots set 7 = 1.5, the center plots set 7 = 3, and the right plots set r == 6.
C Additional Examples
This section provides additional examples of risk profiles.
C.1 Additional Figure for Example
Here we provide an additional figure for Example 1 The setting is restated below.
Example 1 A healthcare provider possesses a data set comprising demographic information about individuals diagnosed with a particular form of cancer in region of interest. They plan to release the count of individuals diagnosed with this form of cancer in various demographic groups via the geometric mechanism, but concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. They wish to choose appropriately.
As discussed in Section 4. reasonable risk profile for this setting might focus on pt and qi 1. If we additionally suppose the agency is generally willing to accept maximum absolute disclosure risk of 0.25 for adversaries with small prior probabilities. risk profile for this agency might be of the form, for some F > 1,
r (ptt.g:) = max
0.25 ps r..
if = 1;
(31)
00,
if q: # 1.
The three example risk functions considered in Section 4 are presented in Figure 3
Agency A is risk averse, agency utility seeking, and agency sits between in terms of risk and utility. For adversaries with high prior probabilities, agencies A, B, and C bound the relative disclosure risk at 1.5, 3, and respectively.
C.2 Extended Example
Here provide extended analysis of Example The setting is restated below.
18

---

Baseline
Agency
Agency
Agency
c,(0.05, q))
10
r0.05
3
01
03
.01
03
01 .03
.01
.03
41
Figure 4: The risk profiles for three agencies with risk profile given by 32 The lines represent the risk profiles for p; 0.05 function of yi and the colors represent the implied at each point the curve. The left plot sets ā 0.025, the center sets ā = 0.15, and the right sets à = 0.3.
Agency
Recommendation
Noise Std. Dev.
Prob. Exact
A
0.025
1.09
1.24
50%
B 0.15
1.21
1.10
54%
C
0.3
2.10
0.56
78%
Table For each of the three risk profiles in Figure 4 we present the recommended by our frame- work. For release satisfying E-DP using the geometric mechanism, we present the corresponding standard deviation the noise distribution and the probability that the exact value released (i.c., the noise distribution'ss 's probability mass at zero).
Example survey is performed sample of individuals in the region of interest. 5% of the region is surveyed, and respondents are asked whether they have this particular form of cancer along with series of demographic questions. The agency plans to release the counts of surveyed individuals who have and do not have the cancer in various demographic groups via the geometric mechanism, but is concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. The agency wishes to choose e appropriately.
As discussed in Section a reasonable risk profile for this setting might set S = {y E 10,1)" 1} and focus qs. while fixing p: 0.05. Additionally, suppose the agency is generally willing to accept a maximum relative disclosure risk for adversaries with large prior probabilities. A reasonable risk profile for this agency might be of the form, for some à
r" ("ip qi = max {
à 0.05g:
3 B
if P: 0.05;
(32)
x0,
P: * 0.05.
Three example risk functions of this form are presented in Figure 4 Once again, agency A is risk averse, agency C is utility seeking, and agency sits in between on risk and utility. Agencies B, and C are willing allow adversaries to achieve absolute disclosure risk of ā 0.025, ā = 0.15. and = 0.3, respectively. Table presents the recommendations for each agency along with the standard deviation of the noise and probability of releasing the exact value of each statistic under the geometric mechanism.
As in Table I the recommendations reflect trade offs between privacy and accuracy, They also are much higher than the recommendations from corresponding simple risk profile of r rP: q:) for all prior probabilities, which implies E z 0.55. Even the most risk averse agency is recommended an E that much larger than this baseline risk profile. This gain is primarily due the assumptions that the survey is a simple random sample from the population, and the adversary has no prior knowledge about which individuals are surveyed. Essentially, the additional uncertainty from the sampling mechanism allows for recommendation with less noise injected. This is consistent with prior work showing that DP mechanisms applied to random subsamples provide better privacy guarantees 3]. The recommended will increase the proportion of individuals from the population surveyed
19

---

1.00-
(pi q
100
30
0.10-
0.01
0.01
0.i0
1.00
1.00
e/Pp, qi)
4
3
0.10
2
0.01
0.01
0.i0 Pi
1.00
Figure The top panel presents the (p: q:) from 33 as a function p3 and 9:- The bot- tom panel presents the implied (pt, 9s) as function of ps and qi- The red point represents argmin e (p q)). For clarity presentation, all r (pr, q.) 100 are truncated to 100 and all (p 9:) are truncated to 4.
(p) decreases. For example, for the risk function in 32 with à 0.025 and F 3. if 0.005, recommend è as 1.63; if = 0.0005, we recommend & RJ 3.94.
C.3 Two-dimensional Example
The examples in Appendices CT and focus settings where only one of p; and qi is important and the other can be reasonably fixed to a constant. Now we consider the setting where both may be simultaneously important. For example, in Example the agency may wish consider adversaries with various pı, rather than only p = 0.05. Perhaps the agency wishes to limit the absolute disclosure to be below disclosure to be below f = when P.q. is high. This corresponds to the following risk profile.
0.25 when total prior probability of disclosure, Р;q;, is low and limit relative
à
0.25 piq:
r" (p..g.) = max
F max
(33)
p.q.
plot of this desired bound on pairs (pt, 4:) on the space (0, 1] x (0, 1] is presented in the top panel
of Figure 5 Notably, if p; is fixed at 5 E (0, 1], plot of r (ū, q:) as function of qi has form similar the plots of Figure Similarly, if gi is fixed q E (0, 1), a plot of r (pi, ②) as a function of p; has form similar to the plots of Figure 3
20

---

To determine the recommended by this profile, we numerically solve the minimization problem in
13.. A plot of e; (Ps 9: as function of pairs (pi: q:) on the space (0, 1] (0, 1] is presented the
bottom panel of Figure 5 Our framework recommends x 0.65, which corresponds to = 1 and
4 0.083 ä/F.
D Additional Discussion of Prior Work
In this section, we describe two previous works with similar aims to our framework using the notation expanding on the discussion in Section
Section 2.2
D.1
"How Much is Enough? Choosing for Differential Privacy"
29 focus on settings where the population, P, of size n is public information and the adversary's goal is to determine which subset of individuals in P was used for differentially private release of statistic. We can characterize their setting with the notation of Section 2.2 as follows. We define Y be the subset of individuals' values P used compute the statistic of interest, T(Y), ). and its released DP counterpart, T (Y). In their examples, the authors focus on the setting where only one individual is removed from P to create Y, and the adversary's 's goal is to determine which i was removed.
We can apply framework this setting with minor modification. For this comparison, assume the adversary's ' 9i PM[Y; E S 1 - 0] = 1 for any set S (although we note that this is weaker assumption than that of Lee and Clifton, since do not assume P is public). We redefine p: and the risk measures to be in terms of I, = 0, rather than 1 = 1.
p: PM = 0]
(34)
T: (p; 1,t") PM]li 0 T =
(35)
PM [1, = 0]
0: (p: 1,t") = PM(T: = 0 pT= t-}
(36)
29 focus on the case of p; 1/n, and seek enforce the bound a;(Inn, 1,t" S for some constant ā and all t", which implies the relative risk bound
(n, pf = 1 n2 -= =
r (p,,, ②d) = (100) otherwise.
(37)
2 with the redefined pt. follows that under these conditions, our From an analogy to Theorem method sets
(n 1)ā In the motivating example from their paper, the authors
1 - -
log
log ā
(38)
nm
4 and à 1/3, giving r" (11/n, 4/3. This results in & log(3/2) s 0.41 from our method. When the release mechanism is the addition of Laplace noise, 's s method arrives similar form, but with the recommendation scaled by a factor of AT' Av.
AT
(n 1)ā
c Av
log
(39)
à
AT max (IT(Y,) T(Y2) Y, - n
(40)
Ar = max (IT(Y,) - T(Y:)) CP
11. 1}.
(41)
The recommendation of 29 's method thus depends both the population and the particular release function. This results in different & values for the same n and å, as low as 0.34 and as high as 1.62 in the authors' examples, depending on the statistic of interest and the values in the data.
D.2 "Differential Privacy: A Primer for Non-Technical Audience"
The example
considers an individual deciding whether or not to participate survey for which results will be released via DP with particular Using notation, let Z, f(Y
45
21

