Differential Privacy as a Causal Property

TL;DR

This paper explores differential privacy from associative and causal perspectives, providing a new causal characterization that clarifies its guarantees without assuming data point independence, and linking it to causal inference.

Contribution

It introduces a causal view of differential privacy, offering a simple characterization that clarifies its guarantees without independence assumptions, resolving prior disagreements.

Findings

Causal view allows characterization without independence assumptions

Differential privacy limits the causal effect of a data point

Associative view relates to correlation, not causation

Abstract

We present associative and causal views of differential privacy. Under the associative view, the possibility of dependencies between data points precludes a simple statement of differential privacy's guarantee as conditioning upon a single changed data point. However, we show that a simple characterization of differential privacy as limiting the effect of a single data point does exist under the causal view, without independence assumptions about data points. We believe this characterization resolves disagreement and confusion in prior work about the consequences of differential privacy. The associative view needing assumptions boils down to the contrapositive of the maxim that correlation doesn't imply causation: differential privacy ensuring a lack of (strong) causation does not imply a lack of (strong) association. Our characterization also opens up the possibility of applying results from statistics, experimental design, and science about causation while studying differential privacy.