Prior-itizing Privacy: A Bayesian Approach to Setting the Privacy Budget in Differential Privacy

Authors: zeki  kazan
jerome p reiter
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-10 21:32:44

Abstract: When releasing outputs from confidential data, agencies need to balance the analytical usefulness of the released data with the obligation to protect data subjects' confidentiality. For releases satisfying differential privacy, this balance is reflected by the privacy budget, $\varepsilon$. We provide a framework for setting $\varepsilon$ based on its relationship with Bayesian posterior probabilities of disclosure. The agency responsible for the data release decides how much posterior risk it is willing to accept at various levels of prior risk, which implies a unique $\varepsilon$. Agencies can evaluate different risk profiles to determine one that leads to an acceptable trade-off in risk and utility.

Main paper: 
 introduction: 
 Differential privacy (DP) [11] is a gold standard definition of what it means for data curators, henceforth referred to as agencies, to protect individuals' confidentiality when releasing sensitive data. The confidentiality guarantee of DP is determined principally by a parameter typically referred to as the privacy budget ε. Smaller values of ε generally imply greater confidentiality protection at the cost of injecting more noise into the released data. Thus, agencies must choose ε to balance confidentiality protection with analytical usefulness. This balancing act has resulted in a wide range of values of ε in practice. For example, early advice in the field recommends ε of "0.01, 0.1, or in some cases, log (2) or log(3)" [10] , whereas recent large-scale implementations use ε = 8.6 in OnTheMap [31] , ε = 14 in Apple's use of local DP for iOS 10.1.1 [44] , and an equivalent of ε = 17.14 in the 2020 decennial census redistricting data release [1] . Some decision makers may find interpreting and selecting ε difficult [20, 24, 29, 36, 43] . For example, a recent study of practitioners using DP Creator [43] found that users wished for more explanation about how to select privacy parameters and better understanding of the effects of this choice. One potential path for providing guidance is to convert the task of selecting ε to setting bounds on the allowable probabilities of adversaries learning sensitive information from the released data, as in the classical disclosure limitation literature [8, 14, 41] . There is precedent for this approach: prior work in the literature suggests that "privacy semantics in terms of Bayesian inference can shed more light on a privacy definition than privacy semantics in terms of indistinguishable pairs of neighboring databases" [28] and prevailing advice for setting δ in (ε, δ)-DP originates from such Bayesian semantics [25] .We propose that agencies utilize relationships between DP and Bayesian semantics [2, 11, 25, 26, 27, 28, 29, 33] to select values of ε that accord with their desired confidentiality guarantees. The basic idea is as follows. First, the agency constructs a function that summarizes the maximum posterior probability of disclosure permitted for any prior probability of disclosure. For example, for a prior risk of 0.001, the agency may be comfortable with a ten-fold (or more) increase in the ratio of posterior risk to prior risk, whereas for a prior risk of 0.4, the agency may require the increase not exceed, say, 1.2. Second, for each prior risk value, the agency converts the posterior-to-prior ratio into the largest ε that still ensures the ratio is satisfied. Third, the agency selects the smallest ε among these values, using that value for the data release. Importantly, the agency does not use the confidential data in these computations-they are theoretical and data free-so that they do not use up part of the overall privacy budget. Our main contributions include:• We propose a framework for selecting ε under certain conditions (see Section 3) that applies to any DP mechanism, does not use additional privacy budget, and can account for disclosure risk from both an individual's inclusion and the sensitivity of values in the data.• We enable agencies to tune the choice of ε to achieve their desired posterior-to-prior risk profile. This can avoid setting ε unnecessarily small if, for example, the agency tolerates larger posterior-to-prior ratios for certain prior risks. In turn, this can help agencies better manage trade-offs in disclosure risk and data utility.• We give theoretic justification for the framework and derive closed-form solutions for the ε implied by several risk profiles. For more complex risk profiles, we also provide a general form for ε as a minimization problem.To streamline the discussion, we focus on the release of discrete-valued statistics computed on discrete-valued data. Extension to continuous-valued statistics and data can be accomplished by replacing sums with integrals and PMFs with PDFs throughout the theorem statements and proofs. 
background and motivation: 
 We first describe some aspects of DP and Bayesian probabilities of disclosure relevant for our approach. We summarize all notation and definitions in Tables 2 and 3 in Appendix A.1.Let P represent a population of individuals. The agency has a subset of P, which we call Y, comprising n individuals measured on d variables. For any individual i, let Y i be the length-d vector of values corresponding to individual i, and let I i = 1 when individual i is in Y and I i = 0 otherwise. For all i such that I i = 1, let Y -i be the (n -1) × d matrix of values for the n -1 individuals in Y excluding individual i. 1 The agency wishes to release some function of the data, T (Y). We assume Y and T (Y) each have discrete support but may be many-dimensional. The agency turns to DP and will release T * (Y), a noisy version of T (Y) under ε-DP.Our work focuses on unbounded DP as defined in [9] , which involves the removal or addition of one individual's information. 2 If a function T * (Y) with discrete support satisfies unbounded ε-DP, then for all i, all y in the support of Y i , all y -i in the support of Y -i , and all t * in the support of T * (Y),EQUATIONIn settings where the statistic of interest is a count, a commonly used algorithm to satisfy DP is the geometric mechanism [18] . Definition 1 (Geometric Mechanism). Let T (Y) ∈ Z be a count statistic and suppose we wish to release a noisy count T * (Y) ∈ Z satisfying ε-DP. The geometric mechanism produces a count centered at T (Y) with noise from a two-sided geometric distribution with parameter e -ε . That is,P [T * (Y) = t * | T (Y) = t] = 1 -e -ε1 + e -ε e -ε|t * -t| , t * ∈ Z.(EQUATIONUnder the geometric mechanism, the variance of T * (Y) is 2e -ε /(1 -e -ε ) 2 . The variance increases as ε decreases, reflecting the potential loss in data usefulness when setting ε to a small value.Of course, data usefulness is only one side of the coin. Agencies also need to assess the implications of the choice of ε for disclosure risks [7, 42, 43] . Prior works on setting ε focus on settings where (i) the data have yet to be collected, and the goal is to simultaneously select ε and determine how much to compensate individuals for their loss in privacy [6, 15, 23, 30] , (ii) the population is already public information, and the goal is to protect which subset of individuals is included in a release [29, 35] , or (iii) data holders can utilize representative test data or the confidential data set itself [4, 17, 20, 35] . We focus on the common setting where data already have been collected, the population they are drawn from is not public information, and no data are available for tuning ε.Consider an adversary who desires to learn about some particular individual i in Y using the release of T * (Y). We suppose that the adversary has a model, M, for making predictions about the components of Y i that they do not already know. 3 For example, the adversary could know some demographic information about individual i but not some other sensitive variable. The adversary might predict this sensitive variable from the demographic information using a model estimated with proprietary information or data from sources like administrative records. We assume that the release mechanism for T * (Y) is known to the adversary, that the DP release mechanism does not depend on M, and that, under M, the observations are independent but not necessarily identically distributed. These conditions are formalized in Section 3. For our ultimate purpose, i.e., helping agencies set ε, the exact form of the adversary's M is immaterial. In fact, as we shall discuss, we are not concerned whether the adversary's predictions from M are highly accurate or completely awful.On a technical note, we make the distinction that the agency views Y and I i as fixed quantities, since it knows which rows are in the collected data and what values are associated to each row. The adversary, however, views Y and I i as random variables, and thus probabilistic statements about these quantities are well defined from the adversary's perspective. Notationally, we signify that a probabilistic statement is from the adversary's perspective via the subscript M.Let S be the subset of the support of Y i that the agency considers a privacy violation. For example, if d = 1 and Y is income data, then S may be the set of possible incomes within 5,000 or within 5% of the true income for individual i. Alternatively, if d = 1 and Y is binary, then S is a subset of {0, 1}.The selection of S must not depend on P, as this might constitute a privacy violation.The agency may be concerned about the risk that the adversary determines individual i is in Y or the risk that the adversary makes a disclosure for individual i; that is, I i = 1 and Y i ∈ S, respectively. Assuming that the adversary's model puts nonzero probability mass on these events, we can express their relevant prior probabilities as follows.EQUATIONFor fixed p i and q i , we can measure the risk of disclosure for individual i in a number of ways.Drawing from [33] , one measure is the relative disclosure risk, r i (p i , q i , t * ). Writing the noisy statistic as T * and suppressing the dependence on Y or Y -i , this is defined as follows.Definition 2 (Relative Disclosure Risk). For fixed data Y, individual i, adversary's model M, and released T * = t * , the relative disclosure risk is the posterior-to-prior risk ratio,EQUATIONThe relative risk can be decomposed into the posterior-to-prior ratio from inclusion (I i ) and the posterior-to-prior ratio from the values (Y i ). We haveEQUATIONThe relative risk, however, does not tell the full story. As discussed in [22] , the data holder also may care about absolute disclosure risks, a i (p i , q i , t * ). Definition 3 (Absolute Disclosure Risk). For fixed data Y, individual i, adversary's model M, and released T * = t * , the absolute disclosure risk is the posterior probability,EQUATIONSince r i (p i , q i , t * ) = a i (p i , q i , t * )/(p i q i ), we can convert between these risk measures.The quantities from Section 2.2 can inform the choice of ε. For example, DP implies thatEQUATIONfor all (p i , q i , t * ). 4 The inequality in (7) implies a naive strategy for setting ε: select a desired bound on the relative risk, r * , and set ε = log(r * )/2. Practically, however, this strategy suffers from two drawbacks that could result in a smaller recommended ε than necessary. First, for any particular p i and q i , the bound in (7) need not be tight. In fact, this bound is actually quite loose across a wide range of values. Second, this strategy does not account for agencies willing to tolerate different relative risks for different prior probabilities. For example, if p i q i = 0.25, an agency may wish to limit the adversary's posterior to a i (p i , q i , t * ) ≤ 2 × 0.25 = 0.5, but for p i q i = 10 -6 , the same agency may find a limit of a i (p i , q i , t * ) ≤ 2 × 10 -6 unnecessarily restrictive.Rather than restricting to a constant bound, the agency can consider tolerable relative risks as a function of a hypothetical adversary's prior probabilities. We refer to this function as the agency's risk profile, denoted r * (p i , q i ). Thus, the agency establishes a r * (p i , q i ) so that, for all p i , q i , and t * ,EQUATIONAs the following results show, the requirement in (8) translates to a maximum value of ε. 
