Exponential mechanism (differential privacy)

Short description: Technique for designing differentially private algorithms

The exponential mechanism is a technique for designing differentially private algorithms. It was developed by Frank McSherry[1] and Kunal Talwar[2] in 2007. Their work was recognized as a co-winner of the 2009 PET Award for Outstanding Research in Privacy Enhancing Technologies.[3]

Most of the initial research in the field of differential privacy revolved around real-valued functions which have relatively low sensitivity to change in the data of a single individual and whose usefulness is not hampered by small additive perturbations. A natural question is what happens in the situation when one wants to preserve more general sets of properties. The exponential mechanism helps to extend the notion of differential privacy to address these issues. Moreover, it describes a class of mechanisms that includes all possible differentially private mechanisms.

## Contents

* 1 The exponential mechanism [4]
* 1.1 Algorithm
* 1.2 Accuracy
* 2 Example application of the exponential mechanism [5]
* 2.1 Release mechanism
* 3 The exponential mechanism in other domains
* 4 References
* 5 External links

## The exponential mechanism [4]

### Algorithm

In very generic terms, a privacy mechanism maps a set of n inputs from domain 𝒟 to a range ℛ. The map may be randomized, in which case each element of the domain 𝒟 corresponds to a probability distribution over the range ℛ. The privacy mechanism makes no assumption about the nature of 𝒟 and ℛ apart from a base measure μ on ℛ. Let us define a function q:𝒟n×ℛ->ℝ. Intuitively this function assigns a score to the pair (d,r), where d∈𝒟n and r∈ℛ. The score reflects the appeal of the pair (d,r), i.e. the higher the score, the more appealing the pair is. Given the input d∈𝒟n, the mechanism's objective is to return an r∈ℛ such that the function q(d,r) is approximately maximized. To achieve this, set up the mechanism ℰqε(d) as follows:
Definition: For any function q:(𝒟n×ℛ)->ℝ, and a base measure μ over ℛ, define:

ℰqε(d):= Choose r with probability proportional to eεq(d,r)×μ(r), where d∈𝒟n,r∈ℛ.

This definition implies the fact that the probability of returning an r increases exponentially with the increase in the value of q(d,r). Ignoring the base measure μ then the value r which maximizes q(d,r) has the highest probability. Moreover, this mechanism is differentially private. Proof of this claim will follow. One technicality that should be kept in mind is that in order to properly define ℰqε(d) the ∫reεq(d,r)×μ(r) should be finite.

Theorem (differential privacy): ℰqε(d) gives (2εΔq)-differential privacy.

Proof: The probability density of ℰqε(d) at r equals

eεq(d,r)μ(r)∫eεq(d,r)μ(r)dr.

Now, if a single change in d changes q by at most Δq then the numerator can change at most by a factor of eεΔq and the denominator minimum by a factor of e−εΔq. Thus, the ratio of the new probability density (i.e. with new d) and the earlier one is at most exp⁡(2εΔq).

### Accuracy

We would ideally want the random draws of r from the mechanism ℰqε(d) to nearly maximize q(d,r). If we consider maxrq(d,r) to be OPT then we can show that the probability of the mechanism deviating from OPT is low, as long as there is a sufficient mass (in terms of μ) of values r with value q close to the optimum.

Lemma: Let St={r:q(d,r)>OPT−t} and S¯2t={r:q(d,r)≤OPT−2t}, we have p(S¯2t) is at most exp⁡(−εt)/μ(St). The probability is taken over ℛ.

Proof: The probability p(S¯2t) is at most p(S¯2t)/p(St), as the denominator can be at most one. Since both the probabilities have the same normalizing term so,

p(S¯2t)p(St)=∫S¯2texp⁡(εq(d,r))μ(r)dr∫Stexp⁡(εq(d,r))μ(r)dr≤exp⁡(−εt)μ(S¯2t)μ(St).

The value of μ(S¯2t) is at most one, and so this bound implies the lemma statement.

Theorem (Accuracy): For those values of t≥ln⁡(OPTtμ(St))/ε, we have E[q(d,ℰqε(d))]≥OPT−3t.

Proof: It follows from the previous lemma that the probability of the score being at least OPT−2t is 1−exp⁡(−εt)/μ(St). By hypothesis, t≥ln⁡(OPTtμ(St))/ε. Substituting the value of t we get this probability to be at least 1−t/OPT. Multiplying with OPT−2t yields the desired bound.

We can assume μ(A) for A⊆ℛ to be less than or equal to one in all the computations, because we can always normalize with μ(ℛ) .

## Example application of the exponential mechanism [5]

Before we get into the details of the example let us define some terms which we will be using extensively throughout our discussion.

Definition (global sensitivity): The global sensitivity of a query Q is its maximum difference when evaluated on two neighbouring datasets D1,D2∈𝒟n:

GSQ=maxD1,D2:d(D1,D2)=1|(Q(D1)−Q(D2))|.

Definition: A predicate query Qφ for any predicate φ is defined to be

Qφ=|{x∈D:φ(x)}||D|.

