G AUSSIAN D IFFERENTIAL P RIVACY T RANSFORMATION : FROM IDENTIFICATION TO APPLICATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Gaussian differential privacy (GDP) is a single-parameter family of privacy notions that provides coherent guarantees to avoid the exposure of individuals from machine learning models.
Relative to traditional ( (cid:15), δ ) -differential privacy (DP)
GDP is more interpretable and tightens the bounds given by standard DP composition theorems.
In this paper we start with an exact privacy proﬁle characterization of ( (cid:15) δ ) -DP and then deﬁne an efﬁcient tractable, and visualizable tool called the
Gaussian differential privacy transformation (GDPT).
With theoretical property of the GDPT
, we develop an easy-to-verify criterion to characterize and identify
GDP algorithms
Based on our criterion an algorithm is GDP if and only if an asymptotic condition on its privacy proﬁle is met.
By development of numerical properties of the GDPT we give a method to narrow down possible values of an optimal privacy measurement µ with an arbitrarily small and quantiﬁable margin of error
As applications of our newly developed tools, we revisit some established ( (cid:15), δ )
DP algorithms and ﬁnd that their utility can be improved
We additionally make a comparison between two single-parameter families of privacy notions, (cid:15) -
DP and µ
GDP
Lastly, we use the
GDPT to examine the effect of subsampling under the
GDP framework
I NTRODUCTION
Recent years have seen explosive growth in the research and application of data-driven machine learning.
While data fuels advancement in this unprecedented age of “big data”, concern for individual privacy has deepened with the continued mining, transportation, and exchange of this new resource.
While expressions of privacy concerns can be traced back as early as 1969 (Miller, 1969), the concept of privacy is often perceived as “vague and difﬁcult to get into a right perspective” (Shils, 1966).
Through its alluring convenience and promise of societal prosperity, the use of aggregated data has long outstripped the capabilities of privacy protection measures.
Indeed, early privacy protection protocols relied on the ad hoc enforcement of anonymization and offered little to no protection against the exposure of individual data, as evidenced by the AOL search log and
Netﬂix Challenge dataset controversies (Narayanan & Shmatikov, 2006; 2008; Barbaro & T. Zeller, 2006).
Differential privacy (DP) ﬁrst gained traction as it met the urgent need for rigour and quantiﬁability in privacy protection (Dwork et al., 2006).
In short, DP bounds the change in the distribution of outputs of a query made on a dataset under an alteration of one data point.
The following deﬁnition formalizes this notion.
Deﬁnition 1.1 (Dwork et al., 2006)
A randomized algorithm A , taking a dataset consisting of individuals as its input, is ( (cid:15), δ ) -differentially private if, for any pair of datasets S and S (cid:48) that differ in the record of a single individual and any event E ,
[Equation]
When δ = 0 , A is called (cid:15) -differentially private ( (cid:15) -DP).
While the notion of ( (cid:15), δ ) -DP has wide applications (Dankar & El Emam, 2012; Erlingsson et al., 2014; Cormode et al., 2018; Hassan et al., 2019), there are a few notable drawbacks to this framework.
One is the poor interpretability of ( (cid:15), δ ) -DP: unlike other concepts in machine learning, DP should not remain a black box.
Privacy guarantees are intended for human interpretation and so must be understandable by the users it affects and by regulatory entities.
A second drawback is ( (cid:15), δ ) -DP’s inferior composition properties and lack of versatility.
Here, “composition” refers to the ability for
DP properties to be inherited when DP algorithms are combined and used as building blocks.
As an example, the training of deep learning models involves gradient evaluations and weight updates: each of these steps can be treated as a building block.
It is natural to expect that a DP learning algorithm can be built using differentially-private versions of these components.
However, the DP composition properties cannot generally be well characterized within the framework of ( (cid:15), δ ) -DP, leading to very loose composition theorems.
To overcome the drawbacks of ( (cid:15), δ ) -DP, numerous variants have been developed, including the hypothesis-testing-based f -DP (Wasserman & Zhou, 2010; Dong et al., 2019), the momentsaccountant-based R´enyi DP (Mironov, 2017), as well as concentrated DP and its variants (Bun & Steinke, 2016; Bun et al., 2018).
Despite their very different perspectives, all of these DP variants can be fully characterized by an inﬁnite union of ( (cid:15), δ ) -DP guarantees.
In particular, there is a two-way embedding between f -DP and the inﬁnite union of ( (cid:15), δ ) -DP guarantees: any guarantee provided by an inﬁnite union of ( (cid:15), δ ) -DP can be fully characterized by f -DP and vice visa (Dong et al., 2019).
Consequently, f -DP has the versatility to treat all of the above notions as special cases.
In addition to its versatility, f -DP is more interpretable than other DP paradigms because it considers privacy protection from an attacker’s perspective.
Under f -DP, an attacker is challenged with the hypothesis-testing problem
H 0 : the underlying dataset is S versus
H 1 : the underlying dataset is S (cid:48) and given an output of an algorithm A , where S and S (cid:48) are neighbouring datasets.
The harder this testing problem is, the less privacy leakage
A has.
To see this, consider the dilemma that the attacker is facing.
The attacker must reject either H 0 or H 1 based on the given output of A : this means the attacker must select a subset R 0 of Range( A ) and reject H
if the sampled output is in R 0 (or must otherwise reject H 1 ).
The attacker is more likely to incorrectly reject H
(in a type I error)
when
R 0 is large.
Conversely, if R 0 is small, the attacker is more likely to incorrectly reject H 1 (in a type
II error).
We say that an algorithm A is f -DP if, for any α ∈ [0 , 1] , no attacker can simultaneously bound the probability of type I error below α and bound the probability of type II error below f ( α ) .
The function f is called a trade-off function and controls the strength of the privacy protection.
The versatility afforded by f can be unwieldy in practice.
Although f -DP is capable of handling composition and can embed other notions of differential privacy, it is not convenient for representing safety levels as a curve amenable to human interpretation.
Gaussian differential privacy (GDP), as a parametric family of f -DP guarantees, provides a balance between interpretability and versatility.
GDP guarantees are parameterized by a single value µ and use the trade-off function f ( α ) =
Φ (cid:0) Φ − 1 (1 − α ) − µ (cid:1) , where Φ is the cumulative distribution function of the standard normal distribution.
With this choice of f , the hypothesis-testing problem faced by the attacker is as hard as distinguishing between N (0 , 1) and N ( µ, 1) on the basis of a single observation.
Aside from its visual interpretation, GDP also has unique composition theorems: the composition of a µ 1 - and µ 2 -GDP algorithm is, as expected, (cid:112) µ 21 + µ 22 -GDP.
This property can be easily generalized to n -fold composition.
GDP also has has a special central limit theorem implying that all hypothesis-testing-based deﬁnitions of privacy converge to GDP in terms of a limit in the number of compositions.
Readers are referred to Dong et al.
for more information.
The beneﬁts of DP come with a price.
As outlined in the deﬁnition of DP, any DP algorithm must be randomized.
This randomization is usually achieved by perturbing the intermediate step or the ﬁnal output via the injection of random noise.
Because of the noise, a DP algorithm cannot faithfully output the truth like its non-DP counterpart.
To provide a higher level of privacy protection, a stronger utility compromise should be made.
This leads to the paramount problem of the “privacy– utility trade-off”.