theoretical results: 
 In this section, we describe our main theoretical results. To devote more space to examples and applications, we describe supporting results in Appendix B.1 and provide all proofs in Appendix E.We begin by formalizing the assumptions on the release mechanism for T * and the adversary's model, M. We emphasize thatP [T * (Y) = t * | Y i = y, Y -i = y -i , I i = 1] and P [T * (Y -i ) = t * | Y -i = y -i , I i = 0]are probabilities under the actual DP mechanism used for the release of T * (Y) when i is and is not included, respectively. We use these probabilities in two assumptions as follows.Assumption 1. For all y in the support of Y i , y -i in the support of Y -i , and t * in the support of T * ,P M [T * (Y) = t * | Y i = y, Y -i = y -i , I i = 1] = P [T * (Y) = t * | Y i = y, Y -i = y -i , I i = 1] P M [T * (Y -i ) = t * | Y -i = y -i , I i = 0] = P [T * (Y -i ) = t * | Y -i = y -i , I i = 0].Assumption 1 implies that the mechanism for releasing T * given Y is known to the adversary and that the adversary uses the actual release mechanism. An adversary who uses something other than the actual release mechanism to compute probabilities is unlikely in general to find more success than the adversary who does. Hence, Assumption 1 assures that the agency's computations are principled and cover a type of "worst-case" analysis. Assumption 2. For all y in the support of Y i and y -i in the support of Y -i ,EQUATIONAssumption 2 implies that the adversary's beliefs about the distribution of Y -i do not change whether individual i is included in the data or not, nor do they depend on individual i's confidential values. This assumption is similar to one explored in [28] , who consider the case where "the presence/absence/record-value of each individual is independent of the presence/absence/recordvalues of other individuals," although we do not require that (9) holds for all i. Since DP is designed to capture the effect that a single atomic unit of data has on the output distribution, assuming this type of independence structure ensures one atomic unit is a single data point. 5 We believe these two assumptions are weaker than those in related work on choosing ε, which we discuss in Section 6.Under Assumption 1 and Assumption 2, we can relate ε to the distribution of T * unconditional on Y -i via the following lemma. This result is similar, but not identical to, Theorem 6.1 in [28] .Lemma 1. Under Assumption 1 and Assumption 2, if the release of T * = t * satisfies ε-DP, then for any subset S of the domain of Y i , we haveEQUATIONWe emphasize that Lemma 1 and all subsequent results require Assumption 2. Without it, generalizable knowledge from the release can lead to arbitrarily large relative risk, as demonstrated by examples in [25, 27] .For a given function r * selected by the data holder, we can determine the ε that should be used for the release. This is due to the following result relating the relative risk to ε. Theorem 1. Under Assumption 1 and Assumption 2, if the release of T * = t * satisfies ε-DP, thenEQUATION)One can solve for e -ε in (11) to determine the recommended ε, which is given by Theorem 2. Theorem 2. For any individual i, fix the prior probabilities, p i and q i , and a desired bound on the relative disclosure risk, r * (p i , q i ). Define ε i (p i , q i ) to be the functionEQUATIONUnder the conditions of Theorem 1, any statistic T * = t * released under ε-DP with ε ≤ ε i (p i , q i ) will satisfy r i (p i , q i , t * ) ≤ r * (p i , q i ).By Theorem 2, to achieve r i (p i , q i , t * ) ≤ r * (p i , q i ) for all (p i , q i ), the agency should set ε via the following minimization problem:EQUATIONClosed forms for the ε resulting from a few specific risk profiles are included in the appendix.4 Using Posterior-to-prior Risks for Setting εIn this section, we illustrate how an agency can use the results of Section 3 to select ε. Notationally, for a given quantity x, we use x to indicate the agency has fixed x to a particular constant.Given S, the agency must select a form for r * (p i , q i ). A default choice, equivalent to the naive strategy using (7) discussed above, is to set the bound to a constant r > 1, i.e.,EQUATIONAs we prove in Theorem 3 in the appendix, the bound in ( 14) implies the agency should set ε = log(r)/2. While a constant bound on relative risk is simple, agencies that tolerate different risk profiles may be able to set ε to larger values, as we now illustrate.Consider an agency that seeks to bound the relative risks for high prior probabilities and bound the absolute disclosure risk for low prior probabilities. For example, the agency may not want adversaries whose prior probabilities are low to use t * to increase those probabilities beyond 0.10. Simultaneously, the agency may want to ensure adversaries with prior probabilities around, for example, 0.20 cannot use t * to triple their posterior probability. Such an agency can specify a risk profile that requires either the relative risk be less than some r > 1 or the absolute risk be less than some ã < 1, as we now illustrate via the following two examples.The first example is a setting inspired by a case study in [13] .Figure 1 : Each column corresponds to a particular hypothetical agency. The first row presents the agency's risk profile and the second row presents the profile's implied maximal allowable ε at each point on the curve. Agency 1's risk profile is given by ( 15) with ã = 0.1, q = 1, and r = 3, while Agency 2's risk profile is given by ( 16) with ã = 0.1, p = 0.05, and r = 3. For Agency 2, r * and ε i are very large for small q i ; large values are truncated for readability. 1 : The ε recommended by our framework for three risk profiles of the form in (15) . Also included are the standard deviations of the noise distribution and the probabilities that the exact value is released, i.e., the mass at zero, for geometric mechanisms that satisfy the corresponding ε-DP.Example 1. A healthcare provider possesses a data set comprising demographic information about individuals diagnosed with a particular form of cancer in a region of interest. They plan to release the count of individuals diagnosed with this form of cancer in various demographic groups via the geometric mechanism, but are concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. They wish to choose ε appropriately.In this example, the primary concern is with respect to inclusion in the data set. That is, for a given individual i, the adversary's prior probability p i is the key quantity, whereas the q i is not as important for any given S. The agency can fix some q ∈ (0, 1], for example q = 1 to focus on adversaries who already know individual i's demographic information. To simplify the analysis, we set the risk profile to ∞ for adversaries with q ̸ = 1, which indicates these adversaries are not considered. A reasonable risk profile for this agency then might be of the form, for some r > 1 and ãEQUATION)An example visualization of this risk function is presented in the first column of Figure 1 . The upper plot displays the risk profile as a function of p i when q i = q, and the lower plot displays the maximal ε for which the relative risk bound holds for each p i . We can derive a closed form for ε under this risk profile; see Table 4 in Appendix A.2 for a summary and Theorem 5 in Appendix B.1 for details.Suppose the agency is generally willing to accept a maximum absolute disclosure risk of ã = 0.25 for adversaries with small prior probabilities. Table 1 presents the maximal ε which satisfies the desired risk profile for three such agencies. Agency A is risk averse, agency C is utility seeking, and agency B sits in between in terms of risk and utility. For adversaries with high prior probabilities, agencies A, B, and C bound the relative disclosure risk at r = 1.5, r = 3, and r = 6, respectively. Figure 3 in Appendix C.1 plots the forms of each agency's risk profile. To provide intuition on the amount of noise implied by these ε, in Table 1 we display the standard deviation of the noise distribution for each statistic under the geometric mechanism and the probability that the geometric mechanism will output the exact value of each statistic. The risk averse agency is recommended an ε that results in a release with a high standard deviation and fairly low probability of releasing the exact value of the statistic. The utility seeking agency is recommended an ε that results in a release with a fairly low standard deviation and high probability of releasing the exact value of the statistic.The recommendations from these risk profiles, which are tailored to the setting and agency preferences, are higher than the recommendations from a corresponding simple risk profile of r * (p i , q i ) = r for all prior probabilities. This simple profile yields ε ≈ 0.20, ε ≈ 0.55, and ε ≈ 0.90 for r = 1.5, r = 3, and r = 6, respectively, less than half the corresponding ε values in Table 1 .We now consider a second example, inspired by Example 16 in [45] , that alters Example 1.Example 2. A survey is performed on a sample of individuals in the region of interest. 5% of the region is surveyed, and respondents are asked whether they have this particular form of cancer along with a series of demographic questions. The agency plans to release the counts of surveyed individuals who have and do not have the cancer in various demographic groups via the geometric mechanism, but is concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. The agency wishes to choose ε appropriately.In this example, the primary concern is with respect to the values in the data set. For ease of notation, let Y i be a d-vector of binary values, and let the first element, Y 1i , be an indicator for whether individual i has this form of cancer. Set S to be the subset of the support of Y i for which individual i has the cancer, i.e., S = {y ∈ {0, 1} d : y 1 = 1}. For individual i, the adversary's q i is the key quantity, and their p i is not of interest. The agency can fix some p ∈ (0, 1]; for example, if the agency is most concerned about adversaries whose only prior knowledge is that individual i is in the population, but not whether they were surveyed, they might set p = 0.05. Alternatively, they might set p = 1 to imply an adversary that knows a priori that individual i is included in Y. A reasonable risk profile for this agency might be of the form, for some ã < 1 and r > 1,7 EQUATIONAn example visualization of this risk function is presented in the second column of Figure 1 . The upper plot displays the risk profile as a function of q i when p i = p, and the lower plot displays the maximal ε for which the relative risk bound holds for each p i . The agency can select the smallest ε on this curve for their release. We can derive a closed form the minimum; see Table 4 in Appendix A.2 for a summary and Theorem 4 in Appendix B.1 for details. Notably, it can be shown that the ε selected under these two profiles is bounded below by log(r)/2 and may be much larger. We provide further exploration and visualizations for this example in Appendix C.2.As demonstrated by these examples, the gap between the baseline strategy of ( 14) and our recommendation can be large. To further illustrate, suppose an agency has a simple, "point" risk profile, where r * (0.5, 1) = r ′ for r ′ < 2 (and ∞ elsewhere). The baseline recommends ε = log (r ′ ) /2 < 0.35, while the recommendation from Theorem 2 can be shown to have the form ε = log (r ′ / (2 -r ′ )), which diverges as r ′ → 2. Thus, the gap between the recommendations can be arbitrarily large. While this likely does not represent a realistic disclosure risk profile of a real-world agency, it is instructive. In general, the baseline's recommendation is smaller because it is enforcing a relative risk of r ′ for adversaries with small priors. If r ′ < 2, then an adversary with prior probability p i q i = 0.001 is restricted to a posterior probability at most 0.002, leading to a small ε recommendation. If adversaries with small priors are ignored or allowed to have large relative risks, the recommendation from our method will outperform the baseline, and possibly by a substantial amount.A particular agency's risk profile may not be characterized by one of the forms described above. For example, an agency may be equally concerned about p i and q i , rather than focusing on one; see Appendix C.3 for an example of this setting. Or, as argued in [32] , in some settings, agencies might be most concerned about the difference between the posterior and prior probabilities (rather than their ratio). 8 In such settings, it is straightforward to write down the corresponding risk function, r * (p i , q i ), and the optimal ε can be determined by numerically solving the minimization problem in (13). 9 Regardless of the agency's desiderata for a risk profile, we recommend that they keep the following in mind when setting its functional form. First, for any region where r * (p i , q i ) > 1/(p i q i ), the risk profile generates a bound on the posterior probability that exceeds 1. Of course, the posterior probabilities themselves cannot exceed 1; thus, in these regions, the risk profile effectively does not bound the posterior risk. For example, an agency that sets r * (p i , 1) = 3 in the region where p i ≥ 1/3 (as in the left column of Figure 1 ) implicitly is willing to accept an unbounded ε for prior probabilities p i ≥ 1/3. Second, when bounding the absolute disclosure risk below some ã in some region of (p i , q i ), the agency should require p i q i < ã in that region. When p i q i = ã, the recommended ε = 0 since the data holder requires T * to offer no information about Y i . This also suggests that an agency bounding absolute disclosure risk in a region of (p i , q i ) that sets ã close to some value of p i q i in the region is willing to accept only small ε values. 
