Achieving Dalenius' Goal of Data Privacy with Practical Assumptions

TL;DR

This paper introduces an information-theoretic framework for data privacy inspired by Dalenius' goal, overcoming differential privacy limitations by leveraging Shannon's perfect secrecy and practical knowledge constraints, and demonstrating improved utility-privacy tradeoffs.

Contribution

It establishes a novel information privacy framework satisfying Dalenius' security, with proven mechanisms and a reduction to finite convex optimization for practical application.

Findings

Mechanisms satisfy Dalenius' privacy requirements

Individual channel capacity decreases with higher entropy constraints

Framework outperforms classical differential privacy in utility-privacy tradeoffs

Abstract

Current differential privacy frameworks face significant challenges: vulnerability to correlated data attacks and suboptimal utility-privacy tradeoffs. To address these limitations, we establish a novel information-theoretic foundation for Dalenius' privacy vision using Shannon's perfect secrecy framework. By leveraging the fundamental distinction between cryptographic systems (small secret keys) and privacy mechanisms (massive datasets), we replace differential privacy's restrictive independence assumption with practical partial knowledge constraints ($H(X) \geq b$). We propose an information privacy framework achieving Dalenius security with quantifiable utility-privacy tradeoffs. Crucially, we prove that foundational mechanisms -- random response, exponential, and Gaussian channels -- satisfy Dalenius' requirements while preserving group privacy and composition properties. Our channel capacity analysis reduces infinite-dimensional evaluations to finite convex optimizations, enabling direct application of information-theoretic tools. Empirical evaluation demonstrates that individual channel capacity (maximal information leakage of each individual) decreases with increasing entropy constraint $b$, and our framework achieves superior utility-privacy tradeoffs compared to classical differential privacy mechanisms under equivalent privacy guarantees. The framework is extended to computationally bounded adversaries via Yao's theory, unifying cryptographic and statistical privacy paradigms. Collectively, these contributions provide a theoretically grounded path toward practical, composable privacy -- subject to future resolution of the tradeoff characterization -- with enhanced resilience to correlation attacks.

Equations

$$C_1^{\mathbb{P}}=\underset{i\in [n],X\in \mathbb{P}}{\max }I(X_i;Y),$$

$$C_1^{\mathbb{P}}\le ϵ,$$

$$I_{\infty }(X;Y)=\underset{x\in \mathcal{X},y\in \mathcal{Y}}{\max }\log \frac{p(y|x)}{p(y)}.$$

$$C_{1,\infty }^{\mathbb{P}}=\underset{i\in [n],X\in \mathbb{P}}{\max }{I}_{\infty }(X_i;Y),$$

$$C_{1,\infty }^{\mathbb{P}}\le ϵ,$$

$${\mathbb{P}}_{ind}=\left\{p(x)\in \Delta (\mathcal{X}):p(x)=\prod _{i=1}^{n}p(x_i),\forall x=(x_1,\dots ,x_n)\in \mathcal{X}\right\},$$

$$\log \frac{p(y|x)}{p(y|x^{\prime })}\le ϵ,$$

$$\log \frac{p(y|x)}{p(y|x^{\prime })}\le ϵ.$$

$$I_{\infty }(X_i;Y)=\underset{x_i,y}{\max }\log \frac{p(y|x_i)}{p(y)}=$$

$$\le$$

$$=$$

$$\le$$

$$\Delta (\mathcal{X}{)}_b=\{X\in \Delta (\mathcal{X}):H(X)\ge b\}$$

$$C_1=C_1^b+\delta .$$

$$\delta =g(b)=C_1-C_1^b,b\in [0,\log |\mathcal{X}|]$$

$$0=g(0)\le g(b)\le g(\log |\mathcal{X}|)\le C_1$$

$$f(x_1,x_2)=\{\begin{array}{ll}1& x_1=x_2\\ 0& \text{mbox}otherwise\end{array}$$

$$C_1=\underset{i\in [n],X\in \Delta (\mathcal{X})}{\max }I(X_i;Y)=$$

$$=$$

$$p(y|x_i)=\sum _{x_{(i)}}p(y|x_i,x_{(i)})p(x_{(i)}|x_i)$$

$$\left(\begin{array}{c}p(y_1|x_1)\\ p(y_2|x_1)\end{array}\right)=\left(\begin{array}{cc}p(y_1|x_1,x_{21})& p(y_1|x_1,x_{22})\\ p(y_2|x_1,x_{21})& p(y_2|x_1,x_{22})\end{array}\right)\left(\begin{array}{c}p(x_{21}|x_1)\\ p(x_{22}|x_1)\end{array}\right)$$

$$A=\left(\begin{array}{ccc}p(y_1|x_{11})& p(y_1|x_{12})& p(y_1|x_{13})\\ p(y_2|x_{11})& p(y_2|x_{12})& p(y_2|x_{13})\end{array}\right)$$

$${\mathbb{Q}}_1=\{({\mathcal{X}}_1,p(y|x_1),\mathcal{Y}):p(x_2|x_1)\in \Delta (\mathcal{X})\},$$

$${\mathbb{Q}}_2=\{({\mathcal{X}}_2,p(y|x_2),\mathcal{Y}):p(x_1|x_2)\in \Delta (\mathcal{X})\},$$

$${\mathbb{S}}_1=$$

$$=$$

$$\displaystyle\mbox{ of the $i$th plane paralleled to the $x_{2}$-$y$ plane in Fig. \ref{figure-1} for $i\in[|\mathcal{X}_{1}|]$}\}$$

$${\mathbb{S}}_2=$$

$$=$$

$$\displaystyle\mbox{ of the $i$th plane paralleled to the $x_{1}$-$y$ plane in Fig. \ref{figure-1} for $i\in[|\mathcal{X}_{2}|]$}\},$$

$$A=\sum _{B\in {\mathbb{S}}_i}{\lambda }_{B}B,$$

$${\mathbb{Q}}_i=\left\{\sum _{B\in {\mathbb{S}}_i}{\lambda }_{B}B:{\lambda }_B\ge 0,\sum _{B\in {\mathbb{S}}_i}{\lambda }_B=1\right\}.$$

$$C_1=$$

Full text

hannel capacity, Dalenius’ goal, data privacy, differential privacy, perfect secrecy

1 Introduction

The field of data privacy protection [1, 2, 3] is concerned with how to query a dataset in the way of preserving the privacy of individuals whose sensitive data is contained in the dataset. Since data privacy is a fundamental problem in today’s information age, this field becomes more and more important. The differential privacy model [4, 5] is currently the most important and popular data privacy protection model and has obtained great success both in the computer science communities [6, 7] and in the industry world [8, 9]. We reason that its success is strongly related to the feature that its definition of privacy is irrelevant to the semantic meaning of data, which significantly separates it from many other privacy models, such as the $k$-anonymity [10], the $\ell$-diversity [11] or the $t$-closeness [12] model etc. Note that this feature is very similar to the one of Shannon’s information theory which strips away the “semantic aspects” from the definition of information [13, 14]. The other important feature of the differential privacy model is the composition privacy property, which makes it possible to modularly construct complex differentially private algorithms from simpler ones.

In spite of the big success of the differential privacy model, after a decade or so of study, researchers, however, found that this model is vulnerable to those attacks where adversaries have knowledge of the correlation among different individuals’ data in the dataset [15, 16, 17, 18, 19, 20]. Due to this reason, there is a debate on whether the security of differential privacy is based on the independence assumption [16, 17, 18, 21, 22], the assumption which assumes that each adversary has no knowledge of the correlation among different individuals’ data in the dataset. Furthermore, it seems that this model is too inflexible to provide satisfying data utility in many application scenarios [23, 24, 25]. Especially, this model can’t utilize the “crowd-blending” phenomenon to improve the utility of privacy mechanisms/channels, where the phenomenon is that if an individual’s data is blended into a large crowd of individuals’ data then this individual may have more privacy than the case of blending into a small crowd [23, 10]. Therefore, many new privacy models are introduced to alleviate the above two weaknesses of differential privacy, such as the crowd-blending privacy model [23], the Pufferfish model [16], the coupled-worlds privacy model [17], the zero-knowledge privacy model [26], the inferential privacy model [18], the prior differential privacy model [27], the concentrated differential privacy [28, 29], and the model in [30], etc. These models in general are either more secure or more flexible in obtaining better utility than the differential privacy model. However, it seems that no one can give both better utility and better privacy. Furthermore, the composition property of most of these models can’t be proved.

Then the question is whether there exists the ideal kind privacy model. To answer this question, we revisit some seminal papers about differential privacy [4, 5] and find that the differential privacy is a compromise of Dalenius’ goal, which says that nothing about an individual should be learnable from the dataset that cannot be learned without access to the dataset. Specifically, the differential privacy, a weaker privacy notion, is introduced as a substitution of Dalenius’ goal since the later cannot be achieved with no trivial utility. Then an important question is that in what condition or in what extent that the differential privacy is equivalent to Dalenius’ goal. However, there is still no well-accepted answer to this question.

Our contributions: First, we formalized Dalenius’ goal by using Shannon’s perfect secrecy, the origin of the famous semantic security. Our first result is that, if the independence assumption is true, then the differential privacy is equivalent to Dalenius goal, where the independence assumption assumes that each adversary has no knowledge of the correlation among different individuals’ data in the dataset. This implies that the security of differential privacy is based on the independence assumption. In view of that the independence assumption is impractical, we introduced a new practical assumption, which assumes that each adversary is unknown to some data in the dataset (this is always true when the dataset is large enough). Based on the new assumption, we introduced a new privacy model which both satisfies Dalenius goal and has a parameter to provide better balance between privacy and utility.

Second, we provided an interesting result which can transform the problem of evaluating an individual’s maximal disclosed information (called individual channel capacity), which is related to the problem of evaluating the capacities of an infinite number of channels, into the problem of evaluating the capacities of a finite number of channels. This result is very useful to utilize results in information theory to evaluate the individual channel capacities. As some examples, we evaluated the individual channel capacities of several useful privacy channels by using it, such as the random response privacy channel, the exponential privacy channel and the Gaussian privacy channel, which are respective counterparts of the random response mechanism, the exponential mechanism and the Gaussian mechanism of the differential privacy model [6].

Third, we proved the post-processing, the group privacy, and the composition privacy properties of the privacy model. Our proofs to the three properties are very simple, which is due to our treatment to the privacy model by using the information theoretic tools. Furthermore, we also discussed the privacy problem of application scenarios where two (or more) datasets generated by the same group of individuals are output independently, such as the privacy problem of the real scenario where the IMDb dataset and the Netflix dataset are output independently [31]. This kind of privacy problem, which we called the general composition privacy problem, is different from the traditional composition privacy problem, which we called the basic composition privacy problem and which can be treated by the traditional composition privacy property. To the general composition privacy problem, some interesting results were given.

Forth, by using Yao’s computational information theory, we extended our model to the computational-bounded case. We proved that the computational-bounded setting can give better utility than the information-theoretical setting. We also showed that the encryption model and the differential privacy model are special cases of our model.

In summary, we developed a data privacy protection model which satisfies Dalenius security, and which can provide better utility based on a practical assumption. This model equips the post-processing property, the group privacy property and the composition privacy property. Furthermore, we extended our model to the computational-bounded case.

Outline: The following part of this paper is organized as follows. In Section 2, we will first formalize Dalenius’ goal by using Shannon’s perfect secrecy. Then we will show that the differential privacy model needs the independence assumption in order to let it satisfy Dalenius’ goal. A new practical assumption is introduced to substitute for the independence assumption in view of that the later is impractical. Based on the new assumption, a new privacy model is introduced. Section 3 will introduce a result which can transform the problem of evaluating the individual channel capacity to the problem of evaluating the capacities of some channels in information theory. In Section 4 we will show how to use the result in Section 3 to evaluate the individual channel capacities of some privacy channels, such as the random response privacy channel and the exponential privacy channel. In Section 5 we will extend the result in Section 3 to the continuous case and then evaluate the individual channel capacity of the Gaussian privacy channel. Section 6 will give the group privacy property. Section 7 will give the composition privacy property. We will extend the information privacy model to the computational-bounded case in Section 8. Section 9 will present related works. Section 10 will conclude this paper.

2 The Information Privacy Model

In this section, we will first introduce the information privacy model and formalize Dalenius’ goal by using Shannon’s perfect secrecy. This model is a variant of Shannon’s information theoretic model of encryption systems [32]. In section 2.1 we will show that the security of the differential privacy model is based on the independence assumption. In section 2.2, a new assumption is introduced to substitute for the independence assumption and then a new privacy model is introduced. Compared to the differential privacy model, the new model is more secure and has more good utility. Most notations of this paper follow the book [33].

In the information privacy model there are $n\geq 1$ individuals and a dataset has $n$ records, each of which is the private data of one individual. Let the random variables $X_{1},\ldots,X_{n}$ denote an adversary’s probabilities/uncertainties to the $n$ records in the dataset. Let $\mathcal{X}_{i}$ denote the record universe of $X_{i}$. A dataset $x:=(x_{1},\ldots,x_{n})$ is a sequence of $n$ records, where each $x_{i}$ is an assignment of $X_{i}$ and so $x_{i}\in\mathcal{X}_{i}$. Let $\mathcal{X}=\prod_{i\in[n]}\mathcal{X}_{i}$ where $[n]=\{1,\ldots,n\}$. Let $p(x)$ and $p(x_{i})$ denote the probability distribution of $X=(X_{1},\ldots,X_{n})$ and $X_{i}$, respectively. Set $\mathcal{X}_{(i)}=\prod_{j\neq i}\mathcal{X}_{j}$, $X_{(i)}=(X_{1},\ldots,X_{i-1},X_{i+1},\ldots,X_{n})$, and $x_{(i)}=(x_{1},\ldots,x_{i-1},x_{i+1},\ldots,x_{n})$.

Definition 1 (The Knowledge of an Adversary).

Let the random vector $X:=(X_{1},\ldots,X_{n})$ denote the uncertainties/probabilities of an adversary to the dataset. Then $X$ or its probability distribution is called the knowledge of the adversary (to the dataset). We will use $X$ to name the adversary. An adversary $X$ is said to be practical if it is practical for an adversary to have the knowledge $X$ in the real world.

Impractical adversaries are popular in data privacy protection when the dataset is large enough. For example, it is impractical to assume that an adversary knows all data in the Netflix dataset even though some data in the dataset were de-anonymized [31].

