# Privacy-Preserving Monotonicity of Differential Privacy Mechanisms
## 8 Discussion  
We have presented the definition of privacy-preserving monotonicity of differential privacy to formulate the trade-off between privacy and utility. Our theoretical and experimental results show that several existing differential privacy mechanisms can ensure privacy-preserving monotonicity. In the following discussion, we discuss the method of seeking trade-off under semi-honest model and analyze unilateral trade-off under rational model. We have verified privacy-preserving monotonicity of differential privacy mechanisms. To provide a guideline on solving trade-off, we discuss the method of differential privacy under the semi-honest model. We denote the privacy metric and the utility metric by using \(PM_{\varepsilon}\) and \(UIM_{\varepsilon}\) under privacy budget \(\varepsilon\), respectively. In Figure 2, since differential privacy mechanisms ensure privacy-preserving monotonicity, the specific privacy metric \(PM_{\varepsilon_{0}}\) and utility metric \(UIM_{\varepsilon_{0}}\) have one-to-one relationship to privacy budget \(\varepsilon_{0}\). Thus, data curator can ensure the trade-off between data privacy and data utility under the semi-honest model. The procedure is as follows. * Data curator evaluates privacy metrics \(PM_{\varepsilon_{0}}\) under different privacy budget \(\varepsilon_{0}\) for a differential privacy mechanism. * Since data analyst is semi-honest, data curator chooses desirable privacy budget \(\varepsilon_{0}\) according to the corresponding privacy metric \(PM_{\varepsilon_{0}}\). * Data curator adding noise to the queries results using differential privacy mechanism under desirable privacy budget \(\varepsilon_{0}\). From the above steps, a differential privacy mechanism can achieve the trade-off between privacy and utility under semi-honest model. Therefore, privacy-preserving monotonicity of formulating trade-off is beneficial to data curator under semi-honest model. However, we see the data are completely not available under a tiny privacy budget for data analyst. Data curator benefits to protect data privacy, but data analyst has no choice on the data utility. Thus, trade-off of a differential privacy mechanism may lead to utility disaster of engineering implementation under semi-honest model. Thus, we need to consider the rational model. Next, we discuss whether the trade-off between privacy and utility exits under rational model. Rational data curator and rational data analyst hope to the maximum privacy-preserving level and the maximum data utility, respectively. However, the protection strategies of data curator and the analysis strategies of data analyst are mutually restrictive in non-interactive model or interactive model. Considering rational data curator and rational data analyst, both of them hope to get expected privacy-preserving and expected data utility. Thus, based on the privacy-preserving monotonicity of differential privacy mechanism, data curator can achieve expected privacy preservation, but this may lead to utility disaster. Similarly, data analyst can achieve expected data utility by negotiation with data curator, but this may lead to privacy leakage of data curator. Data curator and data analyst can only achieve unilateral trade-off under rational model. Therefore, the trade-off between privacy of data curator and utility of data analyst cannot be achieved under the rational model. Privacy-preserving monotonicity shows the trade-off between privacy and utility under the semi-honest model. However, unilateral trade-off would create a unilateral benefit of the data curator or data analyst under rational model. As a result, unilateral trade-off boosts (or degrades) privacy-preserving of data curator and reduces (or improves) data utility of data analyst. Therefore, it is needed to modify differential privacy with multilateral negotiation, which can achieve expected privacy-preserving and expected data utility of differential privacy under rational model.