Under the ( (cid:15), δ ) -DP framework, this trade-off is often characterized in a form of σ = f ( (cid:15), δ ) : to achieve ( (cid:15), δ ) -DP, the utility parameter (usually the scale of noise) needs to be chosen as f ( (cid:15), δ ) .
We will further discuss this formulation with examples in the next section.
1. O UR CONTRIBUTION
The general goal of this paper is to provide both a deeper theoretical understanding of and powerful practical tools for the GDP framework.
To this end, we start with the analysis of privacy proﬁles under the condition of traditional ( (cid:15), δ ) -DP, where we point out an often-overlooked partial order on ( (cid:15), δ ) -DP conditions via implication.
We choose this as the starting point for our work because ignoring this partial order will lead to problematic asymptotic analysis and compromised utility.
Next, we broken down the GDP into two parts: a head condition and a tail condition and deﬁne an efﬁcient, tractable, and visualizable tool, called the Gaussian differential privacy transformation (GDPT).
We ﬁrst used the GDPT on the identiﬁcation of GDP algorithms.
Through the intermediate property of GDPT that we develop, we ﬁnd an easy-to-verify criterion that can distinguish GDP mechanisms from non-GDP mechanisms.
For GDP algorithms, this criterion provides a lower bound for the privacy protection parameter µ .
This criterion can help researchers widen the set of available
GDP algorithms and also gives an interesting characterization of GDP without an explicit reference to the Gaussian distribution.
Following the identiﬁcation of a GDP algorithm, the logical next step is to measure the exact value of µ .
By development of numerical properties of the GDPT, we give a method to narrow down possible values of an optimal µ with an arbitrarily small and quantiﬁable margin of error.
Lastly, we give three more applications of our newly developed tools.
In the ﬁrst, we revisit some established ( (cid:15), δ ) -DP
algorithms and improve their utility by accounting for the overlooked partial order on ( (cid:15), δ ) -DP conditions provided by logical implication.
In the second application, we make a comparison between (cid:15) -DP and µ -GDP and ﬁnd that any (cid:15) -DP algorithm must be also µ -GDP.
In the last application, we discuss the effect of subsampling using the GDPT.
B ACKGROUND
An algorithm can be ( (cid:15), δ ) -DP for multiple pairs of (cid:15) and δ : the union of all such pairs provides a complete image of the algorithm under the ( (cid:15), δ ) -DP framework.
In particular, an ( (cid:15), δ ) -DP mechanism
A is also ( (cid:15) (cid:48) , δ (cid:48) )
-DP for any (cid:15) (cid:48) ≥ (cid:15) and any δ (cid:48) ≥ δ .
The inﬁnite union of ( (cid:15), δ ) pairs can thus be represented as the smallest δ associated with each (cid:15) .
This intuition is formulated as a privacy proﬁle in Balle & Wang (2018).
The privacy proﬁle corresponding to a collection of ( (cid:15), δ ) -DP guarantees Ω is deﬁned as the curve in [0 , ∞ )
× [0 , 1] separating the space of privacy parameters into two regions, one of which contains exactly the pairs in Ω .
The privacy proﬁle provides as much information as Ω itself.
Many privacy guarantees and privacy notions, including ( (cid:15), δ ) -DP, R ´ enyi DP, f -DP, GDP, and concentrated DP, can be embedded into a family of privacy proﬁle curves and fully characterized (Balle et al., 2020a).
A privacy proﬁle can be provided or derived by an algorithm’s designer or users.
Before proceeding with detailed discussions, we ﬁrst give three examples of DP algorithms that are used throughout the paper.
The ﬁrst example we consider is the Laplace mechanism, a classical
DP mechanism whose prototype is discussed in the paper that originally deﬁned the concept of differential privacy (Dwork et al., 2006).
The level of privacy that the Laplace mechanism can provide is determined by the scale b of the added Laplacian noise.
Given a global sensitivity ∆ , the value of b needs to be chosen as f ( (cid:15), 0) =
∆ /(cid:15) in order to provide an ( (cid:15), 0) -DP guarantee.
Despite its long history, the Laplace mechanism has remained in use and study in recent years (Phan et al., 2017;
Hu et al., 2019; Xu et al., 2020; Li & Clifton, 2021).
Our second example is a family of algorithms in which a noise parameter has the form σ =
A(cid:15) − 1 (cid:112) log( B/δ ) .
Examples include
• the goodness of ﬁt algorithm
(Gaboardi et al., 2016), • noisy stochastic gradient descent and its variants (Bassily et al., 2014; Abadi et al., 2016; Feldman et al., 2018), and • the one-shot spectral method and the one-shot Laplace algorithm (Qiao et al., 2021).
Our third example comes from the ﬁeld of federated learning: given n users and the number of messages m , the invisibility cloak encoder algorithm (ICEA) from (Ishai et al., 2006) is ( (cid:15), δ )
-DP if m > 10 log( n/ ( (cid:15)δ )) (Ghazi et al., 2019).
See also (Balle et al., 2020b; Ghazi et al., 2020) for other analysis of ICEA.
For ﬁgures and numerical demonstrations in this paper, we use b = 2 / ∆ for the Laplace mechanism;
A = 2 , B = 1 , and σ = 2 for the second example, which we refer to as SGD; and m = 20 and n = for the ICEA.
We omit the internal details of these methods and focus on their privacy guarantees: other than for the classical Laplace mechanism, whose privacy proﬁle is known (Balle et al., 2020a), privacy guarantees are given in the form of a privacy–utility trade-off equation σ = f ( (cid:15), δ ) .
Given σ , it is tempting to derive the privacy proﬁle by inverting the trade-off equation (i.e., as δ A ( (cid:15) )
=
min { δ | σ = f ( (cid:15), δ ) } ).
However, in most cases, a privacy proﬁle naively derived in this way is not tight and will lead to a problematic asymptotic analysis, especially near the origin, because of a frequently overlooked partial order between ( (cid:15), δ ) -DP conditions, which we discuss below.
P RIVACY PROFILES AND AN EXACT PARTIAL ORDER ON ( (cid:15), δ ) -DP CONDITIONS
An ( (cid:15) 0 , δ 0 )
-DP algorithm is trivially ( (cid:15), δ ) -DP for any (cid:15) ≥ (cid:15) 0 and δ ≥ δ 0 .
However, this statement does not give a full picture of the relationships between different ( (cid:15), δ ) -DP conditions.
Theorem 3.1 Assume that (cid:15) 0 ≥ 0 and 0 ≤ δ 0 < 1 .
The ( (cid:15) 0 , δ 0 )
-DP condition implies ( (cid:15), δ ) -DP
if and only if δ ≥ δ 0 + (1 − δ 0 )( e (cid:15) 0 − e (cid:15) )
+ / (1 + e (cid:15) 0 ) .
Corollary 3.1 Assume that (cid:15) ≥ (cid:15) 0 ≥ 0 and δ ≤ [(1 + e (cid:15) )
δ 0 − e (cid:15) + e (cid:15) 0 ] / (1 + e (cid:15) 0 ) .
An ( (cid:15), δ ) -DP algorithm is ( (cid:15) 0 , δ 0 ) -DP.
Corollary 3.2 Let A be an ( (cid:15) 0 , δ 0 )
-DP algorithm with the privacy proﬁle δ A .
