Local Obfuscation Mechanisms for Hiding Probability Distributions

TL;DR

This paper proposes a formal model for distribution privacy, introduces a new obfuscation mechanism called tupling, and demonstrates its effectiveness in protecting user attributes while maintaining service quality.

Contribution

It defines distribution privacy for local mechanisms, analyzes existing mechanisms' limitations, and introduces the tupling mechanism to improve privacy-utility tradeoff.

Findings

Existing mechanisms require high noise for distribution privacy.

The tupling mechanism outperforms traditional methods in experiments.

Tupling effectively balances privacy protection and service utility.

Abstract

We introduce a formal model for the information leakage of probability distributions and define a notion called distribution privacy as the local differential privacy for probability distributions. Roughly, the distribution privacy of a local obfuscation mechanism means that the attacker cannot significantly gain any information on the distribution of the mechanism's input by observing its output. Then we show that existing local mechanisms can hide input distributions in terms of distribution privacy, while deteriorating the utility by adding too much noise. For example, we prove that the Laplace mechanism needs to add a large amount of noise proportionally to the infinite Wasserstein distance between the two distributions we want to make indistinguishable. To improve the tradeoff between distribution privacy and utility, we introduce a local obfuscation mechanism, called a tupling mechanism, that adds random dummy data to the output. Then we apply this mechanism to the protection of user attributes in location based services. By experiments, we demonstrate that the tupling mechanism outperforms popular local mechanisms in terms of attribute obfuscation and service quality.

Figures

Tables

Table 1. Table 1 : Summary of basic properties of DistP .

Sequential composition $\odot$	$A_b$ is $({\epsilon }_b,{\delta }_b)$-DistP
	$\Rightarrow$ $A_1\odot A_0$ is $({\epsilon }_0+{\epsilon }_1,\left({\delta }_0+{\delta }_1\right)\cdot \left|\Phi \right|)$-DistP
Sequential composition $\bullet$	$A_b$ is $({\epsilon }_b,{\delta }_b)$-DistP
	$\Rightarrow$ $A_1\bullet A_0$ is $({\epsilon }_0+{\epsilon }_1,{\delta }_0+{\delta }_1)$-DistP
Post-processing	$A_0$ is $(\epsilon ,\delta )$-DistP $\Rightarrow$ $A_1\circ A_0$ is $(\epsilon ,\delta )$-DistP
Pre-processing (by $c$-stable $T$)	$A$ is $(\epsilon ,\delta )$-DistP $\Rightarrow$ $A\circ T$ is $(c\epsilon ,\delta )$-DistP

Equations

$$\frac{p(y|{\lambda }_{home})}{p(y|{\lambda }_{out})}\le e^{\epsilon },$$

$$\mathrm{Pr}[A(x)\in R]\le e^{\epsilon }\mathrm{Pr}[A(x^{\prime })\in R]+\delta$$

$$\mathit{\varDelta}_{\varPhi,\mathit{d}}\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\max_{\begin{subarray}{c}(x,x^{\prime})\in\varPhi\end{subarray}}\mathit{d}(x,x^{\prime})=\max_{\begin{subarray}{c}(x,x^{\prime})\in\varPhi\end{subarray}}\max_{y\in\mathcal{Y}}\bigl{|}\mathit{u}(x,y)-\mathit{u}(x^{\prime},y)\bigr{|}{.}$$

$$\mathrm{Pr}[A(x)\in R]\le e^{\epsilon d(x,x^{\prime })}\mathrm{Pr}[A(x^{\prime })\in R]+\delta .$$

$$W_{\infty ,d}({\lambda }_0,{\lambda }_1)=\underset{\gamma \in \mathsf{cp}({\lambda }_0,{\lambda }_1)}{\min }\underset{(x_0,x_1)\in \mathsf{supp}(\gamma )}{\max }d(x_0,x_1).$$

$$\frac{p(y|{\lambda }_{male})}{p(y|{\lambda }_{female})}\le e^{\epsilon }.$$

$$A^{\#}(\lambda )[R]\le e^{\epsilon }\cdot A^{\#}({\lambda }^{\prime })[R]+\delta .$$

$$A^{\#}(\lambda )[R]\le e^{\epsilon d(\lambda ,{\lambda }^{\prime })}\cdot A^{\#}({\lambda }^{\prime })[R]+\delta .$$

$$K({\lambda }_0,{\lambda }_1,y)=\frac{p({\lambda }_0|y)}{p({\lambda }_1|y)}\cdot \frac{p({\lambda }_1)}{p({\lambda }_0)}=\frac{p(y|{\lambda }_0)}{p(y|{\lambda }_1)}=\frac{A^{\#}({\lambda }_0)[y]}{A^{\#}({\lambda }_1)[y]}\le e^{\epsilon }.$$

$$D_{\infty }(A^{\#}({\lambda }_0)\parallel A^{\#}({\lambda }_1))$$

$$\mathsf{diam}({\lambda }_0,{\lambda }_1)=\underset{x_0\in \mathsf{supp}({\lambda }_0),x_1\in \mathsf{supp}({\lambda }_1)}{\max }d(x_0,x_1).$$

$$\Lambda_{\beta,\eta,\mathit{A}}=\bigl{\{}\lambda\in\mathbb{D}\mathcal{X}\mid\Pr\bigl{[}y\stackrel{{\scriptstyle\mathrm{\$}}}{{\leftarrow}}\mathcal{Y}:{\mathit{A}}^{\#}(\lambda)[y]\leq\beta\bigr{]}\geq 1-\eta\bigr{\}}{.}$$

$$\displaystyle L\bigl{(}\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}\bigr{)}=\textstyle\!\sum_{x\in\mathcal{X}}\sum_{\bar{y}\in\mathcal{Y}^{k+1}}\lambda[x]\,\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(x)[\bar{y}]\,\min_{i}\mathit{d}(x,y_{i}){.}$$

$$\text{for each x0∈X, }{\lambda }_0[x_0]$$

$$\text{for each x1∈X, }{\lambda }_1[x_1]$$

$$A(x_0)[R]$$

$$\le \delta$$

$$A^{\#}({\lambda }_0)[R]$$

$$\le |\mathsf{supp}({\lambda }_0)|\cdot \delta$$

$$\le |\Phi |\cdot \delta \text{(by ∣supp(λ0)∣≤∣supp(γ)∣≤∣Φ∣)}$$

$$={\delta }^{\prime }$$

$$\displaystyle\frac{\small\mbox{${\mathit{A}}^{\#}(\lambda_{0})[R]-\delta^{\prime}$}}{\small\mbox{${\mathit{A}}^{\#}(\lambda_{1})[R]$}}$$

$$=$$

$$\le$$

$$\displaystyle\frac{\small\mbox{${\mathit{A}}^{\#}(\lambda_{0})[R]-\delta^{\prime}$}}{\small\mbox{${\mathit{A}}^{\#}(\lambda_{1})[R]$}}\leq$$

$$\le$$

$$=$$

$$A^{\#}(\widetilde{{\lambda }_0})[R]$$

$$\le e^{\epsilon \left(d({\lambda }_0,{\lambda }_1)+c\right)}\cdot A^{\#}({\lambda }_1)[R]$$

$$\le e^{\epsilon \left(d({\lambda }_0,{\lambda }_1)+2c\right)}\cdot A^{\#}(\widetilde{{\lambda }_1})[R]$$

$$A^{\#}(\widetilde{{\lambda }_0})[R]\le e^{3\epsilon }\cdot A^{\#}(\widetilde{{\lambda }_1})[R]+{\delta }^{\prime }.$$

$$A^{\#}(\widetilde{{\lambda }_0})[R]$$

$$\le e^{\epsilon }(e^{\epsilon }\cdot A^{\#}({\lambda }_1)[R]+\delta )+\delta$$

$$\le e^{\epsilon }(e^{2\epsilon }\cdot A^{\#}(\widetilde{{\lambda }_1})[R]+(1+e^{\epsilon })\delta )+\delta$$

$$\le e^{3\epsilon }\cdot A^{\#}(\widetilde{{\lambda }_1})[R]+(1+e^{\epsilon }+e^{2\epsilon })\delta .$$

$$A(x_0)[R]=A^{\#}({\eta }_{x_0})[R]\le e^{\epsilon }\cdot A^{\#}({\eta }_{x_1})[R]+\delta =e^{\epsilon }\cdot A(x_1)[R]+\delta .$$

Full text

1 Introduction

Differential privacy [1] is a quantitative notion of privacy that has been applied to a wide range of areas, including databases, geo-locations, and social network. The protection of differential privacy can be achieved by adding controlled noise to given data that we wish to hide or obfuscate. In particular, a number of recent studies have proposed local obfuscation mechanisms [2, 3, 4], namely, randomized algorithms that perturb each single “point” data (e.g., a geo-location point) by adding certain probabilistic noise before sending it out to a data collector. However, the obfuscation of a probability distribution of points (e.g., a distribution of locations of users at home/outside home) still remains to be investigated in terms of differential privacy.

For example, a location-based service (LBS) provider collects each user’s geo-location data to provide a service (e.g., navigation or point-of-interest search), and has been widely studied in terms of the privacy of user locations. As shown in [3, 5], users can hide their accurate locations by sending to the LBS provider only approximate location information calculated by an obfuscation mechanism.

Nevertheless, a user’s location information can be used for an attacker to infer the user’s attributes (e.g., age, gender, social status, and residence area) or activities (e.g., working, sleeping, and shopping) [6, 7, 8, 9]. For example, when an attacker knows the distribution of residence locations, he may detect whether given users are at home or outside home after observing their obfuscated locations. For another example, an attacker may learn whether users are rich or poor by observing their obfuscated behaviors. These attributes can be used by robbers hence should be protected from them. Privacy issues of such attribute inference are also known in other applications, including recommender systems [10, 11] and online social networks [12, 13]. However, to our knowledge, no literature has addressed the protection of attributes in terms of local differential privacy.

To illustrate the privacy of attributes in an LBS, let us consider a running example where users try to prevent an attacker from inferring whether they are at home or not. Let $\lambda_{{\it home}}$ and $\lambda_{{\it out}}$ be the probability distributions of locations of the users at home and outside home, respectively. Then the privacy of this attribute means that the attacker cannot learn from an obfuscated location whether the actual location follows the distribution $\lambda_{{\it home}}$ or $\lambda_{{\it out}}$.

This can be formalized using differential privacy. For each $t\in\{{\it home},\allowbreak{\it out}\}$,  we denote by $p(y\,|\,\lambda_{t})$ the probability of observing an obfuscated location $y$ when an actual location is distributed over $\lambda_{t}$. Then the privacy of $t$ is defined by:

[TABLE]

which represents that the attacker cannot distinguish whether the users follow the distribution $\lambda_{{\it home}}$ or $\lambda_{{\it out}}$ with degree of $\varepsilon$.

To generalize this, we define a notion, called distribution privacy (DistP), as the differential privacy for probability distributions. Roughly, we say that a mechanism $\mathit{A}$ provides DistP w.r.t. $\lambda_{{\it home}}$ and $\lambda_{{\it out}}$ if no attacker can detect whether the actual location (input to $\mathit{A}$) is sampled from $\lambda_{{\it home}}$ or $\lambda_{{\it out}}$ after he observed an obfuscated location $y$ (output by $\mathit{A}$)111In our setting, the attacker observes only a sampled output of $\mathit{A}$, and not the exact histogram of $\mathit{A}$’s output distribution. See Section 3.5 for more details.. Here we note that each user applies the mechanism $\mathit{A}$ locally by herself, hence can customize the amount of noise added to $y$ according to the attributes she wants to hide.

Although existing local differential privacy mechanisms are designed to protect point data, they also hide the distribution that the point data follow. However, we demonstrate that they need to add a large amount of noise to obfuscate distributions, and thus deteriorate the utility of the mechanisms.

