[Paper Review] Elliptical Perturbations for Differential Privacy

Matthew Reimherr, Jordan Awan|arXiv (Cornell University)|May 23, 2019

Privacy-Preserving Technologies in Data41 references4 citations

TL;DR

This paper investigates elliptical distributions for differential privacy (DP) in finite and infinite-dimensional spaces. It shows that while elliptical perturbations can achieve $\epsilon$-DP in finite dimensions under specific conditions, no elliptical distribution can achieve $\epsilon$-DP in infinite-dimensional spaces—only $(\epsilon,\delta)$-DP is possible due to the equivalence of elliptical and Gaussian processes in such settings.

ABSTRACT

We study elliptical distributions in locally convex vector spaces, and determine conditions when they can or cannot be used to satisfy differential privacy (DP). A requisite condition for a sanitized statistical summary to satisfy DP is that the corresponding privacy mechanism must induce equivalent measures for all possible input databases. We show that elliptical distributions with the same dispersion operator, $C$, are equivalent if the difference of their means lies in the Cameron-Martin space of $C$. In the case of releasing finite-dimensional projections using elliptical perturbations, we show that the privacy parameter $\ep$ can be computed in terms of a one-dimensional maximization problem. We apply this result to consider multivariate Laplace, $t$, Gaussian, and $K$-norm noise. Surprisingly, we show that the multivariate Laplace noise does not achieve $\ep$-DP in any dimension greater than one. Finally, we show that when the dimension of the space is infinite, no elliptical distribution can be used to give $\ep$-DP; only $(ε,δ)$-DP is possible.

Motivation & Objective

• To determine under what conditions elliptical distributions can satisfy differential privacy in locally convex vector spaces.
• To analyze the equivalence of probability measures induced by elliptical perturbations for DP.
• To investigate whether elliptical noise can achieve pure $\epsilon$-DP in infinite-dimensional settings.
• To extend the Laplace mechanism to multivariate and functional data using elliptical distributions with customizable dependence and tail behavior.
• To establish conditions under which elliptical mechanisms achieve $(\epsilon,\delta)$-DP in infinite-dimensional function spaces.

Proposed method

• The paper studies elliptical distributions in locally convex vector spaces, focusing on their measure equivalence via the Cameron-Martin space.
• It derives conditions under which two elliptical distributions with the same dispersion operator $C$ are equivalent, based on whether the mean difference lies in the Cameron-Martin space of $C$.
• For finite-dimensional summaries, it reduces the privacy parameter $\epsilon$ to a one-dimensional maximization problem.
• It applies the framework to multivariate Laplace, $t$, Gaussian, and $K$-norm noise, showing that multivariate Laplace fails to achieve $\epsilon$-DP in dimensions >1.
• It proves that in infinite-dimensional spaces, any elliptical distribution is equivalent to a Gaussian mixture, and thus cannot achieve $\epsilon$-DP.
• It establishes a $(\epsilon,\delta)$-DP guarantee using a mixture of Gaussians, with $\delta$ derived from the moment generating function of the mixing variable $V$.

Experimental results

Research questions

• RQ1 Under what conditions are two elliptical distributions with the same dispersion operator equivalent in a locally convex space?
• RQ2 Can multivariate Laplace noise achieve $\epsilon$-DP in dimensions greater than one?
• RQ3 Is it possible to achieve $\epsilon$-DP using elliptical perturbations in infinite-dimensional function spaces?
• RQ4 How does the mixing structure of elliptical processes affect privacy guarantees in infinite dimensions?
• RQ5 Can elliptical mechanisms achieve better utility than Gaussian mechanisms while still satisfying $(\epsilon,\delta)$-DP in infinite-dimensional settings?

Key findings

• Elliptical distributions with the same dispersion operator $C$ are equivalent if the difference of their means lies in the Cameron-Martin space of $C$.
• In finite-dimensional settings, the privacy parameter $\epsilon$ can be computed via a one-dimensional maximization problem.
• The multivariate Laplace distribution fails to achieve $\epsilon$-DP in any dimension greater than one.
• In infinite-dimensional spaces, no elliptical distribution can achieve $\epsilon$-DP; only $(\epsilon,\delta)$-DP is possible.
• The mixing variable $V$ in an elliptical process can be recovered from the sanitized output $\widetilde{T}_D$, making the mechanism effectively a mixture of Gaussians.
• For $(\epsilon,\delta)$-DP, the mechanism achieves privacy with $\sigma^2 \geq \frac{2\log(2/\delta')}{\epsilon^2}\Delta^2$, where $\delta'$ is adjusted via the moment generating function of $V$.