Then
[Equation]
We remark that the bound given in (1) is tight in the following sense: there is a speciﬁc ( (cid:15) 0 , δ 0 )
-DP algorithm
A such that δ A ( (cid:15) ) is exactly δ 0 + (1 − δ 0 )
( e (cid:15)
− e (cid:15) )
+ / (1 + e (cid:15) 0 ) .
Corollary 3.1 states the exact partial order of logical implication on ( (cid:15), δ ) -DP conditions.
Taking this partial order into account, the privacy proﬁle derived from the naive inversion of the trade-off function can be reﬁned into
[Equation]
Intuitively, the reﬁned privacy proﬁle not only considers ( (cid:15), δ ) -DP provided directly by the trade-off function but also takes all pairs ( (cid:15), δ ) inferred by Corollary 3.1.
Theorem 3.2 can itself be used as a tool to improve some DP results: we will discuss this improvement in Section 5.
With this approach, we can derive the privacy proﬁle of our second example to be δ SGD ( (cid:15) )
=
min( δ 2 + (1 − δ 2 )( e (cid:15) 2 − e (cid:15) )
+ / (1 + e (cid:15) 2 ) , exp {− (cid:15) 2 } ) , where (cid:15) 2 ≈ 1 . 187 and δ 2 ≈ 0 .
The privacy proﬁle of our third example is δ ICEA ( (cid:15) )
=
min( δ 3 + (1 − δ 3 )( e (cid:15) 3 − e (cid:15) )
+ / (1 + e (cid:15) 3 ) , K/(cid:15) } ) , where K = 4 /e 2 , (cid:15) 3 ≈ 1 . 159 , and δ 3 ≈ 0 .
Notice that δ SGD and δ ICEA share a similar form: both are the smaller of two terms, one derived from Corollary 3.1 from a particular ( (cid:15), δ ) -DP pair and the other from inverting the trade-off function.
This is no coincidence.
We leave the derivation to Appendix B.
We next show the connection between GDP and the privacy proﬁle: brieﬂy, Gaussian differential privacy can be characterized as an inﬁnite union of ( (cid:15), δ ) -DP conditions.
Theorem 3.2 A mechanism is µ -GDP if and only if it is ( (cid:15), δ µ ( (cid:15) ))
-DP for all (cid:15) ≥ 0 , where
[Equation]
This result follows from properties of f -DP and is formulated as Corollary 2.13 in Dong et al.
Prior to this general form, a similar expression for a special case appeared in Balle & Wang (2018).
From the deﬁnition of the privacy proﬁle, it follows immediately that an algorithm A with the privacy proﬁle
δ A is µ -GDP if and only if δ µ ( (cid:15) )
≥ δ A ( (cid:15) ) for all non-negative (cid:15) .
However, this observation does not automatically lead to a meaningful way to identify µ -GDP algorithms.
Before proceeding with an analysis of privacy proﬁles, we give a few visual examples in Figure 1.
The left pane illustrates the privacy proﬁles of our examples.
That of the Laplace mechanism is derived in Balle et al.
(2020a)
as Theorem 3: given a noise parameter b and a global sensitivity ∆ , the privacy proﬁle of the Laplace mechanism is δ ( (cid:15) )
= max(1 − exp { ε/ 2 − ∆ / (2 b ) } , 0) .
For the second and the third examples, we compare the naive privacy proﬁles obtained by inverting the trade-off function and the reﬁned privacy proﬁles.
The reﬁned and naive privacy proﬁles take on notably different values around (cid:15) = 0 .
The inverted trade-off functions suggest that (0 , δ ) cannot be achieved by any choice of parameter σ .
However, this is clearly not true, considering Theorem 3.1.
As shown in the right pane of Figure 1, the Laplace mechanism’s privacy proﬁle is below the 2-GDP and 4-GDP curves but crosses the 1-GDP curve, indicating that the Laplace mechanism in this case is 2-GDP and 4-GDP but not 1-GDP.
The ICEA curve intersects all of the displayed GDP curves, so the algorithm is not µ -GDP for µ ∈ { 1 , 2 , 4 } .
It is hard to tell whether or not the SGD curve crosses the 1-GDP curve and we cannot say if it will cross the 2-GDP or even the 4-GDP curve at a large value of (cid:15) .
These examples illustrate that we cannot draw conclusions simply by looking at a graph.
A privacy proﬁle is deﬁned on [0 , ∞ ) , so it is hard to tell if an inequality is maintained as (cid:15) increases.
Previous failures of ad hoc attempts at privacy have taught that privacy must be protected via tractable and objective means (Narayanan & Shmatikov, 2006; 2008; Barbaro & T. Zeller, 2006).
Performing this check via numerical evaluation yields similar problems: we cannot consider all values of (cid:15) on an inﬁnite interval (or even a ﬁnite one, for that matter).
Turning to closed forms for privacy proﬁles and δ µ is also difﬁcult: even if a given privacy proﬁle is easy to handle, δ µ presents some technical hurdles.
The proﬁle δ µ and Φ are transcendental with different asymptotic behaviors for different values of µ and (cid:15) .
This is clear from the right pane of Figure 1: near (cid:15) = 0 , δ µ is concave for µ = 4 but convex for µ = 1 .
As a further complication, both the ﬁrst and second terms in the deﬁnition of δ µ converge to 1 as (cid:15) → ∞ , but the difference between them vanishes.
Subtracting good approximations of two nearby numbers may cause a phenomenon called catastrophic cancellation and lead to very bad approximations (Malcolm, 1971; Cuyt et al., 2001).
Due to the risk of catastrophic cancellation, a good approximation of Φ does not guarantee a good approximation of the GDP privacy proﬁle.
These problems make it difﬁcult to tightly bound δ µ by a function with a simple form.
To address the problem of differing asymptotic behaviours, we deﬁne the following two notions.
Deﬁnition 3.1 (Head condition)
An algorithm A with the privacy proﬁle δ A is ( (cid:15) h , µ ) -head GDP
if and only if δ A ( (cid:15) ) ≤ δ µ ( (cid:15) )
when (cid:15) ≤ (cid:15) h .
Deﬁnition 3.2 (Tail condition)
An algorithm A with the privacy proﬁle δ A is ( (cid:15) t , µ ) -tail GDP
if and only if δ A ( (cid:15) ) ≤ δ µ ( (cid:15) ) when (cid:15) > (cid:15) t .
In particular, we deﬁne A as (+ ∞ , µ ) -tail GDP if A is ( (cid:15) t , µ ) -tail GDP for some (cid:15) t < + ∞ and deﬁne A as ( (cid:15) t , + ∞ ) -tail GDP if A is ( (cid:15) t , µ ) for some µ < + ∞ .
The head condition checks the µ -GDP condition for (cid:15) near zero and the tail condition checks the µGDP condition for (cid:15) far away from zero.
As such, the combination of ( (cid:15), µ ) -head GDP and ( (cid:15), µ ) -tail
GDP is equivalent to µ -GDP.
T HE G AUSSIAN D IFFERENTIAL P RIVACY T RANSFORMATION
In this section, we propose a new tool called the Gaussian Differential privacy transformation (GDPT).
We start by establishing a link between the GDPT and the head and tail conditions and discuss how the GDPT can identify GDP algorithms and measure the value of µ .
Deﬁnition 4.1 (GDPT) Let f be a non-increasing, non-negative function deﬁned on [0 , + ∞ ) satisfying f (0) ≤ 1 .
