The Optimal Mechanism in Differential Privacy · 11/07/2013 PhD Final Exam of Quan Geng, ECE, UIUC 9 database Collect data Users Database Curator Analyst Query Released info. •Database

The Optimal Mechanism in Differential Privacy

Quan GengAdvisor: Prof. Pramod Viswanath

11/07/2013 PhD Final Exam of Quan Geng, ECE, UIUC 1

Outline

•Background on Differential Privacy

• 𝜖-Differential Privacy: Single Dimensional Setting

• 𝜖-Differential Privacy: Multiple Dimensional Setting

• (𝜖, 𝛿)-Differential Privacy

•Conclusion


•Vast amounts of personal information are collected

•Data analysis produces a lot of useful applications

Motivation


•How to release the data while protecting individual’s privacy?

Motivation


Big DataRelease data/info.

Analyst

Applications

Motivation


• How to protect PRIVACY resilient to attacks with arbitrary side information?

Motivation



• Answer: randomized releasing mechanism

Motivation




•How much randomness is needed?• completely random (no utility)

• deterministic (no privacy)

Motivation




•How much randomness is needed?• completely random (no utility)

• deterministic (no privacy)

• Differential Privacy [Dwork et. al. 06]: one way to quantify the level of randomness and privacy

Background on Differential Privacy


database

Collect data

Users

Database Curator

Analyst

Query

Released info.

• Database Curator: How to answer a query, providing usefuldata information to the analyst, while still protecting the privacy of each user.



database

Collect data

Users

Database Curator

Analyst

Query

Released info.

dataset: D query function: 𝑞 (D) randomized released mechanism: K DAge

A: 20

B: 35

C: 43

D: 30

q: How many people are older than 32?

q(D) = 2

K(D) = 1 w.p. 1/8K(D) = 2 w.p. 1/2K(D) = 3 w.p. 1/4K(D) = 4 w.p. 1/8



• Two neighboring datasets: differ only at one element

Age

A: 20

B: 35

C: 43

D: 30

Age

A: 20

B: 35

D: 30

𝐷1 𝐷2



• Two neighboring datasets: differ only at one element

Age

A: 20

B: 35

C: 43

D: 30

Age

A: 20

B: 35

D: 30

𝐷1 𝐷2

Differential Privacy: presence or absence of any individual record in the dataset should not affect the released information significantly.

𝐾 𝐷1 ≈ 𝐾(𝐷2)



• A randomized mechanism 𝐾 gives 𝝐-differential privacy, if for any two neighboring datasets 𝐷1, 𝐷2 , and all 𝑆 ⊂Range(K),

𝐏𝐫 𝐊 𝐃𝟏 ∈ 𝐒 ≤ 𝐞𝛜 𝐏𝐫 𝐊 𝐃𝟐 ∈ 𝐒





Make hypothesis testing hard:𝑒𝜖𝑃𝐹𝐴 + 𝑃𝑀𝐷 ≥ 1𝑃𝐹𝐴 + 𝑒

𝜖𝑃𝑀𝐷 ≥ 1





• 𝝐 quantifies the level of privacy• 𝜖 → 0, high privacy• 𝜖 → +∞, low privacy• a social question to choose 𝝐 (can be 0.01, 0.1, 1, 10 …)



• Q: How much perturbation needed to achieve 𝜖-DP?

• A: depends on how different 𝑞 𝐷1 , 𝑞(𝐷2) are





𝑞 𝐷1 , 𝑞(𝐷2)

If 𝑞 𝐷1 = 𝑞 𝐷2 , no perturbation is needed.





