Privacy-Utility Trade-offs Under Multi-Level Point-Wise Leakage Constraints

TL;DR

This work studies information-theoretic privacy mechanism design under multi-level point-wise leakage constraints, where each disclosed symbol $u_i$ has a distinct leakage budget with respect to the private data $X$ while a utility-maximizing relation $X-Y-U$ is maintained. In the small-leakage regime, the authors derive a quadratic approximation for invertible leakage matrices, showing that a binary $U$ suffices and that the maximum utility scales as $\tfrac{1}{2} \, \ε_1 \ε_2 \sigma_{ ext{max}}^2(W)$ with $W=[\text{diag}(P_Y)^{-1/2}] P_{X|Y}^{-1} [\text{diag}(P_X)^{1/2}]$. For the general leakage case, they cast the optimization into a linear program by exploiting the extreme points of convex polytopes that bound $P_{Y|U=u_i}$, enabling efficient privacy designs with multi-level budgets; the framework also accommodates mixtures of perfect privacy and nonzero leakage via hybridization and pseudo-inverse generalizations. A numerical example demonstrates substantial utility under multi-level leakage and confirms binary-signaling sufficiency for the invertible case. Overall, the paper provides low-complexity, tunable leakage-control mechanisms with practical relevance to privacy-preserving data disclosure.

Abstract

An information-theoretic privacy mechanism design is studied, where an agent observes useful data $Y$ which is correlated with the private data $X$. The agent wants to reveal the information to a user, hence, the agent utilizes a privacy mechanism to produce disclosed data $U$ that can be revealed. We assume that the agent has no direct access to $X$, i.e., the private data is hidden. We study privacy mechanism design that maximizes the disclosed information about $Y$, measured by the mutual information between $Y$ and $U$, while satisfying a point-wise constraint with different privacy leakage budgets. We introduce a new measure, called the \emph{multi-level point-wise leakage}, which allows us to impose different leakage levels for different realizations of $U$. In contrast to previous studies on point-wise measures, which use the same leakage level for each realization, we consider a more general scenario in which each data point can leak information up to a different threshold. As a result, this concept also covers cases in which some data points should not leak any information about the private data, i.e., they must satisfy perfect privacy. In other words, a combination of perfect privacy and non-zero leakage can be considered. When the leakage is sufficiently small, concepts from information geometry allow us to locally approximate the mutual information. We show that when the leakage matrix $P_{X|Y}$ is invertible, utilizing this approximation leads to a quadratic optimization problem that has closed-form solution under some constraints. In particular, we show that it is sufficient to consider only binary $U$ to attain the optimal utility. This leads to simple privacy designs with low complexity which are based on finding the maximum singular value and singular vector of a matrix.

Figures (1)

• Figure 1: In this model, disclosed data $U$ is designed by a privacy mechanism that maximizes the information disclosed about $Y$ and satisfies the multi-level point-wise privacy constraint. Here, each realization of $U$ must satisfy a privacy constraint with different leakage budget. Furthermore, $\mathcal{L}(X \rightarrow u_i)$ denotes the leakage from the private data $X$ to the letter (realization) $u_i \in \mathcal{U}$.

Theorems & Definitions (32)

• Remark 1
• Example 1
• Remark 2
• Remark 3
• Proposition 1
• proof
• Proposition 2
• proof
• Lemma 1
• proof