Programming Frameworks for Differential Privacy

TL;DR

This chapter surveys some of the conceptual ideas underlying these frameworks in a way that it is hoped will be helpful for both practitioners and researchers.

Abstract

Many programming frameworks have been introduced to support the development of differentially private software applications. In this chapter, we survey some of the conceptual ideas underlying these frameworks in a way that we hope will be helpful for both practitioners and researchers. For practitioners, the survey can provide a starting point for understanding what features may be valuable when selecting a programming framework. For researchers, it can help organize existing work in a unified way and provide context for understanding new features in future frameworks.

Figures (1)

• Figure 1: Illustration of hierarchical interactivity in PINQ. When a query (yellow circle) is submitted to PINQueryable$C_1$, its agent (A) forwards the budget request (yellow bar) to the agent of its parent, $Q$. In this case, because the children represent disjoint partitions of $Q$'s data, the agent of $Q$ keeps track of the cumulative privacy loss incurred at each child (red bars). When it receives the request from the child, it calculates how much this query would increase the maximum privacy loss and sends a request to the agent of its parent, $P$, who checks the residual cost against a budget. Since the request is under budget, response data (D) flows back to the PINQueryable where the query initiated.