𝑓𝐷1(𝑥) 𝑓𝐷2(𝑥)

𝑞 𝐷1 𝑞(𝐷2)

If |𝑞 𝐷1 − 𝑞 𝐷2 | is small, use small perturbation





𝑓𝐷1(𝑥)𝑓𝐷2(𝑥)

𝑞 𝐷1 𝑞(𝐷2)

If |𝑞 𝐷1 − 𝑞 𝐷2 | is large, use large perturbation



• Global Sensitivity Δ: how different when q is applied to neighboring datasets

𝜟 ≔ 𝐦𝐚𝐱(𝑫𝟏,𝑫𝟐) 𝒂𝒓𝒆 𝒏𝒆𝒊𝒈𝒉𝒃𝒐𝒓𝒔

|𝒒 𝑫𝟏 − 𝒒 𝑫𝟐 |

• Example: for a count query, Δ = 1



• Laplace Mechanism:

𝑲 𝑫 = 𝒒 𝑫 + 𝑳𝒂𝒑(Δ

𝜖),

𝐿𝑎𝑝𝛥

𝜖is a r.v. with p.d.f 𝑓 𝑥 =

1

2𝜆𝑒−|𝑥|

𝜆 , 𝜆 =Δ

𝜖

• Basic tool in DP

𝑓𝐷1(𝑥) 𝑓𝐷2(𝑥)

Optimality of Existing work?




𝜖),

• Two Questions:• Is data-independent perturbation optimal?

• Assume data-independent perturbation, is Laplacian distribution optimal?

Optimality of Existing work?




𝜖),

• Two questions:• Is data-independent perturbation optimal?• Assume data-independent perturbation, is Laplacian distribution

optimal?

• Our results:• data-independent perturbation is optimal• Laplacian distribution is not optimal: the optimal is staircase

distribution

Part One:

The Optimal Mechanism in 𝝐-Differential Privacy: Single Dimensional Setting


presented in my preliminary exam

Recap of Part One: Problem Formulation


m𝑖𝑛𝑖𝑚𝑖𝑧𝑒 supt∈𝑅 𝑥∈𝑅 𝐿 𝑥 𝜈𝑡(𝑑𝑥)

s.t. 𝛎t1 S ≤ eϵ𝛎t2 S + t1 − t2 ,

∀measurable set S, ∀t1, t2 ∈ R, s. t. t1 − t2 ≤ Δ,

𝑳: 𝑅 → 𝑅 cost function on the noise𝛎𝑡 noise probability distribution given query output tΔ global sensitivity

11/07/2013 26

• Optimality of query-output independent perturbationIn the optimal mechanism, 𝜈𝑡 is independent of 𝑡 (under a technical condition).

• Staircase MechanismOptimal noise probability distribution has staircase-shaped p.d.f.

Recap of Part One: Main Results

Minimize L x P dxs.t. Pr X ∈ S ≤ eϵ Pr X ∈ S + d ,∀ d ≤ Δ,measurable set S

11/07/2013 27

• ℓ𝟏: 𝐋 𝐱 = |𝐱|

• ℓ𝟐: 𝐋 𝒙 = 𝐱𝟐

Recap of Part One: Applications

𝑽 𝑷𝜸∗ = 𝚫𝒆𝝐𝟐

𝒆𝝐 − 𝟏

𝜖 → 0, the additive gap → 0

𝜖 → +∞, 𝑉 𝑃𝛾∗ = Θ(Δe−𝜖

2)

𝑉𝐿𝑎𝑝 =Δ

𝜖

𝜖 → 0, the additive gap ≤ 𝑐Δ2

𝜖 → +∞, 𝑉 𝑃𝛾∗ = Θ(Δ2 e−

2𝜖

3 )

𝑉𝐿𝑎𝑝 =2Δ2

𝜖2

Huge improvement in low privacy regime

11/07/2013 28

• Properties of 𝛾∗ (for 𝐿 𝑥 = 𝑥 𝑚)

• Extension to Discrete Setting

• Extension to Abstract Setting

Recap of Part One: Applications

Conclusion of Part One:


• Fundamental tradeoff between privacy and utility in 𝜖-Differential Privacy

• Staircase Mechanism, optimal mechanism for single real-valued query• Huge improvement in low privacy regime

• Extension to discrete setting and abstract setting

Part Two:

The Optimal Mechanism in 𝝐-Differential Privacy: Multiple Dimensional Setting



• Query output can have multiple components

𝒒 𝑫 = 𝒒𝟏 𝑫 , 𝒒𝟐 𝑫 ,… , 𝒒𝒅 𝑫 ∈ 𝑹𝒅

Multiple Dimensional Setting



𝒒 𝑫 = 𝒒𝟏 𝑫 , 𝒒𝟐 𝑫 ,… , 𝒒𝒅 𝑫 ∈ 𝑹𝒅

• If all components are uncorrelated, perturb each component independently to preserve DP.




𝒒 𝑫 = 𝒒𝟏 𝑫 , 𝒒𝟐 𝑫 ,… , 𝒒𝒅 𝑫 ∈ 𝑹𝒅

• If all components are uncorrelated, perturb each component independently to preserve DP.

• Composition Theorem:

For each component 𝒒𝑖 (𝑫) preserving 𝜖-DP, end-to-end achieves 𝒅𝝐-DP.




𝒒 𝑫 = 𝒒𝟏 𝑫 , 𝒒𝟐 𝑫 ,… , 𝒒𝒅 𝑫 ∈ 𝑹𝒅

• For some query, all components are coupled together.

Histogram query: one user can affect only one component




𝒒 𝑫 = 𝒒𝟏 𝑫 , 𝒒𝟐 𝑫 ,… , 𝒒𝒅 𝑫 ∈ 𝑹𝒅

• For some query, all components are coupled together.

• Global sensitivity

𝚫 ≔ max𝑫𝟏,𝑫𝟐 𝒂𝒓𝒆 𝒏𝒆𝒊𝒈𝒉𝒃𝒐𝒓𝒔

|𝒒 𝑫𝟏 − 𝒒 𝑫𝟐 | 𝟏

Histogram query: 𝚫 = 1


Problem Formulation:


Query-output independent perturbation:

𝑲 𝑫 = 𝒒(𝑫) + 𝑿= (𝒒𝟏 𝑫 + 𝒙𝟏, 𝒒𝟐 𝑫 + 𝒙𝟐, … , 𝒒𝒅 𝑫 + 𝒙𝒅)





Cost function on the noise:

𝐿: 𝑅𝑑 → 𝑅

Optimization problem:

𝑚𝑖𝑛𝑖𝑚𝑖𝑧𝑒 𝑅𝑑𝐿 𝑥1, … , 𝑥𝑑 𝑃(𝑑𝑥1⋯𝑑𝑥𝑑)

s.t. 𝑃 𝑆 ≤ 𝑒𝜖𝑃 𝑆 + 𝒕 , ∀𝑆 ⊂ 𝑅𝑑 , 𝒕 1 ≤ Δ


38



Cost function on the noise:

𝐿: 𝑅𝑑 → 𝑅

Our Result: Optimality of Staircase Mechanism

39

Theorem: If 𝐿 𝑥1, … , 𝑥𝑑 = 𝑥1 +⋯+ 𝑥𝑑 , 𝑑 = 2, then optimal probability distribution has multidimensional staircase-shaped p.d.f.


40



41


Conjecture: the result holds for any 𝒅

Proof Ideas


Step 1: Argue only need to consider multi-dimensional piecewise constant p.d.f. by averaging

𝑥1

𝑥2

0

Averaging preserves DP

Proof Ideas

PhD Final Exam of Quan Geng, ECE, UIUC 43

Step 1: Argue only need to consider multi-dimensional piecewise constant p.d.f. by averaging

