Differential privacy from axioms
Guy Blanc, William Pires, Toniann Pitassi
TL;DR
This paper formalizes an axiomatic framework for privacy measures and proves that any reasonable privacy notion with nontrivial composition is equivalent to differential privacy up to polynomial factors in sample size. Central to the argument is TV-stability, which acts as a bridge from a general privacy measure to DP, via a sequence of steps that leverage preprocessing, blatanthood prohibition, strong composition, and linear scalability. The authors also show that DP itself satisfies the proposed axioms and demonstrate the minimality of the axioms by constructing ill-behaved privacy notions when any axiom is removed, including DP-hardness results for fundamental tasks like FindElement. The results justify DP as the robust, essentially unique notion under the stated axioms for statistical tasks, and connect privacy with stability concepts from the broader algorithmic toolkit. Practically, this suggests that average-case relaxations of DP are unlikely to yield substantial gains without sacrificing core privacy guarantees or venturing into degenerate definitions.
Abstract
Differential privacy (DP) is the de facto notion of privacy both in theory and in practice. However, despite its popularity, DP imposes strict requirements which guard against strong worst-case scenarios. For example, it guards against seemingly unrealistic scenarios where an attacker has full information about all but one point in the data set, and still nothing can be learned about the remaining point. While preventing such a strong attack is desirable, many works have explored whether average-case relaxations of DP are easier to satisfy [HWR13,WLF16,BF16,LWX23]. In this work, we are motivated by the question of whether alternate, weaker notions of privacy are possible: can a weakened privacy notion still guarantee some basic level of privacy, and on the other hand, achieve privacy more efficiently and/or for a substantially broader set of tasks? Our main result shows the answer is no: even in the statistical setting, any reasonable measure of privacy satisfying nontrivial composition is equivalent to DP. To prove this, we identify a core set of four axioms or desiderata: pre-processing invariance, prohibition of blatant non-privacy, strong composition, and linear scalability. Our main theorem shows that any privacy measure satisfying our axioms is equivalent to DP, up to polynomial factors in sample complexity. We complement this result by showing our axioms are minimal: removing any one of our axioms enables ill-behaved measures of privacy.