# Calibrating the Attack to Sensitivity in Differentially Private Mechanisms
## 4 Adversarial Classification in Gaussian Mechanisms
### Privacy-Distortion Trade-off for Second-Order Statistics  
The idea applied here is to render the problem of adversarial classification under DP as a _lossy source-coding problem_. Instead of using the mutual information between the input and output (or the input's estimate obtained via the output), considering the adversary's conflicting goals we derive the mutual information between the datasets before and after the attack. We present the main result for Gaussian mechanism by the following theorem. **Theorem 5**. : _The privacy-distortion function for a dataset \(X^{n}\) and Gaussian mechanism as defined by (6) is_  
\[P(s)=\frac{1}{2}\log\left(f_{n}\left(1+\prod_{i}^{n}\sigma_{X_{i}}^{2}/s^{2} \right)\right), \tag{47}\]  
_for \(s\in\left[0,\prod_{i}^{n}\sigma_{X_{i}}^{2}\right]\) and zero elsewhere. \(\sigma_{X_{i}}\) denotes the standard deviation of \(X_{i}\) for \(i=1,\cdots,n\), \(f_{n}\) is some constant dependent on the size of the dataset \(n\) and \(\sigma_{X_{i}}\) is the standard deviation of the additional data._Proof. : The first expansion of \(I(X^{n};\hat{X}^{n})\) proceeds as follows  
\[I(X^{n};\hat{X}^{n})=h(X^{n})-h(X^{n}|\hat{X}^{n}) \tag{48}\] \[\geq h(X^{n})-h(q(X^{n})-\bar{X}^{n}|\bar{X}^{n})\] (49) \[=h(X^{n})-h(q(X^{n})-q(\bar{X}^{n})|\bar{X}^{n})\] (50) \[\geq h(X^{n})-h(q(X^{n})-q(\bar{X}^{n}))\] (51) \[\geq\frac{1}{2}\sum_{i=1}^{n}\log\[PERSON]{(}(2\pi\mathrm{e})\sigma_{ X_{i}}^{2}\Bigr{)}-\frac{1}{2}\log\[PERSON]{(}2\pi\mathrm{e}s^{2}\Bigr{)}\] (52) \[=\frac{1}{2}\log\[PERSON]{(}(2\pi\mathrm{e})^{n-1}\prod_{i}^{n} \sigma_{X_{i}}^{2}/s^{2}\Biggr{)} \tag{53}\]  
In (51), we apply the following property due to concavity of entropy function, \(h(g(x))\leq h(x)\) for any function \(g(. )\) and introduce the lower bound since the condition conditioning reduces entropy. In (52), we plug in Definition 5 into the second term after bounding it by Gaussian entropy. It is worth noting that the additional factor \(2\pi\mathrm{e}\) appears here as opposed to the original rate-distortion function due to the choice of the query function that aggregates the entire dataset and returns an output of size 1. **Corollary 2**. : _The second order statistics of the additional data inserted into the dataset by the adversary is upper bounded by a function of the privacy budget \((\epsilon,\delta)-\) and the statistics of the original dataset as follows_  
\[\sigma_{X_{a}}^{2}\leq\frac{1}{(2\pi\mathrm{e})^{n-1}}\Biggl{[}\frac{s^{2}}{1- s^{2}/\sigma_{X_{n}}^{2}}\Biggr{]} \tag{54}\]  
_where \(s^{2}=\frac{\sigma_{1}^{2}\epsilon^{2}}{2\log(1.25/\delta)}\) due to Definition 6 for \(n\geq 2\)._  
Proof. : For the second expansion of \(I(X^{n};\hat{X}^{n})\), we have the following considering the neighbor that includes \(X_{a}\) has now \((n+1)\) entries over \(n\) rows as \(\hat{X}^{n}=\{X_{1},X_{2},\cdots,X_{n}+X_{a}\}\). \[I(X^{n};\hat{X}^{n})=h(\tilde{X}^{n})-h(\tilde{X}^{n}|X^{n}) \tag{55}\] \[\leq\sum_{i=1}^{n}\frac{1}{2}\log(2\pi\mathrm{e})^{n}\sigma_{X_{i }}^{2}-\frac{1}{2}\log\Bigl{(}(2\pi\mathrm{e})^{n}\sigma_{X_{a}}^{2}\Bigr{)}\] (56) \[I(X^{n};\hat{X}^{n})=h(X^{n})-h(X^{n}|\hat{X}^{n}) \tag{48}\]0 (57) \[I(X^{n};\hat{X}^{n})=h(X^{n})-h(X^{n}|\hat{X}^{n}) \tag{48}\]1  
Due to the adversary's attack, in the first term of (56), we add up the variances of \((n+1)\)\(X_{i}\)'s including \(X_{a}\). Since (58) \(\geq\) (53), global sensitivity is bounded as follows in terms of the second-order statistics of the original data and those of the additional data \(X_{a}\). \[I(X^{n};\hat{X}^{n})=h(X^{n})-h(X^{n}|\hat{X}^{n}) \tag{48}\]2  
Alternatively, the lower bound on the sensitivity of the Gaussian mechanism can be used as an upper bound on \(\sigma_{X_{a}}^{2}\) to yield a threshold in terms of the additional data \(X_{a}\)'s variance as a function of the privacy budget and the original data \(X_{n}\)'s statistics to guarantee that the adversary avoids being detected. **Remark 3**.