---

{0, 1} be a quantity of interest to the adversary, who wishes to learn whether Z, 1. They have some prior 9; LM 1]. Rather than considering the relative or absolute disclosure risk, the individual is interested in comparing the adversary's s posterior probability if they participate in the survey, (=) = PM [2
T; 1 (.). to the adversary's 's posterior probability if they do not participate, do. (g:: (2) PM 7 = 1 I 0, qi and all t*,
T ln].
The authors of [45] state that for all
Ops aps(9s: (96, t²)
a1s t*)
(42)
aos (oi, t²) e 2= and gg t*))
This expression is in the same spirit as the results from our framework with Pt 1. By Theorem we have
(1,9b11) S
a1(1,
qi
(43)
9s + e 21 q:)
qi + e 23
4.)
The authors of 45 suggest that the individual considering survey participation use 422 bound di for various values of aos. The individual can examine these bounds to make an informed decision about whether to participate in the survey.
22

---

E Proofs
This section provides proofs of results from Section 3 and Appendix B.
Lemma |
Under Assumption [and Assumplion if the release of = 1' satisfies DP, then for any subset S of the domain of Yi, we have
PM = Y, E S.I, =
PM[T = e, <
Se,
PM[T =t YY + S S
PM = 1" 1 = 0
10
Proof. To begin, we demonstrate that for all y in the support of Y and t* in the support of T
E= PM 1" YY; PM 1 - 6
Y; = y. = 1]
(44)
Let V-, be the support of Y under M. Then,
PM[T" =t Yi = y, 4; = 1]
Σ
P(T 1- Yi = y, Y - |Y Y y, 4 =1] 1] (45)
v-rEU-1
$
Σ
P(T = ts Y = - --- 11
(46)
y-iEM-
=e
Σ
PM =t t Y = y- P|Y =
y- -
(47)
V-IEY-1
PM[[T |=
(48)
The equality in (45) follows from the law of total probability and Assumption The inequality in
(46) follows from DP via ( The equality in (47) follows from Assumption 2 The equality in (48)
tollows from the law of total probability and Assumption ! This completes the proof of the right
inequality. The proof of the left inequality is identical with the other inequality in ( applied in (46).
Now, we apply Bayes' Theorem to [M[ = 1" Y, E S, 4 = 1].
PMIKESTTT =t" 1,=1 Px(
PM t" Y, E 1
PM (VEST 11
(49)
PM T = 1' 4 0]
PM = t' 4=00 0J
PM[TT =t 1 =t,
(50)
11= 0
We can then break the second term in the numerator into a summation and apply Bayes' Theorem to each term in the sum.
PM 1o Y,, E 544=1]
P = 1s 1, =0]
PMIT" =t" I; = 1] Σ YES PM = y =
-f,1,1
(51)
PM E E =
4=
PM =t I, 111 Eyes PM Keylal
(52)
PM E S S = 1) PM (T = |=00
Eyes PMI''=1 PM [1 PM |V: = = [=
(53)
PMIx E S 114=1]
We apply 44 to achieve the left bound in the first expression of (T))
PM[T' = Y, 1 Eyese- PM = 1, 1] =6
(54)
PM = 4=
PM E S I, =]
We achieve the right bound the first expression of (10) similar fashion.
PM[T = t Y Y S
Eyes e PM E = =
(55)
[M 4=0
PM 4=11
23

---

We now turn to the second expression in 10
First note that
PM = tot Y, E 5,1==1 1
PM = 1" Y, $ E, =1
PM =t Y; E 1.S,,111
PM[T = 1- = 0
(56)
PM 4=
PM(T = Y $ 8,4 = 1]
By applying the bounds in the first expression in (10) to S and SC
PMT =t Y E 5. Se:
(57)
PM = 1" 1; 0]
PM = Y; c 1 Se PM 1, --0
(58)
Thus, achieve the left inequality in the second expression in 10
PM[T = t" Y, S,4, PM = & 2 - 2-22
(59)
To achieve the right inequality in the second expression in (0).
PM[ = t Y, E PM Y, $4 e (c-9)- -1 62
(60)
24

---

Theorem 1
Under Assumption 7 and Assumption 2 if the release T = t" satisfies DP, then
re(ps, 9b
( q:P: + c 20 1-11-1100 qi)ps e e (11-c(11p))) (11-p)) pi)
Proof. We begin by applying Bayes' Theorem to reverse the conditional in the relative risk.
PMIy, E -
Tilpis qc, (*)
(61)
P E =
PMIT" =t' YYE. PM(() PM(T-=("
(62)
PM E -
PM(T = 1" (
(63)
P
We may decompose the denominator via the law of total probability.
PM = PMIT = ts Y, E 8, = P E S I, = 1 =
+ PM 12 Y $ 1] PM & T, 1] 1] PM = 1]
+ PM[T" 1- [
(64)
PM =t =t E,,,,,
+ PM[T" =t" [, - -))
+ PM[T" =t (1-
(65)
Using this expansion in the expression for and dividing through by the numerator yields
ri (p Qo. (*)
(66)
q:Pi
Pv PM
9:)pr
(MS (1 pp))
PM
Using Lemma we then have
1
Te 9: t))
(67)
4:P: + c 2- 9:) P, + e (0-e1-1-) - ps)
25

---

Theorem 2
For any individual i, fix the prior probabilities, P; and and desired bound on the relative disclosure risk, (pis q.). Define Ep q.) to be the function.
log
2p, (1-0.)
1/0 < < 1;
ex q:)
[1 (1-p:]2+4pp.l 9:) (6.00 p:9: - -11-p))
12
log
ifq: =1
P',.4 Pi
Under the conditions of Theorem any statistic T = -t" released under e-DP with S c:(p;, will satisfy ra Pa qi, S Pi.
Proof. We begin with the simpler case where qi By Theorem
1:(p,110% z + e- ps)
(68)
Since < log ((1 pp)p p.)). follows that c (p))))))) Thus, as desired,
1
rr(p,,1,77 S
=r'(p,1) 1).
(69)
P4
(P..3 Pt 1-pi
(1 pē)
Pi + (p...) Pi
Now consider the case where 0 < qi < 1. By Theorem 1
Telpi. t0)
(70)
4:P: + 2= - qdp, + +e= (1-1111 11pppp pp)
Since
2p:(1 9i)
S log
(71)
pz)2 + 4pt(1 9:)
[T( p:gss) (1 pi)
it follows that
(1 p.)2 + 4p: 4:)
Trt (T'(....)) Pegs) -(1 pi)
(72)
2p; 11-- 9i)
Taking the square gives
4p:(1 9:) ((..)))))) piqs
+ +(1 - -2;)²
25
4p² (1 9:)2
2(1 - ((1--i) pp)² + Ap: q:)
(p(r)))))) Psgs
(73)
4p. - 9:)2
(1- pz) - (1 - pb)
(1 - -p:)2 + 4p; - 9:) (rr() psgs
T"(PL-033
Piqi
Pt 9:)
2p -9:²²
(74)
26