𝑥1

𝑥2

Averaging preserves DP𝑃1 ≤ 𝑒𝜖 𝑃5𝑃1 ≤ 𝑒𝜖 𝑃6𝑃1 ≤ 𝑒𝜖 𝑃16𝑃1 ≤ 𝑒𝜖 𝑃7𝑃1 ≤ 𝑒𝜖 𝑃15……

𝑃4 ≤ 𝑒𝜖 𝑃12𝑃4 ≤ 𝑒𝜖 𝑃13𝑃4 ≤ 𝑒𝜖 𝑃14𝑃4 ≤ 𝑒𝜖 𝑃15𝑃4 ≤ 𝑒𝜖 𝑃16

𝑖=14 𝑃𝑖

4≤ 𝑒𝜖 𝑖=516 𝑃𝑖

12

Proof Ideas


𝑥2

0

Averaging preserves DP

Formulate a matrix filling-in problem• row sum is a constant• column sum is a constant

Explicit formula for 𝒅 = 𝟐, and arbitrary 𝚫

Proof Ideas


Due to Step 1, the p.d.f. is a function of 𝑿 𝟏

Step 2: Monotonicity

Step 3: Geometrically Decaying

Step 4: Staircase-Shape

Optimal 𝜸∗ for ℓ𝟏 cost function (d=2)


Asymptotic analysis


Laplacian Mechanism: 𝑽 =𝟐𝚫

𝝐

Multidimensional Staircase Mechanism:High privacy regime(𝜖 → 0):

Low privacy regime(𝜖 → ∞):

Asymptotic analysis


Laplacian Mechanism: 𝑽 =𝟐𝚫

𝝐

Multidimensional Staircase Mechanism:High privacy regime(𝜖 → 0):

Low privacy regime(𝜖 → ∞):Independent Staircase Mechanism:

𝑉 = Θ(2Δ𝑒−𝜖4)

Conclusion of Part Two:


• Extension of Optimality of Staircase Mechanism to Multi-dimensional Setting (𝑑 = 2)• Conjecture: holds for any dimension

•Approximate Optimality of Laplacian Mechanism in High Privacy Regime

•Huge Improvement in Low Privacy Regime

Part Three:

The Optimal Mechanism in (𝝐, 𝜹)-Differential Privacy


Part Three: (𝜖,𝛿)-differential privacy


• (𝜖, 𝛿)-differential privacy

𝐏𝐫 𝐊 𝐃𝟏 ∈ 𝐒 ≤ 𝐞𝛜 𝐏𝐫 𝐊 𝐃𝟐 ∈ 𝐒 + 𝛅

• Two special cases:• (𝝐, 𝟎)-differential privacy

• well studied in Part 1 and Part 2

• (𝟎, 𝜹)-differential privacy

52



• Make hypothesis testing hard:

𝑒𝜖𝑃𝐹𝐴 + 𝑃𝑀𝐷 ≥ 1 − 𝛿

𝑃𝐹𝐴 + 𝑒𝜖𝑃𝑀𝐷 ≥ 1 − 𝛿

(𝜖,𝛿)-Differential Privacy

11/07/2013 PhD Final Exam of Quan Geng, ECE, UIUC

53



• Make hypothesis testing hard:

𝑒𝜖𝑃𝐹𝐴 + 𝑃𝑀𝐷 ≥ 1 − 𝛿

𝑃𝐹𝐴 + 𝑒𝜖𝑃𝑀𝐷 ≥ 1 − 𝛿

• Standard approach: adding Gaussian noise



54

• (𝜖, 𝛿)-differential privacy 𝐏𝐫 𝐊 𝐃𝟏 ∈ 𝐒 ≤ 𝐞

𝛜 𝐏𝐫 𝐊 𝐃𝟐 ∈ 𝐒 + 𝛅

• What is the optimal noise probability distribution in this setting?

