Information Design for Differential Privacy

TL;DR

The paper reframes differential privacy as a constrained information-design problem, where a data provider commits to a publication mechanism to maximize end-user welfare under an $\epsilon$-DP constraint. It shows that for magnitude data, adding noise is not generally optimal, while for categorical data with anonymous respondents, oblivious mechanisms can be optimal; in the latter setting, the $\epsilon$-geometric mechanism is optimal in supermodular decision problems. A novel Uniform-Peaked Relative Risk (UPRR) order is developed to compare information structures, and a Frechét-representation-based argument establishes that UPPR-dominance yields superiority in supermodular contexts. Practically, these results guide mechanism design in DP publication, indicating when simple noise-adding is sufficient and when more flexible, data-dependent publication can yield substantial welfare gains, with the geometric mechanism offering robust performance under common privacy and decision-making structures.

Abstract

Firms and statistical agencies must protect the privacy of the individuals whose data they collect, analyze, and publish. Increasingly, these organizations do so by using publication mechanisms that satisfy differential privacy. We consider the problem of choosing such a mechanism so as to maximize the value of its output to end users. We show that mechanisms which add noise to the statistic of interest--like most of those used in practice--are generally not optimal when the statistic is a sum or average of magnitude data (e.g., income). However, we also show that adding noise is always optimal when the statistic is a count of data entries with a certain characteristic, and the underlying database is drawn from a symmetric distribution (e.g., if individuals' data are i.i.d.). When, in addition, data users have supermodular payoffs, we show that the simple geometric mechanism is always optimal by using a novel comparative static that ranks information structures according to their usefulness in supermodular decision problems.

Figures (8)

• Figure 1: $\epsilon$-differentially private posteriors. Consider a setting with categorical data ($T=1$), $N=2$, $\epsilon=1$, and $(\pi_0(0,0),\pi_0(0,1),\pi_0(1,0),\pi_0(1,1))=( \frac{1}{3},\frac{1}{6}, \frac{1}{6},\frac{1}{3})$. Left panel: The blue shaded region of the probability simplex is described by the constraint $-\epsilon\leq \log\left(\pi((0,1))/\pi((0,0))\right)-\log\left(\pi_0((0,1))/\pi_0((0,0))\right) \leq\epsilon$ bounding the amount of information that an $\epsilon$-differentially private mechanism can reveal about $\theta_2$ when $\theta_1=0$. Middle panel: The region enclosed by the green lines is described by the constraint $-\epsilon\leq \log\left(\pi((1,0))/\pi((0,0))\right)-\log\left(\pi_0((1,0))/\pi_0((1,0))\right) \leq\epsilon$ bounding the amount of information that an $\epsilon$-differentially private mechanism can reveal about $\theta_1$ when $\theta_2=0$; its intersection with the region from the left panel is shaded in blue. Right panel: The blue shaded region is the intersection of the regions described by the constraints in (\ref{['E:DP_posteriorT']}), i.e., the set $K(\epsilon,\pi_0)$ of $\epsilon$-differentially private posteriors. Note that $K(\epsilon,\pi_0)$ is asymmetric because there is no constraint on the ratio $\pi((0,0))/\pi((1,1))$, since the type profiles $(0,0)$ and $(1,1)$ are not adjacent.
• Figure 2: Projection onto $\Delta(\Omega)$ in Figure \ref{['F:DPpostT']}. A posterior belief $\pi\in\Delta(\Theta)$ about the database $\theta$ is projected onto the space $\Delta(\Omega)$ --- shown here embedded in $\Delta(\Theta)$ --- of beliefs about the population statistic $\omega$.
• Figure 3: Oblivious $\epsilon$-differentially private posteriors. Recall that in Figure \ref{['F:DPpostT']}, we had categorical data ($T=1$), $N=2$, $\epsilon=1$, and prior $(\pi_0(0,0),\pi_0(0,1),\pi_0(1,0),\pi_0(1,1))=( \frac{1}{3},\frac{1}{6}, \frac{1}{6},\frac{1}{3})$. Hence, $\mu_0=P\pi_0=\left[\frac{1}{3}\ \frac{1}{3}\ \frac{1}{3}\right]'$. The region of the probability simplex enclosed by the blue dotted lines is described by the constraint $-\epsilon\leq \log\left(\mu(1)/\mu(0)\right)-\log\left(\mu_0(1)/\mu_0(0)\right) \leq\epsilon$; the region enclosed by the red dotted lines is described by the constraint $-\epsilon\leq \log\left(\mu(2)/\mu(1)\right)-\log\left(\mu_0(2)/\mu_0(1)\right) \leq\epsilon$; their intersection is $K_\Omega(\epsilon,\mu_0)$. Note that $K_\Omega(\epsilon,\mu_0)$ is asymmetric because there is no constraint on the ratio $\mu(0)/\mu(2)$, since states 0 and 2 are not adjacent.
• Figure 4: Projection of $K(\epsilon,\pi_0)$ onto $\Delta(\Omega)$ in Figures \ref{['F:DPpostT']} and \ref{['F:DPpost']}. Left panel: The set of $\epsilon$-differentially private posteriors (blue) and the space $\Delta(\Omega)$ of posteriors about the population statistic (brown). Right panel: Since $\pi_0$ is symmetric and data is categorical (i.e., $T=1$) in Figures \ref{['F:DPpostT']} and \ref{['F:DPpost']}, the projection operator $P$ carries $K(\epsilon,\pi_0)$ to the set of oblivious $\epsilon$-differentially private posteriors (blue).
• Figure 5: Possible solutions to the designer's problem \ref{['E:DesignProblem']} in Figures \ref{['F:DPpostT']}-\ref{['F:projDP']}. In each panel, the extreme points of $K_\Omega(\epsilon,\mu_0)$ are labeled $\mu_w,\mu_x,\mu_y$, and $\mu_z$. Left panel: One possible solution is the unique Bayes-plausible distribution of posteriors about the population statistic with support $\{\mu_x,\mu_y,\mu_z\}$. Right panel: The alternative is the unique Bayes-plausible distribution with support $\{\mu_w,\mu_y\}$.

Theorems & Definitions (36)

• Example 1: School Planning
• Definition : $\epsilon$-Differential Privacy dwork2006calibrating
• Proposition 1: Differentially Private Data Publication as Information Design
• Proposition 2: Characterization of Optimal Data Publication Mechanisms
• Proposition 3: Differential Privacy for Oblivious Mechanisms
• Theorem 1: Oblivious Mechanisms and Magnitude Data
• Theorem 2: Oblivious Mechanisms and Categorical Data
• Corollary 1: Differentially Private Data Publication as Information Design: Categorical Data
• Proposition 4: Oblivious Mechanisms with Two Respondents
• Proposition 5: Permutation-Invariant Mechanisms