Definition 2 (Probability Simplex [6]).

Given a set $B$, the probability simplex over $B$, denoted $\Delta(B)$, is defined to be the set of all probability distributions over $B$. Then, $\Delta(\mathcal{X}),\Delta(\mathcal{X}_{i})$ is the probability simplex over $\mathcal{X},\mathcal{X}_{i}$, respectively.

For notational simplicity, we sometimes abuse a capital letter, such as $X$, to either denote a random variable or denote the probability distribution which the random variable follows. Let $\mathbb{P}$ be a subset of $\Delta(\mathcal{X})$. Then if the probability distribution of the random variable $X$ is in $\mathbb{P}$, we say that $X$ is in $\mathbb{P}$, denoted as $X\in\mathbb{P}$. Furthermore, if $X=(X_{I_{1}},X_{I_{2}})$ follows the joint probability distribution $p(x_{I_{1}})p(x_{I_{2}}|x_{I_{1}})$ and $X\in\mathbb{P}$, then we denote $p(x_{I_{1}})\in\mathbb{P}$ and $p(x_{I_{2}}|x_{I_{1}})\in\mathbb{P}$.

For a query function $f$ over $\mathcal{X}$, let $\mathcal{Y}=\{f(x):x\in\mathcal{X}\}$ be its range. Except in Section 5, this paper assumes that the sets $\mathcal{X},\mathcal{Y}$ both are finite. We now define the privacy channel/mechanism.

Definition 3 (Privacy Channel/Mechanism).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$, we define a privacy channel/mechanism, denoted by $(\mathcal{X},p(y|x),\mathcal{Y})$ or $p(y|x)$ for simplicity (when there is no ambiguity), to be the probability transition matrix $(\mathcal{X},p(y|x),\mathcal{Y})$ that expresses the probability of observing the output symbol $y\in\mathcal{Y}$ given that we query the dataset $x\in\mathcal{X}$. In this paper, we let the conditional probability $p(y|x)$ denote the element of the $y$th row and the $x$th column in the matrix.

What is a secure privacy channel? After viewing that the well-known differential privacy model is not secure enough and may give poor utility in many application cases, researchers are in big debate about how to define the notion of secure channel since many works provided its own security standard [30, 16, 18, 21, 17, 34, 35, 36, 37, 27, 22]. To answer this question, we revisited some seminal papers of differential privacy [5, 4] where we found that Dalenius had given us an answer. As noted in [5], Dalenius [38] articulated a desideratum for statistical databases: nothing about an individual should be learnable from the database that cannot be learned without access to the database. We now formalize Dalenius’ goal by using Shannon’s perfect secrecy [32]. One may ask why we choose the perfect secrecy but not the semantic security, a computational-bounded relaxation of the perfect secrecy [39, 40], to model Dalenius’ goal as in [5]. Our answer is that the semantic security is more complicated than the perfect secrecy to model data privacy protection problems which are more complicated than encryption problems. We will discuss the semantic security-like definition in Section 8.

Definition 4 (Dalenius Security).

A privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ is said to be $\epsilon$-perfect Dalenius secure if, for any adversary $X\in\Delta(\mathcal{X})$ and any $i\in[n]$, there must be $I(X_{i};Y)\leq\epsilon$, where $Y$ is the output random variable of the privacy channel and $I(X_{i};Y)$ is the mutual information between $X_{i}$ and $Y$. It is said to be $\epsilon$-practical Dalenius secure or $\epsilon$-Dalenius secure for short if, for any practical adversary $X$ and any $i\in[n]$, there must be $I(X_{i};Y)\leq\epsilon$.

In the above definition, the parameter $\epsilon$ is called the privacy budegt. The Dalenius’ goal is formalized as $\epsilon$-perfect Dalenius security (when $\epsilon\rightarrow 0$). Except $\epsilon$-perfect Dalenius security, we also proposed $\epsilon$-practical Dalenius security, a relaxed version of the former, to improve data utility since the former will result in poor data utility [5], where an adversary $X$ is said to be practical if it is practical to the adversary to have the knowledge $X$ in the real world. One can compare the relation between $\epsilon$-perfect Dalenius security and $\epsilon$-Dalenius security to the relation between perfect secrecy and semantic security [39, 40, 41]. Recall that, based on some difficulty assumption, such as the existence of one-way function or the difficulty of factoring large integers, the semantic security satisfies perfect secrecy.

One needs to be mentioned is that this paper, including Definition 4, employes the mutual information $I(X_{i};Y)$ but not the max-mutual information $I_{\infty}(X_{i};Y)$ (defined in Definition 7) to measure privacy. Intuitively, the later is more appropriate than the former both because of it is more secure since $I(X_{i};Y)\leq I_{\infty}(X_{i};Y)$ and because of it is directly related to the differential privacy which will be shown in Section 2.1. We have two reasons to choose the former. First, using $I(X_{i};Y)$ doesn’t obviously weaken the Dalenius security to protect privacy but can in some extent improve the utility since this paper mainly focuses on the case where $n$ is large enough (which is alway true for most data processing problems in the real world). The other important reason is that we find that the field of data privacy protection, including the differential privacy as shown in Section 2.1, is strongly related to information theory. This motivates us to transplant the results and approaches of information theory into data privacy protection. Of course, if one wishes to use $I_{\infty}(X_{i};Y)$, such as for the case of small dataset i.e. of small $n$, then most parts of this paper can be treated similarly, which implies that they are essentially of no difference to use either $I_{\infty}(X_{i};Y)$ or $I(X_{i};Y)$.

Dalenius security, as differential privacy, also satisfies the post-processing invariance property [6]; that is, if a privacy channel protects an individual’s privacy, then an adversary cannot increase privacy loss from the output of the privacy channel. Note that this property is satisfied by the data-processing inequality.

Proposition 1 (Post-Processing).

Let the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $\epsilon$-Dalenius security. Let $X,Y$ be the input and output random variables of the channel and let $Z=g(Y)$ be a random variable over $\mathcal{Z}=\{g(y):y\in\mathcal{Y}\}$. Then the composition channel $(\mathcal{X},p(z|x),\mathcal{Z})$ also satisfies $\epsilon$-Dalenius security.

Proof.

Note that the random variables $X,Y,Z$ form a markov chain $X\rightarrow Y\rightarrow Z$ since $Z=g(Y)$. This implies that $X_{i},Y,Z$ also form a markov chain $X_{i}\rightarrow Y\rightarrow Z$. Then the claim is a direct corollary of the data-processing inequality in [33, Theorem 2.8.1].

To the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$, let $Y$ be its output random variable. We now define the individual channel capacity which is used to model the largest amount of information of an individual that an adversary can obtain from the output $Y$.

Definition 5 (Individual Channel Capacity).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$ and one of its privacy channels $p(y|x)$, we define the individual channel capacity of $p(y|x)$ with respect to $\mathbb{P}\subseteq\Delta(\mathcal{X})$ as

[TABLE]

where $X$ equals $(X_{1},\ldots,X_{n})$. When $\mathbb{P}=\Delta(\mathcal{X})$, we denote $C_{1}^{\mathbb{P}}$ to be $C_{1}$ for short.

The information privacy model protects privacy by restricting the individual channel capacity.

Definition 6 (Information Privacy).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$, we say that one of its privacy channels $p(y|x)$ satisfies $\epsilon$-information privacy with respect to $\mathbb{P}$ if

[TABLE]

where $C_{1}^{\mathbb{P}}$ is the individual channel capacity of $p(y|x)$ with respect to $\mathbb{P}$. Furthermore, for notational simplicity, we say that the privacy channel $p(y|x)$ satisfies $\epsilon$-information privacy for short if it satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$. Note that $\epsilon$-information privacy with respect $\Delta(\mathcal{X})$ equals $\epsilon$-perfect Dalenius security.

We now provide an assumption about adversaries’ knowledge. This assumption is a critical component of the information privacy model to balance privacy and utility. We will also show in Section 2.1 that the independence assumption is a special case of this assumption.

{assumption}

If $X$ is the knowledge of one practical adversary, then there must be $X\in\mathbb{P}$, where $\mathbb{P}\subseteq\Delta(\mathcal{X})$ is a parameter.

Note that, if Assumption 2 is true, then the privacy channel $p(y|x)$ which satisfies $\epsilon$-information privacy with respect to $\mathbb{P}$ will ensure that any possible adversary can only obtain at most $\epsilon$ bits information of each individual from the channel’s output. We then have the following proposition.

Proposition 2.

Assume Assumption 2 is true and assume the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $\epsilon$-information privacy with respect to $\mathbb{P}$. Then this privacy channel is $\epsilon$-Dalenius secure.

2.1 The Differential Privacy Model

One debate about the security of differential privacy is whether the differential privacy model is based on the independence assumption, the assumption which assumes that the individuals’ data are independent to each other [16, 17, 18, 21, 27, 22]. This section will explain why the assumption is essential to the Dalenius security of differential privacy. We will define a special case of the information privacy models and formalize the independence assumption. Then we will show that, based on the independence assumption, the special case is equivalent to the differential privacy model.

We first define the max-mutual information, which is the maximum of $\log\frac{p(y|x)}{p(y)}$. Note that the mutual information $I(X;Y)$ is the expected value of $\log\frac{p(y|x)}{p(y)}$.

Definition 7 (Max-Mutual Information [32, 42, 36]).

The max-mutual information of the random variables $X,Y$ is defined as

[TABLE]

Similarly, we can define the max-individual channel capacity.

Definition 8 (Max-Individual Channel Capacity).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$ and one of its privacy channel $p(y|x)$, we define the max-individual channel capacity of $p(y|x)$ with respect to $\mathbb{P}\subseteq\Delta(\mathcal{X})$ as

[TABLE]

where $X=(X_{1},\ldots,X_{n})$.

We now present the max-information privacy which restricts the max-individual channel capacity, and in which the adversaries’ knowledges are restricted to the independent knowledges to each data in the dataset. We will also give the definition of differential privacy and then show that they are equivalent to each other.

Definition 9 (Max-Information Privacy).

A privacy channel $p(y|x)$ satisfies $\epsilon$-max-information privacy with respect to $\mathbb{P}_{ind}$ if it satisfies

[TABLE]

where $C_{1,\infty}^{\mathbb{P}}$ is the max-invididual channel capacity of the privacy channel $p(y|x)$ with respect to $\mathbb{P}=\mathbb{P}_{ind}$, where

[TABLE]

with $X\sim p(x)$ and $X_{i}\sim p(x_{i})$. Note that $\mathbb{P}_{ind}$ is the set of all probability distributions $p(x)$ such that the random variables $X_{1},\ldots,X_{n}$ are independent to each other.

The independence assumption is formalized as follow. Note that it is a special case of Assumption 2.

{assumption}

[Independence Assumption] If $X$ is the knowledge of one practical adversary, then there must be $X\in\mathbb{P}_{ind}$.

Definition 10 (Differential Privacy [4, 6]).

A privacy channel $p(y|x)$ satisfies $\epsilon$-differential privacy if, for any $y\in\mathcal{Y}$ and any two neighboring datasets $x,x^{\prime}\in\mathcal{X}$, there is

[TABLE]

where $x,x^{\prime}$ are said to be neighboring datasets if $\|x-x^{\prime}\|_{1}=\sum_{i}d(x_{i},x_{i}^{\prime})\leq 1$ with $d(x_{i},x_{i}^{\prime})$ being the hamming distortion [33, p. 304].

The following result shows that, based on Assumption 9, the above two apparently different definitions, i.e. Definition 9 and Definition 10, are equal. One needs to be mentioned is that this result, in part or in other form, had appeared in many references, such as [16, 17, 18, 21, 27, 22]. We stress that this result is not a restatement of existed ones but a reformulation which motivates new privacy model in Section 2.2.

Theorem 2.1.

Assume Assumption 9 is true. Then the following two conditions are equivalent:

the privacy channel $p(y|x)$ satisfies $\epsilon$-max-information privacy with respect to $\mathbb{P}_{ind}$. 2. 2.

the privacy channel $p(y|x)$ satisfies $\epsilon$-differential privacy.

Proof.

Assume Assumption 9 is true in this proof. Then we only need to consider the setting $X\in\mathbb{P}_{ind}$.

We first prove $2\Rightarrow 1$. Assume the privacy channel $p(y|x)$ satisfies $\epsilon$-differential privacy. Then, for any $x,x^{\prime}\in\mathcal{X}$ satisfying $\|x-x^{\prime}\|_{1}\leq 1$ and any $y\in\mathcal{Y}$, there is

[TABLE]

Then, for any $p(x)\in\mathbb{P}_{ind}$ with $X\sim p(x)$, we have

[TABLE]

where the equality of (10) holds when the probability distribution $p(x_{i})$ is one degenerate distribution over $\mathcal{X}_{i}$, (11) is due to $X\in\mathbb{P}_{ind}$ for any practical $X$, (13) is due to [43, Lemma 3] and the equality is achieved when the probability distribution $p(x_{(i)})$ is one degenerate distribution over $\mathcal{X}_{(i)}$, and (14) is due to (8). The proof of $2\Rightarrow 1$ is complete.

Now we prove $1\Rightarrow 2$. Assume the privacy channel $p(y|x)$ satisfies $\epsilon$-max-information privacy with respect to $\mathbb{P}_{ind}$. Let $x,x^{\prime}\in\mathcal{X}$ satisfy $\|x-x^{\prime}\|_{1}=1$. Then there must exist $x_{i},x_{i}^{\prime}\in\mathcal{X}_{i}$ and $x_{(i)}\in\mathcal{X}_{(i)}$ such that $x=(x_{i},x_{(i)})$ and $x^{\prime}=(x_{i}^{\prime},x_{(i)})$. Then we can prove $\log\frac{p(y|x)}{p(y|x^{\prime})}\leq\epsilon$ by the inverse of the proof of $2\Rightarrow 1$, where the key point is that the bounds of the inequalities (10) and (13) both are reachable. The details are omitted.

The prove is complete.

We then have the following corollary.

Corollary 1.

Assume Assumption 9 is true and assume the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $\epsilon$-differential privacy. Then this privacy channel is $\epsilon$-Dalenius secure.

Proof.