To achieve both high utility and strong privacy of attributes, we introduce a mechanism, called the tupling mechanism, that not only perturbs an actual input, but also adds random dummy data to the output. Then we prove that this mechanism provides DistP. Since the random dummy data obfuscate the shape of the distribution, users can instead reduce the amount of noise added to the actual input, hence they get better utility (e.g., quality of a POI service).

This implies that DistP is a relaxation of differential privacy that guarantees the privacy of attributes while achieving higher utility by weakening the differentially private protection of point data. For example, suppose that users do not mind revealing their actual locations outside home, but want to hide (e.g., from robbers) the fact that they are outside home. When the users employ the tupling mechanism, they output both their (slightly perturbed) actual locations and random dummy locations. Since their outputs include their (roughly) actual locations, they obtain high utility (e.g., learning shops near their locations), while their actual location points are protected only weakly by differential privacy. However, their attributes at home/outside home are hidden among the dummy locations, hence protected by DistP. By experiments, we demonstrate that the tupling mechanism is useful to protect the privacy of attributes, and outperforms popular existing mechanisms (the randomized response [14], the planar Laplace [3] and Gaussian mechanisms) in terms of DistP and service quality.

Our contributions.   The main contributions of this work are given as follows:

• •

We propose a formal model for the privacy of probability distributions in terms of differential privacy. Specifically, we define the notion of distribution privacy (DistP) to represent that the attacker cannot significantly gain information on the distribution of a mechanism’s input by observing its output.

• •

We provide theoretical foundation of DistP, including its useful properties (e.g., compositionality) and its interpretation (e.g., in terms of Bayes factor).

• •

We quantify the effect of distribution obfuscation by existing local mechanisms. In particular, we show that (extended) differential privacy mechanisms are able to make any two distributions less distinguishable, while deteriorating the utility by adding too much noise to protect all point data.

• •

For instance, we prove that extended differential privacy mechanisms (e.g., the Laplace mechanism) need to add a large amount of noise proportionally to the $\infty$-Wasserstein distance $\mathit{W}_{\infty,\mathit{d}}(\lambda_{0},\lambda_{1})$ between the two distributions $\lambda_{0}$ and $\lambda_{1}$ that we want to make indistinguishable.

• •

We show that DistP is a useful relaxation of differential privacy when users want to hide their attributes, but not necessarily to protect all point data.

• •

To improve the tradeoff between DistP and utility, we introduce the tupling mechanism, which locally adds random dummies to the output. Then we show that this mechanism provides DistP and hight utility for users.

• •

We apply local mechanisms to the obfuscation of attributes in location based services (LBSs). Then we show that the tupling mechanism outperforms popular existing mechanisms in terms of DistP and service quality.

All proofs of technical results can be found in Appendix.

2 Preliminaries

In this section we recall some notions of privacy and metrics used in this paper. Let $\mathbb{N}^{>0}$ be the set of positive integers, and $\mathbb{R}^{>0}$ (resp. $\mathbb{R}^{\geq 0}$) be the set of positive (resp. non-negative) real numbers. Let $[0,1]$ be the set of non-negative real numbers not grater than $1$. Let $\varepsilon,\varepsilon_{0},\varepsilon_{1}\in\mathbb{R}^{\geq 0}$ and $\delta,\delta_{0},\delta_{1}\in[0,1]$.

2.1 Notations for Probability Distributions

We denote by $\mathbb{D}\mathcal{X}$ the set of all probability distributions over a set $\mathcal{X}$, and by $|\mathcal{X}|$ the number of elements in a finite set $\mathcal{X}$.

Given a finite set $\mathcal{X}$ and a distribution $\lambda\in\mathbb{D}\mathcal{X}$, the probability of drawing a value $x$ from $\lambda$ is denoted by $\lambda[x]$. For a finite subset $\mathcal{X}^{\prime}\subseteq\mathcal{X}$ we define $\lambda[\mathcal{X}^{\prime}]$ by: $\lambda[\mathcal{X}^{\prime}]=\sum_{x^{\prime}\in\mathcal{X}^{\prime}}\lambda[x^{\prime}]$. For a distribution $\lambda$ over a finite set $\mathcal{X}$, its support $\mathsf{supp}(\lambda)$ is defined by $\mathsf{supp}(\lambda)=\{x\in\mathcal{X}\colon\lambda[x]>0\}$. Given a $\lambda\in\mathbb{D}\mathcal{X}$ and a $f:\mathcal{X}\rightarrow\mathbb{R}$, the expected value of $f$ over $\lambda$ is: $\operatornamewithlimits{\mathbb{E}}_{x\sim\lambda}[f(x)]\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\sum_{x\in\mathcal{X}}\lambda[x]f(x)$.

For a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ and a set $R\subseteq\mathcal{Y}$ we denote by $\mathit{A}(x)[R]$ the probability that given input $x$, $\mathit{A}$ outputs one of the elements of $R$. Given a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ and a distribution $\lambda$ over $\mathcal{X}$, we define ${\mathit{A}}^{\#}(\lambda)$ as the distribution of the output of $\mathit{A}$. Formally, for a finite set $\mathcal{X}$, the lifting of $\mathit{A}$ w.r.t. $\mathcal{X}$ is the function ${\mathit{A}}^{\#}:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ such that ${\mathit{A}}^{\#}(\lambda)[R]\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\sum_{x\in\mathcal{X}}\lambda[x]\mathit{A}(x)[R]$.

2.2 Differential Privacy (DP)

Differential privacy [1] captures the idea that given two “adjacent” inputs $x$ and $x^{\prime}$ (from a set $\mathcal{X}$ of data with an adjacency relation $\varPhi$), a randomized algorithm $\mathit{A}$ cannot distinguish $x$ from $x^{\prime}$ (with degree of $\varepsilon$ and up to exceptions $\delta$).

Definition 1 (Differential privacy)

Let $e$ be the base of natural logarithm. A randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-differential privacy (DP) w.r.t. an adjacency relation $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$ if for any $(x,x^{\prime})\in\varPhi$ and any $R\subseteq\mathcal{Y}$,

[TABLE]

where the probability is taken over the random choices in $\mathit{A}$.

2.3 Differential Privacy Mechanisms and Sensitivity

Differential privacy can be achieved by a privacy mechanism, namely a randomized algorithm that adds probabilistic noise to a given input that we want to protect. The amount of noise added by some popular mechanisms (e.g., the exponential mechanism) depends on a utility function $\mathit{u}:\mathcal{X}\times\mathcal{Y}\rightarrow\mathbb{R}$ that maps a pair of input and output to a utility score. More precisely, the noise is added according to the “sensitivity” of $\mathit{u}$, which we define as follows.

Definition 2 (Utility distance)

The utility distance w.r.t a utility function $\mathit{u}:(\mathcal{X}\times\mathcal{Y})\rightarrow\mathbb{R}$ is the function $\mathit{d}$ given by: \mathit{d}(x,x^{\prime})\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\max_{y\in\mathcal{Y}}\bigl{|}\mathit{u}(x,y)-\mathit{u}(x^{\prime},y)\bigr{|}.

Note that $\mathit{d}$ is a pseudometric. Hereafter we assume that for all $x,y$, $\mathit{u}(x,y)=0$ is logically equivalent to $x=y$. Then the utility distance $\mathit{d}$ is a metric.

Definition 3 (Sensitivity w.r.t. an adjacency relation)

The sensitivity of a utility function $\mathit{u}$ w.r.t. an adjacency relation $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$ is defined as:

[TABLE]

2.4 Extended Differential Privacy (XDP)

We review the notion of extended differential privacy [15], which relaxes DP by incorporating a metric $d$. Intuitively, this notion guarantees that when two inputs $x$ and $x^{\prime}$ are closer in terms of $d$, the output distributions are less distinguishable.

Definition 4 (Extended differential privacy)

For a metric $d:\mathcal{X}\times\mathcal{X}\rightarrow\mathbb{R}$, we say that a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta,d)$-extended differential privacy (XDP) if for all $x,x^{\prime}\in\mathcal{X}$ and for any $R\subseteq\mathcal{Y}$,

[TABLE]

2.5 Wasserstein Metric

We recall the notion of probability coupling as follows.

Definition 5 (Coupling)

Given $\lambda_{0}\in\mathbb{D}\mathcal{X}_{0}$ and $\lambda_{1}\in\mathbb{D}\mathcal{X}_{1}$, a coupling of $\lambda_{0}$ and $\lambda_{1}$ is a $\gamma\in\mathbb{D}(\mathcal{X}_{0}\times\mathcal{X}_{1})$ such that $\lambda_{0}$ and $\lambda_{1}$ are $\gamma$’s marginal distributions, i.e., for each $x_{0}\in\mathcal{X}_{0}$, $\lambda_{0}[x_{0}]=\!\sum_{x^{\prime}_{1}\in\mathcal{X}_{1}}\!\gamma[x_{0},x^{\prime}_{1}]$ and for each $x_{1}\in\mathcal{X}_{1}$, $\lambda_{1}[x_{1}]=\!\sum_{x^{\prime}_{0}\in\mathcal{X}_{0}}\!\gamma[x^{\prime}_{0},x_{1}]$. We denote by $\mathsf{cp}(\lambda_{0},\lambda_{1})$ the set of all couplings of $\lambda_{0}$ and $\lambda_{1}$.

Example 1 (Coupling as transformation of distributions)

Let us consider two distributions $\lambda_{0}$ and $\lambda_{1}$ shown in Fig. 1. A coupling $\gamma$ of $\lambda_{0}$ and $\lambda_{1}$ shows a way of transforming $\lambda_{0}$ to $\lambda_{1}$. For example, $\gamma[2,1]=0.1$ moves from $\lambda_{0}[2]$ to $\lambda_{1}[1]$.

We then recall the $\infty$-Wasserstein metric [16] between two distributions.

Definition 6 ($\infty$-Wasserstein metric)

Let $\mathit{d}$ be a metric over $\mathcal{X}$. The $\infty$-Wasserstein metric $\mathit{W}_{\infty,\mathit{d}}$ w.r.t. $\mathit{d}$ is defined by: for any $\lambda_{0},\lambda_{1}\in\mathbb{D}\mathcal{X}$,

[TABLE]

The $\infty$-Wasserstein metric $\mathit{W}_{\infty,\mathit{d}}(\lambda_{0},\lambda_{1})$ represents the minimum largest move between points in a transportation from $\lambda_{0}$ to $\lambda_{1}$. Specifically, in a transportation $\gamma$,  $\max_{(x_{0},x_{1})\in\mathsf{supp}(\gamma)}\allowbreak\mathit{d}(x_{0},x_{1})$ represents the largest move from a point in $\lambda_{0}$ to another in $\lambda_{1}$. For instance, in the coupling $\gamma$ in Example 1, the largest move is $1$ (from $\lambda_{0}[2]$ to $\lambda_{1}[1]$, and from $\lambda_{0}[2]$ to $\lambda_{1}[3]$). Such a largest move is minimized by a coupling that achieves the $\infty$-Wasserstein metric.

We denote by $\mathit{\Gamma_{\!{\rm\infty,\mathit{d}}}}$ the set of all couplings that achieve the $\infty$-Wasserstein metric.

Finally, we recall the notion of the lifting of relations.

Definition 7 (Lifting of relations)

Given a relation $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$, the lifting of $\varPhi$ is the maximum relation ${\varPhi}^{\#}\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$ such that for any $(\lambda_{0},\lambda_{1})\in{\varPhi}^{\#}$, there exists a coupling $\gamma\in\mathsf{cp}(\lambda_{0},\lambda_{1})$ satisfying $\mathsf{supp}(\gamma)\subseteq\varPhi$.

Note that by Definition 5, the coupling $\gamma$ is a probability distribution over $\varPhi$ whose marginal distributions are $\lambda_{0}$ and $\lambda_{1}$. If $\varPhi=\mathcal{X}\times\mathcal{X}$, then ${\varPhi}^{\#}=\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$.

