Composition Properties of Bayesian Differential Privacy

TL;DR

This paper proves that Bayesian differential privacy maintains key properties like composability and post-processing, enabling its broader application in dependent data scenarios.

Contribution

It establishes that Bayesian differential privacy preserves sequential and parallel composability as well as post-processing, extending its theoretical robustness.

Findings

Bayesian differential privacy is composable both sequentially and in parallel.

The privacy guarantees are preserved under post-processing.

The properties hold even with data dependencies.

Abstract

Differential privacy is a rigorous privacy standard that has been applied to a range of data analysis tasks. To broaden the application scenarios of differential privacy when data records have dependencies, the notion of Bayesian differential privacy has been recently proposed. However, it is unknown whether Bayesian differential privacy preserves three nice properties of differential privacy: sequential composability, parallel composability, and post-processing. In this paper, we provide an affirmative answer to this question; i.e., Bayesian differential privacy still have these properties. The idea behind sequential composability is that if we have $m$ algorithms $Y_1, Y_2, \ldots, Y_m$, where $Y_{\ell}$ is independently $\epsilon_{\ell}$-Bayesian differential private for ${\ell}=1,2,\ldots,m$, then by feeding the result of $Y_1$ into $Y_2$, the result of $Y_2$ into $Y_3$, and so on, we will finally have an $\sum_{\ell=1}^m \epsilon_{\ell}$-Bayesian differential private algorithm. For parallel composability, we consider the situation where a database is partitioned into $m$ disjoint subsets. The $\ell$-th subset is input to a Bayesian differential private algorithm $Y_{\ell}$, for ${\ell}=1,2,\ldots,m$. Then the parallel composition of $Y_1$, $Y_2$, $\ldots$, $Y_m$ will be $\max_{\ell=1}^m \epsilon_{\ell}$-Bayesian differential private. The post-processing property means that a data analyst, without additional knowledge about the private database, cannot compute a function of the output of a Bayesian differential private algorithm and reduce its privacy guarantee.