The Gaussian differential privacy transformation (GDPT) of f is the function G f mapping [0 , ∞ ) to [0 , ∞ ) such that G f ( (cid:15) )
= µ GDP ( (cid:15), f ( (cid:15) )) , where µ GDP ( x, y ) is the implicit function deﬁned by the equation δ µ ( x ) = y .
We highlight two critical features of the GDPT.
• The GDPT is order preserving: if f ( (cid:15) ) ≥ g ( (cid:15) ) , then G f ( (cid:15) ) ≥ G g ( (cid:15) ) .
• The GDPT of δ µ is G δ µ ( (cid:15) )
= µ , a constant function.
The ﬁrst of these two features derives from the monotonicity of δ µ ( (cid:15) ) .
Given a ﬁxed µ , δ µ ( (cid:15) ) is a strictly decreasing continuous function of (cid:15) . Given a ﬁxed (cid:15) , δ µ ( (cid:15) ) is a strictly increasing continuous function of µ .
Therefore, µ GDP ( x, y ) is an increasing function of y : this leads to the order-preserving property.
The second property follows immediately from the deﬁnition of µ GDP .
By taking advantage of the order-preserving property, direct comparisons between δ µ and δ A are no longer necessary: instead, it is sufﬁcient to compare their corresponding GDPTs.
Furthermore, appealing to the second property above, we need only compare G δ A to the constant function µ .
The following theorems formalize this insight.
Theorem 4.1 An algorithm A with the privacy proﬁle
δ A is ( (cid:15) h , µ ) -head GDP
if and only if µ ≥ sup( { G δ A ( (cid:15) )
| (cid:15) ∈ [0 , (cid:15) h ]) .
Theorem 4.2 An algorithm A with the privacy proﬁle
δ A is ( (cid:15) t , µ ) -tail GDP if and only if µ ≥ sup( { G δ A ( (cid:15) )
| (cid:15) ∈ ( (cid:15) t , ∞ )) .
Corollary 4.1 An algorithm A with the privacy proﬁle δ A is µ -GDP if and only if µ ≥ sup( { G δ A ( (cid:15) )
| (cid:15) ∈ [0 , ∞ ) } ) .
Without the above results, we would be forced to search through an uncountably-large family of functions for a single δ µ that never crosses δ A anywhere on [0 , ∞ ) and has µ as small as possible.
Now, with Theorem 4.1, we need only consider one function: the GDPT of δ A .
The tightest value µ is sup (cid:15) { G δ A ( (cid:15) ) } .
Using the GDPT framework, a condition for identifying GDP algorithms (that does not specify the exact value of µ ) is simple to formulate.
We do so in the following theorems.
Theorem 4.
An algorithm A is GDP if and only if A is (+ ∞ , + ∞ ) -tail GDP.
Theorem 4.4 Let f be a non-increasing, non-negative function deﬁned on [0 , + ∞ ) satisfying f (0) ≤ 1 .
Then
[Equation]
Theorems 4.3 and 4.4 give a useful criterion characterizing GDP and deepen our understanding of
GDP.
Putting the exact value of µ aside, a GDP algorithm must provide an inﬁnite union of ( (cid:15), δ ) -DP conditions, where δ must be O ( e − (cid:15) 2 ) as (cid:15) → ∞ .
Refer to Appendices A.3 and A.4 for proofs of
Theorems 4.3 and 4.4, respectively.
Using these newly-developed tools, we revisit our previous three examples for which the limit in
Theorem 4.4 is 0 , (cid:112) 1 / 2 , and + ∞ , respectively.
From these evaluations, we can conclude that the
Laplace mechanism and SGD are GDP for some µ and that the privacy proﬁle of the ICEA algorithm crosses every µ -GDP curve regardless of how large µ is, indicating that the ICEA algorithm is not
GDP.
The left pane of Figure 2 shows the GDPTs of the three examples considered in this paper.
All three GDPTs converge to a ﬁnite value as (cid:15) → 0 + .
This can be attributed to the fact that any algorithm providing some non-trivial ( (cid:15), δ ) -DP guarantee is (0 , δ ) -DP for some δ ∈ [0 , 1) .
For larger values of (cid:15) , the GDPT of the Laplace mechanism takes on a constant value of 0 , the GDPT of
SGD converges to a value that is approximately 0 .
7 , and the GDPT of the ICEA seems to diverging.
These observations are consistent with the values of 0 , (cid:112) 1 / 2 , and ∞ obtained from Theorem 4.4.
Nonetheless, plots are only good for visualization and are not sufﬁcient proof when verifying GDP.
We still need objective and tractable methods for obtaining bounds on GDPTs.
Once an algorithm is conﬁrmed to be GDP via Theorems 4.3 and 4.4, it is natural to be interested in the exact level of privacy protection, quantiﬁed by µ .
Following the intuition outlined by deﬁnition 3.1 and 3.2, we decompose the GDP condition into head and tail conditions and ﬁrst focus on ﬁnding µ such that A is ( (cid:15), µ ) -head GDP.
4. M EASURING THE HEAD
Without additional knowledge, ﬁnding sup { G δ A ( (cid:15) )
| (cid:15) ∈ [0 , (cid:15) h ] } , even for a ﬁnite (cid:15) h , seems computationally infeasible as there are uncountably many real numbers in any non-empty interval and it is impossible to iterate through an inﬁnite set.
To solve this problem, we take advantage of the fact that µ GDP has a bounded partial derivative.
Theorem 4.5 One of the partial derivatives of µ GDP is uniformly bounded.
Speciﬁcally, 0 ≤
[Equation]
Theorem 4.6 Given (cid:15) h ≥ 0 , let D =
(cid:15)
h /n and x i
= iD + (cid:15) h for i ∈ { 0 , . .
. , n + 1 } .
The GDPT of A , denoted by G A ( (cid:15) ) , is bounded between the two staircase functions
[Equation]
and
[Equation]
Speciﬁcally,
[Equation]
Refer to Appendix A.5 and A.6 for proofs of Theorem 4.5 and 4.6, respectively.
For any (cid:15) h < + ∞ , we can now bound any GDPT G δ A to any precision on [0 , (cid:15) h ] without full pointwise evaluation because G δ A is bounded between G + δ A and G − δ A and each staircase function takes on only ﬁnitely many values.
The inequalities in (3) provide a viable way to estimate max G δ A ( (cid:15) ) : max i ∈{ 0 ,...,n } G − δ A ( x i ) and max i ∈{ 0 ,...,n +1 } G + δ A ( x i ) can be computed by choosing the maximum value among 2 n + 2 evaluations of µ
GDP .
For the completeness, we provide a detailed description of an efﬁcient algorithm with a time complexity of O ( (cid:15) h /D + log 2 ( D ) log( (cid:15) h )) in Appendix D.
C UTTING THE TAIL
With Theorem 4.6, one can verify ( (cid:15) h , µ ) -head GDP conditions for arbitrarily large (cid:15) h and an arbitrarily precise approximation of µ .
While the error in µ can be quantiﬁed by D , one gap remains: (cid:15) h can be arbitrarily large but can never truly be + ∞ .
In this subsection, we discuss the gap between ( (cid:15) h , µ ) -head GDP and true GDP (which is equivalent to (+ ∞ , µ ) -head GDP).
