Measure-Observe-Remeasure: An Interactive Paradigm for Differentially-Private Exploratory Analysis

TL;DR

This paper introduces an interactive paradigm called Measure-Observe-Remeasure for differential privacy analysis, enabling analysts to efficiently allocate privacy budget during exploratory data analysis without prior query knowledge.

Contribution

The paper proposes a novel interactive framework and visualization interface for differential privacy, allowing adaptive privacy budget allocation during exploratory analysis.

Findings

Participants successfully used the paradigm to allocate privacy budget.

Participants' utility was comparable to rational agents, with some limitations.

The approach supports more effective privacy-preserving exploratory analysis.

Abstract

Differential privacy (DP) has the potential to enable privacy-preserving analysis on sensitive data, but requires analysts to judiciously spend a limited ``privacy loss budget'' $\epsilon$ across queries. Analysts conducting exploratory analyses do not, however, know all queries in advance and seldom have DP expertise. Thus, they are limited in their ability to specify $\epsilon$ allotments across queries prior to an analysis. To support analysts in spending $\epsilon$ efficiently, we propose a new interactive analysis paradigm, Measure-Observe-Remeasure, where analysts ``measure'' the database with a limited amount of $\epsilon$, observe estimates and their errors, and remeasure with more $\epsilon$ as needed. We instantiate the paradigm in an interactive visualization interface which allows analysts to spend increasing amounts of $\epsilon$ under a total budget. To observe how analysts interact with the Measure-Observe-Remeasure paradigm via the interface, we conduct a user study that compares the utility of $\epsilon$ allocations and findings from sensitive data participants make to the allocations and findings expected of a rational agent who faces the same decision task. We find that participants are able to use the workflow relatively successfully, including using budget allocation strategies that maximize over half of the available utility stemming from $\epsilon$ allocation. Their loss in performance relative to a rational agent appears to be driven more by their inability to access information and report it than to allocate $\epsilon$.