---

Thus,
op:te - pp + e e=((1= - -pi)
2 9:P: + (P..0 Pils
(1 - q:)ps
P: 96)
(1 - pi)2 - (1 pi) (1 ps)² + 4p;(1 - -i))
1 Pols
(1 9:)pt
2p² q:)²
1 (1 pi)2 + 4p:(1 qi) (pi.9))
piqit (1-pi)
+
(1- - pi)
(75)
2p - 9i)
1
q:Pi +
r* (pi;
- -Piqs
(1 pi) V/ (1 pp:)² + 4p:(1 - -9:)
1
-
r (pi:
2p:(1 ②c)
1
1 Pi
(1 pi) 1 (1 p;)² 4p;(1 9:)
-Peqi
(76)
2p:(1 ②
(77)
r (pt. 96)
is then immediate that
ry (p(; 9c, 1*) S
r (pi.
(78)
4:P: + e 2- 9)pp + (1= -p:) ps)
27

---

Corollary 1
Under the conditions of Theorem 7 for all Ps E (0, 1] and all t",
Ti (P t*) E
(79)
First note that since, 0 S e 1, follows that e Se Then, applying the result of Theorem
Proof.
1
1
9:P: + 25 ps te {(1 t p.)
9ipi + 2=
4)p: + 25 ps)
(80)
Combining terms and using the fact that 9:p: 2 0 gives
1
S
20
(81)
q:pi 2c -:p;)) e + qipi(1 ---2)
e +0
Corollary 2 Under the conditions of Theorem T to released under e-DP with
P: 1 and < qi 1, then any statistic
5 5 log
(82)
2
(*(1.g)) 46
will satisfy r: (1. rr rl.
Proof. Plugging
1 into the expression from Theorem yields
2(1 - 91)
& S log
(83)
0 + 4(1 qi) (m_2.. (1))
1 4
log
(84)
p" (1.1. q
q
log
(85)
28

---

Lemma 2
Fix 9s E (0 and let (p: q:) a/(p:9)) Then the function
2p: -q.)
ept, log
(86)
(1 100-p.22 + 4pt(1 1 91) (1 - p.q.) - (1 -pi)
has partial derivatives such that
1. de(pi.9) < for all 0 < < 1 and 0 < <
2. Be(ps. dq:
< 0 for all 0 <ss <1 and 0 < 9 < 1.
Proof. To begin, we re-express the function of interest in the form
s(pi, q:) log (2pi(1 (:)) -log
(1 p.)² + 4p;(1 q:)
(1)-
(Pih:
piq:) -(1 (Pi) (87)
à
= loo (2p:(1 (:)) - -log
(11-pp)) p.)² 41 - ( - -(1-pi) pi) (88)
(1-pi))
We first examine (e(p;, 9:p/Op. Taking the partial derivative with respect to qi gives
2(1 m1)1--))+-00 +-) 9: -1)
+
@E(ps: 91)
1
2/ (1-1))+++000111
(89)
Op:
Pi
(11 - p-)p + 4pp 9:
1)
v (1=-)))+- (1
(1-P:) 4pen))-peniin n)
1
(90)
Pi
v - pz) 42
- pi)
(1- |4
(1
Pi V (1 pz)² 4p/ - - pp)
(91)
[(1 (()-P))+ +p)+ (1-p4) (1-p))++ (1
(11-p)2 + 4:)(
(92)
p.)2 + (1 -
pi
V( /
(93)
Pt V(1 (1 p2.2 + 4pfq:(1 - 4:) - -1) p.)
(94)
Pi PIV(1 p.)² 4ppq
Certainly, the denominator of 94 is positive. Thus, dE(p,, q.)ppp < 0, as desired.
29

---

We now examine 0=(p: 9./qq. Taking the partial derivative with respect to gives
de (ps, qi)
2 2(11-1))=++420(00000))0 (1-p;) -1
(95)
dq:
1 9:
( p:)² + 4p/qg(1 - (1 - -1) 1
V(1 (1 p4)2 + 4pp q:)) (22 - - - - p4) 2p (1-1)) (2-
v (1p==)))47(7
(96)
(1-q1) 9.) / (1 p:)² + 42 9:) (1 1) - (1 - pp))
(1 (4-x:)+ -2) /
11) deg (0:(2-
//
(1 (1- (1-9)) [ p2)² 4p, 9i) ( - - (1 (1-pi) pi)
(97)
Consider the three parts of (97). Since < 1, we have that in the denominator of the numerator,
V(1 p.)2 + 4pp - q.) (h 1) > 0. The denominator is also positive, since (1 9:) > 0 and
W/ (1- + -g) 4)) (1-1) -(1 -(1-)) mn) > [V(1 - 11)---)--0 (1 pi) O. (98)
This leaves the numerator of the numerator (97p. Let us denote this expression as g(g:). If g(q:) O, then it follows that Öe(ps 9:)/ 0. To show this, begin by simplifying the expression for 9(%.):
{1 - (1 --idy/ (1 pi)2 + 4p7a: ())
1
(
((%) = (1 - p.)² + 4pp - 9:)
+ 2pp [1 -1) (1 9:)
1qi(1 (1 -.iil
(99)
0q:
{ - -(1 -i) -a (1-pi)² + 402(1 9:99
1
1
= (1-p.)² + 2p?(( (1- -2:)(24))
-1
(//=) -1 (1 - 2qcc
1
+ +1p (:)
(100)
à
= (1 - p.)² - (1 pii) (1 (1-p)) + 4p?(1 9:99; à -1) 1 + 2p? 9:) (1_ -1).
(101)
Taking the derivative of g, we find that
0g(4:)
4p (1 - 2q,) (1 -1)
1
-(1 (p))
2p
ā -1)
(102)
0q:
2 (1 p.)2 + 40? - -9:)9 ( (1-1)
1 -1)
1- 1-29;
222
(1 pi)
+1
(103)
à
V(1 p.)2 + 4pp 9.)9 (1 - 1)
30

---

For 0 < 9: 1/2, 2q; 2 0 and so /g(q:)/0q < O. For 1/2 < 9 < 1, since 2q: - 1 < 1 and
V(1 p.)² + 4pp(11 9.9% (1/ā
> 1 Pi.
0g(4:)
22p - 1)
1 1 (1 p:)
2g:
(104)
dqi
V (1-paa) p:)² + +pp (1-p:)²
): ( -1
< 2p? { -1)
1 [ - (1 p:) 1 pi
(105)
<0 0.
(106)
Thus, p(a:) strictly decreasing function of q on 0 < 9: < 1. Since
9 (1) = (1)= (1 p.)² p.)² 4p7 1)1
[ -1) 2pp
+20 (1-1)
- -11 0, (107)
follows that g(q:) > for < 9; and so (:)/q. < in this range.
31

---

Lemma
Fix 9s E (0, and let (p:. q:) = F < 1/(p.))). Then the function
2p:(1 - -9))
E(pi, = log
(108)
pb)2 + 4p:(1 q:) (PrA)a pslli) (1 -pi)
has partial derivatives such that
@e(pL.g.
<0i < qi < - and pi <1
Op:
2. (e(p..4.) = 0 if = 1+1 and < Pi < 1
3.
(s(p).as)
0 if F+1 qi and pi qu
dp:
> 0 if0 < Pi < and 0 < 4 < 1 4. (.(p..q.) Dy:
pif
Proof. To begin, we re-express the function of interest the form
e(p;, (:) = log (2p: - -:)) - log (va-m)²+ 4p:(1 - q:) ( Pilti - -11-p)) (109)
-
We now examine (s(p; /p)/pp; Taking the partial derivative of with respect p; and simplifying gives
(1),
[1 (1-p.) (
(110)
Op:
Pi
(1 - (1-p;)} + 4p, (:) piqs) - (1 p:)
1(1 (1 (4p -P(L)
1
(1 ).) p(g.)
(111)
Pi
(11 - (1-2,)² + 4p. 46) ( p:gs) - (1 Pi)
(1 (1-p:) +1p. (1- - (:(;
pvn:) (1 p2) +pp) ( Pigs
v(1 - x2) 4m:(1 0:) -Pi9s)
(1(1 - (1,1;) + 4p (1 9:) ( pig:) - (1 pi)
D:
4:) P:(1-p)) 2pp(1 - 9. )( p. + 9:)9 P:y pc) +pp (1:p:(11:)(( PPa))
11 p2 4m ( pins)
(112)
P V p2) + 4p: (1 - 91 ( pags)) (1 - pt)
(1 +1pp))++p..11-//// q:) pmdi) p. (1-
- + (1-1111000 (1-pt) +4p 2.) p(g.)
va (1- + ( -Pos))
pi |V (1 p:)² 4p, q:) (1 P(q.) (1 pi)
(113)
21, - 4 } + (1 - p.) / p.)2 + 4p, - 96) ( -p9%)
Pi V (1 p2) 4p.(1 q:) (t p.q.) (1 - p.) V(1 p,)² 4p; 9:) (t p.q.)
(114)
We can rearrange the expression in (144 to the following form.
2pa(1-9u1
de Øs(pi, qi)
(1-p.) (1==)))= -111--
(115)
Op:
Pi (1 1111-p.2-2 4p -1-1111000 9:) ( -p(9:)
32