Before giving a solution, we intuitively illustrate the gap between ( (cid:15) h , µ ) -head GDP and true GDP.
Consider the following two cases:
• GDP with catastrophic failure, where with probability 1 − p , A 1 functions properly and exact µ -GDP is guaranteed, but with probability p , A 1 malfunctions and discloses the entire dataset; and • head-GDP with (cid:15) -DP, where A 2 is both ( (cid:15) h , µ ) -head GDP and ( (cid:15) h , 0) -DP.
The µ -GDP privacy guarantee lies strictly between those of A 1 and A 2 : speciﬁcally, δ A 1 ( (cid:15) ) <
δ µ ( (cid:15) ) <
δ A 2 ( (cid:15) ) .
In practice, µ is rarely above six in GDP and (cid:15) is rarely above 10 in (cid:15) -DP because more-extreme values provide almost no privacy protection (Dong et al., 2019).
If we verify the head condition up to (cid:15) h = 100 (which is not difﬁcult because the time required for veriﬁcation grows linearly) and take µ = 6 , then p = δ µ ( (cid:15) h ) will be on the order of 10 − 43 .
If (cid:15) h is increased to 200 , then p will be smaller than 10 − 202 .
Hence, we conclude that the gap won’t make any notable difference in practice with a proper choice of µ and (cid:15) h .
However, in some cases, one may still wish to fully mend the gap theoretically.
This can also be achieved under the GDPT framework.
A GDPT is a ﬁxed function that inherits smoothness properties from the corresponding privacy proﬁle.
The maximum value of a GDPT can be analysed using standard functional tools.
We give an example of such an analysis in Section 5.
If the privacy proﬁle is not given in a manageable closed form or the analysis is infeasible, we provide the following “clip and retify” procedure that can turn any ( (cid:15) h , µ ) -head GDP algorithm into a µ -GDP one at the cost of some utility.
Theorem 4.7 Let A be a ( (cid:15) h , µ ) -head GDP algorithm with a numerical output.
Assume that −∞ < y − < y
+ < + ∞ .
Deﬁne C ( y ) = max(min
( y, y + ) , y − ) and R ( z )
=
z + v , where v is sampled from Laplace( b ) with b =
( y + − y − ) /(cid:15) h .
Then R ◦ C ◦
A is µ -GDP.
Refer to Appendix A.7 for proof of Theorem 4.7.
We remark that, in order to minimize the utility loss, the bounds y − and y + should be properly chosen and the head condition should be veriﬁed to an (cid:15) h that is as large as possible.
A PPLICATIONS 5. GDPT OF (cid:15) -DP ALGORITHMS AND THE L APLACE MECHANISM
By our previous analysis of the GDPT, we know that being GDP means that a privacy proﬁle has a quickly vanishing tail (i.e., δ ( (cid:15) ) must be O ( e − (cid:15) 2 ) ).
It is remarkable that another single parameter family of DP conditions, the (cid:15) -DP conditions, is also a property that pertains to the tail of privacy proﬁles.
For any (cid:15)
-DP algorithm, the privacy proﬁle must be exactly 0 after (cid:15) 0 .
This suggests that (cid:15)
-DP is stronger than GDP.
Next, we will quantify this intuition using the tools developed in this paper.
By Theorem 3.2, we know if A is (cid:15)
-DP, then in the worst case, δ A ( (cid:15) )
=
( e (cid:15)
− e (cid:15) )
+ / (1 + e (cid:15) 0 ) .
We consider the GDPT of δ A , denoted by G δ A .
It is easy to see that, for (cid:15) ≥ (cid:15) 0 ,
G δ A ( (cid:15) )
=
: we need only consider (cid:15) ∈ [0 , (cid:15) 0 ) .
Let G δ A ( (cid:15) ) be denoted by µ (cid:15) .
Using using the partial derivative of G δ A derived in Appendix A.5, we know that ∂∂(cid:15) G δ A ( (cid:15) )
= √ 2 π exp (cid:110)(cid:0) µ 2 (cid:15) + 2 (cid:15) (cid:1) 2 / (8 µ 2 (cid:15) )
(cid:111) (cid:104) Φ( − µ 2 (cid:15) +
(cid:15) 2 µ (cid:15) )
− Φ( − µ 0 2 ) (cid:105) .
Then sign( ∂∂(cid:15) G δ A ( (cid:15) ) )
= sign( µ (cid:15) − µ 0 − 2 (cid:15)/µ 0 ) .
We can conclude that µ (cid:15) ≤ µ 0 and, further, that G δ A ( (cid:15) ) is strictly decreasing on [0 , (cid:15) 0 ) .
By Theorem 4.1, we know that A is µ 0 -DP.
This ﬁnding can be more generally formulated as the following theorem.
Theorem 5.1 Any ( (cid:15), 0)
-DP algorithm is also µ -GDP for µ ≥ − 2Φ − 1 (1 / (1 + e (cid:15) )) .
Dong et al.
(2019) pointed out that the DP guarantees of the Laplace mechanism are stronger than those correspondingly provided by (cid:15) -DP.
We reafﬁrm this difference by showing that it still exists under the GDP framework.
The Laplace mechanism satisﬁes µ -GDP for µ smaller than the bound given in Theorem 5.1.
The GDPTs presented in Appendix E.1 illustrate this difference.
5. U TILITY REFINEMENT
There is an interesting byproduct or the privacy proﬁle reﬁnement. Theoretically, the privacy proﬁle reﬁnement can also be used to improve an algorithm’s utility.
For example, the projected noisy SGD algorithm in Feldman et al.
(2018) is ( (cid:15), δ ) -DP
and the trade-off function is σ = − C log( δ 0 ) /(cid:15) 0 .
To achieve (0 . 2 , e − 2 ) -DP, it appears that σ needs to be chosen as − C log( e − 2 ) / 0 .
2 = 10 C .
By Corollary 3.1, ( (cid:15), δ ) -DP implies (0 . 2 , e − 2 )
-DP when δ + (1 − δ )( e (cid:15) − e 0 . 2 ) + / (1 + e (cid:15) )
=
e − 2 .
Numerical methods suggest
that, by choosing (cid:15) ≈ 0 .
334 and δ ≈ 0 .
067 , ( (cid:15), δ ) -DP implies (0 . 2 , e − 2 ) -DP
but σ = − C log( δ ) /(cid:15)
≈ 8 .
086 C < 10 C .
Therefore, the desired level of DP can be achieved with a lower noise parameter.
However, this type of reﬁnement majorly affects privacy proﬁle around the origin and therefore minor in practice.
For the general case and details of this derivation, refer to Appendix C.
5. E FFECT OF SUBSAMPLING
It is well known that a mechanism can be improved from a privacy perspective by adding extra steps to perturb its input or output.
One popular approach is the subsampling technique (Balle et al., 2020a).
We omit the details of this method and use the following result from Balle et al.
(2020a). Let A be an ( (cid:15), δ ) -DP algorithm and S γ the Poisson subsampling procedure wherein each data point is retained with probability γ .
Then A ◦ S γ is (log(1 − γ + γe (cid:15) ) , γδ ) -DP when two datasets are considered differ in one element if one dataset equals to the other dataset plus one additional element.
Combining this result with the partial derivatives of µ GDP , the Poisson subsampling procedure can signiﬁcantly decrease the value of µ around (cid:15) =
but has no effect on the GDPT’s tail.