Roughly speaking, this result is a special case of Proposition 2 where $\mathbb{P}=\mathbb{P}_{ind}$. Specifically, assuming Assumption 9 is true and assuming the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $\epsilon$-differential privacy, then the privacy channel satisfies $\epsilon$-max-information privacy with respect to $\mathbb{P}_{ind}$ by Theorem 2.1. Then it also satisfies $\epsilon$-information privacy with respect to $\mathbb{P}_{ind}$ since $I(X_{i};Y)\leq I_{\infty}(X_{i};Y)$. The claim is then a special case of Proposition 2 where $\mathbb{P}=\mathbb{P}_{ind}$.

Then, by Theorem 2.1 and Corollary 1, we can say that the security of the differential privacy model is based on Assumption 9. However, Assumption 9 is very impractical in the real world since it assumes that each practical adversary can only have a product probability distribution $X$ as his knowledge. Therefore, the differential privacy model is not secure due to the impracticality of Assumption 9.

2.2 New Setting

Section 2.1 shows that the differential privacy model is not secure since Assumption 9 on which the model is based is impractical. Therefore, we now introduce a practical assumption to substitute for Assumption 9. This assumption is formalized as follow.

{assumption}

If $X$ is the knowledge of one practical adversary, then there must be $X\in\Delta(\mathcal{X})_{b}$, where $b$ is a nonnegative parameter, and where

[TABLE]

with $H(X)$ being the entropy of $X$.

Roughly speaking, Assumption 2.2 assumes that each adversary is unknown to at least $b$ bits information of the dataset. We have the following evidences to support the reasonability of Assumption 2.2.

The maximal entropy $\max_{X}H(X)$, in general, is huge in privacy models than in cryptography models. For example, to the AES-256 encryption model [44], an adversary only needs to recover the 256 bits secret key in order to recover the information contained in the output $Y$ and therefore it is reasonable to assume that $H(X)$ can be very small or even zero since $H(X)$ is at most 256 bits. However, to the Netflix Prize dataset [31] in data privacy, an adversary, in principle, needs to recover the whole dataset in order to recover the information contained in the output $Y$222Note that there is no fixed “secret key” in data privacy protection models. and therefore it is reasonable to assume that $H(X)$ is relatively large since the Netflix Prize dataset is large and then $\max_{X}H(X)$ is at least larger than $100,480,507$ bits, which is huge compared to $256$ bits.333The Netflix Prize dataset contains 100, 480, 507 movie ratings and each rating has at least two choices [31]. 2. 2.

The long tail phenomenon444https://en.wikipedia.org/wiki/Long_tail implies that there are too much “outlier data” in big dataset, which increases the uncertainty $H(X)$. 3. 3.

Someone may doubt of the assumption since there are too much background knowledge in data privacy protection compared to in cryptography. For example, to the Netflix Prize dataset [31], it is inevitable that there exists open data, such as the IMDb dataset, as an adversary’s background knowledge. Our comment is that, when the dataset is large enough, such as the Netflix dataset, the background knowledge, such as the IMDb dataset, in general, can’t have large part, such as over 50%, to be overlapped with the secret dataset. In fact, the Netflix Prize dataset has very small part to be overlapped with the IMDb dataset. Therefore, the entropy $H(X)$ is still large for big dataset even though the diversity of background knowledges. 4. 4.

Theoretically, a dataset can be completely recovered by querying the dataset too many times as noted in [45, 46][6, Chapter 8]; that is, theoretically, the entropy $H(X)$ can be very small or even zero [32, p. 659]. However, if we restrict the query times555The differential privacy model also needs to restrict the query times [6, Chapter 8] and a cryptography model also needs to change its secret key after a time of usage. Furthermore, it seems to be computationally impractical to query a much big dataset too many times [47]. and assume the dataset is big enough, we can ensure $H(X)$ not too small.

Due to the above evidences, it would be acceptable to adopt Assumption 2.2 as a reasonable assumption. Notice that Assumption 2.2 can achieve the idea of “crowd-blending privacy” (but in a way different from [23, 10]), where each individual’s privacy is related to other individuals’ data; that is, if some other individuals’ data are kept secrete, then Assumption 2.2 holds, which in turn ensures Dalenius security.

Corollary 2.

Assume Assumption 2.2 is true and assume the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})_{b}$. Then this privacy channel is $\epsilon$-Dalenius secure.

Corollary 2 is a special case of Proposition 2 where $\mathbb{P}=\Delta(\mathcal{X})_{b}$. Comparing Corollary 2 with Corollary 1, we have that, when $n$ is large enough and when $b$ is not so large, $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})_{b}$ is more secure than $\epsilon$-differential privacy since Assumption 2.2 is more practical than Assumption 9.

We now define the (utility-privacy) balance function of a privacy channel. This function is used to express the ability of the privacy channel to preserve the privacy when adversaries’ knowledges are reduced to $\Delta(\mathcal{X})_{b}$ from $\Delta(\mathcal{X})$ in order to improve the data utility.

Definition 11 (Balance Function).

To the privacy channel $p(y|x)$, let $C_{1},C_{1}^{b}$ be its individual channel capacities with respect to $\Delta(\mathcal{X}),\Delta(\mathcal{X})_{b}$, respectively. To given $b$, assume there exists a nonnegative constant $\delta$ such that

[TABLE]

Then we say that the privacy channel is $(b,\delta)$-(utility-privacy) balanced, and that the function

[TABLE]

is the (utility-privacy) balance function of the privacy channel.

The balance function is an increasing function since, when $b\leq b^{\prime}$, there is $\Delta(\mathcal{X})_{b}\supseteq\Delta(\mathcal{X})_{b^{\prime}}$, which implies $C_{1}^{b}\geq C_{1}^{b^{\prime}}$ and then $g(b)\leq g(b^{\prime})$.

Lemma 1 (Monotonicity of Balance Function).

Let $\delta=g(b)$ be the balance function of the privacy channel $p(y|x)$. Then this function is non-decreasing and therefore there is

[TABLE]

Clearly, the more large $b$ is means that the more weak adversaries are, which then implies more large data utility and more large $\delta$. Therefore, the parameter $b$ can be considered as an indicator of the data utility but the parameter $\delta$ can be considered as an indicator of the amount of the private information lost when the data utility has $b$ amount of increment.

Proposition 3.

Let $\delta=g(b)$ be the balance function of the privacy channel $p(y|x)$. Then the privacy channel $p(y|x)$ satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})_{b}$ if and only if it satisfies $(\epsilon+\delta)$-information privacy with respect to $\Delta(\mathcal{X})$.

Proposition 3 is implied by Definition 11. It shows that, to construct an $\epsilon$-information privacy channel with respect to $\Delta(\mathcal{X})_{b}$, we only need to construct an $(\epsilon+\delta)$-information privacy channel with respect to $\Delta(\mathcal{X})$, where $\delta=g(b)$ is the balance function of the channel. However, we find that it is very hard to evaluate the balance functions of privacy channels. We leave this problem as an open problem. Of course, even though we don’t know the balance functions, this doesn’t mean that we can’t use them. Specifically, we can first give the needed value of $\delta$ (but not $b$), then there must exist a largest $b=b^{\prime}$ such that $g(b^{\prime})\leq\delta$ by the monotonicity of balance functions (even though we can’t find it). Then we can freely use Proposition 3 to construct $\epsilon$-information privacy channels with respect to $\Delta(\mathcal{X})_{b^{\prime}}$ from the $(\epsilon+\delta)$-information privacy channels with respect to $\Delta(\mathcal{X})$. The only drawback of this way is that we don’t know the value of $b^{\prime}$ and then can’t estimate the extent of practicality of Assumption 2.2 for $b=b^{\prime}$.

Due to above reasons, we will only study the privacy channels with respect to $\Delta(\mathcal{X})$ in the following part of this paper. Note that $\epsilon$-information privacy with respect $\Delta(\mathcal{X})$ equals $\epsilon$-perfect Dalenius security.

3 From Individual Channel Capacity to Channel Capacity

The preceding section shows that the information privacy model is compatible with the differential privacy model. Then a natural question is: *Are the Laplace channel, the Gaussian channel and the exponential channel also applicable in the information privacy model? * Before answering this question, we first should be able to evaluate the individual channel capacities of privacy channels. In this section we will develop approaches to evaluate individual channel capacities. One needs to be emphasized is that evaluating the individual channel capacity is not a sub-problem of evaluating the capacity region of the multi-access channel in information theory since the later assumes the individuals/senders are independent [33, §15] but the former assumes they are dependent.

3.1 An Example

It is very complicated to evaluate the individual channel capacity of a privacy channel. Before given the general results, a simple example is suitable to explain our ideas.

Example 1.

Set $\mathcal{X}_{1}=\{x_{11},x_{12},x_{13}\}=\{0,1,2\}$, $\mathcal{X}_{2}=\{x_{21},x_{22}\}=\{0,1\}$ and $\mathcal{X}=\mathcal{X}_{1}\times\mathcal{X}_{2}$. The function $f:\mathcal{X}\rightarrow\mathcal{Y}$ is defined as

[TABLE]

for $(x_{1},x_{2})\in\mathcal{X}$.666We use $x_{i}$ to denote an element in $\mathcal{X}_{i}$, $x$ to denote an element in $\mathcal{X}$, and $y$ to denote an element in $\mathcal{Y}$. Then $\mathcal{Y}=\{y_{1},y_{2}\}=\{0,1\}$. The probability transition matrix of the privacy channel $p(y|x)$ is shown in Fig. 1.

The individual channel capacity of the privacy channel $p(y|x)$ can be simplified as

[TABLE]

where $\Delta(\mathcal{X}_{i})$ denotes the probability simplex over $X_{i}$, and $X_{i}\sim p(x_{i})$, and $\mathbb{Q}_{i}$ denotes the set of all probability transition matrices $(\mathcal{X}_{i},p(y|x_{i}),\mathcal{Y})$ such that $X\in\Delta(\mathcal{X})$, and $C_{p(y|x_{i})}$ denotes the channel capacity of the channel $p(y|x_{i})$. Then the main problem becomes to show what is the set $\mathbb{Q}_{i}$. Recall that the probability

[TABLE]

for $(y,x_{i})\in\mathcal{Y}\times\mathcal{X}_{i}$, where $(i)=\{2\}$ if $i=1$ and $(i)=\{1\}$ if $i=2$. We first consider the case of $i=1$. There is

[TABLE]

for each $x_{1}\in\mathcal{X}_{1}=\{x_{11},x_{12},x_{13}\}$. Note that every column vector in the above equation is a probability distribution. Let $A\in\mathbb{Q}_{1}$ and assume

[TABLE]

Then the $j$th column vector of $A$ is a convex combination of the column vectors of the first matrix in the right-hand side of (23) when setting $x_{1}=x_{1j}$, $j=\{1,2,3\}$. By combining the above result with the fact that the first matrix in the right-hand side of (23), when setting $x_{1}=x_{1j}$, is the $j$th plane, i.e. a two-dimensional matrix, in Fig. 1 that is parallel to the $x_{2}$-$y$ plane, we conclude that the $j$th column vector of the matrix $A\in\mathbb{Q}_{1}$ is a convex combination of the column vectors of the $j$th plane paralleled to the $x_{2}$-$y$ plane in Fig. 1. Furthermore, since $X\in\Delta(\mathcal{X})$, then the conditional probability distribution $(p(x_{21}|x_{1}),p(x_{22}|x_{1}))$ over $\mathcal{X}_{2}$ can be any possible binary distribution, which implies that the coefficients of the convex combination can be any binary convex coefficients. Therefore, the set $\mathbb{Q}_{1}$ contains and only contains those matrices $A$, whose $j$th column vector is a convex combination of the column vectors of the $j$th plane paralleled to the $x_{2}$-$y$ plane. Specifically, we have

[TABLE]

where $p(x_{2}|x_{1})\in\Delta(\mathcal{X})$ means there exists $X\in\Delta(\mathcal{X})$ such that $X\sim p(x_{1})p(x_{2}|x_{1})$, and where the probability $p(y|x_{1})$ is evaluated by (22). Similarly, the set $\mathbb{Q}_{2}$ contains and only contains those matrices $A$, whose $j$th column vector is a convex combination of the column vectors of the $j$th plane paralleled to the $x_{1}$-$y$ plane. That is,

[TABLE]

where $p(x_{1}|x_{2})\in\Delta(\mathcal{X})$ means there exists $X\in\Delta(\mathcal{X})$ such that $X\sim p(x_{2})p(x_{1}|x_{2})$, and where the probability $p(y|x_{2})$ is evaluated by (22).

The above discussions tell us that each set $\mathbb{Q}_{i}$ is infinite and it is, therefore, not a reasonable way to evaluate $C_{1}$ by evaluating the channel capacity of each channel in the sets $\mathbb{Q}_{i},i\in[n]$. Now we construct a new set $\mathbb{S}_{i}$, which is finite and is a small subset of $\mathbb{Q}_{i}$, and show that it has the same maximal channel capacity as $\mathbb{Q}_{i}$. Let the subset $\mathbb{S}_{1}$ ($\mathbb{S}_{2}$) of $\mathbb{Q}_{1}$ ($\mathbb{Q}_{2}$) contains and only contains those matrices whose $j$th column vector is one column vector of the $j$th plane paralleled to the $x_{2}$-$y$ ($x_{1}$-$y$) plane. Formally, set

[TABLE]

and

[TABLE]

where $\Delta(\mathcal{X}_{2})^{dg}$ is the set of all probability transition matrices $p(x_{2}|x_{1})$ whose each column vector is one degenerate probability distribution over $\mathcal{X}_{2}$, and where $\Delta(\mathcal{X}_{1})^{dg}$ is the set of all probability transition matrices $p(x_{1}|x_{2})$ whose each column vector is one degenerate probability distribution over $\mathcal{X}_{1}$. Therefore, $|\mathbb{S}_{1}|=|\mathcal{X}_{2}|^{|\mathcal{X}_{1}|}=8$ and $|\mathbb{S}_{2}|=|\mathcal{X}_{1}|^{|\mathcal{X}_{2}|}=9$. Then the $j$th column vector of a matrix in $\mathbb{Q}_{i}$ is a convex combination of those $j$th column vectors of the matrices in $\mathbb{S}_{i}$. Therefore, each probability transition matrix $A\in\mathbb{Q}_{i}$ is a convex combination of the probability transition matrices $B\in\mathbb{Q}_{i}$. Without loss of generality, to each matrix $A\in\mathbb{Q}_{i}$, set

[TABLE]

where $\lambda_{B}\geq 0$ and $\sum_{B\in\mathbb{S}_{i}}\lambda_{B}=1$ and then

[TABLE]

We have

[TABLE]

where (35) is due to (20), (36) is due to (33), (37) is due to Lemma 2 and the Jensen’s inequality, and where $C_{B}$ is the channel capacity of $B\in\mathbb{S}_{i}$, i.e.

