Composition Theorems for f-Differential Privacy

TL;DR

This paper connects $f$-differential privacy ($f$-DP) with Quantitative Information Flow (QIF) by establishing a Galois connection between the trade-off function lattice $({\mathbb F},\le)$ and the two-row channel lattice $({\mathbb C}_2,\sqsubseteq)$. It defines a pair of order-preserving mappings ${\cal T}$ and ${\cal C}$ that enable translating $f$-DP constraints into channel refinements and vice versa, thereby enabling general composition theorems for $f$-DP. A key contribution is showing that two-row channels and their hockey-stick tests capture the full structure of $f$-DP, and that finite, piecewise-linear trade-off functions admit constructive canonical representations through channel composition (e.g., the canonical $(\epsilon,\delta)$ channel). The framework yields universal composition rules for parallel, visible, hidden, and pre-processing compositions, and applies them to mechanisms such as privacy purification and sub-sampling, providing precise, actionable privacy profiles. Overall, the work delivers a principled, compositional foundation for analyzing complex privacy pipelines under $f$-DP, with practical implications for rigorous privacy accounting in real-world systems.

Abstract

"f differential privacy" (fDP) is a recent definition for privacy privacy which can offer improved predictions of "privacy loss". It has been used to analyse specific privacy mechanisms, such as the popular Gaussian mechanism. In this paper we show how fDP's foundation in statistical hypothesis testing implies equivalence to the channel model of Quantitative Information Flow. We demonstrate this equivalence by a Galois connection between two partially ordered sets. This equivalence enables novel general composition theorems for fDP, supporting improved analysis for complex privacy designs.

Figures (9)

• Figure 1: A summary of the relationships between hypothesis testing and quantitative information flow. Our contributions in this paper are highlighted in blue.
• Figure 2: Trade-off function $f_{\epsilon, \delta}$.
• Figure 3: Barycentric representation of $[u {\triangleright}C]$ for $C=2/53/54/51/5$, showing posteriors $(1/3, 2/3)$ and $(3/4, 1/4)$, rendered as orange points on the horizontal axis to indicate the probability of the first component. Observe that $V_g[u{\triangleright} C]$ corresponds to the intersection of the vertical at the mid-point, and the line connecting $V_g(\delta_0)$ and $V_g(\delta_1)$, as $C$ has only two posteriors.
• Figure 4: Illustration of refinement: The posteriors (orange points) of $C^\alpha$ lie outside the posteriors (blue points) of $M^\alpha$ indicating by (IV) that $C^\alpha \sqsubseteq M^\alpha$. For every hockey stick function (green line), the orange diagonal line will lie above (or on) the blue diagonal line, indicating that $V_{\underline{h}}[u{\triangleright}C^\alpha] \geq V_{\underline{h}}[u{\triangleright}M^\alpha]$ for any $h$. The grey diamonds correspond to the particular $V_{\underline{h}}$ values for $C^\alpha$ and $M^\alpha$ in this example.
• Figure 5: Two equivalent methods for computing $V_{\underline{h}}[u{\triangleright}C]$: the left plot first computes $V_{\underline{h}}[\delta]$ for each (blue) posterior of $C$, and then averages, the right plot first averages the (blue) posteriors (equivalent to taking a refinement) and then computes $V_{\underline{h}}[\delta']$ on the two (orange) results.

Theorems & Definitions (43)

• definition thmcounterdefinition
• lemma thmcounterlemma: Neyman-Pearson NPL1933
• definition thmcounterdefinition: Trade-off function
• definition thmcounterdefinition: Abstract trade-off functions
• definition thmcounterdefinition: $f$-DP
• definition thmcounterdefinition: Refinement of channels
• definition thmcounterdefinition: Leakage semantics
• definition thmcounterdefinition
• definition thmcounterdefinition: Distinguishability profile
• definition thmcounterdefinition: Trade-off channel