Therefore, in the worst case, a subsampling procedure does not improve the value of µ for a GDP algorithm.
For detailed plots, refer to Appendix E.2.
C ONCLUSION AND DISCUSSION
In this paper, we provided both an analytical understanding of and engineering tools for the GDP framework.
Using the new notions we proposed, we gave solutions to two problems in GDP: identiﬁcation and measurement.
We further provided many applications of the proposed tools.
Our developments in this paper suggest numerous interesting directions for future work.
The “clip and retify” procedure can be extended to provide more versatility to methods for privacy ampliﬁcations by utilizing more advanced composition and post-processing results.
GDPT is generalizable to other parameterized DP notions such as RDP and cDP and enriches the DP literature with its tractability and visualizability.
Ethics Statement.
Our work is majorly development of mathematical tools for the differential privacy framework.
We cannot foresee any immediate real-world impact and believe those mathematical tools will contribute to the developments of privacy-aware technologies.
Reproducibility Statement.
For all our theoretical results, we conﬁrm that all necessary assumptions are properly addressed, and all proofs are provided unless trivial.
No datasets and interactive virtual environments are involved in this paper.
There are no experimental results in this work.
Figures are only for demonstrative reasons as main results are supported by proofs.
A PPENDIX : P ROOFS
Proof A.1 Proof of Theorem 3.1:
Sufﬁciency:
When (cid:15) ≥ (cid:15) 0 , the sufﬁciency is trivial as δ = δ 0 .
When (cid:15) < (cid:15) 0 , given that A is ( (cid:15) 0 , δ 0 ) -DP, by the deﬁnition, for any pair of datasets S and S (cid:48) that differ in the record of a single individual and any event E ,
P
[Equation]
δ 0 .
When P [ A ( S (cid:48) ) ∈ E ] ≤ 1 − δ 0
+ e (cid:15) 0 :
= c 0 ,
P [ A ( S ) ∈ E ] ≤ e (cid:15)
P [ A ( S (cid:48) )
∈ E ] + δ≤ ( e (cid:15)
+ e (cid:15) − e (cid:15) ) P [ A ( S (cid:48) )
∈ E ]
+ δ
+ δ − δ ≤ e (cid:15)
P
[Equation]
S
[Equation]
+
[Equation] [Equation]
e
[Equation] [Equation]
[Equation]
δ 0 − δ ≤
[Equation]
S
[Equation] [Equation]
[Equation] [Equation]
[Equation]
≤ e
[Equation]
P [ A ( S (cid:48) )
∈ E ]
+ δ.
When c 0 ≤ P [ A ( S (cid:48) ) ∈ E ] ≤ 1 ,
P [ A ( S ) ∈ E ] = 1 − P [ A ( S ) ∈
E c ] ≤ 1 − e − (cid:15)
( P [ A ( S (cid:48) )
∈ E
[Equation]
Necessity:
We prove the necessity by giving a speciﬁc ( (cid:15) 0 , δ 0 )
-DP algorithm
A such that δ A ( (cid:15) ) is exactly δ 0 + (1 − δ 0 )
( e (cid:15)
− e (cid:15) )
+
+ e (cid:15).
Deﬁne Ω e = { 1 , 2 , 3 , 4 } and Ω S
= { 0 , 1 } .
Let (cid:15) ≥ 0 , 0 ≤ δ 0 ≤ 1 and denote e (cid:15)
+ e (cid:15)
as α 0 .
Let A be a randomized algorithm that take a single point from Ω S and generate output as follows:  
P ( A ( S ) = 1 | S = 0)
=
δ 0 ,
P ( A ( S ) = 2 | S = 0) = 0 ,
P ( A ( S ) = 3 | S = 0) =
(1 − δ 0 )
α 0 ,
P ( A ( S ) =
| S = 0)
= (1 − δ 0 )(1 − α 0 ) ,  
P ( A ( S ) = 1 | S = 1) = 0 ,
P ( A ( S ) = 2 | S = 1) = δ 0 ,
P ( A ( S ) =
| S = 1) =
(1 − δ 0 )(1 − α 0 ) ,
P ( A ( S ) =
| S = 1) =
(1 − δ 0 )
α 0 .
By deﬁnition, δ ( (cid:15) ) is the smallest δ such that P ( A ( S ) ⊂
E | S = s ) ≤ e (cid:15) P ( A ( S ) ⊂
E | S = 1 − s )
+ δ holds true for all E ⊂ Ω e and s ∈ Ω S .
By checking all 64 combinations, we can conclude that δ A ( (cid:15) )
=
δ
+ (1 − δ 0 )( e (cid:15)
− e (cid:15) )
+
+ e (cid:15).
We present a key lemma underlying much of the theoretical analysis and may be of use for future developments.
Lemma A.1 Deﬁne ˜
δ µ ( (cid:15) ) =
µe − a 2 / 2 √ 2 πa 2 , where a = − (cid:15)µ + µ 2 .
It follows that lim (cid:15) → + ∞ δ µ ( (cid:15) )
˜
δ µ ( (cid:15) )
= 1 .
Proof A.2 Proof of Lemma A.1:
It is well known that (Abramowitz et al., 1988), for t < 0 :
[Equation]
Let a = (cid:16) − εµ + µ 2 (cid:17) and b = (cid:16) − εµ − µ 2 (cid:17) ,
[Equation]
=
[Equation]
Therefore
[Equation]
It is easy to see that,
[Equation]
By L’Hospital’s rule:
[Equation]
Proof A.3 Proof of Theorem 4.3:
It is easy to see that A is (+ ∞ , + ∞ )
-tail GDP
if and only if lim (cid:15) → + ∞ G δ A ( (cid:15) ) < + ∞ .
Sufﬁciency:
If A is µ -GDP.
Then lim [Equation]
→ + ∞ G δ A (
[Equation]
) ≤ lim
[Equation]
→ + ∞ G
[Equation]
µ ( (cid:15) )
= µ .
Necessity:
If lim (cid:15) → + ∞ G δ A ( (cid:15) )
= µ < + ∞ , there must be a (cid:15) t > 0 such that A is ( (cid:15) t , µ 0 + 1) -tail GDP.
Notice that lim µ →∞ δ µ ( (cid:15) t ) = 1 , we can pick µ 1 > µ 0 large enough such that δ µ 1 ( (cid:15) t ) >
δ A (0) .
This is possible because by Theorem 3.1, δ A (0) < 1 .
Then for (cid:15) ∈ [0 , (cid:15) t ) , δ A ( (cid:15) ) ≤ δ A (0) ≤ δ µ 1 ( (cid:15) t ) ≤ δ µ 1 ( (cid:15) ) .
A is both ( (cid:15) t , µ ) -head and tail GDP for µ = µ 0 + µ 1 + 1 .
A is GDP as desired.
Proof A.4 Proof of Theorem 4.4:
Let lim (cid:15) →
+ ∞ G f ( (cid:15) )
= µ t .
First we show that lim (cid:15) →∞
[Equation]
By the deﬁnition the limit, for any µ 0 > µ t , for sufﬁcient large (cid:15) , G f ( (cid:15) ) < µ 0 and further δ A ( (cid:15) )
≤ δ µ 0 ( (cid:15) ) .
Hence, lim (cid:15) →∞ δ A ( (cid:15) )
δ µ 0 ( (cid:15) ) ≤ 1 .