managing the trade-off in privacy and utility: 
 Agencies can use the framework to manage trade-offs in disclosure risk and data utility. In particular, the agency can evaluate potential impacts of the DP algorithm using data quality metrics under different risk profiles, choosing an ε that leads to a satisfactory trade-off. We demonstrate this in the below example, using data on infant mortality in Durham county, N.C. We note that these data may not require the use of DP in reality, but they do allow us to illustrate the process with public data. Example 3. Suppose that an agency in Durham county, N.C., wishes to release a differentially private version of the number of infant deaths the county experienced in the year 2020. The agency plans to use the geometric mechanism to release this value. Of particular interest is whether the county infant death rate meets the U. S. Department of Health and Human Services' Healthy People 2020 target of 6.0 or fewer deaths per 1,000 live births [21] . The agency wishes to minimize the probability that they release a noisy count that changes whether or not the 6.0 target is met; their goal is to ensure this probability is below 10%. It is public information that there were 4,012 live births in Durham county in 2020 [38] .The primary concern in Example 3 is with respect to inclusion in the data. Thus, the agency focuses on adversaries with q i = 1 and varying p i . The agency is generally willing to incur large relative risks if p i is small and small relative risks if p i is large. Furthermore, due to possible policy ramifications of appearing not to meet the target rate, the agency is open to accepting greater privacy risks for greater accuracy in the released count, within reason as determined by agency decision makers.The agency's privacy experts determine that they can characterize the agency's risk profiles reasonably well using the following general class of risk profiles.EQUATIONTo allow for consideration of the effects on accuracy of different specifications of ( 17), the agency considers combinations of r ∈ {1.2, 2, 5} and ã ∈ {0.1, 0.25, 0.5}. They also examine ã = 0, which corresponds to a constant risk profile r * (p i , q i ) = r. The agency could consider other combinations of parameters or risk profiles classes should these not lead to a satisfactory trade-off in risk and utility.Figure 2 summarizes an analysis of the risk/utility trade-offs. For all r, the recommended ε is larger when ã > 0 than under the corresponding constant risk profile. Similar increases in ε also are evident for the risk profiles of Section 4; see Appendix C. Naturally, increases in r and ã decrease the RMSEs 10 of the noisy counts due to larger ε. The switching probabilities in the top panel do not use 8 Requiring the difference between the posterior and prior probabilities to be bounded by some b ∈ (0, 1) is equivalent to requiring the relative risk be bounded by (piqi + b)/(piqi). See Appendix B.2 for details. 9 We provide R code at https://github.com/zekicankazan/choosing_dp_epsilon to determine the recommended ε for a provided risk profile. This code was used to determine closed forms for ε for the additional risk profiles described in Appendix B.2. The example in Appendix C.3 demonstrates the use of this code. 10 Since T * is unbiased for the true count, the RMSE is the standard deviation of the noise distribution. the true count of infant deaths; rather, they consider hypothetical deviations of 0.25, 0.5, 1, and 2 in the true rate from the target rate of 6.0. In this way, the agency avoids additional privacy leakage. The probability differs substantially for each of the four deviations, with the deviation of 0.25 leading to the largest probability of a switch. To ensure the probability is below 10% for the deviation of 0.25, the agency would need to use the most aggressive of the risk profiles, which allows absolute disclosure risk of ã = 0.5 or relative disclosure risk of r = 5. This leads to ε ≈ 2.20 with RMSE ≈ 0.53. If they are willing to allow the probability to exceed 10% or to place priority on deviations exceeding 0.25, the agency could select a less aggressive risk profile that yields a smaller ε.In actuality, there were 6.2 infant deaths per 1,000 live births in Durham County in 2020 [37] . As the truth is close to the 6.0 target, the agency would need to use a large ε to achieve their goal. 
relationship to prior work: 
 The most similar work we are aware of is Lee and Clifton [29] 's "How Much is Enough? Choosing ε for Differential Privacy," which also uses a Bayesian approach to set ε. The authors focus on settings where the population is public information and the adversary's goal is to determine which subset of individuals in the population was used for a differentially private release of a statistic. Their method for selecting ε is tailored to the setting where only disclosure of an individual's inclusion in the data is of concern and the values of the entire population can be used to inform the choice of ε. [29] focuses on the setting where the Laplace mechanism is used and the population size is known; their proposal was extended to any DP mechanism by [24, 39] and settings where the population size is unknown by [34] . In Appendix D.1, we compare the recommended ε from the proposal in [29] and our framework in several examples. We find that the approach of [29] , for particular statistics and populations, can recommend a larger ε than the one resulting from our approach. However, our framework may be used in settings where the values of the entire population are not public and settings where the privacy of the values in the release is of primary concern.Another series of related work involves using Bayesian semantics to communicate the meaning of ε to potential study participants. For an overview of recent work in this area, see [16] , [36] , and citations therein. We highlight an example in [45] (corrected in [46] ), which considers an individual deciding whether or not to participate in a survey for which results will be released via DP with a particular ε. The authors suggest that the individual consider a bound on a posterior-to-posterior ratio similar to the bound in (11) to make an informed decision about whether to participate in the survey. We describe the advice of [45] using our notation in Appendix D.2. While their and our bounds have similar expressions, the goal in [45] differs from ours. They use the bound to characterize the individual's disclosure risks for a fixed ε, whereas we establish the agency's disclosure risk profile in order to set ε.There are a number of other works that examine Bayesian semantics of ε-DP, which we now briefly summarize. In their seminal work proposing DP, [11] showed that, under some conditions, bounded DP is equivalent to a bound on the relative risk when all but one data point is fixed. [25] showed that bounded DP implies a bound on the total variation distance between the posterior distribution with all data points included and the posterior distribution with one data point removed. [28] showed that both bounded and unbounded DP are equivalent to a bound on the posterior-to-prior odds ratio exactly when the presence/absence/record-value of each individual is independent of that of other individuals. Finally, [27] showed that both bounded and unbounded DP imply bounds on the ratio of the posterior distribution with all data points included to the posterior with one observation replaced with a draw from the posterior with their observation removed. These works do not discuss how these semantic characterizations of DP can be used to select ε. 
commentary: 
 In this article, we propose a framework for selecting ε for DP by establishing disclosure risk profiles. Essentially, we provide a method for agencies to trade the problem of selecting ε for a release for the problem of specifying their desired disclosure risk profile. This process involves focusing on particular classes of adversaries the agency is most concerned about-represented by the set S-and tuning ε to ensure the risk from these adversaries is sufficiently low. We emphasize that, once applied, DP will protect against all attacks with the guarantee of DP, not just the attack used to tune ε.We primarily focus on the risk from one class of adversary attacks on one individual, assuming all individuals are exchangeable. If agencies assign different risk profiles for different classes of adversaries, they could repeat the analysis for each class For example, the agency might assign different risk profiles to adversaries targeting different characteristics, e.g., they may consider whether an individual has a disease more sensitive than their age. Similarly, if an agency does not treat individuals in the data as exchangeable-for example, if an agency seeks to ensure lesser disclosure risks for groups with some characteristics than for not-necessarily-disjoint groups without those characteristics -the agency could repeat this analysis for each group. In both of these settings, the agency has a decision problem on its hands. As with designing DP solutions in general, the agency must prioritize some risks over others, e.g., using decision-theoretic criteria. This is an important topic for future work and raises ethical questions regarding how assigning different risk profiles for individuals with different characteristics could affect data equity.One avenue for future work involves incorporating a version of this framework into differentially private data analysis tools. Recently developed interfaces for DP data releases such as [24] and [35] use the framework of [29] to guide users in setting ε. Our framework could be similarly incorporated to provide guidance in settings that do not satisfy the assumption of [29] that the values of the population are public. Another avenue for future work involves examining how an agency can set the risk profile appropriate for a particular release. We envision agencies could do so analogously to the elicitation of utility functions in decision theory, e.g., by considering a series of bets [40] .Other future extensions involve examining whether similar results follow under weaker assumptions. This includes settings with multiple differentially private releases via existing results that relate the relative risk to DP composition theorems (e.g., S5 of [26] ). This also includes extension to variants of DP-such as zero-concentrated DP [5] or approximate DP [12] -by deriving Bayesian semantics analogous to Theorem 1 or leveraging existing results [25, 27] . Additionally, it may be possible to extend the results in this article from posterior-to-prior risks to the sorts of posterior-to-posterior risks discussed in Section 6.A.1 Notation Summary q i P M [Y i ∈ S | I i = 1] Prior probability values disclosed r i (p i , q i , t * ) P M [Yi∈S,Ii=1|T * =t * ] P M [Yi∈S,Ii=1] Relative disclosure risk a i (p i , q i , t * ) P M [Y i ∈ S, I i = 1 | T * = t * ] Absolute disclosure risklog(r) 0 < q ≤ ã r 1 2 log ã(1-q)q(1-ã) (15) 0 < q ≤ 1 r+1 and ã r < q < 1 1 2 log 1-q 1 r -q max ã pi q , r 1 r+1 < q < 1 and ã r < q < 1 log EQUATIONIn this section, we present all results omitted from the paper. Proofs of these results are included in Appendix E.First, we state a corollary to Theorem 1, which generalizes Theorem 1.3 in [19] to sets where |S| > 1 and to unbounded DP. Corollary 1. Under the conditions of Theorem 1, for all p i , q i ∈ (0, 1] and all t * , r i (p i , q i , t * ) ≤ e 2ε .