Multi-Analyst Differential Privacy for Online Query Answering

TL;DR

This paper extends multi-analyst differential privacy mechanisms to online query answering, addressing the challenges of unknown query order and proposing two solutions that balance privacy and utility.

Contribution

It introduces novel mechanisms for online multi-analyst differential privacy, including one that guarantees desiderata and another that randomizes query order to improve performance.

Findings

Fundamental limit on number of queries answered online while satisfying desiderata.

Proposed mechanisms achieve privacy guarantees in online settings.

Randomized query order enhances mechanism performance.

Abstract

Most differentially private mechanisms are designed for the use of a single analyst. In reality, however, there are often multiple stakeholders with different and possibly conflicting priorities that must share the same privacy loss budget. This motivates the problem of equitable budget-sharing for multi-analyst differential privacy. Our previous work defined desiderata that any mechanism in this space should satisfy and introduced methods for budget-sharing in the offline case where queries are known in advance. We extend our previous work on multi-analyst differentially private query answering to the case of online query answering, where queries come in one at a time and must be answered without knowledge of the following queries. We demonstrate that the unknown ordering of queries in the online case results in a fundamental limit in the number of queries that can be answered while satisfying the desiderata. In response, we develop two mechanisms, one which satisfies the desiderata in all cases but is subject to the fundamental limitations, and another that randomizes the input order ensuring that existing online query answering mechanisms can satisfy the desiderata.