Explaining epsilon in local differential privacy through the lens of quantitative information flow

TL;DR

This paper bridges information theory and quantitative information flow to interpret the epsilon parameter in local differential privacy as a capacity measure, enhancing understanding of privacy leakage.

Contribution

It introduces a unified interpretation of epsilon as a capacity measure in both frameworks, connecting differential privacy with information theory and QIF.

Findings

Epsilon is characterized as a capacity measure in both frameworks.

Introduces max-case g-leakage to describe leakage under worst-case assumptions.

Resolves interpretability issues of epsilon in local differential privacy.

Abstract

The study of leakage measures for privacy has been a subject of intensive research and is an important aspect of understanding how privacy leaks occur in computer systems. Differential privacy has been a focal point in the privacy community for some years and yet its leakage characteristics are not completely understood. In this paper we bring together two areas of research -- information theory and the g-leakage framework of quantitative information flow (QIF) -- to give an operational interpretation for the epsilon parameter of local differential privacy. We find that epsilon emerges as a capacity measure in both frameworks; via (log)-lift, a popular measure in information theory; and via max-case g-leakage, which we introduce to describe the leakage of any system to Bayesian adversaries modelled using ``worst-case'' assumptions under the QIF framework. Our characterisation resolves an important question of interpretability of epsilon and consolidates a number of disparate results covering the literature of both information theory and quantitative information flow.