-Liftings for Differential Privacy and f -Divergences Gilles - PowerPoint PPT Presentation

⋆ -Liftings for Differential Privacy and f -Divergences Gilles Barthe, Thomas Espitau, Justin Hsu, Tetsuya Sato, Pierre-Yves Strub 1

Differential privacy: probabilistic program property 2

Differential privacy: probabilistic program property 2

Differential privacy: probabilistic program property Output depends only a little on any single individual’s data 2

More formally Definition (Dwork, McSherry, Nissim, Smith) An algorithm is ( ǫ, δ ) -differentially private if, for every two adjacent inputs, the output distributions µ 1 , µ 2 satisfy: ∆ ǫ ( µ 1 , µ 2 ) ≤ δ � for all sets S , µ 1 ( S ) ≤ e ǫ · µ 2 ( S ) + δ 3

More formally Definition (Dwork, McSherry, Nissim, Smith) An algorithm is ( ǫ, δ ) -differentially private if, for every two adjacent inputs, the output distributions µ 1 , µ 2 satisfy: ∆ ǫ ( µ 1 , µ 2 ) ≤ δ � for all sets S , µ 1 ( S ) ≤ e ǫ · µ 2 ( S ) + δ Behaves well under composition: “ ǫ and δ add up” Sequentially composing an ( ǫ, δ ) -private program and an ( ǫ ′ , δ ′ ) -private program is ( ǫ + ǫ ′ , δ + δ ′ ) -private. 3

How to verify this property? Use ideas from probabilistic bisimulation ◮ ∆ ǫ ( µ 1 , µ 2 ) ≤ δ means “approximately similar” ◮ Composition ⇐ ⇒ approximate probabilistic bisimulation 4

How to verify this property? Use ideas from probabilistic bisimulation ◮ ∆ ǫ ( µ 1 , µ 2 ) ≤ δ means “approximately similar” ◮ Composition ⇐ ⇒ approximate probabilistic bisimulation Foundation for many styles of program verification ◮ Linear and dependent type systems ◮ Product program constructions ◮ Relational program logics 4

Review: Probabilistic Liftings and Approximate Liftings 5

Probabilistic liftings Lift a binary relation R on pairs S × T to a relation � R � on distributions Distr ( S ) × Distr ( T ) Definition (Larsen and Skou) Let R ⊆ S × T be a relation. Two distributions are related µ 1 � R � µ 2 if there exists a witness η ∈ Distr ( S × T ) such that: 1. π 1 ( η ) = µ 1 and π 2 ( η ) = µ 2 , 2. η ( s, t ) > 0 only when ( s, t ) ∈ R . 6

Probabilistic liftings Lift a binary relation R on pairs S × T to a relation � R � on distributions Distr ( S ) × Distr ( T ) Definition (Larsen and Skou) Let R ⊆ S × T be a relation. Two distributions are related µ 1 � R � µ 2 if there exists a witness η ∈ Distr ( S × T ) such that: 1. π 1 ( η ) = µ 1 and π 2 ( η ) = µ 2 , 2. η ( s, t ) > 0 only when ( s, t ) ∈ R . Example µ 1 � = � µ 2 is equivalent to µ 1 = µ 2 . 6

An equivalent definition via Strassen’s theorem Theorem (Strassen 1965) Let R ⊆ S × T be a relation. Then µ 1 � R � µ 2 if and only if: for all subsets A ⊆ S , µ 1 ( A ) ≤ µ 2 ( R ( A )) 7

An equivalent definition via Strassen’s theorem Theorem (Strassen 1965) Let R ⊆ S × T be a relation. Then µ 1 � R � µ 2 if and only if: for all subsets A ⊆ S , µ 1 ( A ) ≤ µ 2 ( R ( A )) 7

Approximate liftings Intuition ◮ Approximately relate two distributions µ 1 and µ 2 ◮ Add numeric indexes ( ǫ, δ ) to lifting Want: ◮ Given R ⊆ S × T , lift to � R � ( ǫ,δ ) ⊆ Distr ( S ) × Distr ( T ) ◮ µ 1 � = � ( ǫ,δ ) µ 2 should be equivalent to ∆ ǫ ( µ 1 , µ 2 ) ≤ δ 8

Approximate liftings Intuition ◮ Approximately relate two distributions µ 1 and µ 2 ◮ Add numeric indexes ( ǫ, δ ) to lifting Want: ◮ Given R ⊆ S × T , lift to � R � ( ǫ,δ ) ⊆ Distr ( S ) × Distr ( T ) ◮ µ 1 � = � ( ǫ,δ ) µ 2 should be equivalent to ∆ ǫ ( µ 1 , µ 2 ) ≤ δ 8

Approximate liftings Intuition ◮ Approximately relate two distributions µ 1 and µ 2 ◮ Add numeric indexes ( ǫ, δ ) to lifting Want: ◮ Given R ⊆ S × T , lift to � R � ( ǫ,δ ) ⊆ Distr ( S ) × Distr ( T ) ◮ µ 1 � = � ( ǫ,δ ) µ 2 should be equivalent to ∆ ǫ ( µ 1 , µ 2 ) ≤ δ 8

Previous definitions: “Existential” Let R ⊆ S × T be a binary relation. Two distributions are related by µ 1 � R � ( ǫ,δ ) µ 2 if: 9

Previous definitions: “Existential” Let R ⊆ S × T be a binary relation. Two distributions are related by µ 1 � R � ( ǫ,δ ) µ 2 if: One witness (Barthe, Köpf, Olmedo, Zanella-Béguelin) There exists η ∈ Distr ( S × T ) such that 1. π 1 ( η ) = µ 1 and π 2 ( η ) ≤ µ 2 , 2. η ( s, t ) > 0 only when ( s, t ) ∈ R , 3. ∆ ǫ ( µ 1 , π 1 ( η )) ≤ δ . 9