By Lemma A.1, lim (cid:15) [Equation]
[Equation]
˜
[Equation]
( (cid:15) ) ≤ 1 .
Then lim (cid:15) →∞ (cid:15) 2 − 2log δ A ( (cid:15) )
≤ lim (cid:15)
[Equation]
lim (cid:15) →∞ (cid:15)
[Equation]
−
[Equation]
δ
[Equation]
( (cid:15) ) ≤ µ t as desired as we take µ 0 → µ t .
Next we show that lim (cid:15) →∞
[Equation]
µ
[Equation]
t :
If lim (cid:15) →∞ (cid:15)
[Equation]
−
[Equation]
δ A ( (cid:15) )
= µ 20 < µ 2 t , then by Lemma A.1, lim
[Equation]
Then for a sufﬁciently large (cid:15) 0 ,
[Equation]
Since log is an increasing function, it follows that δ A ( (cid:15) 0 ) <
δ µ 0 ( (cid:15) 0 ) .
Then lim (cid:15) →
+ ∞ G f ( (cid:15) ) ≤ µ 0 < µ t , which is a contradiction.
Proof A.5 Proof of Theorem 4.5:
Let G µ ( (cid:15) )
=
F ( (cid:15), δ µ ( (cid:15) )) and F ( x, y ) = µ GDP ( x, y ) .
By deﬁnition of µ GDP , G µ ( (cid:15) )
= µ .
On one hand,
[Equation]
On the other hand, by chain rule,
[Equation]
Therefore,
[Equation]
Using the close forms, ∂δ µ ( (cid:15) ) ∂(cid:15) and ∂δ µ ( (cid:15) ) ∂µ can be directly computed: 
[Equation]
Hence, 
[Equation]
Notice that ∂F∂x = √ 2 πe
[Equation]
µ [Equation] Φ( − µ 2 +2 (cid:15) 2 µ ) > 0 , combined with the fact that ∂F∂x ≤ √ 2 π 2 , we can conclude that 0 ≤ ∂µ GDP ( (cid:15),δ ) ∂(cid:15) ≤ √ 2 π 2 .
By ∂F∂y > 0 , we can see GDPT is order preserving.
Proof A.6 Proof of Theorem 4.6:
We now consider the gap between max i ∈{ 0 , ··· ,n } { G − δ A ( x i ) } and max i ∈{ 0 , ··· ,n +1 } { G
+ δ A
( x i ) } bound the length of [ µ − , µ + ] in two cases.
Case 1:
If max i ∈{ 0 , ··· ,n +1 } { G + δ A
( x i ) } =
G + δ A
( x 0 ) , then max i ∈{ 0 , ··· ,n +1 } { G + δ A
( x i ) } =
G + δ A
x 0 )
= µ GDP ( D, δ A (0)) ≤ µ GDP (0 , δ A (0))
+ √ 2 πD.
Therefore,
[Equation]
Case 2: If max i ∈{ 0 , ··· ,n +1 } { G + δ A
( x i ) } (cid:54) =
G + δ A ( x 0 ) , then by the order preserving property, the optimal µ lies in [ µ − , µ + ] , where µ − = max( µ h , max i ∈{ 0 , ··· ,n } { G − δ A ( x i ) } ) and µ + = max( µ h , max i ∈{ 1 , ··· ,n +1 } { G + δ A
( x i ) } ) .
Notice that max
[Equation]
max
[Equation]
max
[Equation]
In both cases the gap is no greater than √ 2 πD as desired.
Proof A.7 Proof of Theorem 4.7:
By the deﬁnition of C , C ◦
A is bounded in [ y − , y +] .
Therefore the global sensitivity of C ◦ A is no greater than y + − y − .
Then R ◦ C ◦
A is a special case of the Laplace mechanism.
By Balle et al.
(2020a), R ◦ C ◦
A is (cid:15) h
-DP.
Then δ R◦C◦
A ( (cid:15) )
=
< δ µ ( (cid:15) ) for any (cid:15) ≥ (cid:15) h .
In addition, because of the post-processing property, δ R◦C◦A ( (cid:15) ) ≤ δ A ( (cid:15) ) < δ µ ( (cid:15) ) for any (cid:15) < (cid:15) h .
Therefore, R ◦ C ◦
A is µ -GDP.
B A PPENDIX : R EFINING THE PRIVACY PROFILE
Given a trade-off function σ = f ( (cid:15), δ ) and a ﬁxed parameter σ .
From deﬁnition of the trade-off function it is instant that the for any ( (cid:15), δ ) ∈ Ω
= { ( (cid:15), δ ) | σ = f ( (cid:15), δ ) } , ( (cid:15), δ ) -DP is guaranteed.
Then, ( (cid:15), δ ) -DP is also guaranteed if there is a ( (cid:15) 0 , δ 0 )
∈
Ω such that ( (cid:15) 0 , δ 0 ) -DP implies ( (cid:15), δ ) -DP. Therefore, δ A ( (cid:15) )
=
min (cid:18) { δ | σ = f ( (cid:15) 0 , δ 0 ) and δ ≥ δ 0 + (1 − δ 0 )
( e (cid:15)
− e (cid:15) )
+
+ e (cid:15)} (cid:19) .
Notice that by Corollary 3.2, ( (cid:15) 0 , δ 0 ) -DP implies ( (cid:15), δ ) with δ <
δ 0 only if (cid:15) < (cid:15) 0 , we rewrite the δ A ( (cid:15) ) as:
[Equation]
where g ( (cid:15), (cid:15) 0 ) :
= (1 − ˆ δ A ( (cid:15) 0 ))
e (cid:15)
− e (cid:15) e (cid:15)
+1 + ˆ δ A ( (cid:15) 0 ) and ˆ δ A is the naive privacy proﬁle deﬁned implicitly by σ = f ( (cid:15) 0 , δ 0 ) .
For continuously differentiable f , the minimum value of the right-hand side can be found be take the derivative:
[Equation]
We remark that the sign of ∂δ A ( (cid:15) ) ∂(cid:15)does not depend on (cid:15) .
For both of our example 2 and 3, we both ﬁnd a particular value (cid:15) i such that Sign ( ∂g ( (cid:15),(cid:15) 0 ) ∂(cid:15) 0 )
= − Sign ( (cid:15) − (cid:15) i ) .
This means for (cid:15) ≥ (cid:15) i , δ A ( (cid:15) )
=
ˆ δ A ( (cid:15) ) and otherwise δ A ( (cid:15) ) equals to the δ value derived from ( (cid:15), ˆ δ A ( (cid:15) )) .
C A PPENDIX : R EFINING THE σ
Given a trade-off function σ = f ( (cid:15), δ ) and desired ( (cid:15), δ ) .
From deﬁnition of the trade-off function, ( (cid:15), δ ) -DP is guaranteed when σ = f ( (cid:15), δ ) .
We treat the σ as the noise parameter and without loss of generality we assume a smaller value of σ is preferred.
Notice that ( (cid:15), δ ) -DP is also guaranteed if there is a ( (cid:15) 0 , δ 0 )
∈
Ω such that ( (cid:15) 0 , δ 0 ) -DP implies ( (cid:15), δ ) -DP.