(EQUATIONNext, we state a corollary to Theorem 2 which considers the special case where p i = 1. This corresponds to a setting where individual i's inclusion in the data is known a priori by the adversary, for example data from a census or public social media platform. Corollary 2. Under the conditions of Theorem 2, if p i = 1 and 0 < q i < 1, any statisticEQUATIONwill satisfy r i (1, q i , t * ) ≤ r * (1, q i ).For particular forms of r * , the optimization in ( 13) has a closed form solution. This is detailed by the following theorems, which are preceded by two lemmas used in the proofs. Lemma 2. Fix p i , q i ∈ (0, 1) and let r * (p i , q i ) = ã piqi . Then the functionEQUATIONhas partial derivatives such that 1. ∂ε(pi,qi) ∂pi < 0 for all 0 < p i < 1 and 0 < q i < 12. ∂ε(pi,qi) ∂qi < 0 for all 0 < p i < 1 and 0 < q i < 1.Lemma 3. Fix p i , q i ∈ (0, 1) and let r * (p i , q i ) = r. Then the functionEQUATIONhas partial derivatives such that 1. ∂ε(pi,qi) ∂pi < 0 if 0 < q i < 1 r+1 and 0 < p i < 12. ∂ε(pi,qi) ∂pi = 0 if q i = 1 r+1 and 0 < p i < 13. ∂ε(pi,qi) ∂pi > 0 if 1 r+1 < q i < 1 and 0 < p i < 14. ∂ε(pi,qi) ∂qi > 0 for all 0 < p i < 1 and 0 < q i < 1.Theorem 3. Under the conditions of Theorem 2, if r * (p i , q i ) = r > 1, the solution to the minimization problem in ( 13) isEQUATION)Theorem 4. Under the conditions of Theorem 2, let ã < 1, p ≤ 1, and r > 1, and 0 < q i < 1. If the function r * is such that r * (p, q i ) = max{ã/(pq i ), r} and r * (p i , q i ) = ∞ if p i ̸ = p, then the solution to the minimization problem in ( 13) isEQUATIONTheorem 5. Under the conditions of Theorem 2, let ã < 1, q ≤ 1, and r > 1, and 0 < p i < 1. If the function r * is such that r * (p i , q) = max{ã/(p i q), r} and r * (p i , q i ) = ∞ for q i ̸ = q, then the solution to the minimization problem in ( 13) isε =                  1 2 log ã(1-q) q(1-ã) , if 0 < q ≤ ã r ; 1 2 log 1-q 1 r -q , if 0 < q ≤ 1 r+1 and ã r < q < 1; log 2ã(1-q) √ (r q-ã) 2 +4ãq(1-q)(1-ã)-(r q-ã), if 1 r+1 < q < 1 and ã r < q < 1;EQUATIONIn this section, we present closed form results for the ε implied by additional disclosure risk profiles not discussed in the main text. Proofs of these results are not provided, although we note that proofs would have a structure similar to the proofs of Theorems 3-5. It is straightforward to verify these results empirically.First, consider an agency that requires a constant relative risk bound to hold on a subset of the (p i , q i ) space and does not have any bounds outside that space. That is, rather than enforcing r * (p i , q i ) = r for all 0 ≤ p i , q i ≤ 1, the agency only enforces this condition for p0 ≤ p i ≤ p1 and q0 ≤ q i ≤ q1 , where 0 ≤ p0 ≤ p1 ≤ 1 and 0 ≤ q0 ≤ q1 ≤ 1 (for p1 , q1 > 0). Formally,EQUATIONThe recommended ε for an agency with the risk profile in ( 25) isEQUATIONNext, consider an agency that desires a constant bound on the difference between the posterior and the prior. That is, for some b ∈ (0, 1), they would like to enforceEQUATIONThis constraint corresponds to the following risk profile. r * (p i , q i ) = p i q i + bEQUATION)The recommended ε for an agency with this risk profile isEQUATIONNotably, by a Taylor series approximation, -log(1 -b) ≈ b + b2 /2. Thus, for small b, it follows that the recommended ε can be approximated byEQUATION)Figure 3 : The risk profiles for three agencies with risk profile given by (31) . The lines in the lower panels represent the risk profiles for q i = 1 as a function of p i , and the colors represent the implied ε at each point on the curve. The lines in the upper panels represent the corresponding baseline r * (p i , 1) = r. The left plots set r = 1.5, the center plots set r = 3, and the right plots set r = 6.This section provides additional examples of risk profiles.Here we provide an additional figure for Example 1. The setting is restated below. Example 1. A healthcare provider possesses a data set comprising demographic information about individuals diagnosed with a particular form of cancer in a region of interest. They plan to release the count of individuals diagnosed with this form of cancer in various demographic groups via the geometric mechanism, but are concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. They wish to choose ε appropriately.As discussed in Section 4, a reasonable risk profile for this setting might focus on p i and set q i = 1.If we additionally suppose the agency is generally willing to accept a maximum absolute disclosure risk of 0.25 for adversaries with small prior probabilities. A risk profile for this agency might be of the form, for some r > 1,EQUATIONThe three example risk functions considered in Section 4 are presented in Figure 3 . Agency A is risk averse, agency C is utility seeking, and agency B sits in between in terms of risk and utility. For adversaries with high prior probabilities, agencies A, B, and C bound the relative disclosure risk at r = 1.5, r = 3, and r = 6, respectively.Here we provide an extended analysis of Example 2. The setting is restated below.Figure 4 : The risk profiles for three agencies with risk profile given by (32) . The lines represent the risk profiles for p i = 0.05 as a function of q i , and the colors represent the implied ε at each point on the curve. The left plot sets ã = 0.025, the center sets ã = 0.15, and the right sets ã = 0. 5 : For each of the three risk profiles in Figure 4 , we present the ε recommended by our framework. For a release satisfying ε-DP using the geometric mechanism, we present the corresponding standard deviation of the noise distribution and the probability that the exact value is released (i.e., the noise distribution's probability mass at zero).Example 2. A survey is performed on a sample of individuals in the region of interest. 5% of the region is surveyed, and respondents are asked whether they have this particular form of cancer along with a series of demographic questions. The agency plans to release the counts of surveyed individuals who have and do not have the cancer in various demographic groups via the geometric mechanism, but is concerned this release, if insufficient noise is added, could reveal which individuals in the community have cancer. The agency wishes to choose ε appropriately.As discussed in Section 4, a reasonable risk profile for this setting might set S = {y ∈ {0, 1} d : y 1 = 1} and focus on q i , while fixing p i = 0.05. Additionally, suppose the agency is generally willing to accept a maximum relative disclosure risk of 3 for adversaries with large prior probabilities. A reasonable risk profile for this agency might be of the form, for some ã < 1,EQUATIONThree example risk functions of this form are presented in Figure 4 . Once again, agency A is risk averse, agency C is utility seeking, and agency B sits in between on risk and utility. Agencies A, B, and C are willing to allow adversaries to achieve an absolute disclosure risk of ã = 0.025, ã = 0.15, and ã = 0.3, respectively. Table 5 presents the ε recommendations for each agency along with the standard deviation of the noise and probability of releasing the exact value of each statistic under the geometric mechanism.As in Table 1 , the ε recommendations reflect trade offs between privacy and accuracy. They also are much higher than the recommendations from a corresponding simple risk profile of r * (p i , q i ) = 3 for all prior probabilities, which implies ε ≈ 0.55. Even the most risk averse agency is recommended an ε that is much larger than this baseline risk profile. This gain is primarily due to the assumptions that the survey is a simple random sample from the population, and the adversary has no prior knowledge about which individuals are surveyed. Essentially, the additional uncertainty from the sampling mechanism allows for an ε recommendation with less noise injected. This is consistent with prior work showing that DP mechanisms applied to random subsamples provide better privacy guarantees [3] . The recommended ε will increase as the proportion of individuals from the population surveyed Figure 5 : The top panel presents the r * (p i , q i ) from ( 33) as a function of p i and q i . The bottom panel presents the implied ε i (p i , q i ) as a function of p i and q i . The red point represents argmin (pi,qi) ε i (p i , q i ). For clarity of presentation, all r * (p i , q i ) > 100 are truncated to 100 and all ε i (p i , q i ) > 4 are truncated to 4.(p) decreases. For example, for the risk function in (32) with ã = 0.025 and r = 3, if p = 0.005, we recommend ε ≈ 1.63; if p = 0.0005, we recommend ε ≈ 3.94.The examples in Appendices C.1 and C.2 focus on settings where only one of p i and q i is important and the other can be reasonably fixed to a constant. Now we consider the setting where both may be simultaneously important. For example, in Example 2, the agency may wish to consider adversaries with various p i , rather than only p = 0.05. Perhaps the agency wishes to limit the absolute disclosure to be below ã = 0.25 when total prior probability of disclosure, p i q i , is low and limit relative disclosure to be below r = 3 when p i q i is high. This corresponds to the following risk profile.r * (p i , q i ) = max ã p i q i , r = max 0.25EQUATIONA plot of this desired bound on pairs (p i , q i ) on the space (0, 1] × (0, 1] is presented in the top panel of Figure 5 . Notably, if p i is fixed at p ∈ (0, 1], a plot of r * (p, q i ) as a function of q i has a form similar to the plots of Figure 4 . Similarly, if q i is fixed at q ∈ (0, 1], a plot of r * (p i , q) as a function of p i has a form similar to the plots of Figure 3 .To determine the ε recommended by this profile, we numerically solve the minimization problem in (13) . A plot of ε i (p i , q i ) as a function of pairs (p i , q i ) on the space (0, 1] × (0, 1] is presented in the bottom panel of Figure 5 . Our framework recommends ε ≈ 0.65, which corresponds to p i = 1 and q i = 0.083 = ã/r.In this section, we describe two previous works with similar aims to our framework using the notation in Section 2.2, expanding on the discussion in Section 6.D.1 "How Much is Enough? Choosing ε for Differential Privacy"[29] focus on settings where the population, P, of size n is public information and the adversary's goal is to determine which subset of individuals in P was used for a differentially private release of a statistic. We can characterize their setting with the notation of Section 2.2 as follows. We define Y to be the subset of individuals' values in P used to compute the statistic of interest, T (Y), and its released DP counterpart, T * (Y).In their examples, the authors focus on the setting where only one individual is removed from P to create Y, and the adversary's goal is to determine which i was removed.We can apply our framework to this setting with a minor modification. For this comparison, we assume the adversary's q i = P M [Y i ∈ S | I i = 0] = 1 for any set S (although we note that this is a weaker assumption than that of Lee and Clifton, since we do not assume P is public). We redefine p i and the risk measures to be in terms of I i = 0, rather than I i = 1.EQUATIONEQUATIONEQUATION[29] focus on the case of p i = 1/n, and seek to enforce the bound a i (1/n, 1, t * ) ≤ ã for some constant ã and all t * , which implies the relative risk boundEQUATIONFrom an analogy to Theorem 2 with the redefined p i , it follows that under these conditions, our method setsEQUATIONIn the motivating example from their paper, the authors set n = 4 and ã = 1/3, giving r * (1/n, 1) = 4/3. This results in ε = log(3/2) ≈ 0.41 from our method. When the release mechanism is the addition of Laplace noise, [29] 's method arrives at a similar form, but with the recommendation scaled by a factor of ∆T /∆v.EQUATIONEQUATIONThe recommendation of [29] 's method thus depends on both the population and the particular release function. This results in different ε values for the same n and ã, as low as 0.34 and as high as 1.62 in the authors' examples, depending on the statistic of interest and the values in the data.The example in [45] considers an individual deciding whether or not to participate in a survey for which results will be released via DP with a particular ε. Using our notation, letZ i = f (Y i , I i ) ∈{0, 1} be a quantity of interest to the adversary, who wishes to learn whether Z i = 1. They have some prior q i = P M [Z i = 1] . Rather than considering the relative or absolute disclosure risk, the individual is interested in comparing the adversary's posterior probability if they participate in the survey, a 1i (q i , t* ) = P M [Z i = 1 | I i = 1, T * = t * ],to the adversary's posterior probability if they do not participate, a 0i (q i , t* ) = P M [Z i = 1 | I i = 0, T * = t * ].The authors of [45] state that for all q i and all t * ,EQUATION)This expression is in the same spirit as the results from our framework with p i = 1. By Theorem 1, we haveEQUATION)The authors of [45] suggest that the individual considering survey participation use (42) to bound a 1i for various values of a 0i . The individual can examine these bounds to make an informed decision about whether to participate in the survey.Theorem 2. For any individual i, fix the prior probabilities, p i and q i , and a desired bound on the relative disclosure risk, r * (p i , q i ). Define ε i (p i , q i ) to be the function.EQUATIONUnder the conditions of Theorem 1, any statistic T * = t * released under ε-DP with ε ≤ ε i (p i , q i ) will satisfy r i (p i , q i , t * ) ≤ r * (p i , q i ).Proof. We begin with the simpler case where q i = 1. By Theorem 1,EQUATION) Since ε ≤ log ((1 -p i )/(1/r * (p i , 1) -p i )), it follows that e -ε ≥ (1/r * (p i , 1)-p i )/(1-p i ).Thus, as desired,EQUATIONNow consider the case where 0 < q i < 1. By Theorem 1,EQUATIONSinceEQUATIONit follows thatEQUATIONTaking the square givese -2ε ≥ 4p i (1 -q i ) 1 r * (pi,qi) -p i q i + 2(1 -p i ) 2 4p 2 i (1 -q i ) 2 - 2(1 -p i ) (1 -p i ) 2 + 4p i (1 -q i ) 1 r * (pi,qi) -p i q i 4p 2 i (1 -q i ) 2 (73) = 1 r * (pi,qi) -p i q i p i (1 -q i ) + (1 -p i ) 2 -(1 -p i ) (1 -p i ) 2 + 4p i (1 -q i ) 1 r * (pi,qi) -p i q i 2p 2 i (1 -q i ) 2.(74) Thus,EQUATIONEQUATIONIt is then immediate thatEQUATIONCorollary 1. Under the conditions of Theorem 1, for all p i , q i ∈ (0, 1] and all t * ,EQUATIONProof. First note that since, 0 ≤ e -ε ≤ 1, it follows that e -2ε ≤ e -ε . Then, applying the result of Theorem 1,EQUATIONCombining terms and using the fact that q i p i ≥ 0 givesEQUATION)Corollary 2. Under the conditions of Theorem 2, if p i = 1 and 0 < q i < 1, then any statisticEQUATIONwill satisfy r i (1, q i , t * ) ≤ r * (1, q i ).Proof. Plugging p i = 1 into the expression from Theorem 2 yieldsEQUATIONEQUATION)Lemma 2. Fix p i , q i ∈ (0, 1) and let r * (p i , q i ) = ã/(p i q i ). Then the functionEQUATIONhas partial derivatives such that 1. ∂ε(pi,qi) ∂pi < 0 for all 0 < p i < 1 and 0 < q i < 12. ∂ε(pi,qi) ∂qi < 0 for all 0 < p i < 1 and 0 < q i < 1.Proof. To begin, we re-express the function of interest in the formEQUATIONWe first examine ∂ε(p i , q i )/∂p i . Taking the partial derivative with respect to q i gives ∂ε(p i , q i )EQUATIONEQUATIONCertainly, the denominator of (94) is positive. Thus, ∂ε(p i , q i )/∂p i < 0, as desired.We now examine ∂ε(p i , q i )/∂q i . Taking the partial derivative with respect to q i gives ∂ε(p i , q i ) ∂qEQUATION= -EQUATION)Consider the three parts of (97). Since ã < 1, we have that in the denominator of the numerator,(1 -p i ) 2 + 4p 2 i q i (1 -q i ) 1 ã -1 > 0.The denominator is also positive, since (1 -q i ) > 0 andEQUATIONThis leaves the numerator of the numerator of (97). Let us denote this expression as g(q i ). If g(q i ) > 0, then it follows that ∂ε(p i , q i )/∂q i < 0. To show this, we begin by simplifying the expression for g(q i ):EQUATIONTaking the derivative of g, we find thatEQUATION)For 0 < q i ≤ 1/2, 1 -2q i ≥ 0 and so ∂g(q i )/∂q i < 0. For 1/2 < q i < 1, since 2q i -1 < 1 andEQUATIONThus, g(q i ) strictly decreasing as a function of q i on 0 < q i < 1. SinceEQUATIONit follows that g(q i ) > 0 for 0 < q i < 1 and so ∂ε(p i , q i )/∂q i < 0 in this range. Lemma 3. Fix p i , q i ∈ (0, 1) and let r * (p i , q i ) = r < 1/(p i q i ). Then the functionEQUATIONhas partial derivatives such that 1. ∂ε(pi,qi) ∂pi < 0 if 0 < q i < 1 r+1 and 0 < p i < 12. ∂ε(pi,qi) ∂pi = 0 if q i = 1 r+1 and 0 < p i < 13. ∂ε(pi,qi) ∂pi > 0 if 1 r+1 < q i < 1 and 0 < p i < 1 qi r 4. ∂ε(pi,qi) ∂qi > 0 if 0 < p i < 1 and 0 < q i < 1 pi r .Proof. To begin, we re-express the function of interest in the formEQUATION)We now examine ∂ε(p i , q i )/∂p i . Taking the partial derivative of with respect to p i and simplifying givesEQUATION= 1 p i - -2(1-pi)+4(1-qi)( 1 r -piqi)-4pi(1-qi)qi+2 (1-pi) 2 +4pi(1-qi)( 1 r -piqi) 2 (1-pi) 2 +4pi(1-qi)( 1 r -piqi) (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i -(1 -p i ) (111) = (1-pi) 2 +4pi(1-qi)( 1 r -piqi)-(1-pi) (1-pi) 2 +4pi(1-qi)( 1 r -piqi) (1-pi) 2 +4pi(1-qi)( 1 r -piqi) p i (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i -(1 -p i ) + pi(1-pi)-2pi(1-qi)( 1 r -piqi)+2p 2 i (1-qi)qi-pi (1-pi) 2 +4pi(1-qi)( 1 r -piqi) (1-pi) 2 +4pi(1-qi)( 1 r -piqi) p i (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i -(1 -p i ) (112) = (1-pi) 2 +4pi(1-qi)( 1 r -piqi)+pi(1-pi)-2pi(1-qi)( 1 r -piqi)+2p 2 i (1-qi)qi-(1-pi) 2 +4pi(1-qi)( 1 r -piqi) (1-pi) 2 +4pi(1-qi)( 1 r -piqi) p i (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i -(1 -p i ) (113) = 2p i (1 -q i ) 1 r + (1 -p i ) -(1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i p i (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i -(1 -p i ) (1 -p i ) 2 + 4p i (1 -q i ) 1 r -p i q i .(114) We can rearrange the expression in (114) to the following form.EQUATION)The denominator of (115) is certainly always positive, so the sign of ∂ε(p i , q i )/∂p i is determined by the sign of the numerator. To determine the sign, we will use the following equality.EQUATIONTo demonstrate that (116) holds, note the following.EQUATIONEQUATIONEQUATIONRearranging (121) gives (116). Now note that, from (116), if q i = 1/(r + 1), thenEQUATIONIt follows that the ratio in the numerator of (115) equals 1 and thus ∂ε(p i , q i )/∂p i = 0. If 0 < q i < 1 r+1 , then the term 4p 2 i (1 -q i )(r 2 -1)/r 2 (q i -1/(r + 1)) < 0 and soEQUATIONIt follows that the ratio in the numerator of (115) is less than 1 and thus ∂ε(p i , q i )/∂p i < 0. If 1 r+1 < q i < 1, then the term 4p 2 i (1 -q i )(r 2 -1)/r 2 (q i -1/(r + 1)) > 0 and soEQUATIONIt follows that the ratio in the numerator of (115) is greater than 1 and thus ∂ε(p i , q i )/∂p i > 0.We now examine ∂ε(p i , q i )/∂q i . Taking the partial derivative of with respect to q i gives ∂ε(p i , q i ) ∂qEQUATIONConsider the three parts of (127). Since r < 1/(p i q i ), it follows that (1/r -p i q i ) > 0. Thus, in the denominator of the numerator, (1-p i ) 2 + 4p i (1 -q i ) (1/r -p i q i ) > 0.The denominator is also positive, since (1 -q i ) > 0 andEQUATIONThis leaves the numerator of the numerator of (127). Let us denote this expression as g(q i ). If g(q i ) < 0, then it follows that ∂ε(p i , q i )/∂q i > 0. To show this, we begin by simplifying the expression for g(q i ):EQUATIONTaking the derivative of g, we find thatEQUATIONNote that since r < 1 piqi , it follows that 1 r -p i q i > 0 and p i (1 -q i ) > p i -1 r . Thus,EQUATION> 0.(137) Thus, g(q i ) is strictly increasing for r < 1/(p i q i ). Note that in terms of q i , this is equivalent to the range 0 < q i < 1/(p i r). SinceEQUATIONit follows that g(q i ) < 0 for 0 < q i < 1/(p i r). Thus, as desired, ∂ε(p i , q i )/∂q i > 0 in this range.Theorem 3. Under the conditions of Theorem 2, if r * (p i , q i ) = r > 1, the solution to the minimization problem in ( 13) isEQUATIONProof. We define ε(p i , q i ) as follows.EQUATIONThe solution to the minimization problem in (13) corresponds to the minimum of ε(p i , q i ) over (0, 1] × (0, 1]. Lemma 3 implies that ∂ε(p i , q i )/∂q i ̸ = 0 for any 0 < q i < 1. This means that this function must take its minimum value around its boundary, i.e., when p i = 1, q i = 1, p i → 0, or q i → 0. We examine each of these in turn.We begin with the boundary where p i = 1. By Corollary 2, for 0 < q i < 1,EQUATION)We take the partial derivative of this function with respect to q i . ∂ε(1, q i )EQUATION)Since 1/r < 1, it follows that ∂ε(1, q i )/∂q i > 0 for all 0 < q i < 1. Thus, the minimum occurs as q i → 0 and isEQUATIONWe next examine with the boundary where qEQUATION)We take the partial derivative of this function with respect to p i . ∂ε(p i , 1)EQUATIONSince 1/r < 1, it follows that ∂ε(p i , 1)/∂p i > 0 for all 0 < p i < 1. Thus, the minimum occurs as p i → 0 and is limEQUATIONWe next examine the boundary where p i → 0. Since the logarithm is a continuous function, for all 0 < q i < 1,EQUATIONUsing L'Hôpital's Rule,EQUATIONFinally, we examine the boundary where q i → 0. For all 0EQUATIONWe take the partial derivative with respect to p i . From (115) in the proof of Lemma 3, we have thatEQUATIONBy (116) with q i = 0, the ratio in the numerator of ( 156) is less than 1 and so ∂/∂p i (lim qi→0 ε(p i , q i )) is negative for all 0 < p i ≤ 1. Thus, the minimum occurs at p i = 1 and is as in (145). The global minimum of ε(p i , q i ) is thus 1/2 log(r).Theorem 4. Under the conditions of Theorem 2, let ã < 1, p ≤ 1, and r > 1, and 0 < q i ≤ 1. If the function r * is such that r * (p, q i ) = max{ã/(pq i ), r} and r * (p i , q i ) = ∞ if p i ̸ = p, then the solution to the minimization problem in ( 13) is , if ã r < p ≤ 1.(157)Proof. We define ε(q i ) as follows.EQUATIONThe solution to the minimization problem in (13) corresponds to the minimum of ε(q i ) over (0, 1].We begin with the case where 0 < p ≤ ã/r. In this setting, we have that r ≤ ã/p ≤ ã/(pq i ), so r * (p, q i ) = ã/(pq i ) for all q i . By Lemma 2, ε(q i ) is a decreasing function of q i , so the minimum occurs at q i = 1 and isEQUATION)We now consider the case where ã/r < p ≤ 1. Note that r ≥ ã/(pq i ) whenever q i ≥ ã/(pr). Since in this setting ã/(pr) < 1, the risk bound can be written in piece-wise form r * (p, q i ) = ã pqi , if 0 < q i < ã pr ; r, if ã pr ≤ q i < 1.(160)Note that if q i ≥ 1/(r p), then r ≥ 1/(pq i ). Thus, r * (p, q i ) ≥ r ≥ 1/(pq i ) and so(1 -p) 2 + 4p(1 -q i ) 1 r * (p, q i ) -pq i -(1 -p)EQUATION= (1 -p) 2 -(1 -p) (162) = 0.(163) Thus, ε(q i ) = ∞ for any q i ≥ 1/(r p). We may thus restrict our attention to q i < min{1, 1/(r p)}.Since r * (p, q i ) is a continuous function of q i and ε(q i ) is a continuous function of r * (p, q i ), it follows that ε(q i ) is a continuous function of q i . By Lemma 2, ε(q i ) is a decreasing function of q i for 0 < q i < ã/(pr) and by Lemma 3, ε(q i ) is an increasing function of q i for ã/(pr) < q i < min{1, 1/(r p)}. Thus, the minimum must occur at q i = ã/(pr) and is When 1/(r + 1) < q < 1, by Lemma 3, ε(p i ) is an increasing function of p i for ã/(qr) < p i < min{1, 1/(r q)}. Thus, the minimum must occur at p i = ã/(qr) and isEQUATION= log 2ã(1 -q) (qr -ã) 2 + 4ãq(1 -q) (1 -ã) -(qr -ã) .Finally, when q = 1 for ã/(qr) < p i < min{1, 1/(r q)},EQUATION)It was shown in (147) that ε(p i ) is an increasing function of p i for ã/r < p i < min{1, 1/r}. The minimum then must occur at p i = ã/r and isEQUATION• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.For all i such that Ii = 0 we let Y-i be an (n -1) × d matrix of individuals not including individual i.This is in contrast to bounded DP[11], which involves the change of one individual's information.To be technically precise, we suppose the adversary assigns zero probability to predictions of Yi with values of components that they know to be incorrect.This is proved in[19] under bounded DP in the case where |S| = 1. We show in Corollary 1 in the appendix that, under our assumptions, it holds for larger sets and for unbounded DP (with ε replaced by 2ε).We thank a referee for highlighting this rationale for Assumption 2.The second equality in(15) assumes q > ã/r. If q ≤ ã/r, then r * (pi, q) = ã/(pi q) for all 0 < pi ≤ 1.The second equality in(16) assumes p > ã/r. If p ≤ ã/r, then r * (p, qi) = ã/(pqi) for all 0 < qi ≤ 1. 
 
