Accuracy Gains from Privacy Amplification Through Sampling for Differential Privacy

TL;DR

This paper explores how sampling can amplify privacy guarantees in differential privacy and investigates conditions under which this amplification can lead to improved accuracy of statistical estimates, focusing on mean and median.

Contribution

It systematically analyzes when privacy amplification through sampling can be exploited to enhance accuracy in differential privacy, especially for noise-added algorithms.

Findings

Accuracy gains are possible under certain conditions.

Gains depend on the sensitivity of the output relative to database size.

The study focuses on mean and median statistics.

Abstract

Recent research in differential privacy demonstrated that (sub)sampling can amplify the level of protection. For example, for $\epsilon$-differential privacy and simple random sampling with sampling rate $r$, the actual privacy guarantee is approximately $r\epsilon$, if a value of $\epsilon$ is used to protect the output from the sample. In this paper, we study whether this amplification effect can be exploited systematically to improve the accuracy of the privatized estimate. Specifically, assuming the agency has information for the full population, we ask under which circumstances accuracy gains could be expected, if the privatized estimate would be computed on a random sample instead of the full population. We find that accuracy gains can be achieved for certain regimes. However, gains can typically only be expected, if the sensitivity of the output with respect to small changes in the database does not depend too strongly on the size of the database. We only focus on algorithms that achieve differential privacy by adding noise to the final output and illustrate the accuracy implications for two commonly used statistics: the mean and the median. We see our research as a first step towards understanding the conditions required for accuracy gains in practice and we hope that these findings will stimulate further research broadening the scope of differential privacy algorithms and outputs considered.