3 Privacy Notions for Probability Distributions

In this section we introduce a formal model for the privacy of user attributes, which is motivated in Section 1.

3.1 Modeling the Privacy of User Attributes in Terms of DP

As a running example, we consider an LBS (location based service) in which each user queries an LBS provider for a list of shops nearby. To hide a user’s exact location $x$ from the provider, the user applies a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, called a local obfuscation mechanism, to her location $x$, and obtains an approximate information $y$ with the probability $\mathit{A}(x)[y]$.

To illustrate the privacy of attributes, let us consider an example in which users try to prevent an attacker from inferring whether they are ${\it male}$ or ${\it female}$ by obfuscating their own exact locations using a mechanism $\mathit{A}$. For each $t\in\{{\it male},{\it female}\}$, let $\lambda_{t}\in\mathbb{D}\mathcal{X}$ be the prior distribution of the location of the users who have the attribute $t$. Intuitively, $\lambda_{{\it male}}$ (resp. $\lambda_{{\it female}}$) represents an attacker’s belief on the location of the male (resp. female) users before the attacker observes an output of the mechanism $\mathit{A}$. Then the privacy of $t$ can be modeled as a property that the attacker has no idea on whether the actual location $x$ follows the distribution $\lambda_{{\it male}}$ or $\lambda_{{\it female}}$ after observing an output $y$ of $\mathit{A}$.

This can be formalized in terms of $\varepsilon$-local DP. For each $t\in\{{\it male},\allowbreak{\it female}\}$,  we denote by $p(y\,|\,\lambda_{t})$ the probability of observing an obfuscated location $y$ when an actual location $x$ is distributed over $\lambda_{t}$, i.e., $p(y\,|\,\lambda_{t})=\sum_{x\in\mathcal{X}}\lambda_{t}[x]\mathit{A}(x)[y]$. Then we can define the privacy of $t$ by:

[TABLE]

3.2 Distribution Privacy and Extended Distribution Privacy

We generalize the privacy of attributes (in Section 3.1) and define the notion of distribution privacy (DistP) as the differential privacy where the input is a probability distribution of data rather than a value of data. This notion models a level of obfuscation that hides which distribution a data value is drawn from. Intuitively, we say a randomized algorithm $\mathit{A}$ provides DistP if, by observing an output of $\mathit{A}$, we cannot detect from which distribution an input to $\mathit{A}$ is generated.

Definition 8 (Distribution privacy)

Let $\varepsilon\in\mathbb{R}^{\geq 0}$ and $\delta\in[0,1]$. We say that a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-distribution privacy (DistP) w.r.t. an adjacency relation $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$ if its lifting ${\mathit{A}}^{\#}:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-DP w.r.t. $\varPsi$, i.e., for all pairs $(\lambda,\lambda^{\prime})\in\varPsi$ and all $R\subseteq\mathcal{Y}$,  we have:

[TABLE]

We say $\mathit{A}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\Lambda\subseteq\mathbb{D}\mathcal{X}$ if it provides $(\varepsilon,\delta)$-DistP w.r.t. $\Lambda^{2}$.

For example, the privacy of a user attribute $t\in\{{\it male}{},\allowbreak{\it female}{}\}$ described in Section 3.1 can be formalized as $(\varepsilon,0)$-DistP w.r.t. $\{\lambda_{{\it male}},\lambda_{{\it female}}\}$.

Mathematically, DistP is not a new notion but the DP for distributions. To contrast with DistP, we refer to the DP for data values as point privacy.

Next we introduce an extended form of distribution privacy to a metric. Intuitively, extended distribution privacy guarantees that when two input distributions are closer, then the output distributions must be less distinguishable.

Definition 9 (Extended distribution privacy)

Let $d:(\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X})\rightarrow\mathbb{R}$ be a utility distance, and $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$. We say that a mechanism $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,d,\delta)$-extended distribution privacy (XDistP) w.r.t. $\varPsi$ if the lifting ${\mathit{A}}^{\#}$ provides $(\varepsilon,d,\delta)$-XDP w.r.t. $\varPsi$, i.e., for all $(\lambda,\lambda^{\prime})\in\varPsi$ and all $R\subseteq\mathcal{Y}$, we have:

[TABLE]

3.3 Interpretation by Bayes Factor

The interpretation of DP has been explored in previous work [17, 15] using the notion of Bayes factor. Similarly, the meaning of DistP can also be explained in terms of Bayes factor, which compares the attacker’s prior and posterior beliefs.

Assume that an attacker has some belief on the input distribution before observing the output values of an obfuscater $\mathit{A}$. We denote by $p(\lambda)$ the prior probability that a distribution $\lambda$ is chosen as the input distribution. By observing an output $y$ of $\mathit{A}$, the attacker updates his belief on the input distribution. We denote by $p(\lambda|y)$ the posterior probability of $\lambda$ being chosen, given an output $y$.

For two distributions $\lambda_{0},\lambda_{1}$, the Bayes factor $K(\lambda_{0},\allowbreak\lambda_{1},y)$ is defined as the ratio of the two posteriors divided by that of the two priors: K(\lambda_{0},\lambda_{1},y)=\frac{p(\lambda_{0}|y)}{p(\lambda_{1}|y)}\big{/}\frac{p(\lambda_{0})}{p(\lambda_{1})}. If the Bayes factor is far from $1$ the attacker significantly updates his belief on the distribution by observing a perturbed output $y$ of $\mathit{A}$.

Assume that $\mathit{A}$ provides $(\varepsilon,0)$-DistP. By Bayes’ theorem, we obtain:

[TABLE]

Intuitively, if the attacker believes that $\lambda_{0}$ is $k$ times more likely than $\lambda_{1}$ before the observation, then he believes that $\lambda_{0}$ is $k\cdot e^{\varepsilon}$ times more likely than $\lambda_{1}$ after the observation. This means that for a small value of $\varepsilon$, DistP guarantees that the attacker does not gain information on the distribution by observing $y$.

In the case of XDistP, the Bayes factor $K(\lambda_{0},\lambda_{1},y)$ is bounded above by $e^{\varepsilon d(\lambda_{0},\lambda_{1})}$. Hence the attacker gains more information for a larger distance $d(\lambda_{0},\lambda_{1})$.

3.4 Privacy Guarantee for Attackers with Close Beliefs

In the previous sections, we assume that we know the distance between two actual input distributions, and can determine the amount of noise required for distribution obfuscation. However, an attacker may have different beliefs on the distributions that are closer to the actual ones, e.g., more accurate distributions obtained by more observations and specific situations (e.g., daytime/nighttime).

To see this, for each $\lambda\in\mathbb{D}\mathcal{X}$, let $\tilde{\lambda}$ be an attacker’s belief on $\lambda$. We say that an attacker has $(c,\mathit{d})$-close beliefs if each distribution $\lambda$ satisfies $\mathit{d}(\lambda,\tilde{\lambda})\leq c$. Then extended distribution privacy in the presence of an attacker is given by:

Proposition 1** (XDistP with close beliefs)**

Let $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provide $(\varepsilon,\mathit{d},0)$-XDistP w.r.t. some $\varPsi\subseteq\mathcal{X}\times\mathcal{X}$. If an attacker has $(c,\mathit{d})$-close beliefs, then for all $(\lambda_{0},\lambda_{1})\in\varPsi$ and all $R\subseteq\mathcal{Y}$, we have ${\mathit{A}}^{\#}(\tilde{\lambda_{0}})[R]\leq e^{\varepsilon\left(\mathit{d}(\lambda_{0},\lambda_{1})+2c\right)}\cdot{\mathit{A}}^{\#}(\tilde{\lambda_{1}})[R]{.}$

When the attacker’s beliefs are closer to ours, then $c$ is smaller, hence a stronger distribution privacy is guaranteed. See Appendix 0.B.2 for DistP.

Note that assuming some attacker’s beliefs are inevitable also in many previous studies, e.g., when we want to protect the privacy of correlated data [18, 19, 20].

3.5 Difference from the Histogram Privacy

Finally, we present a brief remark on the difference between DistP and the differential privacy of histogram publication (e.g., [21]). Roughly, a histogram publication mechanism is a central mechanism that aims at hiding a single record $x\in\mathcal{X}$ and outputs an obfuscated histogram, e.g., a distribution $\mu\in\mathbb{D}\mathcal{Y}$, whereas a DistP mechanism is a local mechanism that aims at hiding an input distribution $\lambda\in\mathbb{D}\mathcal{X}$ and outputs a single perturbed value $y\in\mathcal{Y}$.

Note that neither of these implies the other. The $\varepsilon$-DP of a histogram publication mechanism means that for any two adjacent inputs $x,x^{\prime}\in\mathcal{X}$ and any histogram $\mu\in\mathbb{D}\mathcal{Y}$, $\frac{p(\mu|x)}{p(\mu|x^{\prime})}\leq e^{\varepsilon}.$ However, this does not derive $\varepsilon$-DistP, i.e., for any adjacent input distributions $\lambda,\lambda^{\prime}\in\mathbb{D}\mathcal{X}$ and any output $y\in\mathcal{Y}$, $\frac{p(y|\lambda)}{p(y|\lambda^{\prime})}\leq e^{\varepsilon}$.

4 Basic Properties of Distribution Privacy

In Table 1, we show basic properties of DistP.(See Appendices 0.B.4 and 0.B.5 for the details.)

The composition $A_{1}\mathbin{\odot}A_{0}$ means that an identical input $x$ is given to two DistP mechanisms $A_{0}$ and $A_{1}$, whereas the composition $A_{1}\mathbin{\bullet}A_{0}$ means that independent inputs $x_{b}$ are provided to mechanisms $\mathit{A}_{b}$ [22]. The compositionality can be used to quantify the attribute privacy against an attacker who obtains multiple released data each obfuscated for the purpose of protecting a different attribute. For example, let $\varPsi=\{(\lambda_{{\it male}},\,\lambda_{{\it female}}),\,(\lambda_{{\it home}},\,\lambda_{{\it out}})\}$, and $\mathit{A}_{0}$ (resp. $\mathit{A}_{1}$) be a mechanism providing $\varepsilon_{0}$-DistP (resp. $\varepsilon_{1}$-DistP) w.r.t. $\varPsi$. When $\mathit{A}_{0}$ (resp. $\mathit{A}_{1}$) obfuscates a location $x_{0}$ for the sake of protecting male/female (resp. home/out), then both male/female and home/out are protected with $(\varepsilon_{0}+\varepsilon_{1})$-DistP.

As for pre-processing, the stability notion is different from that for DP:

Definition 10 (Stability)

Let $c\in\mathbb{N}^{>0}$, $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$, and $\mathit{W}$ be a metric over $\mathbb{D}\mathcal{X}$. A transformation $T:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{X}$ is $(c,\varPsi)$-stable if for any $(\lambda_{0},\lambda_{1})\in\varPsi$, $T(\lambda_{0})$ can be reached from $T(\lambda_{1})$ at most $c$-steps over $\varPsi$.  Analogously, $T:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{X}$ is $(c,\mathit{W})$-stable if for any $\lambda_{0},\lambda_{1}\in\mathbb{D}\mathcal{X}$, $\mathit{W}(T(\lambda_{0}),T(\lambda_{1}))\leq c\mathit{W}(\lambda_{0},\lambda_{1})$.

We present relationships among privacy notions in Appendices 0.B.3 and 0.B.7

An important property is that when the relation $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$ includes pairs of point distributions (i.e., distributions having single points with probability $1$), DistP (resp. XDistP) implies DP (resp. XDP). In contrast, if $\varPsi$ does not include pairs of point distributions, DistP (resp. XDistP) may not imply DP (resp. XDP), as in Section 6.

5 Distribution Obfuscation by Point Obfuscation

In this section we present how the point obfuscation mechanisms (including DP and XDP mechanisms) contribute to the obfuscation of probability distributions. (See Appendix 0.B.1 for the proofs.)

