[Paper Review] Per-instance Differential Privacy and the Adaptivity of Posterior Sampling in Linear and Ridge regression.

Yuxiang Wang|arXiv (Cornell University)|Jul 24, 2017

Advanced Causal Inference Techniques3 citations

TL;DR

This paper introduces per-instance differential privacy (pDP), a fine-grained privacy notion that quantifies individual privacy based on a specific data set, showing it implies generalization when data is i.i.d. It analyzes the One-Posterior-Sample (OPS) estimator in linear and ridge regression, proving it achieves $(\epsilon,\delta)$-pDP under well-conditioned data and matches the theoretical lower bound up to a $1+\tilde{O}(n^{-1}\epsilon^{-2})$ factor, with simulations showing superior privacy-utility trade-offs for data-set individuals.

ABSTRACT

Differential privacy (DP), ever since its advent, has been a controversial object. On the one hand, it provides strong provable protection of individuals in a data set, on the other hand, it has been heavily criticized for being not practical, partially due to its complete independence to the actual data set it tries to protect. In this paper, we address this issue by a new and more fine-grained notion of differential privacy --- per instance differential privacy (pDP), which captures the privacy of a specific individual with respect to a fixed data set. We show that this is a strict generalization of the standard DP and inherits all its desirable properties, e.g., composition, invariance to side information and closedness to postprocessing, except that they all hold for every instance separately. When the data is drawn from a distribution, we show that per-instance DP implies generalization. Moreover, we provide explicit calculations of the per-instance DP for the output perturbation on a class of smooth learning problems. The result reveals an interesting and intuitive fact that an individual has stronger privacy if he/she has small leverage score with respect to the data set and if he/she can be predicted more accurately using the leave-one-out data set. Using the developed techniques, we provide a novel analysis of the One-Posterior-Sample (OPS) estimator and show that when the data set is well-conditioned it provides $(\epsilon,\delta)$-pDP for any target individuals and matches the exact lower bound up to a $1+ ilde{O}(n^{-1}\epsilon^{-2})$ multiplicative factor. We also propose AdaOPS which uses adaptive regularization to achieve the same results with $(\epsilon,\delta)$-DP. Simulation shows several orders-of-magnitude more favorable privacy and utility trade-off when we consider the privacy of only the users in the data set.

Motivation & Objective

• Address the criticism that standard differential privacy is overly conservative by introducing a data-dependent, instance-specific privacy notion.
• Develop a new privacy framework—per-instance differential privacy (pDP)—that quantifies individual privacy with respect to a fixed data set.
• Show that pDP implies generalization when data is i.i.d. and inherits core DP properties such as composition and postprocessing invariance, but applied per instance.
• Analyze the privacy guarantees of the One-Posterior-Sample (OPS) estimator in linear and ridge regression under pDP.
• Propose AdaOPS, an adaptive regularization method that achieves $(\epsilon,\delta)$-DP while matching the theoretical lower bound for pDP up to a small factor.

Proposed method

• Define per-instance differential privacy (pDP) as a strict generalization of standard DP, where privacy guarantees are computed per individual and fixed data set.
• Establish that pDP preserves key DP properties—composition, postprocessing invariance, and group privacy—individually for each data instance.
• Analyze output perturbation in smooth learning problems and derive explicit pDP bounds, revealing that privacy depends on leverage scores and leave-one-out prediction accuracy.
• Apply the pDP framework to the One-Posterior-Sample (OPS) estimator, proving it achieves $(\epsilon,\delta)$-pDP for any target individual when the data matrix is well-conditioned.
• Introduce AdaOPS, which uses adaptive regularization to achieve the same pDP guarantees as OPS while ensuring standard $(\epsilon,\delta)$-DP.
• Use explicit calculations of pDP for ridge regression to show that individuals with low leverage and high predictability from the leave-one-out model enjoy stronger privacy.

Experimental results

Research questions

• RQ1 Can a more fine-grained notion of differential privacy be defined that depends on the specific data set and individual, rather than being uniform across all inputs?
• RQ2 Does per-instance differential privacy imply generalization when data is i.i.d., and how does it relate to standard DP?
• RQ3 What is the privacy-utility trade-off of the One-Posterior-Sample (OPS) estimator under per-instance DP in linear and ridge regression?
• RQ4 Can the theoretical lower bound for pDP be matched by a practical estimator, and how close is the OPS estimator to this bound?
• RQ5 How does adaptive regularization in AdaOPS improve privacy-utility trade-offs compared to standard DP mechanisms?

Key findings

• Per-instance differential privacy (pDP) is a strict generalization of standard DP and inherits all its desirable properties—composition, postprocessing invariance, and group privacy—when applied individually to each data instance.
• When data is i.i.d., pDP implies generalization, linking individual privacy to statistical learning performance.
• The privacy of an individual under pDP is stronger when the individual has a low leverage score and can be more accurately predicted using the leave-one-out data set.
• The One-Posterior-Sample (OPS) estimator achieves $(\epsilon,\delta)$-pDP for any target individual in well-conditioned data, matching the theoretical lower bound up to a multiplicative factor of $1+\tilde{O}(n^{-1}\epsilon^{-2})$.
• AdaOPS, using adaptive regularization, achieves the same pDP guarantees as OPS while ensuring standard $(\epsilon,\delta)$-DP, and simulations show it offers several orders-of-magnitude better privacy-utility trade-offs for data-set individuals.
• Explicit pDP calculations for ridge regression reveal that privacy is not uniform across individuals and depends on data-specific properties such as leverage and prediction accuracy.