 Appendix:  


Decision: This paper proposes an approach to setting the privacy budget $\epsilon$ in (pure) differential privacy, based on an organisation’s appetite for (Bayesian) posterior risk of disclosure for given level of prior risk of disclosure. Specifically, the approach uses a so-called ‘risk profile’ which upper bounds disclosure risk. Disclosure risk is decomposed into: identifying presence of an individual; and identifying sensitive features. A strawperson policy of a constant profile (constant bound on posterior/prior ratio) is improved by allowing adversaries with weak priors to learn more (have larger $\epsilon$) than those with strong priors.

Reviews raise concerns about: discrete vs continuous responses (authors clarify that discrete is used for ease of exposition; while it would be ideal to highlight this in the paper, I believe there should be a qualifier that due to limitations of fixed-precision floating-point, that discrete responses are preferred in practice); relatively limited improvement of utility over baseline in the body (however enabling of a doubling of $\epsilon$ in the supplement; accordingly the reviewer raised their score – reflecting the main benefit of the work not per se being interpretable $\epsilon$ but unlocking improved utility); requests for a more thorough discussion of risk profiles (the authors provide a thoughtful reflection in their response that would improve the paper if added); that the framework applies only to pure DP with extension to the much more common approximate DP not known or seemingly available (a residual concern for the work’s impact); that setting risk profiles may not actually be easier than setting a single $\epsilon$; concerns raised on the impact of decomposing privacy risk into two components, that could lead to flaws exploitable by certain pathological mechanisms (demonstrated by E851) were addressed by the authors due to the choice of mechanism’s DP guarantee holding for all subgroups $S$; and (fixable) incorrect motivations/explanations of Assumptions 1 and 2 (corrected by E851).