---

The denominator of (155 is certainly always positive, so the sign of (p: 9://0p; is determined by the sign of the numerator. To determine the sign, we will use the following equality.
1 -Va- p:)² + 4p-(1 - 9:) ( pili))
2p:(1 - 7
12 1--1
1
- (1 -
-Pili)
+ 4pp((1 - q:)
F2
4i
i+1)
(1 - Pi).
(116)
To demonstrate that (166 holds, note the following.
2p.(1 ))) - -p)) = 4p 2:)² 72
+ 4p; - p:)(1 -1)
+ (1 - pt)²
(117)
7
= =ppi(1 - -2))² 1
82 1
+ +p; - p:)(1
(1
- 9:) 7 - 4pp 9:)
9:
72
j2
7
72 -1
1
)
+ 4 9:)
72
9:
F+1
+ (1-p;)²
(118)
1
1
8 -1
1
1
4p,(1 )))
P:(1
9:)
+(1
pb)
=
Ps
(
96
F2
72
72
1
1
+ 4p
96)
72
q:
7+1
-p))²
(119)
4pp((1 9:)
+ Pi
P:qi
+
72
f2
72
52
+ +pp (1 9:))
+ (1 - p.)2
(120)
72
7+1
(1
f2
4p:(1 ②:)
F Pisli
+
4p
--
+ (1 (1-p))
(121)
Rearranging 121 gives (16).
Now note that, from 116 if q: = 1/(f + 1), then
1 ) (L--))² p.)² 4p,(1 q:) - piqi -(1 -pi).
2p.(1
(122)
It follows that the ratio in the numerator of 115 equals 1 and thus 0e(p:,q))/0p 0. If0 <
1 then the term 4p (1 - (F2 - 1)/ /2
1/(F + 1)) < 0 and so
#+1
4
2p. (1 2 < (1 - pz)a (1-p))² + 4px(1 9:) ( pilk - (1 -p))-
(123)
follows that the ratio in the numerator of [15 less than 1 and thus a=(p,, 9.p < 0. F.1 < qi < 1, then the term 4p² )= (72
1)
? 1/(f + 1)) 0 and so
x) 1 2p, ())
a1 (1-p:)² 4p;(1 g:) - peli (1 (p))
(124)
It follows that the ratio in the numerator of 115 is greater than 1 and thus de(p,, g.) > 0.
33

---

We now examine O=(p: 9./qq. Taking the partial derivative of with respect to qi gives
Ap: Dur [1 0: p.0z)
0s (p(;
1
2 (1-p))²++pp) (.)) -pi9))
(125)
0q:
qi
(1 p.)² + 4p; 9:) ( p.g:) - Pi)
(1 ps)² + 4p;(1 - q:) ( - -paq:) - (1 - pc) + 2p.(1 -.) deg [11 -.)) -pra:)
(1)- + 2.) Pugu)
(126)
(1 - 9:) / (1 p.)2 4p: 9 $ p(q.) - (1 p.))
(1-p))244p.0) -.) ( -i.0s) ( - p) (p (1 -p.g.)
-. p.v.. + +pp (1-9:) Du, [1 a1) -p.4.)
(1-9)) 91) [V (1 p,)² + 4p: (1 91) ( -Piqt) (1
(1-p)) pi)
(127)
Consider the three parts of 127 Since F < 1/(p:q:), it follows that (1/F p:g.) > 0. Thus, in the denominator of the numerator, v (1 p.)² + 4p; 4:) (1/F p:{;) > 0. The denominator is also positive, since (1 (:) > 0 and
VV- pi)² + 4p:(1 9i) (+ -piii) ( - (1-p:) ppi) > [1(- p.)² - (1-pi) = (128)
This leaves the numerator of the numerator of (127 Let us denote this expression g(q.)- If g(g:) < O, then it follows that de(p;, q:)/:;;)0: > O. To show this, we begin by simplifying the expression for 9(4)):
g(q:) = (1- 11-p) pz)) 12 4pc(1 - qi)
(1) -Piqi - -(1-pi) pily (1 -p:)2 4p=(1 4i)
( Pil
θ
(1 -14) (1 -Psqi Po9ss
+ +ppp(1 q:) 0q:
(129)
= (1 - p.)² + 2pr(1 - -i1) (2 -2p.9: - (1 pil/ (1-pi) pi)2 + 4pr(1 - 9i) ( piq.
+ +2p -qi) (2piqi - pi - 1
(130)
(1
= =(1 (1- - p.)² - (1- pu)l/
-(1
(1-1i)) (1
(1-p,)2 4p; - -qi)
( - pig.
+ +pp qi) - Ps
(131)
Taking the derivative of g, we find that
0g(g:)
4p, (2p.9: - Pi - #)
-(1 p+)
2p:
( Pi
(132)
0q:
2 (1 - p2) + 4p, qi) ( p.9.))
2p; 9:) + ( p.))
= =2y;
(1 - p:)
7 Pi
(133)
V(1 - (1-p,)² + 4p, q:) ( p.g..)
34

---

Note that since f < 1 it follows that ( -Piq:) > 0 and p: - -0,) > ps - 7. Thus,
pag:
0y(4))
2p:(1 (i) (ps 2) + (pt - :)
2p;
(1 - p:)
(134)
0q:
(11 - p:)² 4p; 9:) ( p(gs)
(pi =)
Pi ;
2ps
(1 - pi)
(135)
V(1- - (p.}
4p:
Pi
(136)
> 0.
(137)
Thus, g(%: is strictly increasing for < 1/(:g)). Note that terms of qi this is equivalent to the range 0 qi 1/(pf)). Since
1 pr
9
(
(1
-p:)²
- (1 ( pb) (1 -p:)2 + 4pr(1
Pi p.f
+
2p;
1
P:
p&f
p,
(138)
2p: 11- 1 ( Pi
(139)
p.p/
< 0,
(140)
follows that g(g:) < for < qi < 1/(p;)). Thus, as desired, de (e 4:) 9:/00 > 0 in this range.
35