5.1 Distribution Obfuscation by DP Mechanisms

We first show every DP mechanism provides DistP. (See Definition 7 for ${\varPhi}^{\#}$.)

Theorem 1** ($(\varepsilon,\delta)$-DP $\Rightarrow$ $(\varepsilon,\,\delta\cdot|\varPhi|)$-DistP)**

Let $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$. If $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-DP w.r.t. $\varPhi$, then it provides $(\varepsilon,\,\delta\cdot|\varPhi|)$-DistP w.r.t. ${\varPhi}^{\#}$.

This means that the mechanism $\mathit{A}$ makes any pair $(\lambda_{0},\lambda_{1})\in{\varPhi}^{\#}$ indistinguishable up to the threshold $\varepsilon$ and with exceptions $\delta\cdot|\varPhi|$. Intuitively, when $\lambda_{0}$ and $\lambda_{1}$ are adjacent w.r.t. the relation ${\varPhi}^{\#}$, we can construct $\lambda_{1}$ from $\lambda_{0}$ only by moving mass from $\lambda_{0}[x_{0}]$ to $\lambda_{1}[x_{1}]$ where $(x_{0},x_{1})\in\varPhi$ (i.e., $x_{0}$ is adjacent to $x_{1}$).

Example 2 (Randomized response)

By Theorem 1, the $(\varepsilon,0)$-DP randomized response [14] and RAPPOR [4] provide $(\varepsilon,0)$-DistP. When we use these mechanisms, the estimation of the input distribution is harder for a smaller $\varepsilon$. However, these DP mechanisms tend to have small utility, because they add much noise to hide not only the input distributions, but everything about inputs.

5.2 Distribution Obfuscation by XDP Mechanisms

Compared to DP mechanisms, XDP mechanisms are known to provide better utility. Alvim et al. [23] show the planar Laplace mechanism [3] adds less noise than the randomized response, since XDP hides only closer locations. However, we show XDP mechanisms still need to add much noise proportionally to the $\infty$-Wasserstein distance between the distributions we want make indistinguishable.

5.2.1 The $\infty$-Wasserstein distance $\mathit{W}_{\infty,\mathit{d}}$ as Utility Distance

We first observe how much $\varepsilon^{\prime}$ is sufficient for an $\varepsilon^{\prime}$-XDP mechanism (e.g., the Laplace mechanism) to make two distribution $\lambda_{0}$ and $\lambda_{1}$ indistinguishable in terms of $\varepsilon$-DistP.

Suppose that $\lambda_{0}$ and $\lambda_{1}$ are point distributions such that $\lambda_{0}[x_{0}]=\lambda_{1}[x_{1}]=1$ for some $x_{0},x_{1}\in\mathcal{X}$. Then an $\varepsilon^{\prime}$-XDP mechanism $\mathit{A}$ satisfies:

[TABLE]

In order for $\mathit{A}$ to provide $\varepsilon$-DistP,  $\varepsilon^{\prime}$ should be defined as $\frac{\varepsilon}{\mathit{d}(x_{0},x_{1})}$. That is, the noise added by $\mathit{A}$ should be proportional to the distance between $x_{0}$ and $x_{1}$.

To extend this to arbitrary distributions, we need to define a utility metric between distributions. A natural possible definition would be the largest distance between values of $\lambda_{0}$ and $\lambda_{1}$, i.e., the diameter over the supports defined by:

[TABLE]

However, when there is an outlier in $\lambda_{0}$ or $\lambda_{1}$ that is far from other values in the supports, then the diameter $\mathsf{diam}(\lambda_{0},\lambda_{1})$ is large. Hence the mechanisms that add noise proportionally to the diameter would lose utility too much.

To have better utility, we employ the $\infty$-Wasserstein metric $\mathit{W}_{\infty,\mathit{d}}$. The idea is that given two distributions $\lambda_{0}$ and $\lambda_{1}$ over $\mathcal{X}$, we consider the cost of a transportation of weights from $\lambda_{0}$ to $\lambda_{1}$. The transportation is formalized as a coupling $\gamma$ of $\lambda_{0}$ and $\lambda_{1}$ (see Definition 5), and the cost of the largest move is $\displaystyle\mathit{\varDelta}_{\mathsf{supp}(\gamma),\mathit{d}}=\max_{(x_{0},x_{1})\in\mathsf{supp}(\gamma)}\mathit{d}(x_{0},x_{1}),$ i.e., the sensitivity w.r.t. the adjacency relation $\mathsf{supp}(\gamma)\subseteq\mathcal{X}\times\mathcal{X}$ (Definition 3). The minimum cost of the largest move is given by the $\infty$-Wasserstein metric: $\mathit{W}_{\infty,\mathit{d}}(\lambda_{0},\lambda_{1})=\displaystyle\min_{\gamma\in\mathsf{cp}(\lambda_{0},\lambda_{1})}\mathit{\varDelta}_{\mathsf{supp}(\gamma),\mathit{d}}{.}$

5.2.2 XDP implies XDistP

We show every XDP mechanism provides XDistP with the metric $\mathit{W}_{\infty,\mathit{d}}$. To formalize this, we define a lifted relation ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$ as the maximum relation over $\mathbb{D}\mathcal{X}$ s.t. for any $(\lambda_{0},\lambda_{1})\in{\varPhi}_{\mathit{W}_{\infty}}^{\#}$, there is a coupling $\gamma\in\mathsf{cp}(\lambda_{0},\lambda_{1})$ satisfying $\mathsf{supp}(\gamma)\subseteq\varPhi$ and $\gamma\in\mathit{\Gamma_{\!{\rm\infty,\mathit{d}}}}(\lambda_{0},\lambda_{1})$. Then ${\varPhi}_{\mathit{W}_{\infty}}^{\#}\subseteq{\varPhi}^{\#}$ holds.

Theorem 2** ($(\varepsilon,\mathit{d},\delta)$-XDP\Rightarrow$$(\varepsilon,\mathit{W}_{\infty,\mathit{d}},\delta\!\cdot\!|\varPhi|)-XDistP)**

If $\mathit{A}\!:\!\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\mathit{d},\delta)$-XDP w.r.t. $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$, it provides $(\varepsilon,\mathit{W}_{\infty,\mathit{d}},\allowbreak{\delta\!\cdot\!|\varPhi|})$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$.

By Theorem 2, when $\delta>0$, the noise required for obfuscation is proportional to $|\varPhi|$, which is at most the domain size squared $|\mathcal{X}|^{2}$. This implies that for a larger domain $\mathcal{X}$, the Gaussian mechanism is not suited for distribution obfuscation. We will demonstrate this by experiments in Section 7.4.

In contrast, the Laplace/exponential mechanisms provide $(\varepsilon,\mathit{W}_{\infty,\mathit{d}},0)$-DistP. Since $\mathit{W}_{\infty,\mathit{d}}(\lambda_{0},\lambda_{1})\leq\mathsf{diam}(\lambda_{0},\lambda_{1})$, the noise added proportionally to $\mathit{W}_{\infty,\mathit{d}}$ can be smaller than $\mathsf{diam}$. This implies that obfuscating a distribution requires less noise than obfuscating a set of data. However, the required noise can still be very large when we want to make two distant distributions indistinguishable.

6 Distribution Obfuscation by Random Dummies

In this section we introduce a local mechanism called a tupling mechanism to improve the tradeoff between DistP and utility, as motivated in Section 1.

6.1 Tupling Mechanism

We first define the tupling mechanism as a local mechanism that obfuscates a given input $x$ by using a point perturbation mechanism $\mathit{A}$ (not necessarily in terms of DP or XDP), and that also adds $k$ random dummies $r_{1},r_{2},\ldots,r_{k}$ to the output to obfuscate the input distribution (Algorithm 1).

The probability that given an input $x$, the mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ outputs $\bar{y}$ is given by $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(x)[\bar{y}]$.

6.2 Privacy of the Tupling Mechanism

Next we show that the tupling mechanism provides DistP w.r.t. the following class of distributions. Given $\beta,\eta\in[0,1]$ and $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, we define $\Lambda_{\beta,\eta,\mathit{A}}$ by:

[TABLE]

For instance, a distribution $\lambda$ satisfying $\max_{x}\lambda[x]\leq\beta$ belongs to $\Lambda_{\beta,0,\mathit{A}}$. (See Proposition 12 in Appendix 0.B.8.)

Theorem 3** (DistP of the tupling mechanism)**

Let $k\in\mathbb{N}^{>0}$, $\nu$ be the uniform distribution over $\mathcal{Y}$, $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, and $\beta,\eta\in[0,1]$. Given an $0<\alpha<\frac{k}{|\mathcal{Y}|}$, let $\varepsilon_{\alpha}=\ln{\textstyle\frac{k+(\alpha+\beta)\cdot|\mathcal{Y}|}{k-\alpha\cdot|\mathcal{Y}|}}$ and $\delta_{\alpha}=2e^{-\frac{2\alpha^{2}}{k\beta^{2}}}+\eta$. Then the $(k,\nu,\mathit{A})$-tupling mechanism provides $(\varepsilon_{\!\alpha},\delta_{\!\alpha})$-​DistP w.r.t. $\Lambda_{\beta,\eta,\mathit{A}}^{2}$.

This claim states that just adding random dummies achieves DistP without any assumption on $\mathit{A}$ (e.g., $\mathit{A}$ does not have to provide DP). For a smaller range size $|\mathcal{Y}|$ and a larger number $k$ of dummies, we obtain a stronger DistP.

Note that the distributions protected by $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ belong to the set $\Lambda_{\beta,\eta,\mathit{A}}$.

• •

When $\beta=1$, $\Lambda_{\beta,\eta,\mathit{A}}$ is the set of all distributions (i.e., $\Lambda_{1,\eta,\mathit{A}}=\mathbb{D}\mathcal{X}$) while $\varepsilon_{\alpha}$ and $\delta_{\alpha}$ tend to be large.

• •

For a smaller $\beta$, the set $\Lambda_{\beta,\eta,\mathit{A}}$ is smaller while $\varepsilon_{\alpha}$ and $\delta_{\alpha}$ are smaller; that is, the mechanism provides a stronger DistP for a smaller set of distributions.

• •

If $\mathit{A}$ provides $\varepsilon_{\mathit{A}}$-DP,  $\Lambda_{\beta,\eta,\mathit{A}}$ goes to $\mathbb{D}\mathcal{X}$ for $\varepsilon_{\mathit{A}}\rightarrow 0$. More generally, $\Lambda_{\beta,\eta,\mathit{A}}$ is larger when the maximum output probability $\max_{y}{\mathit{A}}^{\#}(\lambda)[y]$ is smaller.

In practice, even when $\varepsilon_{\mathit{A}}$ is relatively large, a small number of dummies enables us to provide a strong DistP, as shown by experiments in Section 7.

We note that Theorem 3 may not imply DP of the tupling mechanism, depending on $\mathit{A}$. For example, suppose that $\mathit{A}$ is the identity function. For small $\varepsilon_{\alpha}$ and $\delta_{\alpha}$, we have $\beta\ll 1$, hence no point distribution $\lambda$ (where $\lambda[x]=1$ for some $x$) belongs to $\Lambda_{\beta,\eta,\mathit{A}}$, namely, the tupling mechanism does not provide $(\varepsilon_{\alpha},\delta_{\alpha})$-DP.

6.3 Service Quality Loss and Cost of the Tupling Mechanism

When a mechanism outputs a value $y$ closer to the original input $x$, she obtains a larger utility, or equivalently, a smaller service quality loss $\mathit{d}(x,y)$. For example, in an LBS (location based service), if a user located at $x$ submits an obfuscated location $y$, the LBS provider returns the shops near $y$, hence the service quality loss can be expressed as the Euclidean distance $\mathit{d}(x,y)\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\|x-y\|$.