Setting of DP’s privacy parameters is a well-known policy challenge, with a number of proposals available in the literature. While a major drawback – of a framework intended for use by policy makers – is the complexity of the approach, the framework is nonetheless interesting. This is an important direction. The paper’s approach is contextualised in the literature, is novel, and connects to ideas of Bayesian disclosure risk from statistical disclosure control. The paper is well written, with pedagogical examples of risk profiles, scenarios, providing the reader with helpful reference points to use the approach.

Reviews: review: paper_summary: paper_summary: The paper proposes a novel framework for setting an appropriate privacy budget via controlling Bayesian posterior probabilities of disclosure. The connection is established through the risk profile, an upper bound on disclosure risk involving privacy parameters. Theoretical justification and empirical evaluation are also provided to support this framework.
strength_weakness: strength_weakness: * The framework is designed for releasing discrete statistics, and it is unclear whether it can be extended to release continuous statistics.
questions: questions: Can the framework proposed in this paper be extended to handle cases where $T(Y)$ has continuous support?
limitations: limitations: The authors address this part in the limitations section of the checklist.
paper_summary: paper_summary: This paper proposes a novel method for selecting epsilon that comes with a natural adversarial interpretation. They characterize an adversary’s auxiliary knowledge by two prior probabilities: the prior belief that an individual participated in the dataset, and the prior belief that an individual’s record has some characteristic. Based on these two parameters, an institution can choose a “risk profile”, that maps an adversary’s prior knowledge to their allowable increased posterior knowledge after viewing the DP output. The authors propose a mapping from risk profile to maximum allowable epsilon. 

A major insight is that risk profiles which allow adversaries with weak priors to learn more than those with strong priors allow for larger epsilon values than a constant profile would allow (constant bound on posterior/prior ratio). 

The authors go on to provide instructive examples of risk profiles that different institutions may want, and the resulting epsilon bounds. They include an analytic experiment based on Durham infant mortality rate data.
strength_weakness: strength_weakness: The two main weaknesses that I noticed revolve around baseline clarity: 
Little is offered in the main paper to show improvements over the naive baseline ($\epsilon = \log(r)/2$). I noticed a note on this after Figure 2, but felt it should be highlighted more. The improvement in utility over the baseline $\tilde{a} = 0$ is nonzero, but not enormous. The question is whether that improvement warrants the increased complexity of understanding the $\tilde{a} > 0$ regime (i.e. the complexity of choosing a non-constant risk curve).  
A more thorough exploration of risk profiles and the above baseline. Take a risk profile with minimum $r’$. Set its baseline to the constant risk profile with value $r’$. Can we say anything about the difference between their epsilons? Are there settings where this gap is very large? If so, are these settings realistic? 