[TABLE]

Furthermore, since $\mathbb{S}_{i}\subseteq\mathbb{Q}_{i}$, then we have

[TABLE]

Lemma 2 (Theorem 2.7.4 in [33]).

Let $(X,Y)\sim p(x,y)=p(x)p(y|x)$. Then the mutual information $I(X;Y)$ is a convex function of $p(y|x)$ for fixed $p(x)$.

3.2 The General Results

Now it’s time to give the generalized version of the results in Section 3.1. Set $\mathcal{X}_{(i)}=\prod_{j\neq i}\mathcal{X}_{j}$, $X_{(i)}=(X_{1},\ldots,X_{i-1},X_{i+1},\ldots,X_{n})$, and $x_{(i)}=(x_{1},\ldots,x_{i-1},x_{i+1},\ldots,x_{n})$. Let $p(y|x)$ be one privacy channel of $f:\mathcal{X}\rightarrow\mathcal{Y}$. Then the probability transition matrix of $p(y|x)$ is an $(n+1)$-dimensional matrix, one of whose three-dimensional special case is shown in Fig. 1. By the equation $p(y|x_{i})=\sum_{x_{(i)}}p(y|x_{1},x_{(i)})p(x_{(i)}|x_{i})$, to each $x_{i}\in\mathcal{X}_{i}=\{x_{i1},\ldots,x_{i|\mathcal{X}_{i}|}\}$, we have

[TABLE]

which is a generalization of the equation (23), where $\mathcal{X}_{(i)}=\{x_{(i)1},x_{(i)2},\ldots,x_{(i)|\mathcal{X}_{(i)}|}\}$. Leting $A\in\mathbb{Q}_{i}$, then $A$ is of the following form

[TABLE]

which is a generalization of (24). So, the $j$th column vector of $A$ is a convex combination of the column vectors of the $j$th hyperplane paralleled to the $x_{1}$-$\ldots$-$x_{i-1}$-$x_{i+1}$-$\ldots$-$x_{n}$-$y$ hyperplane.777The $x_{1}$-$\ldots$-$x_{i-1}$-$x_{i+1}$-$\ldots$-$x_{n}$-$y$ hyperplane, denoted $x_{(i)}$-$y$ hyperplane, is the hyperplane extended by the $x_{1}$, …, $x_{i-1}$, $x_{i+1}$, …, $x_{n}$ and $y$ coordinate axises. This hyperplane is the generalization of the $x_{2}$-$y$ plane in Fig. 1. Then the set $\mathbb{Q}_{i}$ contains and only contains those matrices $A$, whose $j$th column vector is a convex combination of the column vectors of the $j$th hyperplane paralleled to the $x_{1}$-$\ldots$-$x_{i-1}$-$x_{i+1}$-$\ldots$-$x_{n}$-$y$ hyperplane. More formally, we have

[TABLE]

where $p(x_{(i)}|x_{i})\in\Delta(\mathcal{X})$ means there exists $X\in\Delta(\mathcal{X})$ such that $X\sim p(x_{i})p(x_{(i)}|x_{i})$. Similarly, we define that the set $\mathbb{S}_{i}$ contains and only contains those matrix $A$, whose $j$th column vector is one column vector of the $j$th hyperplane paralleled to the $x_{(i)}$-$y$ hyperplane. Formally, we define

[TABLE]

where $\Delta(\mathcal{X}_{(i)})^{dg}$ is the set of all probability transition matrices $p(x_{(i)}|x_{i})$ whose each column vector is one degenerate probability distribution over $\mathcal{X}_{(i)}$. Therefore, $|\mathbb{S}_{i}|=|\mathcal{X}_{(i)}|^{|\mathcal{X}_{i}|}$. Combining Lemma 2 with the above results, we then have the following theorem.

Theorem 3.1.

Let $\mathbb{Q}_{i}$ and $\mathbb{S}_{i}$ be as shown in (44) and (45), respectively. Then $\mathbb{S}_{i}\subseteq\mathbb{Q}_{i}$ and each channel in $\mathbb{Q}_{i}$ is one convex combination of the channels in $\mathbb{S}_{i}$. Therefore, there is

[TABLE]

where $C_{1}$ is the individual channel capacity of the privacy channel $p(y|x)$ with respect to $\Delta(\mathcal{X})$, and where $C_{p(y|x_{i})}$ is the channel capacity of the channel $p(y|x_{i})$.

Theorem 3.1 transforms the problem of evaluating the individual channel capacity into the problem of evaluating the maximal channel capacity of some channels. This gives us a way to utilize results in information theory to evaluate the individual channel capacities. We will show its powerful function in the next section.

4 Some Basic Privacy Channels

In this section we will estimate the individual channel capacities of some privacy channels by using Theorem 3.1. Some privacy channels are of special interest as discussed in the beginning of Section 3, such as the random response channel, the Gaussian channel and the (discrete) exponential channel which are respective counterparts of the random response mechanism, the Gaussian mechanism and the exponential mechanism of the differential privacy model.

4.1 Binary Symmetric/Randomized Response Privacy Channel

The binary symmetric privacy channel is a generalization of either the binary symmetric channel in [33, §7.1.4] or the randomized response mechanism in data privacy protection [6, 48]. Let the query function $f$ be defined as $f:\mathcal{X}\rightarrow\mathcal{Y}=\{0,1\}$, such as the one in Example 1. Then the binary symmetric privacy channel or the randomized response privacy channel of $f$ is defined as

[TABLE]

where the output $f(x)$ is complemented with probability $p\in(0,1)$; that is, an error occurs with probability $p$ and in this condition, a [math] of the value of $f(x)$ is received as a $1$ and vice versa. This privacy channel is the simplest privacy channel; yet it captures most of the complexity of the general problem.

We now evaluate the individual channel capacity $C_{1}$ of the binary symmetric privacy channel. There are several cases. First, assume $n=1$ and $|\mathcal{X}|=2$. Then this privacy channel is the binary symmetric channel in [33, §7.1.4] or the randomized response mechanism in the differential privacy model [6]. Therefore, $C_{1}=\log 2-H(p)$ by [33, §7.1.4].

Second, assume $n\geq 2$ and $|\mathcal{X}_{i}|=2$ for all $i\in[n]$. By Theorem 3.1, we have

[TABLE]

where (52) follows from the fact that the conditional probability distribution of $Y|X=x_{i}$ is one line parallel to the $y$-coordinate axis in Fig. 1 which is just the one in (49), where the last inequality follows since $Y$ is a binary random variable, and where

[TABLE]

Furthermore, since $\mathcal{Y}=\{0,1\}$, then there exists a binary symmetric channel in the set $\mathbb{S}_{i}$ by the definition of $\mathbb{S}_{i}$. Therefore $C_{1}=\log 2-H(p)$.

Third, assume $n\geq 2$ and $|\mathcal{X}_{i}|\geq 3$ for some $i\in[n]$. In this case, there is $C_{1}\leq\log 2-H(p)$ by (54). However, whether this bound is reachable is unknown.

Above all, there is $C_{1}\leq\log 2-H(p)$ for all cases. Now we study whether the binary symmetric privacy channel satisfy $\epsilon$-information privacy. Setting $\log 2-H(p)\leq\epsilon$ with $\epsilon\in(0,1)$, then $H(p)\geq\log 2-\epsilon$. Therefore, when setting

[TABLE]

the binary symmetric privacy channel satisfies $\epsilon$-information privacy with respect to $\mathbb{P}$, where $p^{*}$ is the solution of the equation

[TABLE]

We then have the following result.

Corollary 3.

If $p\in(p^{*},1-p^{*})$, then the binary symmetric privacy channel defined in (49) satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$, where $p^{*}$ is a solution of (57).

4.2 Data-Independent Privacy Channels

We now consider the data-independent privacy channels [49, 50], of which the binary symmetric privacy channel is one special case. The data-independent privacy channels are very popular and important in the differential privacy model. For example, the Laplace mechanism and the Gaussian mechanism both are (continuous-case) data-independent privacy channels. Informally speaking, for a data-independent channel, each probability distribution is constant across $\mathcal{Y}$. The following gives the definition.

Definition 12 (Data-Independent Privacy Channel).

Let $p(y|x)$ be one privacy channel of the function $f:\mathcal{X}\rightarrow\mathcal{Y}$. For any two datasets $x,x^{\prime}\in\mathcal{X}$, if the two probability distributions $p(y|x),p(y|x^{\prime})$ over $\mathcal{Y}$ are a permutation of each other, then the privacy channel is said to be data-independent.

Now we estimate the individual channel capacities of the data-independent privacy channels. Let the privacy channel $p(y|x)$ be data-independent. Then there is

[TABLE]

where the random variable $Z\sim p(y|x)$ for a fixed $x\in\mathcal{X}$. The same as in Section 4.1, the key point of the above proof is that each channel in $\mathbb{S}_{i}$ is a data-independent channel in information theory. Furthermore, in general, the upper bound in (63) is hard to be reached. The following defined privacy channel, however, is an exception.

Definition 13 (Weakly Symmetric(-Reachable) Privacy Channel).

Let $p(y|x)$ be a data-independent privacy channel of $f:\mathcal{X}\rightarrow\mathcal{Y}$ and let $\mathbb{S}_{i}$ be defined as in Section 3.2. Then the privacy channel is said to be weakly symmetric(-reachable) if there exist one $i^{\prime}\in[n]$ and one channel $p^{*}(y|x_{i^{\prime}})\in\mathbb{S}_{i^{\prime}}$ such that $\sum_{x_{i^{\prime}}\in\mathcal{X}_{i^{\prime}}}p^{*}(y|x_{i^{\prime}})$ is constant for all $y\in\mathcal{Y}$.

The weakly symmetric privacy channel can reach the upper bound in (63), whose proof is the same as [33, Theorem 7.2.1]. We then have the following result.

Corollary 4.

Let $C_{1}$ be the individual channel capacity of the data-independent privacy channel $p(y|x)$ of $f:\mathcal{X}\rightarrow\mathcal{Y}$ with respect to $\Delta(\mathcal{X})$. Then there is

[TABLE]

where $Z\sim p(y|x)$ for a fixed $x\in\mathcal{X}$. Furthermore, if the privacy channel $p(y|x)$ is weakly symmetric, then there is

[TABLE]

which is achieved by a uniform distribution on the set $\mathcal{X}_{i^{\prime}}$, where ${i^{\prime}}$ is the one in Definition 13. Therefore, when $H(Z)\geq\log|\mathcal{Y}|-\epsilon$, the data-independent privacy channel satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$.

4.3 (Discrete) Exponential Privacy Channel

The exponential mechanism [51, 6] is fundamental in the differential privacy model. Now we construct its counterpart in the information privacy model. Before presenting the channel, we have to do some preparation.

Definition 14 (Distortion Function [33, 52]).

A distortion function is a mapping

[TABLE]

where $\mathbb{R}^{+}$ is the set of nonnegative real numbers. The distortion $d(y,y^{\prime})$ is a measure of the cost of representing the symbol $y$ by the symbol $y^{\prime}$.

For the function $f:\mathcal{X}\rightarrow\mathcal{Y}$, set $\mathcal{Y}=\{y_{1},y_{2},\ldots,y_{k}\}$. Then $|\mathcal{Y}|=k$. To each $x\in\mathcal{X}$, assume

[TABLE]

where $(i_{1},i_{2},\ldots,i_{k})$ is one permutation of $[k]$. Then define a function $\phi_{x}$ on $\mathcal{Y}$ as

[TABLE]

Definition 15 ((Discrete) Exponential Privacy Channel).

To each $x\in\mathcal{X}$, we define

[TABLE]

where $\phi_{x}$ is defined as in (68), $N$ is a positive parameter, and

[TABLE]

is the normalizer. Then the above defined privacy channel $p(y|x)$ is said to be the (discrete) exponential privacy channel with the parameter $N$.

Note that the exponential privacy channel defined above is a little different from the exponential mechanism in [51, 6]. This is intentioned since we want to let the privacy channel be data-independent, which is easy to be verified. Let $Z\sim p(y|x)$ where the probability distribution $p(y|x)$ is defined in (69). We now evaluate the entropy $H(Z)$ of $Z$. Recall that $k=|\mathcal{Y}|$. We have

[TABLE]

Note that the last expression is related to the two series $\alpha,\sum_{i=0}^{k-1}\exp\left(\frac{-i}{N}\right)\frac{i}{N}$. The series $\alpha$ is geometric and then is evaluated as

[TABLE]

The second series $\sum_{i=0}^{k-1}\exp\left(\frac{-i}{N}\right)\frac{i}{N}$ is a bit complicated. Set $\lambda=1/N$. There is

[TABLE]

Then the second series have the value

[TABLE]

Therefore,

[TABLE]

where $k\geq 1$ and $\lambda=\frac{1}{N}\leq 1$.

Let $\log k-H(Z)\leq\epsilon$, which ensures $C_{1}\leq\epsilon$ by (63). Then

[TABLE]

Using numerical method we can find suitable $\lambda=1/N$ or $N$ to satisfy the above inequality, which then ensures $\epsilon$-information privacy with respect to $\mathbb{P}$ of the exponential privacy channel.

Corollary 5.

Let $C_{1}$ be the individual channel capacity of the exponential privacy channel in Definition 15 with respect to $\Delta(\mathcal{X})$. Then there is

[TABLE]

where $H(Z)$ is shown in (82). Therefore, this privacy channel satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$ for all $\lambda^{*}$, where $\lambda^{*}$ is a solution of (83).

5 The Case of Continuous Privacy Channels

The main tasks of this section are to generalize Theorem 3.1 to the continuous case and then to analyze the Gaussian privacy channel.

We consider the case where $\mathcal{X}_{i},i\in[n]$ are continuous sets. In this setting, $X_{i}$ and $X$ are continuous random variables. We also let $Y$ and $\mathcal{Y}$ be continuous. Then all the related probability distributions of the above random variables become the corresponding density functions. The entropy and the mutual information become integrals as defined in [33, §8]; that is,

[TABLE]

and

[TABLE]

where $p(y|x_{i})=\int_{x_{(i)}}p(y|x_{i},x_{(i)})p(x_{(i)}|x_{i})dx_{(i)}$.

