# Calibrating the Attack to Sensitivity in Differentially Private Mechanisms
## 3 Adversarial Classification in Laplace Mechanisms
### Two-Sided Test  
As an alternative solution to the same problem of detecting the attacker through determining the shifts and changes in the location and deviation of the DP noise using a one-sided hypothesis test, a two-sided test could provide a more realistic solution where it is not possible to assume the direction of the shift induced by the adversary. Hence the hypothesis test in (7) can be conducted for determining the (possible) change in the distribution of the DP noise in both directions where the null hypothesis remains the same as \(H_{0}:Z\sim Lap(\mu_{0},s/\epsilon)\) to test against the alternative \(H_{1}:Z\sim Lap(\mu_{1},\theta s/\epsilon)\). This translates to choosing between  
\[H_{0} :\mu=\mu_{0},b=s/\epsilon \tag{34}\] \[H_{1} :\text{ at least one of the equalities does not hold} \tag{35}\]  
where \(\mu\) denotes the location parameter and \(b\) denoted the scale parameter of any Laplace distribution. The alternative hypothesis can also be stated with the parameters \(\mu=\mu_{1}\), \(b=\theta s/\epsilon\) where \(\theta\geq 1\). In this two-sided test, there are two thresholds on each side of the origin to be determined for the critical region each with a size of \(\alpha/2\). Let \(k_{1}\) and \(k_{2}\) denote the threshold greater and smaller than the origin, respectively. The next theorem presents the thresholds for detecting the attack as a function of the probability of false-alarm and the privacy budget of the differentially private mechanism as its one-sided counterpart given by Theorem 3. **Theorem 4**. : _The threshold of the best critical region of size \(\alpha\) defined in (9) for choosing between the null hypothesis and its alternative of the two-sided hypothesis testing problem in (34) and (35) for a Laplace mechanism with the largest power \(\tilde{\beta}\) is_  
\[k_{1} = \mu_{0}-(s/\epsilon)\log\alpha \tag{36}\] \[k_{2} = \mu_{0}+(s/\epsilon)\log\alpha \tag{37}\]  
_Then according to the adversary's hypothesis testing problem, the defender fails to detect the attack when the output of the Laplace mechanism \(Y_{0}\) is confined in \((q(x)+k_{2},q(x)+k_{1})\) where \(q(. )\) is the noiseless query output._  
Proof. : The null hypothesis cannot be rejected if the noisy output of the Laplace mechanism is confined in the interval \((k_{2},k_{1})\). First, we begin with the derivation of threshold for the output of the DP mechanism. The probability of raising a false-alarm or having a type I error is derived as follows. \[\alpha =\Pr[H_{0}\text{ reject}|H_{0}\text{ is true}] \tag{38}\] \[=\int_{-\infty}^{k_{2}}\frac{\epsilon}{2s}\exp\left\{\frac{ \epsilon(z-\mu_{0})}{s}\right\}dz+\int_{k_{1}}^{\infty}\frac{\epsilon}{2s} \exp\left\{-\frac{\epsilon(z-\mu_{0})}{s}\right\}dz \tag{39}\]  
Each addend of \(\alpha\) corresponds to one half of the probability of false-alarm. Equating each integral to \(\alpha/2\) and rewriting the equalities in terms of \(k_{1}\) and \(k_{2}\), we get the thresholds in (37). A Trade-off between \(\mu_{1}\), \(s\) and \(\epsilon\) for Detecting the Attacker-Two-Sided Test  
Using the threshold presented in Theorem 4, we can determine an interval to confine the mean of the attacker's advantage to be detected by the DP mechanism, i.e., for the null hypothesis \(H_{0}\) to be rejected. Alternatively, such an interval can be converted for the privacy parameter \(\epsilon\) as a function of error probabilities, the attack and the sensitivity. The following result, Corollary 1, presents upper and lower bounds on the attacker's advantage so that the defender detects the attack. There are two possible cases w.r.t. the relationship between \(\mu_{0}\) and \(\mu_{1}\). The alternative hypothesis in this two-sided test also states that these two parameters are unequal. As we have discussed earlier in the derivation of the threshold for determining the critical region in Laplace mechanisms, whether \(\mu_{0}>\mu_{1}\) or \(\mu_{1}>\mu_{0}\) directly effects the likelihood ratio function, and thus the condition to reject the null hypothesis.