Therefore, σ can be chosen as,
[Equation]
Notice that by Corollary 3.2, ( (cid:15) 0 , δ 0 ) -DP implies ( (cid:15), δ ) with δ <
δ 0 only if (cid:15) < (cid:15) 0 , we rewrite the σ − as:
[Equation]
where g ( (cid:15), (cid:15) 0 ) :
= f ( (cid:15) 0 , (1 − ˆ δ A ( (cid:15) 0 ))
e (cid:15)
− e (cid:15) e (cid:15)
+1 + ˆ δ A ( (cid:15) 0 )) and ˆ δ A is the naive privacy proﬁle deﬁned implicitly by σ = f ( (cid:15) 0 , δ 0 ) .
For continuously differentiable f , the minimum value of the right-hand side can be found be take the derivative:
[Equation]
We remark that the sign of ∂δ A ( (cid:15) ) ∂(cid:15)does not depend on (cid:15) and the zero point can be effectively solved numerically.
D A SELF - CONTAINED EFFICIENT HEAD MEASUREMENT ALGORITHM
First we formalise the binary search algorithm to ﬁnd µ GDP :
Algorithm 1:
Input
, δ , µ max , b ;
Output: µ − , µ + (lower and upper bound of µ ).
; µ − ← 0 ; µ + ← µ max ; while µ + − µ − > b do µ = µ + + µ −; if δ µ ( (cid:15) ) >
δ then µ + ← µ 0 ; else µ − ← µ 0 ; end end return µ + , µ − .
Given a proper searching range [0 , µ max ] , the algorithm 1 yields µ + and µ − such that µ − ≤ µ GDP ( (cid:15), δ ) ≤ µ + and µ + − µ − < b .
We denote µ + as µ + GDP ( (cid:15), δ, µ max , b ) and µ − as µ − GDP ( (cid:15), δ, µ max , b ) .
When searching for µ via privacy proﬁles, the µ max can chosen as µ GDP ( µ t , δ A (0)) because µ GDP will not exceed this value on [0 , (cid:15) t ] (refer to Theorem 4.3 for the value of µ t ).
Alternatively, µ max can be set to a large constant for convenience, for example 10 .
In this case, if the outputted µ + equals to the preset value (10) then the privacy proﬁle fails to imply 10 -GDP.
In practice, GDP with µ ≥provides almost no privacy protection Dong et al.
With the formal deﬁnition of binary search we use, the exhaustive iteration method to bound the staircase functions outlined in Theorem 4.6 can be formally written as follows:
Algorithm 2: Finding µ with privacy proﬁles (Naive).
Input: δ A , (cid:15) h , µ t , c , µ max .
(Privacy proﬁle
, the end point of searching (cid:15) h , µ given by Theorem 4.3, reciprocal of error margin, searching range);
Output: µ − , µ + (lower and upper bound of µ ).
; i ← 0 ; n ← (cid:100) √ 8 cπ(cid:15) h (cid:101) + 1 ;
D ← (cid:15) h n − 1 ; µ − ← max( µ h , µ t ) ; µ + ← µ max ; while i ≤ n + 1 do x − ← iD + (cid:15) h ; x + ← ( i + 1) D + (cid:15) h ; µ + ← max( µ + , µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) ; µ − ← max( µ − , µ − GDP ( x + ) , δ A ( x − , µ max , 12 c )) ; i ← i + 1 end return µ + , µ − .
Algorithm 2 naively go thorough all G − δ A ( x i ) and G + δ A
( x i ) .
By the choice of D , the true gap between max G − δ A ( (cid:15) ) and max G + δ A ( (cid:15) ) is less than 12 c and the binary search estimate the µ GDP with an error less than 12 c .
Combined together, the overall gap between estimated µ + and µ − is less thanc .
However, there is still room for optimization:
We take µ + ← max( µ + , µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) for example, same optimization can be applied to µ − ← max( µ − , µ − GDP ( x + , δ A ( x − , µ max , 12 c ))) as well.
The naive operation, µ + ← max( µ + , µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) can be optimized into ”If δ µ + ( x − ) <
δ A ( x + ) , then µ + ← µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) .
To see this, we list all three possibilities as follows:
• Case 1: µ + < µ GDP ( x − , δ A ( x + )) ≤ µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) .
• Case 2: µ GDP ( x − , δ A ( x + )) ≤ µ + ≤ µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) .
• Case 3: µ GDP ( x − , δ A ( x + )) ≤ µ + GDP ( x − , δ A ( x + ) , µ max , 12 c )) < µ + .
In case 1, both of the naive operation and the optimized operation will update µ + to µ
+ GDP ( x − , δ A ( x + ) , µ max , 12 c )) .
In case 2, the optimized operation will do nothing, because the test δ µ + ( x − ) <
δ A ( x + ) will fail.
The naive operation will update µ + due to the error of binary search, which should be avoided.
In case 3, the optimized operation will do nothing, because the test δ µ + ( x − ) <
δ A ( x + ) will fail.
The naive operation will also do nothing because the max operator will choose µ + .
To sum up, the optimized operation
always
give a more accurate update.
Besides, we want to avoid case 1 because only in that case a binary search is needed.
Notice that case 1 happens only if δ µ + ( x − ) <
δ A ( x + ) , which is equivalent to µ + < µ GDP ( x − , δ A ( x + )) .
In the k + 1 round of loop, the condition µ + < µ GDP ( x − , δ A ( x + )) holds true only if for all j ∈ { 0 , · · · , k } , µ GDP ( x − j , δ A ( x + j )) < µ GDP ( x − , δ A ( x + )) , where x − j and x + j are the values of x − and x + in the round j .
This inspire us to shufﬂe x
i before iteration because after shufﬂing, the probability of ” µ GDP ( x − j , δ A ( x + j )) < µ GDP ( x − , δ A ( x + )) for all j ∈ { 0 , · · · , k } ” will be 1 k +1 .
The expected occurrence of case 1 will be (cid:80) n +1 k =
1 k +
=
O (log( n )) .
We present the complete optimized algorithm as follows:
Algorithm 3: Finding µ with privacy proﬁles (optimized).
Input: δ A , (cid:15) h , µ t , c , µ max .
(Privacy proﬁle, the
end
point of searching (cid:15) h , µ given by Theorem 4.
reciprocal of
error margin
, searching range)
; Output: µ − , µ + (lower and upper bound of
; i ← 0 ; n ← (cid:100)√ 8 cπ(cid:15) h (cid:101) + 1 ; D ← (cid:15) h n − 1 ; µ − ← max( µ h , µ t ) ; µ + ← µ max
S =
[0, 1, · · · , n + 1 ];
Shufﬂe S ; while i ≤ n + 1 do x − ← S [ i ] D + (cid:15) h ; x + ← S
[ i + 1] D + (cid:15) h ; if δ µ + ( x − ) <
δ A ( x + ) then µ + ← µ + GDP ( x − , δ A ( x +
The time complexity of shufﬂing S is O ( n ) =
O ( (cid:15) h c ) .
Each binary search has a time complexity of
O (log( c )) and the expected number of binary searches is O (log( (cid:15) h c )) .
The overall time complexity of the optimized algorithm is therefore O ( (cid:15) h c
+ log 2 ( c ) log( (cid:15) h )) .
E A PPENDIX
[Figure]
P LOTS E. T HE L APLACE MECHANISM UNDER GDP
E. T HE EFFECT OF SUBSAMPLING