We now generalize the sets $\mathbb{Q}_{i}$ and $\mathbb{S}_{i}$ in Section 3 into continuous case. Recall that the channel $(\mathcal{X}_{i},p(y|x_{i}),\mathcal{Y})$ has of the formula

[TABLE]

Let $\mathbb{Q}_{i}$ be the set of all possible channels $(\mathcal{X}_{i},p(y|x_{i}),\mathcal{Y})$; that is, let

[TABLE]

where $p(x_{(i)}|x_{i})\in\Delta(\mathcal{X})$ means there exists $X\in\Delta(\mathcal{X})$ such that $X\sim p(x_{i})p(x_{(i)}|x_{i})$. Let $\mathbb{S}_{i}$ be the set

[TABLE]

Then the continuous case generalization of Theorem 3.1 is shown as follow.

Theorem 5.1.

Assume the individual channel capacity $C_{1}$ of the privacy channel $(\mathcal{X},p(y|x),\mathcal{Y})$ with respect to $\Delta(\mathcal{X})$, defined as

[TABLE]

exists, and let $\mathbb{Q}_{i}$ and $\mathbb{S}_{i}$ be defined in (88) and (89), respectively. Assume the function $p(y|x)$ is continuous on $\mathcal{Y}\times\mathcal{X}$. Then there are $\mathbb{S}_{i}\subseteq\mathbb{Q}_{i}$ and

[TABLE]

where $C_{p(y|x_{i})}$ is the channel capacity of the channel $p(y|x_{i})$.

The proof of the above theorem needs the continuous case generalization of Lemma 2.

Lemma 3.

Let $X,Y$ both be continuous random variables. Let $(X,Y)\sim p(x,y)=p(x)p(y|x)$. Then the mutual information $I(X;Y)$ is a convex function of $p(y|x)$ for fixed $p(x)$.

Proof.

The proof is omitted since it is the same as the one of [33, Theorem 2.7.4].

Now we prove Theorem 5.1.

of Theorem 5.1.

We first do a notational simplification. We have

[TABLE]

where $\mu^{x_{i}}$ is the probability measure over $\mathcal{X}_{(i)}$ such that

[TABLE]

for all measurable set $A\subseteq\mathcal{X}_{(i)}$. Clearly, there is $\mu^{x_{i}}(\mathcal{X}_{(i)})=1$. Note that the probability measures $\mu^{x_{i}}$ in (93) are different for different $x_{i}\in\mathcal{X}_{i}$.

The first claim $\mathbb{S}_{i}\subseteq\mathbb{Q}_{i}$ is proved as follows. Let $p^{\prime}(y|x_{i})\in\mathbb{S}_{i}$. Then, to each $x_{i}$, there exists $x_{(i)}^{x_{i}}\in\mathcal{X}_{(i)}$ such that

[TABLE]

for all $y\in\mathcal{Y}$ by (89). In order to prove the first claim, we need to prove that there exists a probability transition matrix $\mu=\{\mu^{x_{i}}:x_{i}\in\mathcal{X}_{i}\}$ such that

[TABLE]

where the left-hand side of the equation is the channel when setting the probability transition matrix $p(x_{(i)}|x_{i})$ to be $\mu$. This probability transition matrix $\mu$ is constructed as the limit of a sequence of probability transition matrices $\{\mu_{k}\}_{k\geq 1}$ as follows. Fix $x_{i}$ and $k\geq 1$. By (93), set $p(x_{(i)}|x_{i})$ to be the simple function [53, Definition 2.3.1]

[TABLE]

with $\int_{x_{(i)}\in\mathcal{X}_{(i)}}p(x_{(i)}|x_{i})dx_{(i)}=c_{k}^{x_{i}}\mu_{k}^{x_{i}}(A_{k}^{x_{i}})=1$, where

[TABLE]

is the ball with the center $x_{(i)}^{x_{i}}$ and the radius $1/k$. Inputting the above probability transition matrix $\mu_{k}=\{\mu_{k}^{x_{i}}:x_{i}\in\mathcal{X}_{i}\}$ into (93) and letting $k\rightarrow\infty$, we have

[TABLE]

where (100) is due to $\mu_{k}^{x_{i}}(A_{k}^{x_{i}})c_{k}^{x_{i}}=1$, (101) is due to the mean value theorem, and (102) is due to the continuity of the function $p(y|x)$ on $\mathcal{Y}\times\mathcal{X}$. Letting $\mu=\lim_{k\rightarrow\infty}\mu_{k}\in\Delta(\mathcal{X})$ and inputting $\mu$ into (96), we then have $p^{\prime}(y|x)\in\mathbb{Q}_{i}$, which implies $\mathbb{S}_{i}\subseteq\mathbb{Q}_{i}$. The first claim is proved.

The second claim, i.e. the equation (92), is proved as follows. Since the first claim holds, then we only need to prove

[TABLE]

The crux of the following proofs is the observation that an integral of a function is defined as a limitation of the integrals of a sequence of simple functions [53, §2]. Specifically, the integral in (93) is a limitation of the integrals of a sequence of simple functions, which will be defined as follows. Then we will prove the inequality (104) by the convexity of mutual information in Lemma 3 and the Jensen inequaliy. To each $x_{i}$, let

[TABLE]

be a simple function on $\mathcal{X}_{(i)}$ as defined in [53, Definition 2.3.1], and assume $p_{k_{x_{i}}}^{x_{i},y}(x_{(i)})\uparrow_{k_{x_{i}}}p(y|x_{i},x_{(i)})$ for all $x_{(i)}\in\mathcal{X}_{(i)}$, where $I_{A}$ is the indicator function of the set $A$. Then, to each $x_{i}$, there is

[TABLE]

by [53, Definition 2.3.2, Definition 2.3.3]. Inputting (106) into (86), we have

[TABLE]

where (109) is due to the convexity of mutual information in Lemma 3 and the Jensen’s inequality, (110) is due to $\sum_{j=1}^{k_{x_{i}}}\mu(A_{j}^{x_{i}})=1$, and (111) is due to the continuity of the function $p(y|x)$ on $\mathcal{Y}\times\mathcal{X}$ which ensures

[TABLE]

for one $x_{(i)}^{x_{i}}\in\mathcal{X}_{(i)}$. Therefore, the inequality (104) holds since the channel $p(y|x_{i})=p(y|x_{i},x_{(i)}^{x_{i}})$ in the right-hand side of (111) is in $\mathbb{S}_{i}$.

The claims are proved.

5.1 Gaussian Privacy Channel

Now we introduce the Gaussian privacy channel, which is the counterpart of the Gaussian mechanism of differential privacy [6, §A]. We will not discuss the Laplace privacy channel, the counterpart of the Laplace mechanism of differential privacy. The reason why we choose the Gaussian channel instead of the Laplace channel is that the study of the former is more mature in information theory.

Definition 16 (Gaussian Privacy Channel).

The privacy channel $p(y|x)$ of the continuous function $f:\mathcal{X}\rightarrow\mathcal{Y}$ is said to be Gaussian with the parameter $N$ if, to each $x\in\mathcal{X}$, there is

[TABLE]

where $\mathcal{Y}\subseteq\mathbb{R}$.

Now we evaluate the individual channel capacity of the Gaussian privacy channel. The key point of this evaluating is that each channel $p(y|x_{i})$ in $\mathbb{S}_{i}$ is a Gaussian channel in [33, §9.1]. Note that the continuity of the function $f(x)$ on $\mathcal{X}$ ensures the continuity of the function $p(y|x)$ on $\mathcal{Y}\times\mathcal{X}$. Let $\mathcal{Y}\subseteq[-T,T]$ with $T>0$. Then $Ef(X)^{2}\leq T^{2}$ for all $X\in\Delta(\mathcal{X})$ and

[TABLE]

where (114) is due to Theorem 5.1 and (115) is due to [33, §9.1]. Let

[TABLE]

Then

[TABLE]

Therefore, if $N\geq\frac{T^{2}}{\exp(2\epsilon)-1}$, then the Gaussian privacy channel in Definition 16 satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$.

Corollary 6.

Let $C_{1}$ be the individual channel capacity of the Gaussian privacy channel in Definition 16 with respect to $\Delta(\mathcal{X})$. Then there is

[TABLE]

where $\mathcal{Y}\subseteq[-T,T]$ with $T>0$. Therefore, this privacy channel satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})$ for $N\geq\frac{T^{2}}{\exp(2\epsilon)-1}$.

We stress that the above result is only suitable to the case where $f(x)\in\mathbb{R}$. To the multi-dimensional query function $f:\mathcal{X}\rightarrow\mathbb{R}^{d}$, we can either use the Gaussian privacy channel in each dimension of $f(x)$ or construct multi-dimensional Gaussian privacy channel by using the results of [33, Theorem 8.4.1] and [33, Theorem 8.6.5]. The details are omitted.

5.2 Basic Utility Analysis

Now we give an intuitive comparison of the data utilities between the Gaussian privacy channel in Definition 16 and the Gaussian mechanism, the Laplace mechanism in the differential privacy model. Noting that the variances of the probability distributions in these channels/mechanisms are crucial to indicate the utility, therefore, we only compare their variances.

The variances of the Laplace mechanism and the Gaussian mechanism are respective $\frac{\Delta f}{\epsilon}$ and

[TABLE]

in which (119) ensures $(\epsilon,\delta^{\prime})$-differential privacy and $\Delta f$ is the global sensitivity. The variance of the Gaussian privacy channel in Definition 16 is

[TABLE]

Noticing that $\Delta f\leq T$ for the same $\epsilon$ and for the moderate $\delta^{\prime}$, then the variances of the Laplace mechanism and the Gaussian mechanism are more small than the variance of the Gaussian privacy channel. This implies that the first two mechanisms, in general, have more good utilities than the Gaussian privacy channel when $b=0$. However, if the dataset is big enough, i.e. if $n$ is large enough, which ensures that Assumption 2.2 is true for a moderately large $b$ and then for a moderately large $\delta$ (in Definition 11), then the variance of the Gaussian privacy channel becomes

[TABLE]

by Proposition 3. Then in this setting the Gaussian privacy channel may have more small variance than the Laplace mechanism and the Gaussian mechanism, especially when $n$ is large enough. This implies that the Gaussian privacy channel roughly have more good utility than the last two mechanisms when $n$ is large enough.

The above discussions indicate that the information privacy model is more flexible than the differential privacy model and therefore may obtain more better utility than the later when $n$ is large enough.

5.3 Application to the Law of Large Numbers

In order to show how our model works, we now give a privacy-preserving edition to the law of large numbers [54, Section 5.2].

Proposition 4.

Let $X_{1},X_{2},\ldots,X_{n}$ be a sequence of independent random variables with $\mathbb{E}X_{i}=\mu$ and $\mbox{Var}(X_{i})=\sigma^{2}$. Let $\mathcal{X}_{i}\subseteq[-T,T]$. Let $f(X)=\frac{\sum_{i=1}^{n}X_{i}}{n}$ and $W=f(X)+Z$, where $Z\sim\mathcal{N}(0,N)$ with $N=\frac{T^{2}}{\exp(2\epsilon+2\delta_{n})-1}$. Assume the Gaussian channel $W=f(X)+Z$ is $(b_{n},\delta_{n})$-balanced and assume $\delta_{n}\rightarrow\bar{\delta}$ as $n\rightarrow\infty$. Then the output $W$ satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})_{b_{n}}$ and, for any $\tau\geq 0$,

[TABLE]

Proof.

The claim that the output $W$ satisfies $\epsilon$-information privacy with respect to $\Delta(\mathcal{X})_{b_{n}}$ is ensured by Corollary 6 and Proposition 3.

Now we prove the inequality (162). There are $EW=Ef(X)+EZ=\mu$ and

[TABLE]

Since $\delta_{n}\rightarrow\bar{\delta}$ as $n\rightarrow\infty$, we have $N\rightarrow\frac{T^{2}}{\tau^{2}(\exp(2\epsilon+2\bar{\delta})-1)}$ and $\mbox{Var}(W)\rightarrow 0$ as $n\rightarrow\infty$. Then, by the Chebyshev’s inequality, we have

[TABLE]

The claims are proved.

In Proposition 4, we find that the bound $\frac{T^{2}}{\tau^{2}(\exp(2\epsilon+2\bar{\delta})-1)}\not\rightarrow 0$ as $n\rightarrow 0$. This implies that, in order to let the output satisfy Dalenius security, the Gaussian privacy channel will introduce non-ignorable noise even when $n\rightarrow\infty$. Furthermore, when we set $b_{n}=0$, then $\bar{\delta}=0$ and the bound becomes $\frac{T^{2}}{\tau^{2}(\exp(2\epsilon)-1)}$. This implies that, even though we may introduce non-ignorable noise in order to satisfy Dalenius security, we can greatly reduce the variance of the noise by setting more large $b_{n}$ as $n\rightarrow\infty$.

6 Group Privacy

The group privacy problem is to study whether privacy channels protect the privacy of a group of individuals. In this section we will first formalize the group privacy definition and then prove a result to the group privacy.

Definition 17 (Group Channel Capacity).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$ and one of its privacy channel $p(y|x)$, we define the $k$-group channel capacity of $p(y|x)$ with respect to $\mathbb{P}\subseteq\Delta(\mathcal{X})$ as

[TABLE]

where $X_{I}=(X_{i_{1}},\ldots,X_{i_{k}})$ with $I=\{i_{1},\ldots,i_{k}\}\subseteq[n]$.

Definition 18 (Group Privacy).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$, assume one of its privacy channel $p(y|x)$ satisfies $\epsilon$-information privacy with respect to $\mathbb{P}$. We say that $p(y|x)$ satisfies $c$-group privacy with respect to $\mathbb{P}$ if

[TABLE]

where $C_{k}$ is the $k$-group channel capacity of $p(y|x)$ with respect to $\mathbb{P}$, $c$ is a nonnegative parameter.

Lemma 4.

