Adaptive Privacy Composition for Accuracy-first Mechanisms

TL;DR

This paper introduces a systematic approach to adaptively combine accuracy-first noise reduction mechanisms with other private mechanisms, using privacy filters to ensure overall differential privacy guarantees.

Contribution

It develops privacy filters that enable adaptive switching between differentially private and ex-post private mechanisms while maintaining a global privacy guarantee.

Findings

Privacy filters effectively manage privacy loss over multiple mechanisms.

The approach allows for more accurate answers without compromising privacy.

Systematic framework for combining mechanisms in privacy-preserving data analysis.

Abstract

In many practical applications of differential privacy, practitioners seek to provide the best privacy guarantees subject to a target level of accuracy. A recent line of work by Ligett et al. '17 and Whitehouse et al. '22 has developed such accuracy-first mechanisms by leveraging the idea of noise reduction that adds correlated noise to the sufficient statistic in a private computation and produces a sequence of increasingly accurate answers. A major advantage of noise reduction mechanisms is that the analysts only pay the privacy cost of the least noisy or most accurate answer released. Despite this appealing property in isolation, there has not been a systematic study on how to use them in conjunction with other differentially private mechanisms. A fundamental challenge is that the privacy guarantee for noise reduction mechanisms is (necessarily) formulated as ex-post privacy that bounds the privacy loss as a function of the released outcome. Furthermore, there has yet to be any study on how ex-post private mechanisms compose, which allows us to track the accumulated privacy over several mechanisms. We develop privacy filters [Rogers et al. '16, Feldman and Zrnic '21, and Whitehouse et al. '22'] that allow an analyst to adaptively switch between differentially private and ex-post private mechanisms subject to an overall differential privacy guarantee.