---

Theorem 3 Under the conditions of Theorem 2
= 1, the solution to the minimiza-
tion problem in 13 is
E log (7).
(141)
2
Proof. We define (pi, 9) as follows.
log
(1)
if0 < < 1;
E(ps, 9:)
(1 p2] 4p. a) pia)) -10))-11100 (1-pp)
(142)
log
P1
if q =
The solution the minimization problem in 13) corresponds to the minimum of E(ps, 9s) over (0, 1] x (0, 1]. Lemma 3 implies that (p /d) * 0 for any 0 < < 1. This means that this function must take minimum value around its boundary, i.e., when pt 1, qi 1. Pr - or O. We examine each of these in turn.
We begin with the boundary where p; 1. By Corollary 2 for < 9 1,
%
e(1, 9:)
log
(143)
2
We take the partial derivative of this function with respect to gi-
(s(1,;)
1
1
(144)
0q. 2
1 2: qi
Since F/F < 1, it follows that 0s(1,q))0m > 0 for all 0 < < 1. Thus, the minimum occurs as l and is
lim s(1,g) log(r). 4: -0
(145)
2
We next examine with the boundary where qi 1. When < pi 1,
Pi
a (p;, 1) = log
(146)
Pi
We take the partial derivative of this function with respect to Pi.
de(p,, 1) Op: 1 p.
1
+ 1 3-p4 Pi
(147)
Since 1/F < 1, it follows that 0e(p; 1)/0p; > 0 for all 0 < P: < 1. Thus, the minimum occurs as P: + 0 and is
lim spp,, 1) = log(F).
(148)
We next examine the boundary where Ps + 0. Since the logarithm is a continuous function, for all
0 < qi < 1.
2p:(1 9i)
lim epis lim log
(149)
P- p=
V p.)² 4p; q:) (# -peq.) - -11 (1))
2px(1 1 - 9i)
log
lim
(150)
p.
v (1 p.)² - -pp 9:) (# p.q.) - (1 - (1-p:)
Using L'Hôpital's Rule,
2(1 q:)
lim (:). = log P-
lim
(151)
p. -2(1 -2(1--p.)+ (1)+4(11-01)) p.g.) 4p... (1-
2 +p))++ppp(( ( p:9:)
2(1 9i)
= loog
log(7).
(152)
-1+ (1)
+
VI
36

---

Finally, we examine the boundary where + 0. For all < Pi S 1
2p; (1 - q:)
lim spi, 9:) - lim log
(153)
4:-0
1(1 po)a + Ap 9:) ( -Pii:) (1 pi)
2p.
log
(154)
(1 p.)² 4ps (3) (1- (1-p.) p.)
We take the partial derivative with respect to pt- From (115) the proof of Lemma
we have that
(1 p.)2 4pt ( p:) - -11 (1-p)) )
0
lim E(pc. 9:))
0
2p;
log
(155)
Öp,
14-0
Op;
2p.
(1 p.) 4p, (11-p)))
(156)
Pi / (1 p:)² + 4p: (#)
By 116 with 4o 0, the ratio in the numerator of (56) is less than and so 0/0p, (lim, -0 Ept, 9:)) negative for all 0 ps S 1. Thus, the minimum occurs at p; and is in 115).. The global minimum of e epe, qi) is thus 1o2log(F))
37

---

Theorem Under the conditions of Theorem let á < p S 1, and i 1, and 0 < 9i S 1. If the
function r" such that r² (p.q. q:) max(a/ (pq:), f and (p.. 9:) if p: # p. then the solution to the minimization problem in
13
is
log
(157)
log F2 p]2 1(F a] (1- 8) -F1 8)
2(p à)
Proof. We define e(g)) as follows.
log
20(1
if 9 <
E(qi)
(2 +-pp1 9:
((P.)
84:) -11 (11-p)
(158)
log
1-p
if q 1.
(P99)
The solution the minimization problem in 13 corresponds to the minimum of (9:)) over (0. 1].
We begin with the case where < p < à r.r. In this setting, we have that i a/p â/ (e/(p.)). so (gg) is decreasing function of ys, so the minimum
r" (f² qi) = a/ (fq. for all yi- By Lemma 2
occurs at qi and
1 1-
1-P
a(1 a((-p) p) p(1 ō)
(L1 log
log
log
(159)
1
r- (511)
We now consider the case where a/F < P S 1. Note that 7 2 ap(p)) whenever qs a/(p)). Since this setting (/F) < 1, the risk bound can be written in piece-wise form
i
(p.
=
pqi F, if if 5/ < 1.
p
(160)
Note that if q: 2 1/(p)), then 2 (p4,) Thus, r (5..)) 2 7 2 1/(gq) and so
(1-p)² D)2 + 45(1 9:)
r" (ū, pqi
(1 p)
I VL [1- 45(1 q:) (pq: p4) (1 p)
(161)
= ( p|- (11
(162)
0.
(163)
Thus, e(g:) = for any qi 2 1/(fp). We may thus restrict our attention to < minn(1,
Since r" r", q:) is continuous function of qi and E(q.) is a continuous function of r" rr q:). follows that =(g:) is continuous function of q:- By Lemma 2 E(q)) is a decreasing function of
qi for 9: a/ (f(pF) and by Lemma 3 =(q:) an increasing function of qi for a/ < g:
min (1, Thus, the minimum must occur at q a/ (jr) and is
à log
8
(164)
(1
1)2 + +45
pr
D 1r
(1 p))
2 (pF - ④
=log
(165)
1/ - 2))² 4 (pr à (1 à) - 8(1
38

---

Theorem []
Under the conditions of Theorem 2 ler ā < 1. 9 S 1, and F > 1, and 0 < Pa < 1. If
the function is such that r" (p:. q) max (p: F) and r" (p). q:) oc for qi + q, then the solution to the minimization problem in
13 is
1 log
a(1-9)
if0~ < q ;:
2
6(1 1-
R)
2 log
if0 < म and & < < 1;
(166)
log
21 ( ①)
if / < < and à
7 < q < 1;
(FG-a)²
4ar(
1)(1
a) (FG
log
à
=1
Proof. We define s(p:) follows.
log
(1-p))) 8) (~ - p.a) -0 (11-p)) , if < <<<;;
(p.(1-0)
E(p.) =
(167)
log
1-pi (G
1f
The solution to the minimization problem in 13 corresponds to the minimum of sp:) over (0,
We begin with the case where 0 < 7 F.r. In this setting, we have that F ā/q S ā/ (pr so r" "PPs ④) = (p:0) for all pt- By Lemma e (p;)) is a decreasing function of pt, so the minimum
occurs at p; and is, by Corollary
1
ā - 7) 7( à.)
((1) 2
log
log
(168)
2
We now consider the case where a/r < < 1. Note that F a/ whenever ps ā/(gr). Since this setting a/(q7) < 1, the risk bound can be written piece-wise form
if0 < < क
(p,
P=q'
(169)
if if
S <
Note that p, 2 1/())), then 22 1/(pg)). Thus, r (p.. 2 2 (/(p/) and so
(1- p.)2 + 4p,(1 - 4)) r" (pi, - -Piê (1 1 p.)
$ v(1 - p2:)² + 4p;(1 (1 - 7) (piq - -p: (1 - pt)
(170)
v1 (1-2.
p.) 0.
(171)
Thus, e(p.) = oo for any 2 1/())). We may thus restrict our attention to p. < (1,
Since r" rp(p q) is a continuous function of ps and =(p:) is a continuous function of r" (p:, q), it follows that (p;) is a continuous function of p.. By Lemma e(p:) a decreasing function p: for 0 < P: < (qF).
When 0 q 1/(++1), note that 1/( (++1)/P> 1 and so m 1. By Lemma 3 s(p)) is a decreasing function of p; for (?F) < < 1. Thus, the minimum must occur at = 1 and is, by Corollary
e(1) = log 7
(172)
When q 1/ + 1), again 1/(?F) + > 1. By Lemma e(p)) flat for â a/(FF) < min(L) 1. Thus, the minimum is shared by all points in this range and is equal to 172).
39

