# Refinement Orders for Quantitative Information Flow and Differential Privacy +
###### Abstract  
Quantitative Information Flow (QIF) and Differential Privacy (DP) are both concerned with the protection of sensitive information, but they are rather different approaches. In particular, QIF considers the expected probability of a successful attack, while DP (in both its standard and local versions) is a max-case measure, in the sense that it is compromised by the existence of a possible attack, regardless of its probability. Comparing systems is a fundamental task in these areas: one wishes to guarantee that replacing a system \(A\) by a system \(B\) is a safe operation that is the privacy of \(B\) is no worse than that of \(A\). In QIF, a refinement order provides strong such guarantees, while, in DP, mechanisms are typically compared w.r.t. the privacy parameter \(\varepsilon\) in their definition. In this paper, we explore a variety of refinement orders, inspired by the one of QIF, providing precise guarantees for max-case leakage. We study simple structural ways of characterising them, the relation between them, efficient methods for verifying them and their lattice properties. Moreover, we apply these orders in the task of comparing DP mechanisms, raising the question of whether the order based on \(\varepsilon\) provides strong privacy guarantees. We show that, while it is often the case for mechanisms of the same \"family\" (geometric, randomised response, etc. ), it rarely holds across different families. quantitative information flow; differential privacy; security refinement orderings +
Footnote †: _Cybersecurity and Privacy_  
domain \(\mathcal{X}\). An obfuscation mechanism \(K\) for \(\mathcal{X}\) is a probabilistic mapping from \(\mathcal{X}\) to some output domain \(\mathcal{Y}\), namely a function from \(\mathcal{X}\) to probabilistic distributions over \(\mathcal{Y}\). We will use the notation \(K_{x,y}\) to represent the probability that \(K\) on input \(x\) gives output \(y\). The mechanism \(K\) is \(\varepsilon\cdot d\)-private, where \(\varepsilon\) is a parameter representing the privacy level, if  
\[K_{x_{1},y}\leq\varepsilon^{\varepsilon\cdot d(x_{1},x_{2})}K_{x_{2},y}\qquad \text{for all }x_{1},x_{2}\in\mathcal{X},y\in\mathcal{Y} \tag{1}\]  
Standard DP is obtained from this definition by assuming \(\mathcal{X}\) to be a set of all datasets and \(d\) the Hamming distance between two datasets, seen as vectors or records (i.e., the number of positions in which the two datasets differ). Note that the more common definition of differential privacy assumes that \(x_{1},x_{2}\) are adjacent, i.e., their Hamming distance is 1, and requires \(K_{x_{1},y}\leq\varepsilon^{\varepsilon}\ K_{x_{2},y}\). It is easy to prove that the two definitions are equivalent. As for LDP, it is obtained by considering the so-called _discrete metric_ which assigns distance 0 to identical elements, and 1 otherwise. The other framework for the protection of sensitive information, quantitative information flow (QIF), focuses on the potentialities and the goals of the attacker, and the research on this area has developed rigorous foundations based on information theory [4, 5]. The idea is that a system processing some sensitive data from a random variable \(X\) and releasing some observable data as a random variable \(Y\) can be modelled as an information-theoretic channel with input \(X\) and output \(Y\). The leakage is then measured in terms of correlation between \(X\) and \(Y\). There are, however, many different ways to define such correlation, depending on the notion of adversary. In order to provide a unifying approach, [PERSON]. [6] has proposed the theory of \(g\)-leakage, in which an adversary is characterized by a functional parameter \(g\) representing its _gain_ for each possible outcomes of the attack. One issue that arises in both frameworks is how to compare systems from the point of view of their privacy guarantees.