Optimal Allocation of Privacy Budget on Hierarchical Data Release

TL;DR

This work tackles optimal privacy budget allocation for hierarchical data releases under differential privacy by formulating a convex optimization problem that minimizes a level-weighted mean squared error (MSE) combining bias and variance from Laplace noise and non-negativity post-processing. It proves that, under equal level weighting, the optimal budget is bottom-heavy, allocating more privacy loss to lower levels to improve utility, and demonstrates this with extensive experiments on real U.S. Census data. The framework supports two convex programs: minimizing MSE under a total budget constraint and minimizing total privacy cost under a utility target, both solvable efficiently. The approach yields substantial improvements over uniform budget allocation, reduces bias and variance, and extends to downstream, policy-driven resource allocation tasks, highlighting practical impact for public data releases and decision-making.

Abstract

Releasing useful information from datasets with hierarchical structures while preserving individual privacy presents a significant challenge. Standard privacy-preserving mechanisms, and in particular Differential Privacy, often require careful allocation of a finite privacy budget across different levels and components of the hierarchy. Sub-optimal allocation can lead to either excessive noise, rendering the data useless, or to insufficient protections for sensitive information. This paper addresses the critical problem of optimal privacy budget allocation for hierarchical data release. It formulates this challenge as a constrained optimization problem, aiming to maximize data utility subject to a total privacy budget while considering the inherent trade-offs between data granularity and privacy loss. The proposed approach is supported by theoretical analysis and validated through comprehensive experiments on real hierarchical datasets. These experiments demonstrate that optimal privacy budget allocation significantly enhances the utility of the released data and improves the performance of downstream tasks.

Figures (11)

• Figure 1: A hierarchical structure of geographic regions, where blocks are nested within tracts, and tracts within the state of Virginia.
• Figure 2: Privacy budget allocation using Optimization Program \ref{['eq:2']} in Wyoming.
• Figure 3: Hierarchical data release performance in Wyoming.
• Figure 4: Optimized privacy budget allocation for Wyoming using program \ref{['eq:1']}.
• Figure 5: Total and level-wise MSE as a function of varying $w_3$ (left), and privacy budget allocation across levels from program \ref{['eq:1']} under varying $w_3$ (right) in Wyoming.

Theorems & Definitions (9)

• proof
• proof
• proof
• proof : Proof of Proposition \ref{['proposition:bias']}
• proof : Proof of Proposition \ref{['proposition:variance']}
• proof : Proof of Proposition \ref{['proposition:MSE_convex']}
• proof : Proof of Proposition \ref{['proposition:MSE_bounded']}
• proof : Proof of Theorem \ref{['theorem:bottom_heavy_optimal']}
• proof