Since each output of the tupling mechanism consists of $k+1$ elements, the quality loss of submitting a tuple $\bar{y}=(y_{1},y_{2},\ldots,y_{k+1})$ amounts to $\mathit{d}(x,\bar{y})\mathbin{:=}\min_{i}\allowbreak\mathit{d}(x,y_{i})$. Then the expected quality loss of the mechanism is defined as follows.

Definition 11 (Expected quality loss of the tupling mechanism)

For a $\lambda\in\mathbb{D}\mathcal{X}$ and a metric $\mathit{d}:\mathcal{X}\times\mathcal{Y}\rightarrow\mathbb{R}$, the expected quality loss of $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ is:

[TABLE]

For a larger number $k$ of random dummies, $\min_{i}\allowbreak\mathit{d}(x,y_{i})$ is smaller on average, hence L\bigl{(}\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}\bigr{)} is also smaller. Furthermore, thanks to the distribution obfuscation by random dummies, we can instead reduce the perturbation noise added to the actual input $x$ to obtain the same level of DistP. Therefore, the service quality is much higher than existing mechanisms, as shown in Section 7.

6.4 Improving the Worst-Case Quality Loss

As a point obfuscation mechanism $\mathit{A}$ used in the tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$, we define the restricted Laplace (RL) mechanism below. Intuitively, $(\varepsilon_{\!\mathit{A}},r)$-RL mechanism adds $\varepsilon_{\!\mathit{A}}$-XDP Laplace noise only within a radius $r$ of the original location $x$. This ensures that the worst-case quality loss of the tupling mechanisms is bounded above by the radius $r$, whereas the standard Laplace mechanism reports a location $y$ that is arbitrarily distant from $x$ with a small probability.

Definition 12 (RL mechanism)

Let $\mathcal{Y}_{x,r}=\{y^{\prime}\in\mathcal{Y}\,|\,\mathit{d}(x,y^{\prime})\leq r\}$. We define $(\varepsilon_{\!\mathit{A}},\allowbreak r)$-restricted Laplace (RL) mechanism as the $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ defined by: $\mathit{A}(x)[y]=\frac{e^{-\varepsilon\mathit{d}(x,y)}}{\sum_{y^{\prime}\in\mathcal{Y}_{x,r}}e^{-\varepsilon\mathit{d}(x,y^{\prime})}}$ if $y\in\mathcal{Y}_{x,r}$, and $\mathit{A}(x)[y]=0$ otherwise.

Since the support of $\mathit{A}$ is limited to $\mathcal{Y}_{x,r}$, $\mathit{A}$ provides better service quality but does not provide DP. Nevertheless, as shown in Theorem 3,  $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$ provides DistP, due to dummies in $\mathcal{Y}\setminus\mathcal{Y}_{x,r}$. This implies that DistP is a relaxation of DP that guarantees the privacy of attributes while achieving higher utility by weakening the DP protection of point data. In other words, DistP mechanisms are useful when users want both to keep high utility and to protect the attribute privacy more strongly than what a DP mechanism can guarantee (e.g., when users do not mind revealing their actual locations outside home, but want to hide from robbers the fact that they are outside home, as motivated in Section 1).

7 Application to Attribute Privacy in LBSs

In this section we apply local mechanisms to the protection of the attribute privacy in location based services (LBSs) where each user submits her own location $x$ to an LBS provider to obtain information relevant to $x$ (e.g., shops near $x$).

7.1 Experimental Setup

We perform experiments on location privacy in Manhattan by using the Foursquare dataset (Global-scale Check-in Dataset) [24]. We first divide Manhattan into $11\times 10$ regions with $1.0\mathrm{km}$ intervals. To provide more useful information to users in crowded regions, we further re-divide these regions to $276$ regions by recursively partitioning each crowded region into four until each resulting region has roughly similar population density.222This partition may be useful to achieve smaller values $(\varepsilon,\delta)$ of DistP, because $\beta$ tends to be smaller when the population density is closer to the uniform distribution. Let $\mathcal{Y}$ be the set of those $276$ regions, and $\mathcal{X}$ be the set of the $228$ regions inside the central $10\mathrm{km}\times 9\mathrm{km}$ area in $\mathcal{Y}$.

As an obfuscation mechanism $Q$, we use the tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$ that uses an $(\varepsilon_{\!\mathit{A}},r)$-RL mechanism $\mathit{A}$ and the uniform distribution $\nu$ over $\mathcal{Y}$ to generate dummy locations. Note that $\nu$ is close to the population density distribution over $\mathcal{Y}$, because each region in $\mathcal{Y}$ is constructed to have roughly similar population density. In the definitions of the RL mechanism and the quality loss, we use the Euclidean distance $\|\cdot\|$ between the central points of the regions.

In the experiments, we measure the privacy of user attributes, formalized as DistP. For example, let us consider the attribute ${\it male}/{\it female}$. For each $t\in\{{\it male},{\it female}\}$, let $\lambda_{t}\in\mathbb{D}\mathcal{X}$ be the prior distribution of the location of the users having the attribute $t$. Then, $\lambda_{{\it male}}$ (resp. $\lambda_{{\it female}}$) represents an attacker’s belief on the location of the male (resp. female) users. We define these as the empirical distributions that the attacker can calculate from the above Foursquare dataset.

7.2 Evaluation of the Tupling Mechanism

7.2.1 Distribution privacy

We demonstrate by experiments that the male users cannot be recognized as which of male or female in terms of DistP. In Fig. 2, we show the experimental results on the DistP of the tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$. For a larger number $k$ of dummy locations, we have a stronger DistP (Fig. 2(a)). For a larger $\varepsilon_{\!\mathit{A}}$,  $(\varepsilon_{\!\mathit{A}},0.020)$-RL mechanism $\mathit{A}$ adds less noise, hence the tupling mechanism provides a weaker DistP (Fig. 2(b))333In Fig. 2(b), for $\varepsilon_{\!\mathit{A}}\rightarrow 0$, $\varepsilon$ does not converge to [math], since the radius $r=0.020$ of RL does not cover the whole $\mathcal{Y}$. However, if $r\geq\max_{x,y}\|x-y\|$, $\varepsilon$ converges to [math].. For a larger radius $r$, the RL mechanism $\mathit{A}$ spreads the original distribution $\lambda_{{\it male}}$ and thus provides a strong DistP (Fig. 2(c)). We also show the relationship between $k$ and DistP in the eastern/western Tokyo and London, which have different levels of privacy (Fig. 5).

These results imply that if we add more dummies, we can decrease the noise level/radius of $\mathit{A}$ to have better utility, while keeping the same level $\varepsilon$ of DistP. Conversely, if $\mathit{A}$ adds more noise, we can decrease the number $k$ of dummies.

7.2.2 Expected quality loss

In Fig. 2(d), we show the experimental results on the expected quality loss of the tupling mechanism. For a larger $\varepsilon_{\!\mathit{A}}$, $\mathit{A}$ adds less noise, hence the loss is smaller. We confirm that for more dummy data, the expected quality loss is smaller. Unlike the planar Laplace mechanism ($\rm{PL}{}$),  $\mathit{A}$ ensures that the worst quality loss is bounded above by the radius $r$. Furthermore, for a smaller radius $r$, the expected loss is also smaller as shown in Fig. 2(d).

7.3 Appropriate Parameters

We define the attack success rate (ASR) as the ratio that the attacker succeeds to infer a user has an attribute when she does actually. We use an inference algorithm based on the Bayes decision rule [25] to minimize the identification error probability when the estimated posterior probability is accurate [25].

In Fig. 5, we show the relationships between DistP and ASR in Manhattan for the attribute home, meaning the users located at their home. In theory, $\rm{ASR}=0.5$ represents the attacker learns nothing about the attribute, whereas the empirical ASR in our experiments fluctuates around $0.5$. This seems to be caused by the fact that the dataset and the number of locations are finite. From Fig. 5, we conclude that $\varepsilon=1$ is an appropriate parameter for $(\varepsilon,0.001)$-DistP to achieve $\rm{ASR}=0.5$ in our setting, and we confirm this for other attributes. However, we note that this is an empirical criterion possibly depending on our setting, and the choice of $\varepsilon$ for DistP can be as controversial as that for DP and should also be investigated using approaches for DP (e.g., [26]) in future work.

In Appendices 0.A.1, 0.A.2, and 0.A.3, we show that different levels of DistP are achieved for different attributes in different cities. In particular, we present appropriate parameters for the tupling mechanism for various attributes in a couple of cities.

7.4 Comparison of Obfuscation Mechanisms

We demonstrate that the tupling mechanism (TM) outperforms the popular mechanisms: the randomized response (RR), the planar Laplace (PL), and the planar Gaussian (PG). In Fig. 5 we compare these concerning the relationship between $\varepsilon$-DistP and expected quality loss. Since PG always has some $\delta$, it provides a weaker DistP than PL for the same quality loss. We also confirm that PL has smaller loss than RR, since it adds noise proportionally to the distance. Comparison using other attributes can be found in Appendix 0.A.1.

Finally, we briefly discuss the computational cost of the tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$, compared to $\rm{PL}{}$. In the implementation, for a larger domain $\mathcal{X}$,  $\rm{PL}{}$ deals with a larger size $|\mathcal{X}|\times|\mathcal{Y}|$ of the mechanism’s matrix, since it outputs each region with a non-zero probability. In contrast, since the RL mechanism $\mathit{A}$ used in $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}{}$ maps each location $x$ to a region within a radius $r$ of $x$, the size of $\mathit{A}$’s matrix is $|\mathcal{X}|\times|\mathcal{Y}_{x,r}|$, requiring much smaller memory space than $\rm{PL}{}$.

Furthermore, the users of $\rm{TM}{}$ can simply ignore the responses to dummy queries, whereas the users of $\rm{PL}{}$ need to select relevant POIs (point of interests) from a large radius of $x$, which could cost computationally for many POIs. Therefore, $\rm{TM}{}$ is more suited to be used in mobile environments than $\rm{PL}{}$.

8 Related Work

Differential privacy.

Since the seminal work of Dwork [1] on DP, a number of its variants have been studied to provide different privacy guarantees; e.g., $f$-divergence privacy [27], $d$-privacy [15], Pufferfish privacy [19], local DP [2], and utility-optimized local DP [28]. All of these are intended to protect the input data rather than the input distributions. Note that distributional privacy [29] is different from DistP and does not aim at protecting the privacy of distributions.

To our knowledge, this is the first work that investigates the differential privacy of probability distributions lying behind the input. However, a few studies have proposed related notions. Jelasity et al. [30] propose distributional differential privacy w.r.t. parameters $\theta$ and $\theta^{\prime}$ of two distributions, which aims at protecting the privacy of the distribution parameters but is defined in a Bayesian style (unlike DP and DistP) to satisfy that for any output sequence $y$,  $p(\theta|y)\leq e^{\varepsilon}p(\theta^{\prime}|y)$. After a preliminary version of this paper appeared in arXiv [31], a notion generalizing DistP, called profile based privacy, is proposed in [32].

Some studies are technically related to our work. Song et al. [20] propose the Wasserstein mechanism to provide Pufferfish privacy, which protects correlated inputs. Fernandes et al. [33] introduce Earth mover’s privacy, which is technically different from DistP in that their mechanism obfuscates a vector (a bag-of-words) instead of a distribution, and perturbs each element of the vector. Sei et al. [34] propose a variant of the randomized response to protect individual data and provide high utility of database. However, we emphasize again that our work differs from these studies in that we aim at protecting input distributions.

Location privacy.

Location privacy has been widely studied in the literature, and its survey can be found in [35]. A number of location obfuscation methods have been proposed so far, and they can be broadly divided into the following four types: perturbation (adding noise) [36, 3, 5], location generalization (merging regions) [37, 38], and location hiding (deleting) [37, 39], and adding dummy locations [40, 41, 42]. Location obfuscation based on DP (or its variant) have also been widely studied, and they can be categorized into the ones in the centralized model [43, 44] and the ones in the local model [3, 5]. However, these methods aim at protecting locations, and neither at protecting users’ attributes (e.g., age, gender) nor activities (e.g., working, shopping) in a DP manner. Despite the fact that users’ attributes and activities can be inferred from their locations [6, 7, 8], to our knowledge, no studies have proposed obfuscation mechanisms to provide rigorous DP guarantee for such attributes and activities.