---

When +1) < < 1, by Lemma <(P:) is an increasing function of ps for a/(@r) < ps <
min)) Thus, the minimum must occur at p; (((r)) and is
(1 7)
log
(173)
9T
)2 + 4 (1 9) (
à 9
(1
0F
2ā(1 7)
= log
(174)
v (ÿr a)² + 4āg
4)
(qp ②)
Finally, when q = for a/(rr) < ps < min 1, (/
pi
<(p,) = log
(175)
pi
It was shown in (147) that <p.)) is an increasing function of pi for a/F ps min The
minimum then must occur at p. = a/r and
F ā
log
log
(176)
1 ā
40

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: Our contribution is a novel, general framework for selecting e in DP, which is stated in the abstract and introduction. We emphasize throughout that the framework requires some assumptions, which are provided at the beginning of Section
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The main limitation of our framework is the required assumptions, especially Assumption 2]
We make an effort to call out that these assumptions are required for our framework be used, while also noting that they are milder than assumptions in the existing literature on selecting E.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
41

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: All theorems and lemmas are proved in Appendix E and all assumptions are clearly stated in Section
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: All equations required to reproduce the tables and figures are provided in the text. To find the implied by each profile, the minimization problem is stated in (L3). closed forms are provided in Appendix A.2 where applicable, and code to solve the problem numerically is provided.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
42

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
Code to produce all figures and tables in the text provided.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips.ccpputt wttpcccccppccccceee coroolicggiieeee wwwedeeeeeeeebbmmeeeeeee iobbbmmssiinnl ssionpolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/eetails
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [NA]
Justification: We present illustrations the approach with results derived from mathematical properties of the framework rather than data-based experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [NA]
Justification: Our numerical results derive from calculations based on probabilistic properties of the framework, so error bars or other measures of statistical significance are unnecessary.
Guidelines:
43

---

The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [NA]
Justification: While we do not have any experiments, the code to produce all figures and tables be run on personal computer in few seconds.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We have reviewed and ensured that our paper meets the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [No]
44

---

Justification:
We demonstrate how our framework can help agencies better manage risk and utility trade-offs in private data releases, which can help agencies release information that better informs policy decisions. However, we do not discuss societal impacts beyond that notion.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negatíve societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g.. gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: The paper poses such risks as it uses confidential data.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [NA]
Justification:
The paper does not use existing assets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
45

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperssi thoode com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's ' creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing research with human subjects.
Guidelines:
46