Previous definitions: “Existential” Let R ⊆ S × T be a binary relation. Two distributions are related by µ 1 � R � ( ǫ,δ ) µ 2 if: One witness (Barthe, Köpf, Olmedo, Zanella-Béguelin) There exists η ∈ Distr ( S × T ) such that 1. π 1 ( η ) = µ 1 and π 2 ( η ) ≤ µ 2 , 2. η ( s, t ) > 0 only when ( s, t ) ∈ R , 3. ∆ ǫ ( µ 1 , π 1 ( η )) ≤ δ . Two witnesses (Barthe and Olmedo) There exists η L , η R ∈ Distr ( S × T ) such that 1. π 1 ( η L ) = µ 1 and π 2 ( η R ) = µ 2 , 2. η L ( s, t ) , η R ( s, t ) > 0 only when ( s, t ) ∈ R , 3. ∆ ǫ ( η L , η R ) ≤ δ . 9

Previous definitions: “Universal” Let R ⊆ S × T be a binary relation. Two distributions are related by µ 1 � R � ( ǫ,δ ) µ 2 if: 10

Previous definitions: “Universal” Let R ⊆ S × T be a binary relation. Two distributions are related by µ 1 � R � ( ǫ,δ ) µ 2 if: No witnesses (Sato) For all subsets A ⊆ S , we have µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ 10

Which definition is the “right” one? Definitions support different properties and constructions PW-Eq Up-to-bad Acc. Bd. Subset Mapping Adv. Comp. 1 -witness ? ? Yes ? ? ? 2 -witness Yes Almost* No Almost* Almost* Yes Universal Yes Yes Yes Yes Yes ? 11

Which definition is the “right” one? Definitions support different properties and constructions PW-Eq Up-to-bad Acc. Bd. Subset Mapping Adv. Comp. 1 -witness ? ? Yes ? ? ? 2 -witness Yes Almost* No Almost* Almost* Yes Universal Yes Yes Yes Yes Yes ? Broad tradeoff: How general? ◮ Less general: less compositional ◮ More general: harder to prove properties about 11

Our work: ⋆ -Liftings, Equivalences, and an approximate Strassen’s theorem 12

New definition: ⋆ -liftings Generalize 2 -witness lifting by adding a new point Let R ⊆ S × T be a binary relation, and let A ⋆ = A ∪ { ⋆ } . Two distributions are related by µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if: There exists η L , η R ∈ Distr ( S ⋆ × T ⋆ ) such that 1. π 1 ( η L ) = µ 1 and π 2 ( η R ) = µ 2 , 2. η L ( s, t ) , η R ( s, t ) > 0 only when ( s, t ) ∈ R or s = ⋆ or t = ⋆ , 3. ∆ ǫ ( η L , η R ) ≤ δ . 13

New definition: ⋆ -liftings Generalize 2 -witness lifting by adding a new point Let R ⊆ S × T be a binary relation, and let A ⋆ = A ∪ { ⋆ } . Two distributions are related by µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if: There exists η L , η R ∈ Distr ( S ⋆ × T ⋆ ) such that 1. π 1 ( η L ) = µ 1 and π 2 ( η R ) = µ 2 , 2. η L ( s, t ) , η R ( s, t ) > 0 only when ( s, t ) ∈ R or s = ⋆ or t = ⋆ , 3. ∆ ǫ ( η L , η R ) ≤ δ . Intuition ◮ ⋆ is a default point for tracking “unimportant” mass 13

Why is ⋆ -lifting a good definition? Previously known (??) ⇒ One-witness Two-witness Universal 14

Why is ⋆ -lifting a good definition? Previously known (??) ⇒ One-witness Two-witness Universal ⋆ -liftings unify known approximate liftings ⇐ ⇒ ⇐ ⇒ One-witness ⋆ -lifting Universal 14

Approximate version of Strassen’s theorem ⋆ -liftings are equivalent to “universal” approximate liftings Theorem Let S, T be discrete (countable) sets, and let R ⊆ S × T be a relation. Then µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if and only if: for all sets A ⊆ S , µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ 15

Approximate version of Strassen’s theorem ⋆ -liftings are equivalent to “universal” approximate liftings Theorem Let S, T be discrete (countable) sets, and let R ⊆ S × T be a relation. Then µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if and only if: for all sets A ⊆ S , µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ Theorem (Strassen 1965) Let R ⊆ S × T be a relation. Then µ 1 � R � µ 2 if and only if: for all subsets A ⊆ S , µ 1 ( A ) ≤ µ 2 ( R ( A )) 15

Approximate version of Strassen’s theorem ⋆ -liftings are equivalent to “universal” approximate liftings Theorem Let S, T be discrete (countable) sets, and let R ⊆ S × T be a relation. Then µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if and only if: for all sets A ⊆ S , µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ Theorem (Strassen 1965) Let R ⊆ S × T be a relation. Then µ 1 � R � µ 2 if and only if: for all subsets A ⊆ S , µ 1 ( A ) ≤ µ 2 ( R ( A )) 15

Proof sketch (universal lifting implies ⋆ -lifting) Theorem Let S, T be discrete (countable) sets, and let R ⊆ S × T be a relation. Then µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if and only if: for all sets A ⊆ S , µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ 16

Proof sketch (universal lifting implies ⋆ -lifting) Theorem Let S, T be discrete (countable) sets, and let R ⊆ S × T be a relation. Then µ 1 � R ⋆ � ( ǫ,δ ) µ 2 if and only if: for all sets A ⊆ S , µ 1 ( A ) ≤ e ǫ · µ 2 ( R ( A )) + δ Define a flow network ◮ Nodes 16