[论文解读] Typicality-Based Stability and Privacy.

Raef Bassily, Yoav Freund|arXiv (Cornell University)|Apr 12, 2016

Privacy-Preserving Technologies in Data被引用 3

一句话总结

本文引入了典型稳定性（typical stability），这是一种新的算法稳定性概念，它用输出的集中性条件取代了差分隐私中的有界敏感度要求：即查询输出必须在其数据分布下的期望值附近紧密集中。该文表明，这一概念可确保子高斯和子指数查询的小泛化误差，支持后处理与自适应组合，并能实现基于分布特性的噪声校准的噪声添加机制。

ABSTRACT

In this paper, we introduce a new notion of algorithmic stability called typical stability. When our goal is to release real-valued queries (statistics) computed over a dataset, this notion does not require the queries to be of bounded sensitivity -- a condition that is generally assumed under a standard notion of algorithmic stability known as differential privacy [DMNS06, Dwo06]. Instead, typical stability requires the output of the query, when computed on a dataset drawn from the underlying distribution, to be well-concentrated around its expected value with respect to that distribution. Typical stability can also be motivated as an alternative definition for database privacy (in such case, we call it typical privacy). Like differential privacy, this notion enjoys several important properties including robustness to post-processing and adaptive composition. We also discuss the guarantees of typical stability on the generalization error for a broader class of queries than that of bounded-sensitivity queries. This class contains all queries whose output distributions have a light tail, e.g., subgaussian and subexponential queries. In particular, we show that if a typically stable interaction with a dataset yields a query from that class, then this query when evaluated on the same dataset will have small generalization error with high probability (i.e., it will not overfit to the dataset). We discuss the composition guarantees of typical stability and prove a composition theorem that gives a characterization of the degradation of the parameters of typical stability/privacy under $k$-fold adaptive composition. We also give simple noise-addition algorithms that achieve this notion. These algorithms are similar to their differentially private counterparts, however, the added noise is calibrated differently.

研究动机与目标

• 为解决差分隐私中要求有界敏感度的局限性，提出一种新的稳定性概念，该概念不再依赖于有界敏感度，而是基于查询输出在其均值附近的集中性。
• 定义一种新的隐私框架——典型隐私（typical privacy），其对后处理和自适应组合具有鲁棒性，与差分隐私类似。
• 证明典型稳定性可为更广泛的查询类别（包括子高斯和子指数查询）提供泛化保证，而不仅限于有界敏感度的查询。
• 设计噪声添加机制，使典型稳定性得以实现，且噪声的校准基于查询的尾部行为，而非敏感度。

提出的方法

• 将典型稳定性定义为：当从某一分布中抽取数据集时，查询输出在该分布下的期望值附近紧密集中。
• 形式化典型隐私作为基于相同集中性原则的隐私概念，确保对后处理和自适应组合的鲁棒性。
• 建立在典型稳定性下k重自适应组合的组合定理，刻画稳定性参数在多次查询下的退化情况。
• 提出噪声添加机制，其中噪声的校准基于查询的子高斯或子指数范数，而非其敏感度。
• 利用集中不等式（如子高斯尾部界）推导在典型稳定性下泛化误差的概率界。
• 证明对于具有轻尾输出分布的查询，典型稳定性以高概率意味着小泛化误差。

实验结果

研究问题

• RQ1 能否定义一种稳定性概念，其不依赖于有界敏感度，但仍能保证隐私与泛化？
• RQ2 典型稳定性是否能为超出有界敏感度的查询（如子高斯或子指数查询）提供泛化保证？
• RQ3 典型稳定性在自适应组合下的行为如何？能否建立相应的组合定理？
• RQ4 能否设计出噪声添加机制，使典型稳定性得以实现，且噪声校准基于查询的尾部分布行为而非敏感度？
• RQ5 典型稳定性是否对后处理具有鲁棒性？与差分隐私相比表现如何？

主要发现

• 对于输出分布为轻尾（如子高斯或子指数）的查询，典型稳定性以高概率确保小泛化误差。
• 本文建立了组合定理，刻画了在k重自适应组合下典型稳定性参数的退化情况。
• 提出了实现典型稳定性的噪声添加机制，其中噪声尺度由查询的子高斯或子指数范数决定，而非其敏感度。
• 典型稳定性对后处理具有鲁棒性，与差分隐私类似，确保任何输出变换后仍保持稳定性。
• 典型隐私框架为差分隐私提供了一种可行的替代方案，放松了有界敏感度的要求，同时保持了关键的隐私与泛化特性。
• 对于具有轻尾输出分布的查询，典型稳定性意味着经验性能与真实性能在高概率下接近，从而有效防止过拟合。