I apologize if I missed the above addressed in the paper, but to me this is the most critical question at hand. If we can’t make statements about this gap, then we don’t know how much we can gain over the baseline.
questions: questions: See weaknesses section.
limitations: limitations: The paper identifies its assumptions early on. I think the major limitation is the relatively small boost in epsilon value (and therefore utility) for the risk curves demonstrated.
paper_summary: paper_summary: This paper proposes a bayesian framework for determining the DP budget \eps. In particular, the authors develop a mathematical technique based on how much posterior risk the agencies are willing to accept given some prior risk and the \eps obtained through their formulation is unique.
strength_weakness: strength_weakness: This paper only discusses the setting of \eps in the context of pure DP. It does not discuss whether these techniques could be extended to weaker notions of DP such as approx DP. Since in most real world applications agencies use approx DP notions I feel like this is an important discussion point that is currently missing.
questions: questions: How do your methods extend to weaker notions of DP? (see comment in weaknesses)
limitations: limitations: See weaknesses comment.
paper_summary: paper_summary: For data owners, determining the appropriate privacy level based on the standard interpretation of differential privacy—which limits the likelihood of distinguishability from an adversary's perspective—can be challenging. This paper addresses operational interpretations of (pure) differential privacy by examining the worst-case multiplicative and additive gap between the prior and posterior probabilities of distinguishability when observing the DP mechanism's output. These gaps are defined in terms of relative and absolute disclosure risk. The paper breaks down disclosure risk into two components: a) identifying the presence of an individual's data, and b) identifying certain sensitive features of an individual whose data is present. By contextualizing these two types of disclosure risks, the paper suggests that data owners should create prior-to-posterior risk profiles that reflect their acceptable levels of privacy risk. These risk profiles can then be translated into a pure DP budget by solving an optimization problem or, for a single risk profile, using the provided closed-form solution. The paper includes examples of reasonable risk profiles for specific data-disclosure scenarios and outlines the DP budget required under different prior probabilities of distinguishability by an adversary.
strength_weakness: strength_weakness: - The paper suggests shifting the focus from fixing the budget constant $\epsilon$ to fixing a disclosure risk profile (both absolute and relative), which depends on prior risk probabilities $p_i$ and $q_i$. However, this approach complicates the decision-making process for data owners. They either need to define the disclosure risk behavior for an exhaustive range of prior probabilities $p_i, q_i \in [0,1]$, despite the actual population following specific (but unknown) $p_i$ and $q_i$ values, or they must estimate a reasonable range of these prior probabilities for the population (without using their own data) before determining the disclosure risk behavior within that range.

- Decomposing privacy risk into multiple parts, as done in the paper, has certain flaws that have not been considered. This decomposition requires fixing a subgroup $\mathcal{S}$ that is specific to a violation the data curator wants to effectively prevent.
  - Firstly, deriving a DP budget based on one (or a few) choices of such subsets $\mathcal{S}$ is not secure. This is because for every such choice, it is possible to create a pathological mechanism $T^*$ that has a relative disclosure risk of 1 but is $\infty$-DP. Such a mechanism $T^*$ would ensure that the chosen sub-group captured by the subset $\mathcal{S}$ has no influence on the output, but subgroups that haven't been chosen are always revealed.
  - Secondly, for $d$ (binary) features, there are $2^d$ choices of $\mathcal{S}$, and revealing any of them could be considered a privacy violation. It is impractical for a data curator to tailor the privacy risk profile for each of these potential privacy violations to derive the overall DP budget $\epsilon$.
  - Finally, the gradation expressed by first modeling the inclusion bit $I_i \in \\{0,1\\}$ and then the sub-group disclosure bit $Y_i \in \mathcal{S}$ has not been explored thoroughly. By following this chain of thought, it should be possible to define a sequence of increasing specificity, going from the inclusion of a record, to the record being in a sub-population, to the record further being in a sub-sub-population, and so on. The way the $\epsilon$-DP budget affects the prior-posterior gap as we zoom in on a specific record could be crucial and help in deciding the appropriate budget to set.

- It is not clear how the risk profiles considered in Examples 1 and 2 are reasonable and how one can derive such risk profiles for complex situations. The recommendations on choosing a risk profile in lines 229-239 highlight that setting a risk profile can be tricky. A methodology to help set the DP budget should be much more straightforward, which is not evident in these cases.

- The framework is proposed only for $\epsilon$-DP. In practice, $(\epsilon, \delta)$-DP is the more common notion. The paper does not discuss whether and how the framework can be extended to set the $(\epsilon, \delta)$-DP budget.

### Minor Points:

- The assumptions made in the paper, although standard, are incorrectly motivated:
  - Assumption 1, that the output distribution modeled by the adversary using $\mathcal{M}$ matches the actual output distribution of the mechanism, is not to rule out edge-case adversaries exploiting floating point attacks or ignoring the underlying mechanism. It is standard to make Assumption 1 because, in privacy, a data curator needs to protect against the worst-case adversary who knows exactly how the mechanism $T^*$ works, even though a reasonable real-world adversary might not. The rationale is that if the privacy arguments work for such a strong adversary, they will also work for a weaker one.
  - Assumption 2, that $Y_{-i}$ is independent of $Y_i$, is also standard, but not because assuming otherwise would make the adversary considerably stronger. If the data points are independent, but the adversary models them as dependent, the adversary would perform poorly due to the mismatched assumption. It is standard to make this assumption because differential privacy is designed to capture the effect that a single atomic unit of data has on the output distribution. If we assume that $Y_{-i}$ is dependent on $Y_i$, a single atomic unit would be the entire input dataset.

- Lemma 1 is obvious: $\epsilon$-DP with respect to the add or remove operation trivially gives $2\epsilon$-DP with respect to the replacement operation because replacement can be simulated as an addition followed by a removal.
questions: questions: Following are some questions that would help me understand the presented examples better:

- In Figure 2, deviation of what quantity is being compared? 

- When does it make sense to set the relative disclosure risk to $\infty$ as done in equation (16) and (17)?

- In Figure 1, what are the values of $\epsilon_i$ when $q_i \leq 0.1$ where $p_i = 0.05$? The plots in this range seem to be truncated.
limitations: limitations: The paper has several limitations regarding applicability of the techniques which haven't been discussed. I suggest the authors to shed some light on the following limitations:

- How to choose the disclosure subsets $\mathcal{S}$ without knowing what a potential adversary might be interested in inferring?
- How to decide the appropriate $\epsilon$ from the disclosure risk profile as plotted in Figure 1? For certain choices of $p_i, q_i$, the values of $\epsilon$ could be excessively lax. On the other hand, if we choose the smallest $\epsilon$ pessimistically, the value might be very close (or identical) to the trivial solution equation (7)
- What are the guidelines that may help a data owner in deciding an appropriate disclosure risk-profile that caters to their specific setting?
- What is a fail-safe disclosure-risk profile that should be included with the other risk profiles to ensure that blatant non-privacy never happens?
- Can the framework be extended to $(\epsilon, \delta)$-DP?

Comments: title: Official comment by reviewer XDrZ
comment: We appreciate your willingness to raise your score and your helpful comments on our work.  As you suggest, we will prominently emphasize the increase in $\varepsilon$ from our method generally and, in particular, clarify the gains in $\varepsilon$ from Table 4 as we update the main text.  We also appreciate your suggestion of further analysis of when/why risk profiles admit increased $\varepsilon$.  This is something we plan to investigate as part of our future work in developing this framework.  Thank you for the research topic suggestion and the fruitful conversation.
Thank you for addressing my concerns. I've revised my score from 4 to 6. 

I want to emphasize that *the* value of adopting this methodology is the promise of an increased DP epsilon, and thereby improved utility. With the authors agreeing to update the discussion of the examples in the main text to highlight improvement over the baseline, I have decided to raise my score. 

The above comment on the possibility of arbitrary improvement over the baseline is interesting. A more complete analysis on when semantically meaningful profiles make arbitrary (or large) improvements on epsilon would encourage me to improve my score further. 

I missed the fact that Table 4 (implicitly) shows a 2x improvement of epsilon, which does feel significant. However, the fact that the table shows $\tilde{r}$ from which I need to derive the baseline (naive) $\epsilon = \log(\tilde{r})/2$ to see the improvement needs to be fixed. The fact that this most central point -- improvement of epsilon over the naive bound -- can only be numerically derived from a table deep in the appendix (page 25) is poor presentation that I hope the authors will improve in the main paper. 

Thank you again for the above clarified points
Thank you for taking the time to read and respond to our rebuttal.

We appreciate your comment that setting epsilon in this (or any) principled way can be complex. We imagine you might concur that the whole process of implementing formal privacy solutions in genuine contexts is a highly complex endeavor. 

That said, the literature on setting epsilon in DP in a formal manner is underdeveloped. Despite its importance, there are many settings where we are aware of no existing method for this task (prior to our work). We are optimistic that our approach offers a framework that can be further developed to provide options for addressing this gap in the literature. 

Thank you again for your detailed feedback throughout the review process. We appreciate the time you devoted to our work.
I appreciate the responses and I agree that we need interpretations of DP that allows setting the parameters appropriately. 

> Yet decision-makers in statistical agencies have decades of experience interpreting disclosure risk measures when establishing (legacy) confidentiality protection methods. 

Decision-makers rely on academics for deciding on the risk measurement and appropriate budget to set in my experience. There is rarely a clear consensus on risk measurements despite the decades of involvement in such decisions. 

While the framework proposed is a nascent attempt at solving a complex problem, the complexity of the approach in general is a considerable drawback.
Thank you for answering my question. I will keep my positive score.