Misplaced Pages

This article may be too technical for most readers to understand. Please help improve it to make it understandable to non-experts, without removing the technical details. (July 2024) (Learn how and when to remove this message)

Adding controlled noise from predetermined distributions is a way of designing differentially private mechanisms. This technique is useful for designing private mechanisms for real-valued functions on sensitive data. Some commonly used distributions for adding noise include Laplace and Gaussian distributions.

Sensitivity

Both mechanisms require that the _sensitivity_ of a query function first be determined. The sensitivity is the amount that the result of the query can be changed by adding or removing a person's data from the dataset, where "a person" is any possible person. For queries that count the number of people who meet a requirement, the sensitivity is 1.

Formal Definition

Here is the formal definition of sensitivity.

Let ${\displaystyle {\mathcal {D}}}$ be a collection of all datasets and ${\displaystyle f\colon {\mathcal {D}}\to \mathbb {R} }$ be a real-valued function. The sensitivity of a function, denoted ${\displaystyle \Delta f}$, is defined by

${\displaystyle \Delta f=\max |f(x)-f(y)|,}$

where the maximum is over all pairs of datasets ${\displaystyle x}$ and ${\displaystyle y}$ in ${\displaystyle {\mathcal {D}}}$ differing in at most one element. For functions with higher dimensions, the sensitivity is usually measured under ${\displaystyle \ell _{1}}$ or ${\displaystyle \ell _{2}}$ norms.

Throughout this article, ${\displaystyle {\mathcal {M}}}$ is used to denote a randomized algorithm that releases a sensitive function ${\displaystyle f}$ under the ${\displaystyle \epsilon }$- (or ${\displaystyle (\epsilon ,\delta )}$-) differential privacy.

Real-valued functions

A Real-valued function is any function that returns a "real" value --- that is, a positive or negative number that can be represented by decimal fraction (e.g. 0.5, or 1.32).

The Laplace Mechanism

Introduced by Dwork et al., this mechanism adds noise drawn from a Laplace distribution:

${\displaystyle {\mathcal {M}}_{\mathrm {Lap} }(x,f,\epsilon )=f(x)+\mathrm {Lap} \left(\mu =0,b={\frac {\Delta f}{\epsilon }}\right),}$

where ${\displaystyle \mu }$ is the expectation of the Laplace distribution and ${\displaystyle b}$ is the scale parameter. Roughly speaking, a small-scale noise should suffice for a weak privacy constraint (corresponding to a large value of ${\displaystyle \epsilon }$), while a greater level of noise would provide a greater degree of uncertainty in what was the original input (corresponding to a small value of ${\displaystyle \epsilon }$).

To argue that the mechanism satisfies ${\displaystyle \epsilon }$-differential privacy, it suffices to show that the output distribution of ${\displaystyle {\mathcal {M}}_{\mathrm {Lap} }(x,f,\epsilon )}$ is close in a multiplicative sense to ${\displaystyle {\mathcal {M}}_{\mathrm {Lap} }(y,f,\epsilon )}$ everywhere.$${\displaystyle {\begin{aligned}{\frac {\mathrm {Pr} ({\mathcal {M}}_{\mathrm {Lap} }(x,f,\epsilon )=z)}{\mathrm {Pr} ({\mathcal {M}}_{\mathrm {Lap} }(y,f,\epsilon )=z)}}&={\frac {\mathrm {Pr} (f(x)+\mathrm {Lap} (0,{\frac {\Delta f}{\epsilon }})=z)}{\mathrm {Pr} (f(y)+\mathrm {Lap} (0,{\frac {\Delta f}{\epsilon }})=z)}}\\&={\frac {\mathrm {Pr} (\mathrm {Lap} (0,{\frac {\Delta f}{\epsilon }})=z-f(x))}{\mathrm {Pr} (\mathrm {Lap} (0,{\frac {\Delta f}{\epsilon }})=z-f(y))}}\\&={\frac {{\frac {1}{2b}}\exp \left(-{\frac {|z-f(x)|}{b}}\right)}{{\frac {1}{2b}}\exp \left(-{\frac {|z-f(y)|}{b}}\right)}}\\&=\exp \left({\frac {|z-f(y)|-|z-f(x)|}{b}}\right)\\&\leq \exp \left({\frac {|f(y)-f(x)|}{b}}\right)\\&\leq \exp \left({\frac {\Delta f}{b}}\right)=\exp(\epsilon ).\end{aligned}}}$$ The first inequality follows from the triangle inequality and the second from the sensitivity bound. A similar argument gives a lower bound of ${\displaystyle \exp(-\epsilon )}$.

