Beyond the Calibration Point: Mechanism Comparison in Differential Privacy

2024-06-13

International Conference on Machine Learning

AI Summary

Differential privacy (DP) mechanisms are commonly reported at a single $(varepsilon,delta)$ point, obscuring substantial differences in actual privacy risk among mechanisms sharing identical $(varepsilon,delta)$ parameters—leading to systematic underestimation of risk. Method: We propose a unified quantification framework grounded in $Delta$-divergence, integrating f-differential privacy, Bayesian privacy interpretations, and Blackwell order theory for the first time to establish a decision-theoretically principled paradigm for comparing DP mechanisms. Contribution/Results: By rigorously characterizing worst-case privacy vulnerability disparities, we expose non-negligible excess risk in mainstream noise mechanisms used in DP-SGD. Our framework yields a verifiable, ordinal privacy strength assessment tool—enabling rigorous, theoretically grounded selection of privacy-preserving mechanisms.

Technology Category

• Machine Learning: Privacy
• Reasoning under Uncertainty: Stochastic Optimization
• Game Theory and Economic Paradigms: Mechanism Design

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Economics, Online Markets and Human Computation: Fairness, privacy, and diversity in economic environments

Abstract

In differentially private (DP) machine learning, the privacy guarantees of DP mechanisms are often reported and compared on the basis of a single $(varepsilon, delta)$-pair. This practice overlooks that DP guarantees can vary substantially even between mechanisms sharing a given $(varepsilon, delta)$, and potentially introduces privacy vulnerabilities which can remain undetected. This motivates the need for robust, rigorous methods for comparing DP guarantees in such cases. Here, we introduce the $Delta$-divergence between mechanisms which quantifies the worst-case excess privacy vulnerability of choosing one mechanism over another in terms of $(varepsilon, delta)$, $f$-DP and in terms of a newly presented Bayesian interpretation. Moreover, as a generalisation of the Blackwell theorem, it is endowed with strong decision-theoretic foundations. Through application examples, we show that our techniques can facilitate informed decision-making and reveal gaps in the current understanding of privacy risks, as current practices in DP-SGD often result in choosing mechanisms with high excess privacy vulnerabilities.

Problem

• Comparing DP mechanisms beyond single (ε, δ) pairs
• Quantifying worst-case excess privacy vulnerabilities
• Addressing gaps in current DP-SGD privacy risk understanding

Innovation

• Introduces Δ-divergence for comparing DP mechanisms
• Generalizes Blackwell theorem for decision-theoretic foundations
• Analyzes privacy risks in DP-SGD practices