Let $p(y|x)$ be a privacy channel of $f:\mathcal{X}\rightarrow\mathcal{Y}$. Let $X_{I}=(X_{I_{1}},X_{I_{2}})$ with $I=I_{1}\cup I_{2}$ and $I_{1}\cap I_{2}=\emptyset$. Then there exists $|\mathcal{X}_{I_{1}}|$ probability distributions $\{X^{x_{I_{1}}}:x_{I_{1}}\in\mathcal{X}_{I_{1}}\}$ over $\mathcal{X}$ such that

[TABLE]

where $X_{I_{1}}\sim p(x_{I_{1}})$, where $X^{x_{I_{1}}}=(X^{x_{I_{1}}}_{I_{1}},X^{x_{I_{1}}}_{I_{2}},X^{x_{I_{1}}}_{[n]-I})$ is one probability distribution over $\mathcal{X}$, and where $Y^{x_{I_{1}}}$ is the corresponding output random variable of the privacy channel $p(y|x)$ when the input random variable is $X^{x_{I_{1}}}$.888The superscript $x_{I_{1}}$ in $X^{x_{I_{1}}}$ is used to denote that each $x_{I_{1}}$ corresponds to a unique probability distribution $X^{x_{I_{1}}}$ over $\mathcal{X}$. The same to $Y^{x_{I_{1}}}$.

Proof.

We only prove the case of $I_{1}=\{1\},I_{2}=\{2\}$. Other cases can be proved similarly.

By the chain rule of the mutual information[33, Theorem 2.5.2], we have

[TABLE]

Then, in order to prove the claim, given $x_{1}\in\mathcal{X}_{1}$, we only need to show that there exists a random variable $X^{x_{1}}\sim q(x)\in\Delta(\mathcal{X})$ over $\mathcal{X}$ such that

[TABLE]

where $Y^{x_{1}}$ is the corresponding output random variable of the channel $p(y|x)$ when the input random variable is $X^{x_{1}}=(\tilde{X}_{1}^{x_{1}},\tilde{X}_{2}^{x_{1}})$. For notational simplicity, we set $\tilde{Y}=Y^{x_{1}}$ and $\tilde{X}=X^{x_{1}}$.

Given $x_{1}$, we construct the probability distribution $q(x)\in\Delta(\mathcal{X})$ as follows. Let $q(x_{1})$ be the probability distribution of $\tilde{X}_{1}$. Set $q(x_{1})=1$ and $q(x_{1}^{\prime})=0$ for $x_{1}^{\prime}\in\mathcal{X}_{1}\setminus\{x_{1}\}$. Set $q(x_{(1)}|x_{1})=p(x_{(1)}|x_{1})$ and $q(x)=q(x_{1})q(x_{(1)}|x_{1})$ for all $x=(x_{1},x_{(1)})\in\mathcal{X}$, where $(i)=[n]-i$. Then it is easy to verify that $q(x)\in\mathbb{P}$. Let $\tilde{X}\sim q(x)$ and let $\tilde{Y}\sim q(y)$ be the output random variable when the source follows $\tilde{X}$ and when the channel is $p(y|x)$. Then

[TABLE]

and

[TABLE]

Then

[TABLE]

The claim is proved.

Combining Lemma 4 with Proposition 3, we have the following result.

Theorem 6.1.

Let the privacy channel $p(y|x)$ be $(b,\delta)$-balanced. Then it satisfies [math]-group privacy with respect to $\Delta(\mathcal{X})$, and satisfies $\delta$-group privacy with respect to $\Delta(\mathcal{X})_{b}$.

7 Composition Privacy

The composition privacy problem is to study whether the privacy channels protect each individual’s privacy while multiple datasets or multiple query results are output. There are two kinds of scenarios as discussed in [43]. First, multiple query results of one dataset are output. We call this kind of scenario as the basic composition privacy problem. To the differential privacy model, the privacy problem of this scenario is treated by the composition privacy property [6, 55, 56, 57]. This property is very useful in data privacy since it can be used to modularly construct privacy channels.

Second, multiple query results of multiple datasets generated by the same group of individuals are output, respectively. We call this kind of scenario as the general composition privacy problem. Many famous data privacy disclosing events can be categorized into the general composition privacy problem. For example, the independent data publications of datasets of the Netflix and the IMDb [31] respectively, the independent data publications of the online behaviors and offline retailing data [58] respectively, and the independent data publications of the voter registration data and the medical data [10] respectively. For each of the above applications, the composition attack [59, 31] techniques may employ the relationship between/among different datasets/queries to infer the privacy of individuals whose data is contained in these datasets. We stress that the traditional composition privacy property can’t treat the general privacy problem since the former only treats the case of only one dataset.

One needs to be mentioned is that the general composition privacy is related to the user-level privacy but the basic composition privacy is related to the event-level privacy [60].

7.1 Basic Composition Privacy

The basic composition privacy problem has $m$ query functions $f_{j}:\mathcal{X}\rightarrow\mathcal{Y}^{j},j\in[m]$, which correspond to $m$ queries to a dataset. In this section we set $Y=(Y^{1},\ldots,Y^{m})$, $\mathcal{Y}=(\mathcal{Y}^{1},\ldots,\mathcal{Y}^{m})$, $y^{i}\in\mathcal{Y}^{i}$, and $y=(y^{1},\ldots,y^{m})\in\mathcal{Y}$.

Definition 19 (Basic Composition Privacy).

Assume the privacy channel $(\mathcal{X},p(y^{j}|x),\mathcal{Y}^{j})$ of the function $f_{j}:\mathcal{X}\rightarrow\mathcal{Y}^{j}$ satisfies $\epsilon_{j}$-information privacy with respect to $\mathbb{P}\subseteq\Delta(\mathcal{X})$ for $j\in[m]$. We say that the composition channel $(\mathcal{X},p(y|x),\mathcal{Y})$ satisfies $c$-(basic) composition privacy with respect to $\mathbb{P}$ if

[TABLE]

where $C_{1}^{\mathbb{P}}$ is the individual channel capacity of the composition channel $p(y|x)$ with respect to $\mathbb{P}$, where $c$ is a nonnegative constant, and where

[TABLE]

The equation (138) in the above definition assumes the channels $p(y^{j}|x),j\in[m]$ are independent to each other, which, in general, is the practical setting. The dependent case is left as an open problem.

Lemma 5.

Let the notations be as shown in Definition 19 and set $m=2$. Then there exist $|\mathcal{Y}^{2}|$ probability distributions $\{X^{y^{2}}:y^{2}\in\mathcal{Y}^{2}\}$ over $\mathcal{X}$ such that

[TABLE]

where, to given $y^{2}$, $Y^{y^{2}}=(Y^{1,y^{2}},Y^{2,y^{2}})$ is the output random variable over $\mathcal{Y}$ of the composition channel $p(y|x)$ when the input random variable is $X^{y^{2}}=(X_{1}^{y^{2}},\ldots,X_{n}^{y^{2}})$ over $\mathcal{X}$,999The superscript ${y^{2}}$ in $X^{y^{2}}$ is used to denote that each ${y^{2}}$ corresponds to a unique probability distribution $X^{y^{2}}$ over $\mathcal{X}$. The same to $Y^{y^{2}}$. and where

[TABLE]

Proof.

The proof is similar to the proof of Lemma 4. We only prove the case of $i=1$ and $n=2$, other cases can be proved similarly.

By the chain rule of the mutual information, we have

[TABLE]

Then, in order to prove the claim, to the given $y^{2}$, we only need to show that there exists a random variable $X^{y^{2}}\sim q(x)\in\Delta(\mathcal{X})$ such that

[TABLE]

where $Y^{y^{2}}=(Y^{1,y^{2}},Y^{2,y^{2}})$ is the corresponding output random variable of the channel $p(y|x)$ when the input random variable is $X^{y^{2}}=(X_{1}^{y^{2}},\ldots,X_{n}^{y^{2}})$ over $\mathcal{X}$. We stress that the proof of (142) is nontrivial since the composition channel $p(y|x)$ is fixed. To given $y^{2}$, we construct the probability distribution $q(x)\in\Delta(\mathcal{X})$ as follows, where we set $\tilde{Y}=Y^{y^{2}}$ and $\tilde{Y}=Y^{y^{2}}$ for notational simplicity.

Set $q(x)=q(x_{1})q(x_{2}|x_{1})$ with $q(x_{1})=\frac{p(x_{1})p(y^{2}|x_{1})}{p(y^{2})}=p(x_{1}|y^{2}),q(x_{2}|x_{1})=\frac{p(y^{2}|x_{1},x_{2})p(x_{2}|x_{1})}{p(y^{2}|x_{1})}$ and $q(y^{1}|x_{1})=\sum_{x_{2}}p(y^{1}|x_{1},x_{2})q(x_{2}|x_{1})$ for all $x=(x_{1},x_{2})\in\mathcal{X}$. Then it is easy to verify that $q(x)=p(x|y^{2})\in\Delta(\mathcal{X})$. Let $\tilde{X}$ follow $q(x)$ and let $\tilde{Y}^{1}$ follow $q(y^{1})$, where $\tilde{Y}^{1}$ is the output random variable of the channel $p(y^{1}|x)$ when the source is $\tilde{X}$. Then

[TABLE]

and

[TABLE]

Hence

[TABLE]

The claim is proved.

By Lemma 5 and Proposition 3, we have the following result.

Theorem 7.1.

Let the notations be as shown in Definition 19. Let the privacy channel $p(y^{j}|x)$ be $(b,\delta^{j})$-balanced, $j\in[m]$. Then the composition channel $p(y|x)$ satisfies [math]-composition privacy with respect to $\Delta(\mathcal{X})$, and satisfies $\sum_{j\in[m]}\delta^{j}$-composition privacy with respect to $\Delta(\mathcal{X})_{b}$.

7.2 General Composition Privacy

The composition privacy problem is related to the user-level privacy [60] which measures the privacy of an individual when several pieces of data of the individual are output independently. For example, an individual’s movie ranking data are output independently by IMDb and Netflix [31]. Then our question is that, if the IMDb and Netflix organizations output two datasets respectively and if the two datasets satisfy Dalenius security respectively, whether the combination of the two datasets also satisfies Dalenius security as the result of Theorem 7.1.

We first formalize the general composition privacy problem, where there are $m$ datasets, and each dataset has $n$ elements and is queried once, and the $i$th record of each dataset is the data of the $i$th individual. In this section we set $Y=(Y^{1},\ldots,Y^{m})$, $\mathcal{Y}=(\mathcal{Y}^{1},\ldots,\mathcal{Y}^{m})$, $y^{i}\in\mathcal{Y}^{i}$, $y=(y^{1},\ldots,y^{m})\in\mathcal{Y}$, and

[TABLE]

where

[TABLE]

for $i\in[n],j\in[m]$.101010One needs to be mentioned is that by convention the random variable $X_{i}^{j}$ should be denoted as $X_{ij}$. We choose the former notation due to the notational abbreviation. The notations $x_{i},x^{j},x_{i}^{j},x,\mathcal{X}_{i},\mathcal{X}^{j},\mathcal{X}_{i}^{j}$ and $\mathcal{X}$ are defined accordingly. This implies that, to the general composition privacy problems, the input random variable $X$ is modeled as a random matrix, in which the row random vector $X^{j}$ is used to model the adversary’s knowledge to the $j$th dataset, and the column random vector $X_{i}$ is used to model an adversary’s knowledge to the $m$ records of the $i$th individual in $m$ datasets. There are $m$ query functions $f_{j}:\mathcal{X}^{j}\rightarrow\mathcal{Y}^{j}$, $j\in[m]$ and $Y^{j}$ is the output random variable of $f_{j}$. Let $\Delta(\mathcal{X}^{j})$ denote the probability simplex over $\mathcal{X}^{j}$ for $j\in[m]$, and let $\Delta(\mathcal{X})=\Delta(\prod_{j\in[m]}\mathcal{X}^{j})=\Delta(\prod_{i\in[n]}\mathcal{X}_{i})$, where $\mathcal{X}=\prod_{j\in[m]}\mathcal{X}^{j}=\prod_{i\in[n]}\mathcal{X}_{i}$.

Definition 20 (General Composition Privacy).

To the function $f_{j}:\mathcal{X}^{j}\rightarrow\mathcal{Y}^{j}$, let the privacy channel $(\mathcal{X}^{j},p(y^{j}|x^{j}),\mathcal{Y}^{j})$ satisfy $\epsilon_{j}$-information privacy with respect to $\mathbb{P}^{j}\subseteq\Delta(\mathcal{X}^{j})$ for $j\in[m]$. We say that the composition channel $p(y|x)$ satisfies $c$-general composition privacy with respect to $\mathbb{P}\subseteq\Delta(\mathcal{X})$ if

[TABLE]

where $C_{1}^{\mathbb{P}}$ is the individual channel capacity of the channel $p(y|x)$ with respect to $\mathbb{P}$, and where

[TABLE]

with $y=(y^{1},\ldots,y^{m})\in\mathcal{Y}$ and $x=(x^{1},\ldots,x^{m})\in\mathcal{X}$.

The equation (153) in the above definition assumes the channels $p(y^{j}|x^{j}),j\in[m]$ are independent to each other, which is always the practical setting, such as the independent publishing of the Netflix dataset and the IMDb dataset. The dependent case is left as an open problem.

Note that, if the $m$ random variables $X^{1},\ldots,X^{m}$ are equal, which is equivalent to that the $m$ datasets $x^{1},\ldots,x^{m}$ are equal, then the general composition privacy problem becomes the basic composition privacy problem. Formally, we have the following result.

Proposition 5.

Assume $X^{1}=X^{2}$ with $X=(X^{1},X^{2})$. Then there is

[TABLE]

Proof.

Set $X^{1}=X^{2}$, then

[TABLE]

where

[TABLE]

The claim is proved.

Lemma 6.

