Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Metric Differential Privacy at the User-Level Via the Earth Mover's Distance

Jacob Imola, Amrita Roy Chowdhury, Kamalika Chaudhuri

TL;DR

This paper uses the earth-mover's distance (dEM) as a metric to obtain a notion of privacy as it captures both the magnitude and spatial aspects of changes in a user's data.

Abstract

Metric differential privacy (DP) provides heterogeneous privacy guarantees based on a distance between the pair of inputs. It is a widely popular notion of privacy since it captures the natural privacy semantics for many applications (such as, for location data) and results in better utility than standard DP. However, prior work in metric DP has primarily focused on the item-level setting where every user only reports a single data item. A more realistic setting is that of user-level DP where each user contributes multiple items and privacy is then desired at the granularity of the user's entire contribution. In this paper, we initiate the study of one natural definition of metric DP at the user-level. Specifically, we use the earth-mover's distance ($d_\textsf{EM}$) as our metric to obtain a notion of privacy as it captures both the magnitude and spatial aspects of changes in a user's data. We make three main technical contributions. First, we design two novel mechanisms under $d_\textsf{EM}$-DP to answer linear queries and item-wise queries. Specifically, our analysis for the latter involves a generalization of the privacy amplification by shuffling result which may be of independent interest. Second, we provide a black-box reduction from the general unbounded to bounded $d_\textsf{EM}$-DP (size of the dataset is fixed and public) with a novel sampling based mechanism. Third, we show that our proposed mechanisms can provably provide improved utility over user-level DP, for certain types of linear queries and frequency estimation.

Metric Differential Privacy at the User-Level Via the Earth Mover's Distance

TL;DR

This paper uses the earth-mover's distance (dEM) as a metric to obtain a notion of privacy as it captures both the magnitude and spatial aspects of changes in a user's data.

Abstract

Metric differential privacy (DP) provides heterogeneous privacy guarantees based on a distance between the pair of inputs. It is a widely popular notion of privacy since it captures the natural privacy semantics for many applications (such as, for location data) and results in better utility than standard DP. However, prior work in metric DP has primarily focused on the item-level setting where every user only reports a single data item. A more realistic setting is that of user-level DP where each user contributes multiple items and privacy is then desired at the granularity of the user's entire contribution. In this paper, we initiate the study of one natural definition of metric DP at the user-level. Specifically, we use the earth-mover's distance () as our metric to obtain a notion of privacy as it captures both the magnitude and spatial aspects of changes in a user's data. We make three main technical contributions. First, we design two novel mechanisms under -DP to answer linear queries and item-wise queries. Specifically, our analysis for the latter involves a generalization of the privacy amplification by shuffling result which may be of independent interest. Second, we provide a black-box reduction from the general unbounded to bounded -DP (size of the dataset is fixed and public) with a novel sampling based mechanism. Third, we show that our proposed mechanisms can provably provide improved utility over user-level DP, for certain types of linear queries and frequency estimation.
Paper Structure (41 sections, 35 theorems, 137 equations, 2 tables, 4 algorithms)

This paper contains 41 sections, 35 theorems, 137 equations, 2 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Details of Our Contributions
  3. Mechanism Design
  4. Extending $d_{\textsf{EM}}$-DP to the Unbounded Setting
  5. Demonstrating Improvements Over User-level DP
  6. Background
  7. Differential Privacy
  8. Earth-Mover's Distance
  9. Definition of $d_{\textsf{EM}}$-DP
  10. Mechanisms for $d_{\textsf{EM}}$-DP
  11. Linear Queries
  12. Unordered Release of Item-wise Queries
  13. Generalization to Unbounded DP
  14. Applications of Proposed Mechanisms
  15. Linear Embedding Queries
  16. ...and 26 more sections

Key Result

Theorem 1.1

(Informal version of Theorem thm:sens): The sensitivity of $F\tilde{K}$ is upper bounded by where the notation $F[x]$ indicates the column of $F$ indexed by $x$.

Theorems & Definitions (47)

  • Theorem 1.1
  • Theorem 1.2
  • Theorem 1.3
  • Definition 2.1: Unbounded User-level Local DP acharya2023discrete
  • Definition 2.2: Unbounded User-level Central DP liu2023algorithms
  • Definition 2.3: Local $d_\mathcal{X}$-DP Alvim2018
  • Definition 2.4
  • Lemma 2.1
  • Definition 3.1: (Un)Bounded Local $d_{\textsf{EM}}$-DP
  • Definition 3.2: Bounded Central $d_{\textsf{EM}}$-DP
  • ...and 37 more