9 Conclusion

We have proposed a formal model for the privacy of probability distributions and introduced the notion of distribution privacy (DistP). Then we have shown that existing local mechanisms deteriorate the utility by adding too much noise to provide DistP. To improve the tradeoff between DistP and utility, we have introduced the tupling mechanism and applied it to the protection of user attributes in LBSs. Then we have demonstrated that the tupling mechanism outperforms popular local mechanisms in terms of attribute obfuscation and service quality.

As future work, we will improve the theoretical bound on $\varepsilon$ for the tupling mechanism. We also plan to design optimal mechanisms that minimize the quality loss and computational costs, while providing DistP, in various applications.

Acknowledgment

We thank the reviewers, Catuscia Palamidessi, Gilles Barthe, and Frank D. Valencia for their helpful comments on preliminary drafts.

Appendix 0.A Experimental Results

0.A.1 Experimental Comparison among Attributes in Manhattan

In this section we present the experimental results on more attributes of users in the location data in Manhattan. We investigate the following four attributes:

• •

social/less-social (Fig. 12) represent whether a user’s social status (defined in [45] as the number of followers divided by the number of followings) is greater than $5$ or not. In [9], the social status is regarded as a private attribute that can be leaked by the user’s behaviour and should be protected. We set $5$ to be a threshold, because mobility patterns of people are substantially different when their social status is greater than $5$ [45].

• •

workplace/non-workplace (Fig. 12) represent whether a user is at office or not. This attribute can be sensitive when it implies users are unemployed.

• •

home/out (Fig. 12) represent whether a user is at home or not. This attribute should be protected, for instance, from robbers [46].

• •

north/south (Fig. 12) represent whether a user’s home is located in the northern or southern Manhattan. This attribute needs to be protected, for instance, from stalkers. However, the residential area is highly correlated with visited places, hence can be inferred by the current location relatively easily.

Note that these figures also show the results of KL-DistP, which is not defined in this paper but is introduced in [47].

Compared to the attribute of male/female (Fig. 2), the attributes home/out (Fig. 12) and north/south (Fig. 12) require more noise for distribution obfuscation. This is because the distances between the two distributions of users of these attributes are larger than that of $\lambda_{{\it male}}$ and $\lambda_{{\it female}}$. The histograms for male/female and for north/south are shown in Fig. 8 and Fig. 8 respectively.

We also show the comparison of different obfuscation mechanisms for various attributes in Fig. 6.

0.A.2 Experimental Comparison among Time Periods in Manhattan

In this section we present the experimental results on different periods of time: 00h-05h, 06h-11h, 12h-17h, and 18h-23h in Manhattan in Figs. 16 to 16. It can be seen that $\varepsilon$ depends on a period of time. For example, hiding the attribute male/female and social/less-social requires more noise in 06h-11h. This might be related to the fact that more social people tend to attend social events in the morning. On the other hand, the attribute home/out requires similar amount of noise in any period of time. This implies that residential areas are distant from other areas in each city, and this fact does not change over time.

0.A.3 Experimental Comparison among Various Cities

In this section we compare the experimental results on five cities: Manhattan, eastern Tokyo, western Tokyo, London, and Paris. In Table 8 we show examples of parameters that achieve the same levels of DistP in different cities. More detailed comparison among those cities is shown in Fig. 20 (male/female), Fig. 20 (social/less-social), Fig. 20 (workplace/non-workplace), and Fig. 20 (home/out).

When we use the same parameters in the tupling mechanism, the levels $\varepsilon$ of DistP differ among those cities. In western Tokyo, for instance, the attributes social/less-social and workplace/non-workplace are more difficult to hide. This implies that areas for social events and workplace might be more separated from the other areas in western Tokyo. Since each attribute in each city may require different levels of noise for distribution obfuscation, the reference parameters (e.g., those shown in Table 8) would be useful to select appropriate parameters for the tupling mechanism to protect the privacy of attributes in different cities.

0.A.4 Theoretical/Empirical Values of $\varepsilon$-DistP

In Table 8, we show the theoretical values of $\varepsilon$ calculated by Theorem 3 for $\delta=0.001,\allowbreak 0.01,\allowbreak 0.1$. Compared to the experimental results, those theoretical values can only give loose upper bounds on $\varepsilon$. This is because the concentration inequality used to derive Theorem 3 give loose bounds.

Appendix 0.B Proofs of Technical Results

0.B.1 Distribution Obfuscation by Point Obfuscation

In this section we show the results on how point obfuscation mechanisms provide distribution privacy.

See 1

Proof

Assume $\mathit{A}$ provides $(\varepsilon,\delta)$-DP w.r.t. $\varPhi$. Let $\delta^{\prime}=\delta\cdot|\varPhi|$, and $(\lambda_{0},\lambda_{1})\in{\varPhi}^{\#}$. By Definition 7, there is a coupling $\gamma\in\mathsf{cp}(\lambda_{0},\lambda_{1})$ satisfying $\mathsf{supp}(\gamma)\subseteq\varPhi$. By Definition 5, we have:

[TABLE]

Let $R\subseteq\mathcal{Y}$ such that ${\mathit{A}}^{\#}(\lambda_{0})[R]>\delta^{\prime}$. We first show that ${\mathit{A}}^{\#}(\lambda_{1})[R]>0$ as follows. To derive a contradiction, we assume ${\mathit{A}}^{\#}(\lambda_{1})[R]=0$. Then for any $x_{1}\in\mathsf{supp}(\lambda_{1})$, $\mathit{A}(x_{1})[R]=0$. Let $S_{x_{1}}=\{x_{0}\in\mathcal{X}\mid(x_{0},x_{1})\in\varPhi\}$. For any $x_{0}\in S_{x_{1}}$, we have:

[TABLE]

Thus we obtain:

[TABLE]

This contradicts the definition of $R$. Hence ${\mathit{A}}^{\#}(\lambda_{1})[R]>0$.

Then we calculate the ratio of the probability that ${\mathit{A}}^{\#}$ outputs an element of $R$ given input $\lambda_{0}$ to that given input $\lambda_{1}$:

[TABLE]

Therefore $\mathit{A}$ provides $(\varepsilon,\,\delta\cdot|\varPhi|)$-DistP w.r.t. ${\varPhi}^{\#}$. ∎

See 2

Proof

Assume that $\mathit{A}$ provides $(\varepsilon,\mathit{d},\delta)$-XDP w.r.t. $\varPhi$. Let $(\lambda_{0},\lambda_{1})\in{\varPhi}_{\mathit{W}_{\infty}}^{\#}$. By definition, there exists a coupling $\gamma\in\mathsf{cp}(\lambda_{0},\lambda_{1})$ that satisfies $\mathsf{supp}(\gamma)\subseteq\varPhi$ and $\gamma\in\mathit{\Gamma_{\!{\rm\infty,\mathit{d}}}}(\lambda_{0},\lambda_{1})$. Then $\gamma$ minimizes the sensitivity $\mathit{\varDelta}_{\mathsf{supp}(\gamma)}$; i.e., $\displaystyle\gamma\in\!\operatornamewithlimits{argmin}_{\gamma^{\prime}\in\mathsf{cp}(\lambda_{0},\lambda_{1})}\!\mathit{\varDelta}_{\mathsf{supp}(\gamma^{\prime})}$.

Let $\delta^{\prime}=\delta\cdot|\varPhi|$. Let $R\subseteq\mathcal{Y}$ such that ${\mathit{A}}^{\#}(\lambda_{0})[R]>\delta^{\prime}$. Analogously to the proof for Theorem 1, we obtain ${\mathit{A}}^{\#}(\lambda_{1})[R]>0$. Then it follows from $\mathsf{supp}(\gamma)\subseteq\varPhi$ and $(\varepsilon,\mathit{d},\delta)$-XDP w.r.t. $\varPhi$ that:

[TABLE]

Therefore $\mathit{A}$ provides $(\varepsilon,\mathit{W}_{\infty,\mathit{d}},\delta^{\prime})$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$. ∎

0.B.2 Distribution Privacy with Attacker’s Close Beliefs

Next we show the propositions on distribution privacy with an attacker’s beliefs.

See 1

Proof

We obtain the proposition by:

[TABLE]

∎

Similarly, we say that the attacker has close beliefs w.r.t an adjacency relation $\varPsi$ if for each $(\lambda_{0},\lambda_{1})\in\varPsi$, we have $(\tilde{\lambda_{0}},\lambda_{0})\in\varPsi$ and $(\lambda_{1},\tilde{\lambda_{1}})\in\varPsi$. Then we obtain:

Proposition 2** (DistP with close beliefs)**

Let $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provide $(\varepsilon,\delta)$-DistP w.r.t. an adjacency relation $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$. Let $\delta^{\prime}=(1+e^{\varepsilon}+e^{2\varepsilon})\delta$. If an attacker has close beliefs w.r.t. $\varPsi$, then we obtain $(3\varepsilon,\delta^{\prime})$-DistP against the attacker, i.e., for all $(\lambda_{0},\lambda_{1})\in\varPsi$ and all $R\subseteq\mathcal{Y}$,  we have:

[TABLE]

Proof

We obtain the proposition by:

[TABLE]

0.B.3 Point Obfuscation by Distribution Obfuscation

Next we show that DP is an instance of DistP if an adjacency relation includes pairs of point distributions.

Definition 13 (Point distribution)

For each $x\in\mathcal{X}$, the point distribution $\eta_{x}$ of $x$ is the distribution over $\mathcal{X}$ such that: $\eta_{x}[x^{\prime}]=1$ if $x^{\prime}=x$, and $\eta_{x}[x^{\prime}]=0$ otherwise.

Lemma 1

Let $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$. For any $(x_{0},x_{1})\in\varPhi$, we have $(\eta_{x_{0}},\eta_{x_{1}})\in{\varPhi}_{\mathit{W}_{\infty}}^{\#}$.

Proof

Let $(x_{0},x_{1})\in\varPhi$. We define $\gamma\in\mathbb{D}(\mathcal{X}\times\mathcal{X})$ by: $\gamma[x,x^{\prime}]=1$ if $x=x_{0}$ and $x^{\prime}=x_{1}$, and $\gamma[x,x^{\prime}]=0$ otherwise. Then $\gamma$ is the only coupling between $\eta_{x_{0}}$ and $\eta_{x_{1}}$, hence $\gamma\in\mathit{\Gamma_{\!{\rm\infty,\mathit{d}}}}(\eta_{x_{0}},\eta_{x_{1}})$. Also $\mathsf{supp}(\gamma)=\{(x_{0},x_{1})\}\subseteq\varPhi$. Therefore by definition, we obtain $(\eta_{x_{0}},\eta_{x_{1}})\in{\varPhi}_{\mathit{W}_{\infty}}^{\#}$. ∎

Theorem 4** (DistP $\Rightarrow$ DP and XDistP $\Rightarrow$ XDP)**

Let $\varepsilon\in\mathbb{R}^{\geq 0}$,  $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$, and $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ be a randomized algorithm.

If $\mathit{A}$ provides $(\varepsilon,\delta)$-DistP w.r.t. ${\varPhi}^{\#}$, it provides $(\varepsilon,\delta)$-DP w.r.t. $\varPhi$. 2. 2.

If $\mathit{A}$ provides $(\varepsilon,\mathit{W}_{\infty,\mathit{d}},\delta)$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$, it provides $(\varepsilon,\mathit{d},\delta)$-XDP w.r.t. $\varPhi$.