• Our Results:• (0, 𝛿)-DP

Optimality of Uniform Noise Mechanism

• (𝜖, 𝛿)-DPNot much more general than (𝜖, 0)- and (0, 𝛿)-DP Near-Optimality of Laplacian and Uniform Noise Mechanism in high privacy regime as 𝜖, 𝛿 → 0,0



55

Problem Formulation

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ eϵP S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ


56

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ

(0,𝛿)-Differential Privacy

• Theorem:

If Δ = 1, assuming 1

2𝛿is an integer, optimal noise P.D. is

𝛿

𝑖

P(𝑖)

−1

2𝛿

1

2𝛿− 1


57

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ

(0,𝛿)-Differential Privacy

• Theorem:

If Δ = 1, assuming 1

2𝛿is an integer, optimal noise P.D. is

𝛿

𝑖

P(𝑖)

−1

2𝛿

1

2𝛿− 1

Proof idea: choose 𝑆 = 𝑆𝑘 = {𝑙: 𝑙 ≥ 𝑘},then 𝑃 𝑘 ≤ 𝛿, ∀𝑘


58

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ

(0,𝛿)-DP: General 𝚫

• Upper Bound: Uniform Noise Mechanism

𝛿

Δ

𝑖

P(𝑖)

−Δ

2𝛿

Δ

2𝛿− 1

𝑉∗ ≤ 𝑉𝑈𝐵 ≔ 2 𝑖=1

𝛿2Δ−1 𝛿

Δ𝐿 𝑖 +

𝛿

Δ𝐿(Δ

2𝛿)


59

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ


• Lower Bound: Duality of Linear Programming

choose 𝑆 = 𝑆𝑘 = {𝑙: 𝑙 ≥ 𝑘}, then 𝑖=𝑘𝑘+Δ−1𝑃(𝑖) ≤ 𝛿, ∀𝑘

60

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ



choose 𝑆 = 𝑆𝑘 = {𝑙: 𝑙 ≥ 𝑘}, then 𝑖=𝑘𝑘+Δ−1𝑃(𝑖) ≤ 𝛿, ∀𝑘

𝑉𝐿𝐵 = 2𝛿

𝑖=0

12𝛿−1

𝐿(1 + 𝑖Δ)

61

(0,𝛿)-DP: Comparison of 𝑽𝑳𝑩, 𝑽𝑼𝑩

• 𝑳(𝒊) = |𝒊|

11/07/2013

Constant additive gap

62


• 𝑳(𝒊) = |𝒊|

• 𝑳(𝒊) = 𝒊 𝟐

11/07/2013


Constant multiplicative gap

63


• 𝑳(𝒊) = |𝒊|

• 𝑳(𝒊) = 𝒊 𝟐

• 𝑳(𝒊) = 𝒊 𝒎

11/07/2013


Constant multiplicative gap

64

(𝝐,𝛿)-DP: Upper Bound

•Both (𝝐,0)-DP and (0,𝛿)-DP imply (𝝐,𝛿)-DP

𝑽∗ ≤ 𝒎𝒊𝒏 (𝑽𝑳𝒂𝒑, 𝑽𝑼𝒏𝒊𝒇𝒐𝒓𝒎)

V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ e𝜖P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ


Laplacian Mechanism:

continuous: 𝑓 𝑥 = 12𝜆𝑒−|𝑥|

𝜆 , 𝜆 =Δ

𝜖

discrete: 𝑃 𝑘 = 1−𝑒−𝜖Δ

1+𝑒−𝜖Δ

𝑒−|𝑘|𝜖

Δ

65

(𝝐,𝛿)-DP: Lower Bound V∗ ≔ m𝑖𝑛

i=−∞

+∞

L i P(i)

s.t. P S ≤ e𝜖P S + 𝑑 + 𝛿,∀S ⊂ 𝑍, 𝑑 ∈ 𝑍, 𝑑 ≤ Δ


choose 𝑆 = 𝑆𝑘 = {𝑙: 𝑙 ≥ 𝑘}, by symmetry

66

(𝝐,𝛿)-DP: Comparison of 𝑽𝑳𝑩, 𝑽𝑼𝑩

• 𝑳(𝒊) = |𝒊|, as 𝜖, 𝛿 → (0,0)

𝑚𝑖𝑛 (𝑉𝐿𝑎𝑝, 𝑉𝑈𝑛𝑖𝑓𝑜𝑟𝑚)