Let the notations be as shown in Definition 20 and set $m=2$, which implies $Y=(Y^{1},Y^{2})$ and $X=(X^{1},X^{2})$. Then there exist $|\mathcal{X}_{1}^{1}|$ probability distributions $\{X^{2,x_{1}^{1}}:x_{1}^{1}\in\mathcal{X}_{1}^{1}\}$ over $\mathcal{X}^{2}$, exist $|\mathcal{Y}^{1}|$ probability distributions $\{X^{1,y^{1}}:y^{1}\in\mathcal{Y}^{1}\}$ over $\mathcal{X}^{1}$, and exist $|\mathcal{Y}^{1}\times\mathcal{X}^{1}_{1}|$ probability distributions $\{X^{2,y^{1},x^{1}_{1}}:y^{1}\in\mathcal{Y}^{1},x^{1}_{1}\in\mathcal{X}^{1}_{1}\}$ over $\mathcal{X}^{2}$ such that

[TABLE]

where $Y^{1,x_{1}^{1}}$ is the corresponding output random variable of the channel $(\mathcal{X}^{2},p(y^{1}|x^{2}),\mathcal{Y}^{1})$ when the input random variable is $X^{2,x_{1}^{1}}=(X^{2,x_{1}^{1}}_{1},\ldots,X^{2,x_{1}^{1}}_{n})$ over $\mathcal{X}^{2}$, where $Y^{2,y^{1}}$ is the corresponding output random variable of the channel $(\mathcal{X}^{1},p(y^{2}|x^{1}),\mathcal{Y}^{2})$ when the input random variable is $X^{1,y^{1}}=(X^{1,y^{1}}_{1},\ldots,X^{1,y^{1}}_{n})$ over $\mathcal{X}^{1}$, and where each $Y^{2,x_{1}^{1},y_{1}}$ is the corresponding output random variable of the channel $(\mathcal{X}^{2},p(y^{2}|x^{2}),\mathcal{Y}^{2})$ when the input random variable is $X^{2,x_{1}^{1},y_{1}}=(X^{2,x_{1}^{1},y_{1}}_{1},\ldots,X^{2,x_{1}^{1},y_{1}}_{n})$ over $\mathcal{X}^{2}$.

Proof.

The proof is a combination of the proofs of Lemma 5 and Lemma 4. We have

[TABLE]

where the equalities $=_{a},=_{b}$, and $=_{c}$ are due to Lemma 4 and Lemma 5.

The claim is proved.

Let $C_{1}^{i,j}$ be the individual channel capacity of the privacy channel $(\mathcal{X}^{i},p(y^{j}|x^{i}),\mathcal{Y}^{j})$ with respect to $\Delta(\mathcal{X}^{i})$, $i,j\in[2]$. Then, by Lemma 6, there is

[TABLE]

Combining Proposition 3, we have the following result.

Theorem 7.2.

Let $C_{1}^{i,j}$ be the individual channel capacity of the privacy channel $(\mathcal{X}^{i},p(y^{j}|x^{i}),\mathcal{Y}^{j})$ with respect to $\Delta(\mathcal{X}^{i})$, and let this privacy channel be $(\delta_{i}^{j},b)$-balanced, $i,j\in[2]$. Then the composition channel $p(y|x)$ satisfies $(C_{1}^{1,2}+C_{1}^{2,1})$-general composition privacy with respect to $\Delta(\mathcal{X})=\prod_{j\in[m]}\mathcal{X}^{j}$, and then satisfies $(\sum_{i,j\in[2]}\delta_{i}^{j}+C_{1}^{1,2}+C_{1}^{2,1})$-general composition privacy with respect to $\Delta(\mathcal{X})_{b}$.

Note that the claims of Lemma 6 and Theorem 7.2 can be generalized to the cases of $m\geq 2$, whose proofs are similar to the proofs of Lemma 6 and Theorem 7.2. Furthermore, one needs to be stressed is that the parameters

[TABLE]

in Theorem 7.2 can’t be reduced to [math] as $b\rightarrow 0$ whereas the case in Theorem 7.1 is $c\rightarrow 0$ as $b\rightarrow 0$. Of course, we must acknowledge that the inequality (162) may be loosed too much. Whether the bound in (162) can be further reduced is left as a future work.

To explain the meaning of Theorem 7.2, we take the Netflix and the IMDb application scenario as an example [31]. Let $x^{1},x^{2}$ be the respective datasets of Netflix and IMDb, and let $y^{1},y^{2}$ be their respective outputs. Then the output $y^{j}$ discloses at most $C_{1}^{j,j}$ bits information of each individual, $j\in[2]$. Our first intuition is that the combination $(y^{1},y^{2})$ would disclose at most $C_{1}^{1,1}+C_{1}^{2,2}$ bits information of each individual. However, Theorem 7.2 implies that, except $C_{1}^{1,1}+C_{1}^{2,2}$ bits, another $C_{1}^{1,2}+C_{1}^{2,1}$ bits information of each individual may be disclosed by $(y^{1},y^{2})$. Note that the individual channel capacity $C_{1}^{2,1}$ denotes the maximal disclosed information in the IMDb dataset of an individual due to the output of Netflix dataset. The following part estimates the capacity $C_{1}^{2,1}$, where our question is whether $C_{1}^{2,1}$ is completely determined by $C_{1}^{1,1}$ and $C_{1}^{2,2}$. The capacity $C_{1}^{1,2}$ can be estimated similarly.

Proposition 6.

Set $|\mathcal{Y}^{1}|=m$, $k_{i}=|\mathcal{X}^{2}_{i}|$ and $\ell=|\mathcal{X}^{1}|$. Let $M$ be the probability transition matrix of the channel $p(y^{1}|x^{1})$, let $S_{M}$ be the set of all column vectors of $M$, and let $\mathcal{E}_{i}$ be the set of all matrices of $k_{i}$ columns, where every column of each matrix is an element in $S_{M}$; that is,

[TABLE]

Then

[TABLE]

where $C_{E}$ is the channel capacity of the probability transition matrix $E$.

Before proving the above proposition, we need to do some preparation.

Lemma 7.

Assume

[TABLE]

Then there are $p(y^{1}|x^{1},x^{2})=p(y^{1}|x^{1})$, $p(y^{2}|x^{1},x^{2})=p(y^{2}|x^{2})$, $p(y^{1}|x^{2})=\sum_{x^{1}}p(y^{1}|x^{1})p(x^{1}|x^{2})$, and $p(y^{2}|x^{1})=\sum_{x^{2}}p(y^{2}|x^{2})p(x^{2}|x^{1})$ for $(y^{1},y^{2},x^{1},x^{2})\in(\mathcal{Y}^{1},\mathcal{Y}^{2},\mathcal{X}^{1},\mathcal{X}^{2})$.

Proof.

We only prove $p(y^{1}|x^{1},x^{2})=p(y^{1}|x^{1})$ and $p(y^{1}|x^{2})=\sum_{x^{1}}p(y^{1}|x^{1})p(x^{1}|x^{2})$. There are

[TABLE]

and

[TABLE]

The proof is complete.

The proof of Proposition 6.

By Lemma 7, the transition matrix of the channel $p(y^{1}|x^{2})$ is

[TABLE]

where x^{2}\in\mathcal{X}^{2}=\{x^{21},\ldots,x^{{\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}2k}}\} and x^{1}\in\mathcal{X}^{1}=\{x^{11},\ldots,x^{{\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}1\ell}}\} with $k=|\mathcal{X}^{2}|$, $\ell=|\mathcal{X}^{1}|$ and $m=|\mathcal{Y}^{1}|$. Then the probability transition matrix of the channel $(\mathcal{X}^{2}_{i},p(y^{1}|x^{2}_{i}),\mathcal{Y}^{1})$ can be represented as

[TABLE]

with $k_{i}=|\mathcal{X}^{2}_{i}|$, $\ell=|\mathcal{X}^{1}|$, where (172) is due to Theorem 3.1 and where (173) is due to (171). For the clarity of presentation, we denote the four matrices in (172) and (173) to be $A,B,M,D$ and then the two equations are denoted as $A=B=MD$. Then each column of $B$ (or $A$) is a convex combination of the columns of $M$. Note that $M$ is the probability transition matrix of the channel $p(y^{1}|x^{1})$. Then $A$ is the convex combination of the matrices in the set $\mathcal{E}_{i}$, where

[TABLE]

where S_{M}=\{g:\mbox{g$is a column of$M}\}. This implies the claim.

There are several conclusions. First, assuming the inequality (162) is tight, then Theorem 7.2 implies that the composition of outputs of Netflix and IMDb datasets may disclose an individual’s information more than $2\epsilon$ bits even both of the outputs satisfy $\epsilon$-perfect Dalenius security. Second, Proposition 6 shows that $C_{1}^{1,1},C_{1}^{2,2}$ can’t completely determine the values of $C_{1}^{1,2}$ and $C_{1}^{2,1}$, and that $C_{1}^{1,2}$ and $C_{1}^{2,1}$ are larger than $C_{1}^{1,1}$ and $C_{1}^{2,2}$. Third, if we want to reduce the values of $C_{1}^{1,2}$ and $C_{1}^{2,1}$, then we need to reduce the dependent relation between $X^{1}$ and $X^{2}$. This motivates us a way to develop the privacy measures of continuous observation scenarios [60]. For example, we can introduce parameters, like the decay parameters in online learning [61], to decay the dependent extent among $X^{1},X^{2},\ldots$ according to the appearing time of data. This way can reduce the values of $C_{1}^{i,j}$, $i\neq j$ and then improve data utility. How to set these parameters is out of the scope of this paper and is left as an open problem.

7.3 Note to the Parallel Composition

The parallel composition property in differential privacy [62] is very useful in differentially private data mining [57, 63]. It says that, when sequences of privacy channels are applied to disjoint subsets of the dataset, the ultimate privacy guarantee depends only on the worst of the guarantees of each privacy channel, not the sum as the sequential/basic composition property [62]. However, we find that this property no longer holds to the perfect Dalenius security. Before giving our result, we first formalize this property.

Definition 21 (Parallel Composition).

Let $X=(X_{I_{1}},\ldots,X_{I_{k}})$ and $Y=(Y_{I_{1}},\ldots,Y_{I_{k}})$, where $I_{1},\ldots,I_{k}$ is a partition of the set $[n]$. For notational simplicity, we set $Z_{i}=X_{I_{i}},R_{i}=Y_{I_{i}}$ and set $\mathcal{Z}_{i},\mathcal{R}_{i}$ and $z_{i},r_{i}$ accordingly. Let the privacy channel $(\mathcal{Z}_{i},p(r_{i}|z_{i}),\mathcal{R}_{i})$ satisfies $\epsilon_{i}$-information privacy. Then the composition channel $(\mathcal{X},p(y|x),\mathcal{Y})$ is said to satisfy the parallel composition if, for any partition $I_{1},\ldots,I_{k}$ of $[n]$, this channel satisfies $\max_{i\in[k]}\epsilon_{i}$-information privacy, where

[TABLE]

with $x=(z_{1},\ldots,z_{k})$ and $y=(r_{1},\ldots,r_{k})$.

Let $C^{p(y|x)}_{1},C^{p(r_{i}|z_{i})}_{1}$ be the respective individual channel capacities of the privacy channels $(\mathcal{X},p(y|x),\mathcal{Y})$, $(\mathcal{Z}_{i},p(r_{i}|z_{i}),\mathcal{R}_{i})$. Then Definition 21 shows that the parallel composition is equivalent to

[TABLE]

However, the following proposition shows that (176) doesn’t hold.

Proposition 7.

Let the notations be as shown in Definition 21. Then there exist $\tau\geq 0$ and $\imath\in[k]$ such that

[TABLE]

where $\imath=\arg\max_{i\in[k]}C^{p(r_{i}|z_{i})}_{1}$.

Proof.

Let $\imath=\arg\max_{i\in[k]}C^{p(r_{i}|z_{i})}_{1}$ and let $j\in I_{\imath}$. We have

[TABLE]

Then there exists $X^{\prime}=(X_{1}^{\prime},\ldots,X_{n}^{\prime})$ such that

[TABLE]

where $\tau=\max_{j\in I_{\imath}}I(X_{j}^{\prime};R_{({\imath})}|R_{\imath})$. The non-negativity of $\tau$ is due to the non-negativity of the conditional mutual information. The claim is proved.

One needs to be mentioned is that, most probably, $\tau$ is positive since, to most channels $p(y|x)$, there is no evidence that $X_{j}^{\prime},R_{(\imath)}$ are conditionally independent to $R_{\imath}$. However, we currently can’t prove the positivity of $\tau$ which is left as a future work. Therefore, the parallel composition doesn’t hold to the perfect Dalenius security. This result is rational since adversaries can obtain the knowledge of one individual’s data from other individuals’ data.

8 Computational-Bounded Model

This paper has so far ignored issues of computational complexity, permitting both the owner of datasets and the adversaries to be computationally unbounded. In reality, both the owner and the adversaries are computationally bounded. The computational complexity study of differential privacy has attracted attentions of many theoretical computer sciences researchers [64, 65, 66, 67, 7, 6, 26]. In this section, we will employ Yao’s computational information theory [40] to develop a computational-bounded information privacy model. Yao’s theory resorts to the well-developed computational complexity theory in which the complexity of a computational problem is measured by the asymptotic behavior of algorithms as the input length becomes large. Most notions and notations of this section follow the paper [40].

Following Yao’s theory [40], we use a random ensemble $\mathcal{S}_{i}$ to approximate the random variable $X_{i}$ and then use a vector of random ensembles $\mathcal{S}=(\mathcal{S}_{1},\ldots,\mathcal{S}_{n})$ to approximate the random vector $X=(X_{1},\ldots,X_{n})$. We use the effective entropy $H_{c}(\mathcal{S})$ to approximate the entropy $H(X)$ and use the effective mutual information $I_{c}(\mathcal{S}_{i};\mathcal{T})$ to approximate $I(X_{i};Y)$, where the random ensemble $\mathcal{T}$ is an approximaion to $Y$.

Definition 22.

Let $\mathcal{S}_{i}$ be a source ensemble over $\mathcal{X}_{i}$ and let $\mathcal{S}=(\mathcal{S}_{1},\ldots,\mathcal{S}_{n})$ be a source ensemble over $\mathcal{X}$. Let

[TABLE]

where $H_{c}(\mathcal{S})$ is the effective entropy of the source ensemble $\mathcal{S}$ over $\mathcal{X}$.

Definition 23 (Computational Information Privacy).

To the function $f:\mathcal{X}\rightarrow\mathcal{Y}$, we say that one of its privacy channels $p(y|x)$ satisfies $\epsilon$-computational information privacy with respect to $\mathbb{P}$ if

[TABLE]

where $C_{1,c}^{\mathbb{P}}$ is the effective individual channel capacity of $p(y|x)$ with respect to $\mathbb{P}$ with $\mathbb{P}$ being a subset of $\Delta(\mathcal{X})_{0,c}$.

Definition 24 (Computational Balance Function).

To the privacy channel $p(y|x)$, let $C_{1,c}^{0},C_{1,c}^{b}$ be its effective individual channel capacities with respect to $\Delta(\mathcal{X})_{0,c},\Delta(\mathcal{X})_{b,c}$, respectively; that is,

[TABLE]

To a given $b$, assume there exists a nonnegative constant $\delta_{c}$ such that

[TABLE]

Then we say that the privacy channel is $(b,\delta_{c})$-(utility-privacy) computational balanced, and that the function

[TABLE]

is the (utility-privacy) computational balance function of the privacy channel.

