# Refinement Orders for Quantitative Information Flow and Differential Privacy +
###### Abstract
If the attacker is only interested in identifying the true value among the immediate neighbors, then the geometric is better. Indeed, note that in the subdomain of the numbers between \(40\) and \(60\) the geometric mechanism also satisfies d-privacy with \(d\) being the discrete metric and \(\varepsilon=\log 2\), and in any subdomain smaller than that it satisfies the discrete metric \(d\)-privacy with \(\varepsilon<\log 2\)._  
In this respect, the QIF approach has led to an elegant theory of refinement (pre)order (In this paper, we call \(\sqsubseteq^{\text{avg}}_{\mathbb{G}}\) and the other refinement relations \"orders\", although, strictly speaking, they are preorders.) \(\sqsubseteq^{\text{avg}}_{\mathbb{G}}\), which provides strong guarantees: \(A\sqsubseteq^{\text{avg}}_{\mathbb{G}}B\) means that \(B\) is _sager than \(A\) in all circumstances_, in the sense that the _expected gain_ of an attack on \(B\) is less than on \(A\), for whatever kind of gain the attacker may be seeking. This means that we can always substitute the component \(A\) by \(B\) without compromising the security of the system. An appealing aspect of this particular refinement order is that it is characterized by a precise structural relation between the stochastic channels associated with \(A\) and \(B\)[6, 7], which makes it easy to reason about, and relatively efficient to verify. It is important to remark that this order is based on an _average_ notion of adversarial gain (_vulnerability_), defined by mediating over all possible observations and their probabilities. We call this perspective _average-case_. At the other end of the spectrum, DP, LDP and \(d\)-privacy are _max-case_ measures. In fact, by applying the [PERSON] theorem to (1), we obtain:  
\[\frac{p(x_{1}\mid y)}{p(x_{2}\mid y)}\leq e^{\varepsilon\,d(x_{1},x_{2})}\frac {\pi(x_{1})}{\pi(x_{2})}\qquad\text{for all }x_{1},x_{2}\in\mathcal{X},y\in \mathcal{Y} \tag{2}\]  
where, for \(i\in\{1,2\}\), \(\pi(x_{i})\) is the _prior_ probability of \(x_{i}\) and \(p(x_{i}\mid y)\) is the _posterior_ probability of \(x_{i}\) given \(y\). We can interpret \(\
icefrac{{\pi(x_{1})}}{{\pi(x_{2})}}\) and \(\
icefrac{{p(x_{1}|y)}}{{p(x_{2}|y)}}\) as knowledge about \(\mathcal{X}\): they represent how much more likely \(x_{1}\) is with respect to \(x_{2}\), _before_ (prior) and _after_ (posterior) observing \(y\), respectively. Thus, the property expresses a bound on how much the adversary can learn from each individual outcome of the mechanism (The property (2) is also the semantic interpretation of the guarantees of the Pufferfish framework (cf. [8], Section 3.1). The ratio \(\frac{p(x_{1}|y)}{p(x_{2}|y)}/\frac{\pi(x_{1})}{\pi(x_{2})}\) is known as _odds ratio_). Figure 1: Comparison between the geometric (**red**) and the randomized response (**blue**) mechanisms. The area between \(40\) and \(60\), delimited by the green lines, represents the sub-domain where the geometric mechanism satisfies also the discrete metric \(d\)-privacy with \(\varepsilon=\log 2\). In the literature of DP, LDP and \(d\)-privacy, mechanisms are usually compared on the basis of their \(\varepsilon\)-value (In DP and LDP \(\varepsilon\) is a parameter that usually appears explicitly in the definition of the mechanism. In \(d\)-privacy, it is an implicit scaling factor. ), which controls a bound on the log-likelihood ratio of an observation \(y\) given two \"secrets\" \(x_{1}\) and \(x_{2}\): smaller \(\varepsilon\) means more privacy. In DP and LDP, the bound is \(\varepsilon\) itself, while in \(d\)-privacy it is \(\varepsilon\times d(s_{1},s_{2})\) We remark that the relation induced by \(\varepsilon\) in \(d\)-privacy is fragile, in the sense that the definition of \(d\)-privacy assumes an underlying metric structure \(d\) on the data, and whether a mechanism \(B\) is \"better\" than \(A\) depends in general on the metric considered.