[Paper Review] Typicality-Based Stability and Privacy.

Raef Bassily, Yoav Freund|arXiv (Cornell University)|Apr 12, 2016

Privacy-Preserving Technologies in Data3 citations

TL;DR

This paper introduces typical stability, a new notion of algorithmic stability that replaces the bounded sensitivity requirement of differential privacy with a concentration condition: query outputs must be tightly concentrated around their expected value under the data distribution. It shows that this notion ensures small generalization error for subgaussian and subexponential queries, supports post-processing and adaptive composition, and enables noise-addition mechanisms with distribution-specific noise calibration.

ABSTRACT

In this paper, we introduce a new notion of algorithmic stability called typical stability. When our goal is to release real-valued queries (statistics) computed over a dataset, this notion does not require the queries to be of bounded sensitivity -- a condition that is generally assumed under a standard notion of algorithmic stability known as differential privacy [DMNS06, Dwo06]. Instead, typical stability requires the output of the query, when computed on a dataset drawn from the underlying distribution, to be well-concentrated around its expected value with respect to that distribution. Typical stability can also be motivated as an alternative definition for database privacy (in such case, we call it typical privacy). Like differential privacy, this notion enjoys several important properties including robustness to post-processing and adaptive composition. We also discuss the guarantees of typical stability on the generalization error for a broader class of queries than that of bounded-sensitivity queries. This class contains all queries whose output distributions have a light tail, e.g., subgaussian and subexponential queries. In particular, we show that if a typically stable interaction with a dataset yields a query from that class, then this query when evaluated on the same dataset will have small generalization error with high probability (i.e., it will not overfit to the dataset). We discuss the composition guarantees of typical stability and prove a composition theorem that gives a characterization of the degradation of the parameters of typical stability/privacy under $k$-fold adaptive composition. We also give simple noise-addition algorithms that achieve this notion. These algorithms are similar to their differentially private counterparts, however, the added noise is calibrated differently.

Motivation & Objective

• To address the limitation of differential privacy, which requires bounded sensitivity, by introducing a new stability notion that instead relies on concentration of query outputs around their mean.
• To define a new privacy framework—typical privacy—that is robust to post-processing and adaptive composition, similar to differential privacy.
• To demonstrate that typical stability provides generalization guarantees for a broader class of queries, including subgaussian and subexponential ones, beyond those with bounded sensitivity.
• To develop noise-addition mechanisms that achieve typical stability with noise calibrated to the query's tail behavior rather than sensitivity.

Proposed method

• Define typical stability as the condition that the output of a query on a dataset drawn from a distribution is tightly concentrated around its expected value under that distribution.
• Formalize typical privacy as a privacy notion based on the same concentration principle, ensuring robustness to post-processing and adaptive composition.
• Establish a composition theorem for k-fold adaptive composition under typical stability, characterizing the degradation of stability parameters over multiple queries.
• Propose noise-addition mechanisms where noise is calibrated to the subgaussian or subexponential norm of the query, rather than its sensitivity.
• Use concentration inequalities (e.g., subgaussian tail bounds) to derive probabilistic bounds on generalization error under typical stability.
• Prove that for queries with light-tailed output distributions, typical stability implies small generalization error with high probability.

Experimental results

Research questions

• RQ1 Can a stability notion be defined that does not require bounded sensitivity, yet still ensures privacy and generalization?
• RQ2 Does typical stability provide generalization guarantees for queries beyond those with bounded sensitivity, such as subgaussian or subexponential queries?
• RQ3 How does typical stability behave under adaptive composition, and can a composition theorem be established?
• RQ4 Can noise-addition mechanisms be designed to achieve typical stability with noise calibrated to the query’s tail behavior rather than sensitivity?
• RQ5 Is typical stability robust to post-processing, and how does it compare to differential privacy in this regard?

Key findings

• Typical stability ensures small generalization error with high probability for queries whose output distributions are light-tailed, such as subgaussian or subexponential queries.
• The paper establishes a composition theorem that characterizes the degradation of typical stability parameters under k-fold adaptive composition.
• Noise-addition mechanisms achieving typical stability are proposed, where the noise scale is determined by the query’s subgaussian or subexponential norm rather than its sensitivity.
• Typical stability is robust to post-processing, just like differential privacy, ensuring that any transformation of the output remains stable.
• The framework of typical privacy provides a viable alternative to differential privacy that relaxes the bounded-sensitivity requirement while maintaining key privacy and generalization properties.
• For queries with light-tailed output distributions, typical stability implies that the empirical performance is close to the true performance with high probability, thus preventing overfitting.