Now we give the computational complexity edition of Proposition 3.

Proposition 8.

Let $\delta_{c}=g_{c}(b)$ be the computational balance function of the privacy channel $p(y|x)$. Then this channel satisfies $\epsilon$-computational information privacy with respect to $\Delta(\mathcal{X})_{b,c}$ if and only if it satisfies $(\epsilon+\delta_{c})$-computational information privacy with respect to $\Delta(\mathcal{X})_{0,c}$, and if and only if it satisfies $(\epsilon+\delta_{c}+\tau)$-information privacy with respect to $\Delta(\mathcal{X})$, where $\tau=C_{1}-C_{1,c}^{0}$.

We then have three conclusions.

Proposition 8 implies that, if we assume both some difficulty assumption and Assumption 2.2 are true, then a privacy channel that satisfies $\epsilon$-computational information privacy with respect to $\Delta(\mathcal{X})_{b,c}$ will ensure $\epsilon$-Dalenius security. 2. 2.

Note that

[TABLE]

where $\geq_{a}$ is due to [40, Theorem 2]. This implies that the computational-bounded model will have more good utility than the information privacy model. 3. 3.

Note that, when $n=1,\epsilon=0,b=0$, $\epsilon$-Dalenius security equals the semantic security in cryptography [39, 40]. Note also that, when $n=1,b=0$, $\epsilon$-(computational) Dalenius security equals $\epsilon$-computational differential privacy [7, 6].

9 Related Works

9.1 Differential Privacy, Perfect Secrecy and Semantic Security

Fig. 2 illustrates the relation between the information privacy model, the differential privacy model, the semantic security and the perfect secrecy.

First, the information privacy model is a generalization of Shannon’s encryption model. Specifically, the model has $n$ senders/individuals $X_{1},\ldots,X_{n}$ and a receiver $Y$. The notion of $\epsilon$-perfect Dalenius security is defined as $\max_{i,X}I(X_{i};Y)\leq\epsilon$. If $n=1$ and $\epsilon=0$, then $\epsilon$-perfect Dalenius security equals the perfect secrecy in [32]. As shown in Section 8, if we set $n=1,\epsilon=0$ and assume $X,Y$ are computationally efficient sender and receiver, then the semantic security is a computational bounded analogue of the perfect secrecy and then of $\epsilon$-perfect Dalenius security when some difficulty assumption holds [39, 40, 41].

Second, as shown in Section 2.1, if the independence assumption holds, then $\epsilon$-differential privacy is equivalent to $\epsilon$-Dalenius security (when we define Dalenius security by using $I_{\infty}(X_{i};Y)$). This result is mainly based on Theorem 2.1, which, in part or in other form, had appeared in many references, such as [16, 17, 18, 21, 27, 22]. When $n=1$, $\epsilon$-perfect Dalenius Security is equivalent to $\epsilon$-local differential privacy (when we define Dalenius security by using $I_{\infty}(X_{i};Y)$) [68].

Third, the security of the new model in Section 2.2 is based on Assumption 2.2. This assumption is a substitution of the independence assumption (Assumption 9) and an analogue of the difficulty assumptions in cryptography [39, 40, 41], and is motivated by the later two kinds of assumptions. As discussed in Section 2.2, this assumption is impractical in cryptography but very practical in data privacy protection.

The above discussions show that the information privacy model, the differential privacy model and Shannon’s encryption model, including the semantic security model, are same kind of models except some different settings. This implies that they may share similar properties. For example, the information privacy model inherits the post-processing property, the composition privacy property and the group privacy property of the differential privacy model.

Furthermore, our model in Section 2.2 is more applicable than the differential privacy model in many applications. We take the graph data statistics [69, 70, 25, 24, 71, 72, 73, 74] as an example. The notion of neighboring datasets $x,x^{\prime}$ (Definition 10) is a very important notion in differential privacy. It captures the two states of a dataset when an individual’s data is changed; that is, when an individual’s data is changed, the dataset $x$ becomes $x^{\prime}$. To the graph statistics, there are two options to the notion of the neighboring datasets: the edge neighboring datasets and the node neighboring datasets:

Edge neighboring datasets:

two datasets $x,x^{\prime}$ are said to be neighboring if $x^{\prime}$ is generated when one edge of one individual/node in $x$ is changed.

Node neighboring datasets:

two datasets $x,x^{\prime}$ are said to be neighboring if $x^{\prime}$ is generated when all edges of one individual/node in $x$ are changed.

Clearly, the notion of edge neighboring datasets is too weak to capture an individual’s privacy since an individual’s data may contain many edges whereas the notion of node neighboring datasets is too strong to capture an individual’s privacy since there may exist some individual/node who has very large amount of edges. The later case, in general, implies poor data utility compared to the former. Then we are faced with the dilemma of choosing which one as our notion of neighboring datasets.

To our model in Section 2.2, there is no notion of the neighboring datasets. This model doesn’t emphasize on which data in the dataset are one individual’s data since it, in fact, directly protects the privacy of the data in the dataset but not directly protects the privacy of the individuals generating the dataset. The correlated relation among the data of an individual (such as the correlated relation among the edges of one node) are disregarded since this model assumes an adversary may have any knowledge of the correlation among any data in the dataset, not just limited to the data generated by the same individual. To the graph statistics, we only need to set either the parameter $b$ or the parameter $\delta$. If the graph dataset is large enough, i.e., if the number $n$ of the edges in the dataset is large enough, then Assumption 2.2 is true for large $b$. This implies that we can set large $\delta$, which will generate results with better data utility without loss of privacy.

9.2 Information Theory

Apparently, the information privacy model is very similar to the multi-access channel in information theory [33, §15]. Specifically, they both have $n$ senders/individuals $X_{1},\ldots,X_{n}$ and a common receiver $Y$. However, they mainly have three differences:

To the multi-access channel, the senders must contend not only with the receiver noise but with interference from each other as well. This channel in general assumes the senders send messages independently; that is, it assumes that the random variables $X_{1},\ldots,X_{n}$ are independent. However, there is no independence restriction on these random variables in the information privacy model. For example, Theorem 3.1 and Theorem 5.1 treat the problems where the senders are dependent, which however is not a problem of the multi-access channel. 2. 2.

The multi-access channel studies evaluating the channel capacity region. However, the information privacy model studies evaluating the individual channel capacity. 3. 3.

To our knowledge, the balance function and the individual channel capacity $C_{1}^{b}$ with respect to $\Delta(\mathcal{X})_{b}$ are two completely new notions in information theory. How to evaluate the balance function and $C_{1}^{b}$ is a new problem.

The above three differences show that the multi-access channel and the information privacy model have different problems. Especially, the difficulty of the multi-access channel is to evaluate the channel capacity region when $X_{1},\ldots,X_{n}$ are independent, whereas the difficulty of the information privacy model is to evaluate the individual channel capacity when $X_{1},\ldots,X_{n}$ are dependent.

Furthermore, the group privacy and the composition privacy problems can be considered as some special cases of the network information theory [33, Ch.15]. The group privacy problem is similar to the multi-access channel. Their difference is similar to the difference between the information privacy model and the multi-access channel. The composition privacy problems are similar to the composition of the multi-access channel and the broadcast channel. One of their difference is similar to the difference between the information privacy model and the multi-access channel. Although our proofs in Section 6 and Section 7 seem to be just some simple applications of information theoretic approaches, compared to the difficulties of proving composition privacy and group privacy properties of most other privacy models [75, 76, 30, 16, 18, 21, 17], our work has advantage.

Moreover, Section 8 is an application of Yao’s computational information theory [40]. Section 8 shows that the information privacy model adapts beautifully for the cryptography model [39, 40].

9.3 Other Privacy Measures

Except differential privacy, researchers have developed many other privacy measures.

First, before differential privacy, the $k$-anonymity [10] is the first well-studied privacy model. As discussed in Section 1, the $k$-anonymity model and the related privacy models, such as the $\ell$-diversity [11] and the $t$-closeness [12] model, are very different from the differential privacy model since the privacy notions of the former kind privacy models are relevant to the semantic meaning of data whereas the later is not. However, being irrelevant to the semantic meaning of data is the common feature of two successful security notions: the perfect secrecy and the semantic security. Note that the differential privacy model and the information privacy model inherit this feature as discussed in Section 9.1.

Second, the concentrated differential privacy [28, 29] is a kind of variant of differential privacy. This kind variant mainly aims to obtain better utility and better composition property than differential privacy. However, being similar to differential privacy, the concentrated differential privacy focuses on the privacy loss to an individual by her contribution to a dataset, and therefore does not capture all of the privacy losses from inferences that could be made about one person’s data due to its correlations with other data [18]. Therefore, as differential privacy, the concentrated differential privacy is not secure. The bounded-leakage differential privacy [77] is another relaxed variant of differential privacy. This model inherits the notion of neighboring datasets and therefore it’s security is mainly based on the independence assumption.

Third, it is common to define privacy measures by using $I_{\infty}(X_{i};Y),I(X_{i};Y)$ or other related quantities [75, 76, 30, 16, 18, 21, 17]. Many researchers also use these quantities to study the differential privacy [34, 35, 36, 37, 78, 27, 22]. These related privacy models restrict adversaries’ knowledge to improve data utility [16, 18, 21, 17], which partially motivates Assumption 2.2 and Assumption 9. The two assumptions and the restrictions of adversaries’ knowledge in these privacy models all can be considered as different special cases of Assumption 2. (Almost) all of the above mentioned works develop privacy models to provide either more good utility or more rigorous privacy protection than differential privacy. However, none of these models can provide both. Especially, how to define the notion of secure channel/mechanism is in chaos since almost each work has its own security standard. The first difference between these work and this paper is that we formally define this notion by using the Dalenius goal/Dalenius security, a privacy measure which is well-known not suitable to define data privacy due to poor utility [5, 18]. Of course, we don’t mean that the results of this paper are contrary to other works but want to achieve Dalenius security based on some practical assumption. As discussed in Section 9.1, this treatment is motivated by the hardness assumptions in cryptography. And then the rest of this paper revolves around how to achieve Dalenius security based on some practical assumptions.

We introduced the independence assumption (Assumption 9) and Assumption 2.2 into the information privacy model. The two assumptions combine differential privacy, perfect secrecy and semantic security into a universal model as shown in Section 9.1, which result in more satisfying result of the insecurity of differential privacy and a new direction to define new privacy models with both Dalenius security and more better utility as shown in Section 2. Compared to those restrictions on adversaries’ knowledge, Assumption 2.2 is more practical and more universally applicable to most application scenarios by tuning the parameters $\delta$ or $b$. 2. 2.

We intentionally defined the information privacy model by using information theory as shown in Section 2. This setting, motivated by [32, 40], is very useful to transplant many results and techniques in information theory into the information privacy model as shown in Section 4 and Section 5. Furthermore, the post-processing property, the group privacy property, and the composition privacy property of the information privacy model can be easily proved by using techniques in information theory as shown in Section 2, Section 6, and Section 7. 3. 3.

We proved Theorem 3.1 and Theorem 5.1, which are used to estimate the individual channel capacities of many basic privacy channels, such as the random response privacy channel, the exponential privacy channel and the Gaussian privacy channel as shown in Section 4 and Section 5. By using these basic privacy channels, the composition privacy property and the post-processing property, we can modularly construct more complex privacy channels for complex data processing problems.

That is, our work provides a data privacy model which both satisfies composition privacy property and satisfies Dalenius security with better utility based on a practical assumption.

Another one needs to be mentioned is that there are mainly two ways to explain privacy models [75, 76, 30, 16, 18, 21, 17]:

The correlation among individuals’ data are the nature of these data. The adversary may utilize the knowledge of the correlation to mine each individual’s private data. 2. 2.

The correlation among the individual’s data are the knowledge of an adversary. Different adversary may have different knowledge to the correlation.

Following Shannon’s model to encryption systems [32], this paper uses the second way to explain the privacy models. That is, our privacy models assume that there is a given probability distribution over $\mathcal{X}$ to generate the dataset, and that an adversary can have any probability distribution over $\mathcal{X}$ as his knowledge to the dataset.

10 Conclusion

This paper showed that it is possible to construct privacy channels that both satisfy Dalenius security and have better utility. The reason why these privacy channels can avoid the curse of impossibility results that Dalenius’ goal cannot be achieved with better utility [5] is that a practical assumption is proposed. This assumption (Assumption 2.2), which assumes that each adversary is unknown to some data in the dataset if the dataset is large enough, is a substitution for the impractical independence assumption on which the security of differential privacy is based. The role of this assumption is similar to the role of those difficulty assumptions in cryptography. Of course, we must acknowledge that, even though there are many reasonable evidences, this assumption is really not as stronger as those difficulty assumptions in cryptography; the latter are founded on the computational complexity theory [41, 40, 39] but the former seems can’t. This reminds us of Edmonds’ remark [79]: “It would be unfortunate for any rigid criterion to inhibit the practical development of algorithms which are either not known or known not to conform nicely to the criterion.” Maybe, we should allow the existence of this assumption due to its usefulness in data privacy even though it doesn’t conform nicely to the computational complexity criterion.

Theorem 3.1 and Theorem 5.1 are powerful results to transplant the results or approaches of information theory into the information privacy model to evaluate the individual channel capacities of many privacy channels. For example, the individual channel capacities of the binary symmetric privacy channel and the Gaussian privacy channel are evaluated by using the channels in information theory. This implies a promising direction to treat the problems in data privacy protection by using the results or approaches in information theory.

The Gaussian privacy channel and the exponential privacy channel can take the role of the Laplace mechanism and the exponential mechanism of differential privacy. Specifically, by combining the above privacy channels with the post-processing property, the group privacy property and the composition privacy property, we are ready to modularly construct complicated privacy channels for complicated data processing problems in the information privacy model. The utilities comparison between the Gaussian privacy channel of this paper and the Gaussian mechanism, the Laplace mechanism of the differential privacy model gives us a glimpse of the information privacy model: The information privacy model roughly is more flexible to obtain more good utility than the differential privacy model without loss of privacy when the dataset is large enough.

There are two future works. First, how to evaluate the balance functions is a new problem in information theory. Second, how to develop suitable privacy measures to the continuous observation scenarios is another interesting problem.