Chained-DP: Can We Recycle Privacy Budget?

TL;DR

This paper introduces Chained-DP, a novel framework that enables sequential data aggregation to recycle privacy budgets in federated analytics, significantly improving utility and reducing privacy costs.

Contribution

It proposes a new privacy budget recycling framework with a game-theoretic model, an incentive mechanism, and privacy guarantees to enhance federated data aggregation.

Findings

Significant privacy budget savings demonstrated in simulations

Lower estimation error compared to traditional LDP mechanisms

Effective mitigation of privacy collusion attacks

Abstract

Privacy-preserving vector mean estimation is a crucial primitive in federated analytics. Existing practices usually resort to Local Differentiated Privacy (LDP) mechanisms that inject random noise into users' vectors when communicating with users and the central server. Due to the privacy-utility trade-off, the privacy budget has been widely recognized as the bottleneck resource that requires well-provisioning. In this paper, we explore the possibility of privacy budget recycling and propose a novel Chained-DP framework enabling users to carry out data aggregation sequentially to recycle the privacy budget. We establish a sequential game to model the user interactions in our framework. We theoretically show the mathematical nature of the sequential game, solve its Nash Equilibrium, and design an incentive mechanism with provable economic properties. We further derive a differentially privacy-guaranteed protocol to alleviate potential privacy collusion attacks to avoid holistic exposure. Our numerical simulation validates the effectiveness of Chained-DP, showing that it can significantly save privacy budget and lower estimation error compared to the traditional LDP mechanism.