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
47


Reviews:
[{"review_id": "Gfzm7mNLyr", "reviewer": "Reviewer_XDrZ", "summary": "The paper proposes a novel framework for setting an appropriate privacy budget via controlling Bayesian posterior probabilities of disclosure. The connection is established through the risk profile, an upper bound on disclosure risk involving privacy parameters. Theoretical justification and empirical evaluation are also provided to support this framework.", "questions": "Can the framework proposed in this paper be extended to handle cases where $T(Y)$ has continuous support?", "limitations": "The authors address this part in the limitations section of the checklist.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The paper links differential privacy to Bayesian disclosure risk through the risk profile, providing a reasonable framework for selecting privacy parameters.\n* The paper provides some ready-to-use tools for implementing this framework, supported by empirical results.\n* The paper is well-written, and the authors provide a comprehensive discussion on its connection to related work.", "weaknesses": "* The framework is designed for releasing discrete statistics, and it is unclear whether it can be extended to release continuous statistics.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for noting this omission. Generalization of our results from the discrete case to the continuous case can be accomplished by replacing sums with integrals and probability mass functions with probability density functions throughout the theorem statements and proofs. We focus on the discrete case throughout the document for clarity of presentation. We apologize that this was not clear in the original manuscript and are updating the text to highlight this point.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "scgMDRw550", "reviewer": "Reviewer_QVWW", "summary": "This paper proposes a novel method for selecting epsilon that comes with a natural adversarial interpretation. They characterize an adversary’s auxiliary knowledge by two prior probabilities: the prior belief that an individual participated in the dataset, and the prior belief that an individual’s record has some characteristic. Based on these two parameters, an institution can choose a “risk profile”, that maps an adversary’s prior knowledge to their allowable increased posterior knowledge after viewing the DP output. The authors propose a mapping from risk profile to maximum allowable epsilon. \n\nA major insight is that risk profiles which allow adversaries with weak priors to learn more than those with strong priors allow for larger epsilon values than a constant profile would allow (constant bound on posterior/prior ratio). \n\nThe authors go on to provide instructive examples of risk profiles that different institutions may want, and the resulting epsilon bounds. They include an analytic experiment based on Durham infant mortality rate data.", "questions": "See weaknesses section.", "limitations": "The paper identifies its assumptions early on. I think the major limitation is the relatively small boost in epsilon value (and therefore utility) for the risk curves demonstrated.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "This paper addresses the two primary limitations of differential privacy at once: 1) an interpretable way of setting the privacy loss parameter, and 2) an analytic justification of higher epsilon values. \n\nThe paper writing is strong: their framework is laid out very clearly, and the examples and guidelines are useful and clarifying. The appendix is thorough and supplements most content that I wanted to see added. \n\nOf course, much ink has been spilled over adversarial interpretations of epsilon and different adversarial threat models (especially Bayesian ones). I felt that the authors did their homework, and nicely positioned their work in the literature.", "weaknesses": "The two main weaknesses that I noticed revolve around baseline clarity: \nLittle is offered in the main paper to show improvements over the naive baseline ($\\epsilon = \\log(r)/2$). I noticed a note on this after Figure 2, but felt it should be highlighted more. The improvement in utility over the baseline $\\tilde{a} = 0$ is nonzero, but not enormous. The question is whether that improvement warrants the increased complexity of understanding the $\\tilde{a} > 0$ regime (i.e. the complexity of choosing a non-constant risk curve).  \nA more thorough exploration of risk profiles and the above baseline. Take a risk profile with minimum $r’$. Set its baseline to the constant risk profile with value $r’$. Can we say anything about the difference between their epsilons? Are there settings where this gap is very large? If so, are these settings realistic? \n\nI apologize if I missed the above addressed in the paper, but to me this is the most critical question at hand. If we can’t make statements about this gap, then we don’t know how much we can gain over the baseline.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the useful feedback regarding baseline clarity. On the question of demonstrating improvements over the baseline, the extended versions of Examples 1 and 2 in the supplement demonstrate the potential for substantial improvements over the baseline. For example, Table 4 and the accompanying discussion (lines 862-866) show an increase by more than a factor of two in the recommended $\\varepsilon$ in all cases. We agree that this comparison is an important aspect of our contribution and are updating the discussion of the examples in the main text to highlight this improvement.\n\nThe second point you raise is quite thought-provoking and not one we had previously considered. The gap between the baseline and our recommendation can be large. As an illustrative example, suppose an agency has a simple, “point” risk profile, where for $p_i = 0.5$ and $q_i = 1$, they desire a relative risk bound of $r’ < 2$. That is, $r^*(0.5, 1) = r’$. The baseline recommends $\\epsilon = \\log(r’)/2 < 0.35$. The recommendation from Theorem 2 can be shown to have the form $\\epsilon = \\log(r’/(2 – r’))$. This diverges as $r’ \\to 2$. Thus, the gap between the baseline and the recommendation from Theorem 2 can be arbitrarily large for $r’$ sufficiently close to $2$. \n\nThe example above likely does not represent a realistic disclosure risk profile of a real-world agency, but it is instructive in determining when our method can outperform the baseline. In general, the baseline’s recommendation is smaller because it is necessarily enforcing a relative risk of $r’$ for adversaries with small priors. If $r’=2$, then an adversary with prior probability $p_i q_i = 0.001$ is allowed a posterior probability of at most $0.002$, which is very restrictive and leads to a small $\\varepsilon$ recommendation. If adversaries with small priors are ignored - as in the above point example - or allowed to have large relative risks - as in the extended versions of Examples 1 and 2 - then the recommendation from our method will outperform the baseline, and possibly by a substantial amount. \n\nWe agree that a more thoughtful discussion around these points provides useful context to our examples and are adding the main points we discuss above to the paper.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wn8wDUqLPB", "reviewer": "Reviewer_HWnJ", "summary": "This paper proposes a bayesian framework for determining the DP budget \\eps. In particular, the authors develop a mathematical technique based on how much posterior risk the agencies are willing to accept given some prior risk and the \\eps obtained through their formulation is unique.", "questions": "How do your methods extend to weaker notions of DP? (see comment in weaknesses)", "limitations": "See weaknesses comment.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Although there has been much debate on the topic of how to determine privacy budget and different flavors of this formulation have been proposed in prior works, I have not seen this formulation in the context of agencies deciding their \\eps privacy budget. Authors also do a great job in differentiating their work to prior works that have proposed similar ideas. The ideas in this paper seem novel and useful to real world scenarios.", "weaknesses": "This paper only discusses the setting of \\eps in the context of pure DP. It does not discuss whether these techniques could be extended to weaker notions of DP such as approx DP. Since in most real world applications agencies use approx DP notions I feel like this is an important discussion point that is currently missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for raising this point. A few works such as Kasivisiwanathan & Smith (2014) and Kifer et al. (2022) discuss Bayesian semantics of approximate DP, although the details differ from the semantic characterization we use in this work for pure DP. We imagine one could use these results as the basis for a similar framework for approximate DP, following our framework as a blueprint. We did some initial investigations of this and found the generalization not to be straightforward. Since our work is a first effort on formalizing the selection of $\\varepsilon$ by linking it to statistical disclosure risk profiles, we opted to focus on the pure DP setting and leave this extension for future work. But we agree with the reviewer about the significance of this extension and are updating the text to highlight that it is an important open problem, and we suggest some possible first steps for that future research.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kmWnb0BgAb", "reviewer": "Reviewer_E851", "summary": "For data owners, determining the appropriate privacy level based on the standard interpretation of differential privacy—which limits the likelihood of distinguishability from an adversary's perspective—can be challenging. This paper addresses operational interpretations of (pure) differential privacy by examining the worst-case multiplicative and additive gap between the prior and posterior probabilities of distinguishability when observing the DP mechanism's output. These gaps are defined in terms of relative and absolute disclosure risk. The paper breaks down disclosure risk into two components: a) identifying the presence of an individual's data, and b) identifying certain sensitive features of an individual whose data is present. By contextualizing these two types of disclosure risks, the paper suggests that data owners should create prior-to-posterior risk profiles that reflect their acceptable levels of privacy risk. These risk profiles can then be translated into a pure DP budget by solving an optimization problem or, for a single risk profile, using the provided closed-form solution. The paper includes examples of reasonable risk profiles for specific data-disclosure scenarios and outlines the DP budget required under different prior probabilities of distinguishability by an adversary.", "questions": "Following are some questions that would help me understand the presented examples better:\n\n- In Figure 2, deviation of what quantity is being compared? \n\n- When does it make sense to set the relative disclosure risk to $\\infty$ as done in equation (16) and (17)?\n\n- In Figure 1, what are the values of $\\epsilon_i$ when $q_i \\leq 0.1$ where $p_i = 0.05$? The plots in this range seem to be truncated.", "limitations": "The paper has several limitations regarding applicability of the techniques which haven't been discussed. I suggest the authors to shed some light on the following limitations:\n\n- How to choose the disclosure subsets $\\mathcal{S}$ without knowing what a potential adversary might be interested in inferring?\n- How to decide the appropriate $\\epsilon$ from the disclosure risk profile as plotted in Figure 1? For certain choices of $p_i, q_i$, the values of $\\epsilon$ could be excessively lax. On the other hand, if we choose the smallest $\\epsilon$ pessimistically, the value might be very close (or identical) to the trivial solution equation (7)\n- What are the guidelines that may help a data owner in deciding an appropriate disclosure risk-profile that caters to their specific setting?\n- What is a fail-safe disclosure-risk profile that should be included with the other risk profiles to ensure that blatant non-privacy never happens?\n- Can the framework be extended to $(\\epsilon, \\delta)$-DP?", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The paper addresses a crucial issue in differential privacy: determining the appropriate DP budget. Examining the gap between prior and posterior probabilities of distinguishability from an adversary's perspective, before and after observing the mechanism's output, is a promising approach.\n\n- Decomposing disclosure risk into the risk of detecting inclusion and the risk of inferring sensitive attributes is valuable for understanding the impact of various DP budgets. This approach underscores that DP can mitigate multiple types of privacy risks, albeit with varying levels of effectiveness.\n\n- The proposed framework provides flexibility in modeling an acceptable disclosure risk profile and includes a closed-form expression for deriving a compliant DP budget from it.", "weaknesses": "- The paper suggests shifting the focus from fixing the budget constant $\\epsilon$ to fixing a disclosure risk profile (both absolute and relative), which depends on prior risk probabilities $p_i$ and $q_i$. However, this approach complicates the decision-making process for data owners. They either need to define the disclosure risk behavior for an exhaustive range of prior probabilities $p_i, q_i \\in [0,1]$, despite the actual population following specific (but unknown) $p_i$ and $q_i$ values, or they must estimate a reasonable range of these prior probabilities for the population (without using their own data) before determining the disclosure risk behavior within that range.\n\n- Decomposing privacy risk into multiple parts, as done in the paper, has certain flaws that have not been considered. This decomposition requires fixing a subgroup $\\mathcal{S}$ that is specific to a violation the data curator wants to effectively prevent.\n  - Firstly, deriving a DP budget based on one (or a few) choices of such subsets $\\mathcal{S}$ is not secure. This is because for every such choice, it is possible to create a pathological mechanism $T^*$ that has a relative disclosure risk of 1 but is $\\infty$-DP. Such a mechanism $T^*$ would ensure that the chosen sub-group captured by the subset $\\mathcal{S}$ has no influence on the output, but subgroups that haven't been chosen are always revealed.\n  - Secondly, for $d$ (binary) features, there are $2^d$ choices of $\\mathcal{S}$, and revealing any of them could be considered a privacy violation. It is impractical for a data curator to tailor the privacy risk profile for each of these potential privacy violations to derive the overall DP budget $\\epsilon$.\n  - Finally, the gradation expressed by first modeling the inclusion bit $I_i \\in \\\\{0,1\\\\}$ and then the sub-group disclosure bit $Y_i \\in \\mathcal{S}$ has not been explored thoroughly. By following this chain of thought, it should be possible to define a sequence of increasing specificity, going from the inclusion of a record, to the record being in a sub-population, to the record further being in a sub-sub-population, and so on. The way the $\\epsilon$-DP budget affects the prior-posterior gap as we zoom in on a specific record could be crucial and help in deciding the appropriate budget to set.\n\n- It is not clear how the risk profiles considered in Examples 1 and 2 are reasonable and how one can derive such risk profiles for complex situations. The recommendations on choosing a risk profile in lines 229-239 highlight that setting a risk profile can be tricky. A methodology to help set the DP budget should be much more straightforward, which is not evident in these cases.\n\n- The framework is proposed only for $\\epsilon$-DP. In practice, $(\\epsilon, \\delta)$-DP is the more common notion. The paper does not discuss whether and how the framework can be extended to set the $(\\epsilon, \\delta)$-DP budget.\n\n### Minor Points:\n\n- The assumptions made in the paper, although standard, are incorrectly motivated:\n  - Assumption 1, that the output distribution modeled by the adversary using $\\mathcal{M}$ matches the actual output distribution of the mechanism, is not to rule out edge-case adversaries exploiting floating point attacks or ignoring the underlying mechanism. It is standard to make Assumption 1 because, in privacy, a data curator needs to protect against the worst-case adversary who knows exactly how the mechanism $T^*$ works, even though a reasonable real-world adversary might not. The rationale is that if the privacy arguments work for such a strong adversary, they will also work for a weaker one.\n  - Assumption 2, that $Y_{-i}$ is independent of $Y_i$, is also standard, but not because assuming otherwise would make the adversary considerably stronger. If the data points are independent, but the adversary models them as dependent, the adversary would perform poorly due to the mismatched assumption. It is standard to make this assumption because differential privacy is designed to capture the effect that a single atomic unit of data has on the output distribution. If we assume that $Y_{-i}$ is dependent on $Y_i$, a single atomic unit would be the entire input dataset.\n\n- Lemma 1 is obvious: $\\epsilon$-DP with respect to the add or remove operation trivially gives $2\\epsilon$-DP with respect to the replacement operation because replacement can be simulated as an addition followed by a removal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the thoughtful comments. To frame our response, we begin with two general points. First, our method is intended for the standard definition of DP, and we presume the agency will apply a DP algorithm with the selected epsilon. Thus, the DP guarantee associated with the selected epsilon applies to all subgroups, not only the group that satisfies the particular $\\mathcal{S}$.\n\nSecond, our work is an initial paper on determining an appropriate privacy budget for a given data release; there is more to be done. Based on our review of the literature, practitioners often have difficulty understanding how to set an epsilon that provides a satisfactory balance of risk and utility (see line 20 of the text). Yet decision-makers in statistical agencies have decades of experience interpreting disclosure risk measures when establishing (legacy) confidentiality protection methods. By linking formal privacy guarantees to these concepts, we intend to provide decision-makers familiar with statistical risk measures tools to assess risk-utility trade-offs of different epsilon.\n\nWeaknesses\n- We agree that implementation details may be complex, as can be the case for engineering DP solutions in general. Whether working with risk profiles is less complicated for decision-makers than reasoning about the risk-utility trade-offs for different epsilon using some other ad hoc heuristic is a matter of opinion, which may differ by decision-maker or problem setting. Our intention is to provide a framework for additional paths to setting epsilon that can be developed further to accommodate specific implementations.\n- The privacy guarantee comes from using a DP algorithm with the selected epsilon. The $\\mathcal{S}$ (henceforth, S) is a tool for interpretation and does not affect the guarantee (other than through influencing the choice of epsilon), which applies for all individuals in the data. Of course, tuning epsilon based on a specific S and utility evaluations may result in a looser or tighter guarantee than if the agency were to consider other S or utility evaluations. This seems inevitable with any method for selecting epsilon that considers the risk-utility trade-off. For example, the Census Bureau relied on specific reconstruction attack success rates and utility metrics to decide the ultimate privacy budget (and algorithm itself) for the 2020 census products. The final product may have changed with other disclosure risk or utility evaluations. Nonetheless, the reviewer’s point suggests that the agency should include in S any secrets it deems critical to protect. This need not be every possible S—as the reviewer notes, this is impractical for any method that seeks to manage the risk and utility trade-off—but it could involve evaluations of multiple risk profiles. The question then, which we did not consider in this initial paper, is how the agency should select among them if they present different recommendations. We thank the reviewer for raising this issue and will revise the paper to point to it as future research. \n- We agree that some agencies’ risk profiles may be more complex than those in the text. Our goal is to lay out a general framework, with the expectation that researchers and practitioners could tailor implementations for their particular settings; we leave these developments to future work. That said, the literature indicates that practitioners presently do not understand how to set epsilon to ensure desirable risk-utility trade-offs. Given the lack of standards, even simple risk profiles can be helpful for managing and understanding the trade-offs. \n- See our response to reviewer HWnJ, where we discuss the extension to approximate DP.\n\nMinor Points\n- Thank you for this perspective on our assumptions. We are updating their presentation accordingly.\n\nQuestions\n- In Fig 2, to avoid privacy leakage we consider hypothetical deviations of 0.25, 0.5, 1, and 2 from the target of 6.0. See the text beginning at line 268. To make this clearer, we are adding a note to the caption.\n- The aim in selecting risk profiles of this form is to simplify the analysis. In Ex 1, the agency focuses on a class of adversaries who already know the target’s demographic information; such adversaries have $q_i = 1$. Operationally, the bound on the relative risk is set to $\\infty$ for $q_i \\neq 1$ in (16) to represent that these adversaries are outside the analysis. Ex 2 and (17) employ similar logic with a different class of adversaries. We do not suggest setting $\\epsilon = \\infty$. We are updating the text to clarify this point.\n- In Fig 1, $\\epsilon_i$ is large for small $q_i$, e.g., $\\epsilon_i = 5.4$ when $q_i = 0.01$. We truncate values >3 for readability. We are updating the caption to clarify.\n\nLimitations\n- The agency can decide which S it considers particularly sensitive, e.g., it may consider whether an individual has a disease more sensitive than their age. When multiple S are of interest, the agency has a decision problem on its hands. As with designing DP solutions in general, the agency must prioritize some of these S over others, e.g., using decision-theoretic criteria. This is an important topic for future work. We thank the reviewer for pointing it out and are updating the text to highlight this topic.\n- We take the minimum epsilon as the recommendation (see (13)). This could be a pessimistic choice although, as discussed in our response to reviewer QVWW, there still can be large gains over the baseline recommendation.\n- We envision agencies could determine risk profiles analogously to the solicitation of utility functions in decision theory, e.g., by considering a series of bets. Since our work is a first effort at defining a framework, we leave this development to future work and update the text accordingly.\n- There is no risk of blatant non-privacy since the release satisfies DP with a finite epsilon.\n- See our response to reviewer HWnJ, where we discuss the extension to approximate DP.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes an approach to setting the privacy budget $\epsilon$ in (pure) differential privacy, based on an organisation’s appetite for (Bayesian) posterior risk of disclosure for given level of prior risk of disclosure. Specifically, the approach uses a so-called ‘risk profile’ which upper bounds disclosure risk. Disclosure risk is decomposed into: identifying presence of an individual; and identifying sensitive features. A strawperson policy of a constant profile (constant bound on posterior/prior ratio) is improved by allowing adversaries with weak priors to learn more (have larger $\epsilon$) than those with strong priors.