5.29≤ 𝑉𝐿𝐵 ≤ 𝑉

∗ ≤ 𝑉𝑈𝐵 = 𝑚𝑖𝑛 (𝑉𝐿𝑎𝑝, 𝑉𝑈𝑛𝑖𝑓𝑜𝑟𝑚)


= Θ(min1

𝜖,1

𝛿)

67

(𝝐,𝛿)-DP: Comparison of 𝑽𝑳𝑩, 𝑽𝑼𝑩

• 𝑳(𝒊) = |𝒊|, as 𝜖, 𝛿 → (0,0)


5.29≤ 𝑉𝐿𝐵 ≤ 𝑉


• 𝑳 𝒊 = 𝒊 𝟐, as 𝜖, 𝛿 → (0,0)


40≤ 𝑉𝐿𝐵 ≤ 𝑉



= Θ(min1

𝜖,1

𝛿)

= Θ(𝑚𝑖𝑛1

𝜖2,1

𝛿2)

68

(𝝐,𝛿)-DP: Multi-Dimensional Setting


V∗ ≔ m𝑖𝑛

𝑍𝑑

L i1, 𝑖2, … , 𝑖𝑑 P(i1, 𝑖2, … , 𝑖𝑑)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍𝑑 , 𝑑 ∈ 𝑍𝑑 , 𝑑 1 ≤ Δ• Upper Bound

Uniform Noise Mechanism

Discrete Laplacian Mechanism

𝑃 𝑖1, ⋯ , 𝑖𝑑 =1 − 𝜆

1 + 𝜆

𝑑

𝜆 𝑖1 +⋯+|𝑖𝑑|, 𝜆 = 𝑒−𝜖/Δ

69



V∗ ≔ m𝑖𝑛

𝑍𝑑

L i1, 𝑖2, … , 𝑖𝑑 P(i1, 𝑖2, … , 𝑖𝑑)

s.t. P S ≤ P S + 𝑑 + 𝛿,∀S ⊂ 𝑍𝑑 , 𝑑 ∈ 𝑍𝑑 , 𝑑 1 ≤ Δ

• Lower Bound1. Choose certain sets 𝑆 = 𝑆𝑘

𝑚 ≔ { 𝑖1, ⋯ , 𝑖𝑑 ∈ 𝑍𝑑|𝑖𝑚 ≥ 𝑘}

2. Write down Linear program, and derive the dual problem3. Find proper dual variables to get lower bound

70



Primal Problem Dual Problem

71



• (𝟎,𝛿)-DP:

Uniform Noise Mechanism is Optimal when 𝜟 = 𝟏

ℓ1 ℓ2

• (𝝐,𝛿)-DP:


𝐶≤ 𝑉𝐿𝐵 ≤ 𝑉


𝐶 ≈ 9.49, 𝑓𝑜𝑟 ℓ1

𝐶 ≈ 113, 𝑓𝑜𝑟 ℓ2

Conclusion of Part Three


•Near-Optimality of Uniform Noise Mechanism in 0, 𝛿 -DP

• (𝜖, 𝛿)-DP is not much more general than (0, 𝛿)-DP and (𝜖,0)-DP


𝐶≤ 𝑉𝐿𝐵 ≤ 𝑉


Conclusion


• Fundamental tradeoff between privacy and utility in Differential Privacy

• Staircase Mechanism, optimal mechanism in 𝜖-DP• Huge improvement in low privacy regime• Extension to Multi-Dimensional Setting

• Uniform Noise Mechanism, near-optimal mechanism in (0, 𝛿)-DP

• (𝜖, 𝛿)-DP is not much more general than (0, 𝛿)-DP and (𝜖,0)-DP

Acknowledgment


Thanks to my advisor, Prof. Pramod Viswanath

Thank you!


Documents

The Optimal Mechanism in Differential Privacy · 11/07/2013 PhD Final Exam of Quan Geng, ECE, UIUC 9 database Collect data Users Database Curator Analyst Query Released info. •Database