Concurrent Composition for Differentially Private Continual Mechanisms

TL;DR

This paper develops new concurrent composition theorems for differential privacy in continual mechanisms, enabling privacy guarantees against adaptive adversaries in dynamic, long-term data release scenarios.

Contribution

It introduces the first general concurrent composition theorems for adaptive continual mechanisms and extends the parallel composition theorem to interactive, continual settings.

Findings

Proves privacy guarantees for mechanisms with dataset updates and interleaved queries.

Shows the parallel composition theorem holds under certain conditions for continual mechanisms.

Provides a modular privacy analysis framework for continual mechanisms, including a recent histogram mechanism.

Abstract

Many intended uses of differential privacy involve a $\textit{continual mechanism}$ that is set up to run continuously over a long period of time, making more statistical releases as either queries come in or the dataset is updated. In this paper, we give the first general treatment of privacy against $\textit{adaptive}$ adversaries for mechanisms that support dataset updates and a variety of queries, all arbitrarily interleaved. It also models a very general notion of neighboring, that includes both event-level and user-level privacy. We prove several $\textit{concurrent}$ composition theorems for continual mechanisms, which ensure privacy even when an adversary can interleave queries and dataset updates to the different composed mechanisms. Previous concurrent composition theorems for differential privacy were only for the case when the dataset is static, with no adaptive updates. Moreover, we also give the first interactive and continual generalizations of the "parallel composition theorem" for noninteractive differential privacy. Specifically, we show that the analogue of the noninteractive parallel composition theorem holds if either there are no adaptive dataset updates or each of the composed mechanisms satisfies pure differential privacy, but it fails to hold for composing approximately differentially private mechanisms with dataset updates. We then formalize a set of general conditions on a continual mechanism $M$ that runs multiple continual sub-mechanisms such that the privacy guarantees of $M$ follow directly using the above concurrent composition theorems on the sub-mechanisms, without further privacy loss. This enables us to give a simpler and more modular privacy analysis of a recent continual histogram mechanism of Henzinger, Sricharan, and Steiner. In the case of approximate DP, ours is the first proof showing that its privacy holds against adaptive adversaries.