Information Density Bounds for Privacy

TL;DR

This paper introduces a new privacy measure called pointwise maximal cost (PMC), linking it to existing measures and demonstrating its practical relevance for ensuring privacy through information density bounds.

Contribution

It defines PMC, explores its properties, and connects it with established privacy measures like PML and LDP, filling gaps in privacy measure taxonomy.

Findings

PMC quantifies information leakage about secrets.

Bounded PMC and PML characterize local differential privacy.

PMC provides operational insights into privacy guarantees.

Abstract

This paper explores the implications of guaranteeing privacy by imposing a lower bound on the information density between the private and the public data. We introduce a novel and operationally meaningful privacy measure called pointwise maximal cost (PMC) and demonstrate that imposing an upper bound on PMC is equivalent to enforcing a lower bound on the information density. PMC quantifies the information leakage about a secret to adversaries who aim to minimize non-negative cost functions after observing the outcome of a privacy mechanism. When restricted to finite alphabets, PMC can equivalently be defined as the information leakage to adversaries aiming to minimize the probability of incorrectly guessing randomized functions of the secret. We study the properties of PMC and apply it to standard privacy mechanisms to demonstrate its practical relevance. Through a detailed examination, we connect PMC with other privacy measures that impose upper or lower bounds on the information density. These are pointwise maximal leakage (PML), local differential privacy (LDP), and (asymmetric) local information privacy. In particular, we show that a mechanism satisfies LDP if and only if it has both bounded PMC and bounded PML. Overall, our work fills a conceptual and operational gap in the taxonomy of privacy measures, bridges existing disconnects between different frameworks, and offers insights for selecting a suitable notion of privacy in a given application.