Reviews raise concerns about: discrete vs continuous responses (authors clarify that discrete is used for ease of exposition; while it would be ideal to highlight this in the paper, I believe there should be a qualifier that due to limitations of fixed-precision floating-point, that discrete responses are preferred in practice); relatively limited improvement of utility over baseline in the body (however enabling of a doubling of $\epsilon$ in the supplement; accordingly the reviewer raised their score – reflecting the main benefit of the work not per se being interpretable $\epsilon$ but unlocking improved utility); requests for a more thorough discussion of risk profiles (the authors provide a thoughtful reflection in their response that would improve the paper if added); that the framework applies only to pure DP with extension to the much more common approximate DP not known or seemingly available (a residual concern for the work’s impact); that setting risk profiles may not actually be easier than setting a single $\epsilon$; concerns raised on the impact of decomposing privacy risk into two components, that could lead to flaws exploitable by certain pathological mechanisms (demonstrated by E851) were addressed by the authors due to the choice of mechanism’s DP guarantee holding for all subgroups $S$; and (fixable) incorrect motivations/explanations of Assumptions 1 and 2 (corrected by E851).

Setting of DP’s privacy parameters is a well-known policy challenge, with a number of proposals available in the literature. While a major drawback – of a framework intended for use by policy makers – is the complexity of the approach, the framework is nonetheless interesting. This is an important direction. The paper’s approach is contextualised in the literature, is novel, and connects to ideas of Bayesian disclosure risk from statistical disclosure control. The paper is well written, with pedagogical examples of risk profiles, scenarios, providing the reader with helpful reference points to use the approach.
Decision: Accept (poster)