[Paper Review] Local Private Hypothesis Testing: Chi-Square Tests

Marco Gaboardi, Ryan Rogers|arXiv (Cornell University)|Sep 21, 2017

Privacy-Preserving Technologies in Data2 references19 citations

TL;DR

This paper introduces locally differentially private chi-square goodness-of-fit and independence tests using three distinct privatization mechanisms: Laplace/Gaussian noise, the exponential mechanism, and bit flipping. It establishes that the test statistics converge to a chi-square distribution under the null hypothesis, enabling accurate Type I error control, with empirical results showing that performance varies by data dimension and privacy budget, favoring different mechanisms in different regimes.

ABSTRACT

The local model for differential privacy is emerging as the reference model for practical applications collecting and sharing sensitive information while satisfying strong privacy guarantees. In the local model, there is no trusted entity which is allowed to have each individual's raw data as is assumed in the traditional curator model for differential privacy. So, individuals' data are usually perturbed before sharing them. We explore the design of private hypothesis tests in the local model, where each data entry is perturbed to ensure the privacy of each participant. Specifically, we analyze locally private chi-square tests for goodness of fit and independence testing, which have been studied in the traditional, curator model for differential privacy.

Motivation & Objective

• To design private hypothesis tests for categorical data in the local differential privacy model, where no trusted curator exists and each user perturbs their own data.
• To ensure Type I error is bounded by a significance level α by constructing test statistics that converge to a chi-square distribution under the null hypothesis.
• To develop both goodness-of-fit and independence tests that maintain statistical validity while satisfying local differential privacy (LDP).
• To compare the power of different privatization mechanisms—noise injection, exponential mechanism, and bit flipping—across varying data dimensions and privacy parameters.
• To provide a framework for designing chi-square tests in the local model that can be used in real-world applications like browser and mobile data collection.

Proposed method

• Proposes LocalNoiseGOF, LocalExpGOF, and LocalBitFlipGOF for goodness-of-fit testing, each using a different local privacy mechanism: Laplace/Gaussian noise, exponential mechanism, and bit flipping, respectively.
• Constructs test statistics that asymptotically follow a chi-square distribution under the null hypothesis, enabling critical value selection via standard chi-square quantiles.
• For independence testing, extends the framework to contingency tables using analogous privatization mechanisms: LocalNoiseIND, LocalExpIND, and LocalBitFlipIND.
• Uses noncentral chi-square distributions to model the test statistics under alternative hypotheses, enabling power analysis.
• Employs privacy analysis to prove that each test satisfies ϵ-local differential privacy, ensuring individual-level privacy guarantees.
• Empirically evaluates test power across different data dimensions (r,c), privacy budgets (ϵ ∈ {1,2,4}), and perturbation mechanisms, using synthetic data with controlled dependence structures.

Experimental results

Research questions

• RQ1 Can locally private chi-square tests be designed such that their test statistics converge to a chi-square distribution under the null hypothesis, enabling valid Type I error control?
• RQ2 How do different local privacy mechanisms—Laplace noise, exponential mechanism, and bit flipping—affect the statistical power of private hypothesis tests?
• RQ3 What is the relationship between data dimensionality, privacy budget ϵ, and the optimal choice of privatization mechanism for maximizing test power?
• RQ4 Can the framework be extended from goodness-of-fit to independence testing in the local model while preserving statistical validity and privacy guarantees?
• RQ5 How does the noncentral parameter of the test statistic relate to the power of the test under alternative hypotheses?

Key findings

• The test statistics of LocalNoiseGOF, LocalExpGOF, and LocalBitFlipGOF converge to a chi-square distribution under the null hypothesis, enabling accurate critical value selection for Type I error control.
• LocalBitFlipGOF and LocalExpIND demonstrate superior power in higher-dimensional data, particularly when (r,c) = (10,4), due to better noise efficiency.
• For (r,c) = (2,2), LocalExpIND and LocalBitFlipIND show comparable power, with LocalBitFlipIND slightly outperforming in some privacy regimes.
• The power of each test is directly linked to the noncentral parameter of the test statistic under the alternative hypothesis, which depends on the data distribution and privacy mechanism.
• No single mechanism dominates across all settings: LocalExpGOF performs best in low-dimensional settings with moderate ϵ, while LocalBitFlipGOF excels in high-dimensional or high-privacy regimes.
• Empirical results confirm that the proposed tests maintain Type I error within the nominal level α, validating their statistical correctness under local differential privacy.