Proof

We prove the first claim as follows. Assume that $\mathit{A}$ provides $(\varepsilon,\delta)$-DistP w.r.t. ${\varPhi}^{\#}$. Let $(x_{0},x_{1})\in\varPhi$, and $\eta_{x_{0}}$ and $\eta_{x_{1}}$ be the point distributions, defined in Definition 13. By Lemma 1 and ${\varPhi}_{\mathit{W}_{\infty}}^{\#}\subseteq{\varPhi}^{\#}$, we have $(\eta_{x_{0}},\eta_{x_{1}})\in{\varPhi}^{\#}$. It follows from $(\varepsilon,\delta)$-DistP that for any $R\subseteq\mathcal{Y}$, we obtain:

[TABLE]

Hence $\mathit{A}$ provides $(\varepsilon,\delta)$-DP w.r.t. $\varPhi$.

Next we show the second claim. Assume that $\mathit{A}$ provides $(\varepsilon,\mathit{W}_{\infty,\mathit{d}},\delta)$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$. Let $(x_{0},x_{1})\in\varPhi$, and $\eta_{x_{0}}$ and $\eta_{x_{1}}$ be the point distributions. By Lemma 1, we have $(\eta_{x_{0}},\eta_{x_{1}})\in{\varPhi}_{\mathit{W}_{\infty}}^{\#}$. Then for any $R\subseteq\mathcal{Y}$, we obtain:

[TABLE]

where the last equality follows from the definition of $\mathit{W}_{\infty,\mathit{d}}$. Hence $\mathit{A}$ provides $(\varepsilon,\mathit{d},\delta)$-XDP w.r.t. $\varPhi$. ∎

0.B.4 Sequential Compositions $\mathbin{\odot}$ and $\mathbin{\bullet}$

In this section we show two kinds of compositionality.

0.B.4.1 Sequential Composition $\mathbin{\odot}$ with Shared Input

We first present the definition of the sequential composition with shared input (Fig. 21(a)).

Definition 14 (Sequential composition $\mathbin{\odot}$)

Given two randomized algorithms $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{0}$ and $\mathit{A}_{1}:\mathcal{Y}_{0}\times\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$, we define the sequential composition of $\mathit{A}_{0}$ and $\mathit{A}_{1}$ as the randomized algorithm $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ such that: for any $x\in\mathcal{X}$,  $(\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0})(x)=\mathit{A}_{1}(\mathit{A}_{0}(x),x))$.

Then we show that it is harder to obfuscate distributions when an identical input is applied to the mechanism multiple times.

Proposition 3** (Sequential composition $\mathbin{\odot}$ of $(\varepsilon,\delta)$-DistP)**

Let $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$. If $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{0}$ provides $(\varepsilon_{0},\delta_{0})$-DistP w.r.t. ${\varPhi}^{\#}$ and for each $y_{0}\in\mathcal{Y}_{0}$, $\mathit{A}_{1}(y_{0}):\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ provides $(\varepsilon_{1},\delta_{1})$-DistP w.r.t. ${\varPhi}^{\#}$ then the sequential composition $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},(\delta_{0}+\delta_{1})\cdot|\varPhi|)$-DistP w.r.t. ${\varPhi}^{\#}$.

Proof

By Theorem 4, $\mathit{A}_{0}$ provides $(\varepsilon_{0},\delta_{0})$-DP w.r.t. $\varPhi$, and for each $y_{0}\in\mathcal{Y}_{0}$, $\mathit{A}_{1}(y_{0})$ provides $(\varepsilon_{1},\delta_{1})$-DP w.r.t. $\varPhi$. By the sequential composition theorem for DP mechanisms, $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\delta_{0}+\delta_{1})$-DP w.r.t. $\varPhi$. By Theorem 1, $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},(\delta_{0}+\delta_{1})\cdot|\varPhi|)$-DistP w.r.t. ${\varPhi}^{\#}$.

The compositionality for XDistP can be shown analogously to Proposition 3.

Proposition 4** (Sequential composition $\mathbin{\odot}$ of $(\varepsilon,\delta)$-XDistP)**

Let $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$. If $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{0}$ provides $(\varepsilon_{0},\mathit{W}_{\infty,\mathit{d}},\delta_{0})$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$ and for each $y_{0}\in\mathcal{Y}_{0}$, $\mathit{A}_{1}(y_{0}):\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ provides $(\varepsilon_{1},\mathit{W}_{\infty,\mathit{d}},\delta_{1})$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$ then the sequential composition $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\mathit{W}_{\infty,\mathit{d}},\allowbreak(\delta_{0}+\delta_{1})\cdot|\varPhi|)$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$.

Proof

By Theorem 4, $\mathit{A}_{0}$ provides $(\varepsilon_{0},\mathit{d},\delta_{0})$-XDP w.r.t. $\varPhi$, and for each $y_{0}\in\mathcal{Y}_{0}$, $\mathit{A}_{1}(y_{0})$ provides $(\varepsilon_{1},\mathit{d},\delta_{1})$-XDP w.r.t. $\varPhi$. By the sequential composition theorem for XDP mechanisms, $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\mathit{d},\delta_{0}+\delta_{1})$-XDP w.r.t. $\varPhi$. By Theorem 2, $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\mathit{W}_{\infty,\mathit{d}},(\delta_{0}+\delta_{1})\cdot|\varPhi|)$-XDistP w.r.t. ${\varPhi}_{\mathit{W}_{\infty}}^{\#}$.

0.B.4.2 Sequential Composition $\mathbin{\bullet}$ with Independent Sampling

We first note that the lifting of the sequential composition ${(\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0})}^{\#}$ does not coincide with the sequential composition of the liftings ${\mathit{A}_{1}}^{\#}\mathbin{\odot}{\mathit{A}_{1}}^{\#}$. Then

the latter is a randomized algorithm ${\mathit{A}_{1}}^{\#}\mathbin{\odot}{\mathit{A}_{0}}^{\#}:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ such that for any $\lambda\in\mathbb{D}\mathcal{X}$,  $({\mathit{A}_{1}}^{\#}\mathbin{\odot}{\mathit{A}_{0}}^{\#})(\lambda)={\mathit{A}_{1}}^{\#}({\mathit{A}_{0}}^{\#}(\lambda),\lambda)$. Then each of $\mathit{A}_{0}$ and $\mathit{A}_{1}$ receives an input independently sampled from $\lambda$. This is different from $\mathit{A}_{1}\mathbin{\odot}\mathit{A}_{0}$, in which $\mathit{A}_{0}$ and $\mathit{A}_{1}$ share an identical input drawn from $\lambda$, as shown in Figure 21(a).

To see this difference in detail, we deal with another definition of sequential composition.

Definition 15 (Sequential composition $\mathbin{\bullet}$)

Given two randomized algorithms $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{0}$ and $\mathit{A}_{1}:\mathcal{Y}_{0}\times\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$, we define the sequential composition of $\mathit{A}_{0}$ and $\mathit{A}_{1}$ as the randomized algorithm $\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0}:\mathcal{X}\times\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ such that: for any $x_{0},x_{1}\in\mathcal{X}$,  $(\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0})(x_{0},x_{1})=\mathit{A}_{1}(\mathit{A}_{0}(x_{0}),x_{1}))$.

Then the lifting of the sequential composition ${(\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0})}^{\#}$ coincides with the sequential composition of the liftings ${\mathit{A}_{1}\!}^{\#}\mathbin{\bullet}{\mathit{A}_{1}\!}^{\#}$ in the sense that for any $\lambda_{0},\lambda_{1}\in\mathbb{D}\mathcal{X}$,

[TABLE]

where $\lambda_{0}\times\lambda_{1}$ is the probability distribution over $\mathcal{X}\times\mathcal{X}$ such that for all $x_{0},x_{1}\in\mathcal{X}$,  $(\lambda_{0}\times\lambda_{1})[x_{0},x_{1}]=\lambda_{0}[x_{0}]\lambda_{1}[x_{1}]$.

To show the compositionality for distribution privacy, we introduce an operator $\diamond$ between binary relations $\varPsi_{0}$ and $\varPsi_{1}$ by:

[TABLE]

Proposition 5** (Sequential composition $\mathbin{\bullet}$ of $(\varepsilon,\delta)$-DistP)**

Let $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$. If $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{0}$ provides $(\varepsilon_{0},\delta_{0})$-DistP w.r.t. $\varPsi$ and for each $y_{0}\in\mathcal{Y}_{0}$, $\mathit{A}_{1}(y_{0}):\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}_{1}$ provides $(\varepsilon_{1},\delta_{1})$-DistP w.r.t. $\varPsi$ then the sequential composition $\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\delta_{0}+\delta_{1})$-DistP w.r.t. $\varPsi\diamond\varPsi$.

Proof

By the definition of DistP, we have that ${\mathit{A}_{0}}^{\#}$ provides $(\varepsilon_{0},\delta_{0})$-DP w.r.t. $\varPsi$ and for each $y_{0}\in\mathcal{Y}_{0}$, ${\mathit{A}_{1}(y_{0})}^{\#}$ provides $(\varepsilon_{1},\delta_{1})$-DP w.r.t. $\varPsi$. By the sequential composition theorem for DP mechanisms and Equation (3), ${(\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0})}^{\#}$ provides $(\varepsilon_{0}+\varepsilon_{1},\delta_{0}+\delta_{1})$-DP w.r.t. $\varPsi\diamond\varPsi$. Therefore $\mathit{A}_{1}\mathbin{\bullet}\mathit{A}_{0}$ provides $(\varepsilon_{0}+\varepsilon_{1},\delta_{0}+\delta_{1})$-DistP w.r.t. $\varPsi\diamond\varPsi$.

For brevity, we omit the case of XDistP.

Finally, we remark that the comparison of the compositions with shared input and with independent input is also discussed from the viewpoint of quantitative information flow in [22].

0.B.5 Post-processing and Pre-processing

Next we show that distribution privacy is immune to the post-processing. For $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ and $\mathit{A}_{1}:\mathcal{Y}\rightarrow\mathbb{D}\mathcal{Z}$, we define $\mathit{A}_{1}\circ\mathit{A}_{0}$ by: $(\mathit{A}_{1}\circ\mathit{A}_{0})(x)=\mathit{A}_{1}(\mathit{A}_{0}(x))$.

Proposition 6** (Post-processing)**

Let $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$, and $\mathit{W}:\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}\rightarrow\mathbb{R}^{\geq 0}$ be a metric. Let $\mathit{A}_{0}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, and $\mathit{A}_{1}:\mathcal{Y}\rightarrow\mathbb{D}\mathcal{Z}$.

If $\mathit{A}_{0}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$ then so does the composite function $\mathit{A}_{1}\circ\mathit{A}_{0}$. 2. 2.

If $\mathit{A}_{0}$ provides $(\varepsilon,\mathit{W},\delta)$-XDistP w.r.t. $\varPsi$ then so does the composite function $\mathit{A}_{1}\circ\mathit{A}_{0}$.

Proof

Let $(\lambda_{0},\lambda_{1})\in\varPsi$. Since every randomized algorithm is a convex combination of deterministic algorithms, there are a distribution $\mu$ over an index set $\mathcal{I}$ and deterministic algorithms $\mathit{A}_{1,i}:U_{i}\rightarrow R$ such that $\mathit{A}_{1}=\sum_{i\in\mathcal{I}}\mu[i]\mathit{A}_{1,i}$. Then we obtain:

[TABLE]

Then we show the first claim as follows. Assume that $\mathit{A}_{0}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$.

[TABLE]

Therefore $\mathit{A}_{1}\circ\mathit{A}_{0}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$.

Analogously, we show the second claim. Assume that $\mathit{A}_{0}$ provides $(\varepsilon,\mathit{W},\delta)$-XDistP w.r.t. $\varPsi$.

[TABLE]

Therefore $\mathit{A}_{1}\circ\mathit{A}_{0}$ provides $(\varepsilon,\mathit{W},\delta)$-XDistP w.r.t. $\varPsi$.

∎

We then show a property on pre-processing.

