On Local Mutual-Information Privacy

TL;DR

This paper explores local mutual-information privacy (LMIP), comparing it with local differential privacy (LDP) and local information privacy (LIP), establishing bounds and analyzing its strength as a privacy measure.

Contribution

It provides explicit conversion bounds between LMIP, LDP, and LIP, and demonstrates that LMIP is a weaker privacy notion, also identifying optimal noise for LMIP under certain constraints.

Findings

LMIP can be bounded by LDP and LIP parameters.

LMIP is a weaker privacy notion than LDP and LIP.

Gaussian noise is optimal for CI-LMIP under power constraints.

Abstract

Local mutual-information privacy (LMIP) is a privacy notion that aims to quantify the reduction of uncertainty about the input data when the output of a privacy-preserving mechanism is revealed. We study the relation of LMIP with local differential privacy (LDP), the de facto standard notion of privacy in context-independent (CI) scenarios, and with local information privacy (LIP), the state-of-the-art notion for context-dependent settings. We establish explicit conversion rules, i.e., bounds on the privacy parameters for an LMIP mechanism to also satisfy LDP/LIP, and vice versa. We use our bounds to formally verify that LMIP is a weak privacy notion. We also show that uncorrelated Gaussian noise is the best-case noise in terms of CI-LMIP if both the input data and the noise are subject to an average power constraint.