# Calibrating the Attack to Sensitivity in Differentially Private Mechanisms
## 3 Adversarial Classification in Laplace Mechanisms
### One-Sided Test  
We will investigate both cases of setting the alternative hypothesis \(H_{1}\) as either \(\mu_{1}>\mu_{0}\) (i.e., \(\Delta\mu>0\)) or \(\mu_{1}<\mu_{0}\) (i.e., \(\Delta\mu<0\)). This corresponds to a one-sided hypothesis testing problem. The decision of choosing between the hypotheses in (7) boils down to deciding between \(Y_{0}-\sum_{i=1}^{n}X_{i}=Z\sim Lap(z;\mu_{0},s/e)\) and \(Y_{0}-[\sum_{i=1}^{n}X_{i}+X_{a}]=Z\sim Lap(z;\mu_{1},\theta(s/e))\) where \(\theta\geq 1\) as the measure of the change in the privacy budget of the system whereas \(s\) and \(\epsilon\) denote the sensitivity and privacy parameter, respectively. It should be noted that setting \(\theta=1\) translates the hypothesis test in (7) into testing only the location parameter of the Laplacian DP noise. Our goal is to derive a relationship between the privacy parameter, the significance level (or the probability of false alarm), type II error probability (or the probability of mis-detection) for the attacker to be successful, i.e., to fail to reject \(H_{0}\), as a function of the bias \(\Delta\mu\). The corresponding likelihood ratio to (7) is given by  
\[\Lambda=\frac{\mathcal{L}(p_{1}(\mu_{1},b_{1});z)}{\mathcal{L}(p_{0}(\mu_{0},b _{0});z)}\underset{H_{1}}{\overset{H_  
where \(\kappa\) is some positive number to be determined and \((\mu_{i},b_{i})\) for \(i=0,1\) represent the location and scale parameters of the distributions to be tested. The next theorem states our first main result which presents a threshold of correctly detecting the adversary for a given level of privacy budget, sensitivity and type I error probability. The threshold of the best critical region of size \(\alpha\) defined in (9) for deciding between the null hypothesis and its alternative of the one-sided hypothesis testing problem in (7) for a Laplace mechanism with the largest power \(\tilde{\beta}\) is given as a function of the probability of false alarm \(\alpha\), privacy parameter \(\epsilon\) and global sensitivity \(s\) as follows  
\[k= \begin{cases}\mu_{0}+\frac{\epsilon}{\epsilon}\ln(2(1-\alpha))&\text{if } \alpha\in[0,0.5]\\ \mu_{0}-\frac{\epsilon}{\epsilon}\ln(2\alpha)&\text{if }\alpha\in[0.5,1]\end{cases}  \tag{12}\]  
Then according to the adversary's hypothesis testing problem, the defender detects the attack for \(\Delta\mu>0\) if the output of the Laplace mechanism \(Y_{0}\) exceeds \((k+q(x))\) where \(q(. )\) is the noiseless query output. Similarly, for \(\Delta\mu<0\), the attack is detected if \(Y_{0}<q(x)+k\). The decision rule given by Theorem 3 is equivalent to comparing the Laplace noise to the threshold \(k\) as it will be shown by the following proof. For positive bias, the critical region becomes \((k,\infty)\) thus, \(z\underset{\tilde{H}_{1}}{\lessgtr}k\). By analogy if \(\Delta\mu<0\), the critical region for the Laplace noise becomes \((-\infty,k)\). According to the Neyman-Pearson theorem [18], each point where \(\Lambda\geq\kappa\) composes the best critical region of size \(\alpha\) as defined in (9) for this simple hypothesis testing problem. Using the ratio in (11), we will determine the threshold \(k\) as a function of the best critical region, the power of the test, the privacy budget and lastly, the attack. We expand \(\Lambda\) as follows. \[\Lambda =\frac{\frac{1}{\theta}\exp\left\{\frac{\epsilon}{\theta s}(z(1- \theta)+\theta\mu_{0}-\mu_{1})\right\}}{\frac{1}{\theta}\exp\left\{-\frac{ \epsilon}{\theta s}(z(1-\theta)+\theta\mu_{0}-\mu_{1})\right\}} \tag{13}\] \[=\frac{1}{\theta}\exp\left\{\frac{\epsilon|z-\mu_{0}|}{s}-\frac{ \epsilon|z-\mu_{1}|}{\theta s}\right\} \tag{14}\]  
The likelihood ratio in (13) can be summarized by the following piecewise function based on the possible relationships between \(\mu_{1}\) and \(z\) due to the absolute value in the exponent of the probability distribution for \(\mu_{1}<\mu_{0}\). \[\Lambda_{I}=