Proposition 7** (Pre-processing)**

Let $c\in\mathbb{R}^{\geq 0}$, $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$, and $\mathit{W}:\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}\rightarrow\mathbb{R}^{\geq 0}$ be a metric.

If $T:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{X}$ is a $(c,\varPsi)$-stable transformation and $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-DistP w.r.t $\varPsi$, then $\mathit{A}\circ T$ provides $(c\,\varepsilon,\delta)$-DistP w.r.t $\varPsi$. 2. 2.

If $T:\mathbb{D}\mathcal{X}\rightarrow\mathbb{D}\mathcal{X}$ is a $(c,\mathit{W})$-stable transformation and $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\mathit{W},\delta)$-XDistP, then $\mathit{A}\circ T$ provides $(c\,\varepsilon,\mathit{W},\delta)$-XDistP.

Proof

We show the first claim as follows. Assume that $\mathit{A}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$. Let $(\lambda,\lambda^{\prime})\in\varPsi$, and $R\subseteq\mathcal{Y}$. Then we have:

[TABLE]

Therefore $\mathit{A}\circ T$ provides $(c\,\varepsilon,\delta)$-DistP.

Next we show the second claim. Assume that $\mathit{A}$ provides $(\varepsilon,\mathit{W},\delta)$-XDistP. Let $\lambda,\lambda^{\prime}\in\mathbb{D}\mathcal{X}$, and $R\subseteq\mathcal{Y}$. Then we obtain:

[TABLE]

Therefore $\mathit{A}\circ T$ provides $(c\,\varepsilon,\mathit{W},\delta)$-XDistP.

∎

0.B.6 Probabilistic Distribution Privacy (PDistP)

We next introduce an approximate notion of distribution privacy analogously to the notion of probabilistic differential privacy (PDP) [48]. Intuitively, a randomized algorithm provides $(\varepsilon,\delta)$-probabilistic distribution privacy if it provides $\varepsilon$-distribution privacy with probability at least $(1-\delta)$.

Definition 16 (Probabilistic distribution privacy)

Let $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$. We say that a randomized algorithm $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ provides $(\varepsilon,\delta)$-probabilistic distribution privacy (PDistP) w.r.t. $\varPsi$ if the lifting ${\mathit{A}}^{\#}$ provides $(\varepsilon,\delta)$-probabilistic differential privacy w.r.t. $\varPsi$ , i.e., for all $(\lambda,\lambda^{\prime})\in\varPsi$, there exists an $R^{\prime}\subseteq\mathcal{Y}$ such that ${\mathit{A}}^{\#}(\lambda)[R^{\prime}]\leq\delta$, ${\mathit{A}}^{\#}(\lambda^{\prime})[R^{\prime}]\leq\delta$, and that for all $R\subseteq\mathcal{Y}$,  we have:

[TABLE]

where the probability space is taken over the choices of randomness in $\mathit{A}$.

0.B.7 Relationships between PDistP and DistP

In this section we show the relationships between PDistP and DistP. By definition, $(\varepsilon,0)$-DistP is equivalent to $(\varepsilon,0)$-PDistP. In general, however, $(\varepsilon,\delta)$-DistP does not imply $(\varepsilon,\delta)$-PDistP, while $(\varepsilon,\delta)$-PDistP implies $(\varepsilon,\delta)$-DistP.

Proposition 8** ($(\varepsilon,0)$-PDistP $\Leftrightarrow$ $(\varepsilon,0)$-DistP)**

A randomized algorithm $\mathit{A}$ provides $(\varepsilon,0)$-PDistP w.r.t. an adjacency relation $\varPsi$ iff it provides $(\varepsilon,0)$-DistP w.r.t. $\varPsi$.

Proof

Immediate from the definitions. ∎

Proposition 9** ($(\varepsilon,\delta)$-PDistP $\Rightarrow$ $(\varepsilon,\delta)$-DistP)**

If a randomized algorithm $\mathit{A}$ provides $(\varepsilon,\delta)$-PDistP w.r.t. an adjacency relation $\varPsi$, then it provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$.

Proof

Let $\varPsi\subseteq\mathbb{D}\mathcal{X}\times\mathbb{D}\mathcal{X}$, $(\lambda,\lambda^{\prime})\in\varPsi$, $R\subseteq\mathcal{Y}$, and $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$ be any randomized algorithm that provides $(\varepsilon,\delta)$-PDistP w.r.t. $\varPsi$. Then there exists an $R^{\prime}\subseteq\mathcal{Y}$ such that ${\mathit{A}}^{\#}(\lambda)[R^{\prime}]\leq\delta$, and ${\mathit{A}}^{\#}(\lambda)[R\setminus R^{\prime}]\leq e^{\varepsilon}\cdot{\mathit{A}}^{\#}(\lambda^{\prime})[R\setminus R^{\prime}]$. Hence we obtain:

[TABLE]

Therefore $\mathit{A}$ provides $(\varepsilon,\delta)$-DistP w.r.t. $\varPsi$. ∎

0.B.8 Properties of the Tupling Mechanism

In this section we show properties of the tupling mechanism.

We first present a minor result with $\delta=0$.

Proposition 10** ($(\varepsilon_{\mathit{A}},0)$-DistP of the tupling mechanism)**

If $\mathit{A}$ provides $(\varepsilon_{\mathit{A}},0)$-DP w.r.t. $\varPhi$, then the $(k,\nu,\mathit{A})$-tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\mathit{A}},0)$-DistP w.r.t. ${\varPhi}^{\#}$.

Proof

Let $\varPhi\subseteq\mathcal{X}\times\mathcal{X}$. Since $\mathit{A}$ provides $(\varepsilon_{\mathit{A}},0)$-DP w.r.t. $\varPhi$, Theorem 1 implies that $\mathit{A}$ provides $(\varepsilon_{\mathit{A}},0)$-DistP w.r.t. ${\varPhi}^{\#}$.

Let $(\lambda_{0},\lambda_{1})\in{\varPhi}^{\#}$ and $R\subseteq\mathcal{Y}^{k+1}$ such that $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{0})[R]>0$. Since the dummies are uniformly distributed over $\mathcal{Y}$, we have $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{1})[R]>0$. Let $\bar{y}=(y_{1},y_{2},\ldots,y_{k+1})\in R$ be an output of $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$. Since $i$ is uniformly drawn from $\{1,2,\ldots,k+1\}$ in the mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$, the output of $\mathit{A}$ appears as the $i$-th element $y_{i}$ of the tuple $\bar{y}$ with probability $\frac{1}{k+1}$. For each $b=0,1$, when an input $x$ is drawn from $\lambda_{b}$, the probability that $\mathit{A}$ outputs $y_{i}$ is:

[TABLE]

On the other hand, for each $j\neq i$, the probability that $y_{j}$ is drawn from the dummy distribution $\nu$ is given by $\nu[y_{j}]$. Therefore, the probability that the mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ outputs the tuple $\bar{y}$ is:

[TABLE]

Hence we obtain:

[TABLE]

Therefore $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\mathit{A}},0)$-DistP w.r.t. ${\varPhi}^{\#}$.

Next we show that the tupling mechanism provides PDistP without any restriction on $\mathit{A}$, i.e., $\mathit{A}$ does not have to provide DP in order for the tupling mechanism to provides PDistP.

Proposition 11** ($(\varepsilon_{\alpha},\delta_{\alpha})$-PDistP of the tupling mechanism)**

Let $k\in\mathbb{N}^{>0}$, $\nu$ be the uniform distribution over $\mathcal{Y}$, $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, and $\beta,\eta\in[0,1]$. For an $\alpha\in\mathbb{R}^{>0}$, let $\varepsilon_{\alpha}=\ln{\textstyle\frac{k+(\alpha+\beta)\cdot|\mathcal{Y}|}{k-\alpha\cdot|\mathcal{Y}|}}$ and \delta_{\alpha}=2\exp\bigl{(}-\frac{2\alpha^{2}}{k\beta^{2}}\bigr{)}+\eta. Then for any $0<\alpha<\frac{k}{|\mathcal{Y}|}$, the tupling mechanism $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\alpha},\delta_{\alpha})$-PDistP w.r.t $\Lambda_{\beta,\eta,\mathit{A}}^{2}$.

Proof

Let $\lambda_{0},\lambda_{1}\in\Lambda_{\beta,\eta,\mathit{A}}$, and $R\subseteq\mathcal{Y}^{k+1}$ such that $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{0})[R]>0$. Since the dummies are uniformly distributed over $\mathcal{Y}$, we have $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{1})[R]>~{}0$. As in the proof for Proposition 10, for any $\bar{y}=(y_{1},y_{2},\allowbreak\ldots,y_{k+1})\in R$:

[TABLE]

Recall that in the definition of the tupling mechanism, $y_{i}$ is the output of $\mathit{A}$ while for each $j\neq i$, $y_{j}$ is generated from the uniform distribution $\nu$ over $\mathcal{Y}$. Hence the expected value of $\sum_{j\neq i}{\mathit{A}}^{\#}(\lambda_{0})[y_{j}]$ is given by $\frac{k}{|\mathcal{Y}|}$. Therefore it follows from the Hoeffding’s inequality that for any $\alpha>0$, we have:

[TABLE]

where each $y_{j}$ is independently drawn from $\nu$, hence each of ${\mathit{A}}^{\#}(\lambda_{0})[y_{j}]$ and ${\mathit{A}}^{\#}(\lambda_{1})[y_{j}]$ is independent. By \delta_{\alpha}=2\exp\bigl{(}-\frac{2\alpha^{2}}{k\beta^{2}}\bigr{)}, we obtain:

[TABLE]

When $\bar{y}$ is drawn from $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{0})$, let $y_{i}$ be the output of ${\mathit{A}}^{\#}(\lambda_{0})$. Then we obtain:

[TABLE]

Then there is an $R^{\prime}\subseteq\mathcal{Y}^{k+1}$ such that $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{0})[R^{\prime}]\leq\delta_{\alpha}$, and that for any $\bar{y}\in R$,  $\bar{y}\in R^{\prime}$ iff $\frac{\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{0})[\bar{y}]}{\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}(\lambda_{1})[\bar{y}]}\geq e^{\varepsilon}$. Then:

[TABLE]

Therefore $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\alpha},\delta_{\alpha})$-PDistP w.r.t. $\Lambda_{\beta,\eta,\mathit{A}}^{2}$.

Then, we obtain the DistP of the tupling mechanism from Propositions 11 and 9 as follows. See 3

Proof

By Proposition 11, $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\alpha},\delta_{\alpha})$-PDistP w.r.t. $\Lambda_{\beta,\eta,\mathit{A}}^{2}$. Hence by Proposition 9, $\mathit{Q}^{\sf tp}_{k,\nu,\mathit{A}}$ provides $(\varepsilon_{\alpha},\delta_{\alpha})$-DistP w.r.t. $\Lambda_{\beta,\eta,\mathit{A}}^{2}$.

Finally, we note that if $\mathit{A}$ spreads the input distribution (e.g., $\mathit{A}$ provides $\varepsilon$-DP for a smaller $\varepsilon$), then $\beta$ becomes smaller (by Proposition 12), hence smaller values of $\varepsilon_{\alpha}$ and $\delta_{\alpha}$ as shown in experimental results in Section 7.

Proposition 12

Let $\lambda\in\mathbb{D}\mathcal{X}$, $\mathit{A}:\mathcal{X}\rightarrow\mathbb{D}\mathcal{Y}$, and $y\in\mathcal{Y}$. Then we have $\min_{x\in\mathcal{X}}\lambda[x]\leq{\mathit{A}}^{\#}(\lambda)[y]\leq\max_{x\in\mathcal{X}}\lambda[x]$.

Proof

By ${\mathit{A}}^{\#}(\lambda)[y]=\sum_{x^{\prime}\in\mathcal{X}}\lambda[x^{\prime}]\mathit{A}(x^{\prime})[y]$, we obtain:

[TABLE]