A discrete variant of the Laplace mechanism, called the geometric mechanism, is universally utility-maximizing. It means that for any prior (such as auxiliary information or beliefs about data distributions) and any symmetric and monotone univariate loss function, the expected loss of any differentially private mechanism can be matched or improved by running the geometric mechanism followed by a data-independent post-processing transformation. The result also holds for minimax (risk-averse) consumers. No such universal mechanism exists for multi-variate loss functions.

The Gaussian Mechanism

Analogous to Laplace mechanism, Gaussian mechanism adds noise drawn from a Gaussian distribution whose variance is calibrated according to the sensitivity and privacy parameters. For any ${\displaystyle \delta \in (0,1)}$ and ${\displaystyle \epsilon \in (0,1)}$, the mechanism defined by:

${\displaystyle {\mathcal {M}}_{\text{Gauss}}(x,f,\epsilon ,\delta )=f(x)+{\mathcal {N}}\left(\mu =0,\sigma ^{2}={\frac {2\ln(1.25/\delta )\cdot (\Delta f)^{2}}{\epsilon ^{2}}}\right)}$

provides ${\displaystyle (\epsilon ,\delta )}$-differential privacy.

Note that, unlike Laplace mechanism, ${\displaystyle {\mathcal {M}}_{\text{Gauss}}}$ only satisfies ${\displaystyle (\epsilon ,\delta )}$-differential privacy with ${\displaystyle \epsilon <1}$. To prove so, it is sufficient to show that, with probability at least ${\displaystyle 1-\delta }$, the distribution of ${\displaystyle {\mathcal {M}}_{\text{Gauss}}(x,f,\epsilon ,\delta )}$ is close to ${\displaystyle {\mathcal {M}}_{\text{Gauss}}(y,f,\epsilon ,\delta )}$. See Appendix A in Dwork and Roth for a proof of this result).

High dimensional functions

For high dimensional functions of the form ${\displaystyle f\colon {\mathcal {D}}\to \mathbb {R} ^{d}}$, where ${\displaystyle d\geq 2}$, the sensitivity of ${\displaystyle f}$ is measured under ${\displaystyle \ell _{1}}$ or ${\displaystyle \ell _{2}}$ norms. The equivalent Gaussian mechanism that satisfies ${\displaystyle (\epsilon ,\delta )}$-differential privacy for such function (still under the assumption that ${\displaystyle \epsilon <1}$) is

${\displaystyle {\mathcal {M}}_{\text{Gauss}}(x,f,\epsilon ,\delta )=f(x)+{\mathcal {N}}^{d}\left(\mu =0,\sigma ^{2}={\frac {2\ln(1.25/\delta )\cdot (\Delta _{2}f)^{2}}{\epsilon ^{2}}}\right),}$

where ${\displaystyle \Delta _{2}f}$ represents the sensitivity of ${\displaystyle f}$ under ${\displaystyle \ell _{2}}$ norm and ${\displaystyle {\mathcal {N}}^{d}(0,\sigma ^{2})}$ represents a ${\displaystyle d}$-dimensional vector, where each coordinate is a noise sampled according to ${\displaystyle {\mathcal {N}}(0,\sigma ^{2})}$ independent of the other coordinates (see Appendix A in Dwork and Roth for proof).

References

1. ^ Dwork, Cynthia; McSherry, Frank; Nissim, Kobbi; Smith, Adam (2006). "Calibrating Noise to Sensitivity in Private Data Analysis". Theory of Cryptography. Lecture Notes in Computer Science. Vol. 3876. pp. 265–284. doi:10.1007/11681878_14. ISBN 978-3-540-32731-8.
2. Ghosh, Arpita; Roughgarden, Tim; Sundararajan, Mukund (2012). "Universally Utility-maximizing Privacy Mechanisms". SIAM Journal on Computing. 41 (6): 1673–1693. arXiv:0811.2841. doi:10.1137/09076828X.
3. Gupte, Mangesh; Sundararajan, Mukund (June 2010). "Universally optimal privacy mechanisms for minimax agents". Proceedings of the twenty-ninth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems. pp. 135–146. arXiv:1001.2767. doi:10.1145/1807085.1807105. ISBN 9781450300339. S2CID 11553565.
4. Brenner, Hai; Nissim, Kobbi (January 2014). "Impossibility of Differentially Private Universally Optimal Mechanisms". SIAM Journal on Computing. 43 (5): 1513–1540. arXiv:1008.0256. doi:10.1137/110846671. S2CID 17362150.
5. ^ Dwork, Cynthia; Roth, Aaron (2013). "The Algorithmic Foundations of Differential Privacy" (PDF). Foundations and Trends in Theoretical Computer Science. 9 (3–4): 211–407. doi:10.1561/0400000042. ISSN 1551-305X.

• Differential privacy
• Information privacy