Note that GSQφ≤1/n for any predicate φ.

### Release mechanism

The following is due to Avrim Blum, Katrina Ligett and Aaron Roth.

Definition (Usefulness): A mechanism[yes|permanent dead link|dead link}}] 𝒜 is (α,δ)-useful for queries in class H with probability 1−δ, if ∀h∈H and every dataset D, for D^=𝒜(D), |Qh(D^)−Qh(D)|≤α.

Informally, it means that with high probability the query Qh will behave in a similar way on the original dataset D and on the synthetic dataset D^.
Consider a common problem in Data Mining. Assume there is a database D with n entries. Each entry consist of k-tuples of the form (x1,x2,…,xk) where xi∈{0,1}. Now, a user wants to learn a linear halfspace of the form π1x1+π2x2+⋯+πk−1xk−1≥xk. In essence the user wants to figure out the values of π1,π2,…,πk−1 such that maximum number of tuples in the database satisfy the inequality. The algorithm we describe below can generate a synthetic database D^ which will allow the user to learn (approximately) the same linear half-space while querying on this synthetic database. The motivation for such an algorithm being that the new database will be generated in a differentially private manner and thus assure privacy to the individual records in the database D.

In this section we show that it is possible to release a dataset which is useful for concepts from a polynomial VC-Dimension class and at the same time adhere to ε-differential privacy as long as the size of the original dataset is at least polynomial on the VC-Dimension of the concept class. To state formally:

Theorem: For any class of functions H and any dataset D⊂{0,1}k such that

|D|≥O(k⋅VCDim⁡(H)log⁡(1/α)α3ε+log⁡(1/δ)αε)

we can output an (α,δ)-useful dataset D^ that preserves ε-differential privacy. As we had mentioned earlier the algorithm need not be efficient.

One interesting fact is that the algorithm which we are going to develop generates a synthetic dataset whose size is independent of the original dataset; in fact, it only depends on the VC-dimension of the concept class and the parameter α. The algorithm outputs a dataset of size O~(VCDim⁡(H)/α2)

We borrow the Uniform Convergence Theorem from combinatorics and state a corollary of it which aligns to our need.

Lemma: Given any dataset D there exists a dataset D^ of size =O(VCDim⁡(H)log⁡(1/α))/α2 such that maxh∈H|Qh(D)−Qh(D^)|≤α/2.

Proof:

We know from the uniform convergence theorem that

Pr⁡[|Qh(D)−Qh(D^)|≥α2 for some h∈H]≤2(emVCDim⁡(H))VCDim⁡(H)⋅e−α2m/8,

where probability is over the distribution of the dataset. Thus, if the RHS is less than one then we know for sure that the data set D^ exists. To bound the RHS to less than one we need m≥λ(VCDim⁡(H)log⁡(m/VCDim⁡(H))/α2), where λ is some positive constant. Since we stated earlier that we will output a dataset of size O~(VCDim⁡(H)/α2), so using this bound on m we get m≥λ(VCDim⁡(H)log⁡(1/α)/α2). Hence the lemma.

Now we invoke the exponential mechanism.

Definition: For any function q:(({0,1}k)n×({0,1}k)m)->ℝ and input dataset D, the exponential mechanism outputs each dataset D^ with probability proportional to eq(D,D^)εn/2.

From the exponential mechanism we know this preserves (εnGSq)-differential privacy. Let's get back to the proof of the Theorem.

We define (q(D),q(D^))=−maxh∈H|Qh(D)−Qh(D^)|.

To show that the mechanism satisfies the (α,δ)-usefulness, we should show that it outputs some dataset D^ with q(D,D^)≥−α with probability 1−δ. There are at most 2km output datasets and the probability that q(D,D^)≤−α is at most proportional to e−εαn/2. Thus by union bound, the probability of outputting any such dataset D^ is at most proportional to 2kme−εαn/2. Again, we know that there exists some dataset D^∈({0,1}k)m for which q(D,D^)≥−α/2. Therefore, such a dataset is output with probability at least proportional to e−αεn/4.

Let A:= the event that the exponential mechanism outputs some dataset D^ such that q(D,D^)≥−α/2.

B:= the event that the exponential mechanism outputs some dataset D^ such that q(D,D^)≤−α.

∴Pr⁡[A]Pr⁡[B]≥e−αεn/42kme−αεn/2=eαεn/42km.

Now setting this quantity to be at least 1/δ≥(1−δ)/δ, we find that it suffices to have

n≥4εα(km+ln⁡1δ)≥O(d⋅VCDim⁡(H)log⁡(1/α)α3ε+log⁡(1/δ)αε).

And hence we prove the theorem.

## The exponential mechanism in other domains

In the above example of the usage of exponential mechanism, one can output a synthetic dataset in a differentially private manner and can use the dataset to answer queries with good accuracy. Other private mechanisms, such as posterior sampling,[6] which returns parameters rather than datasets, can be made equivalent to the exponential one.[7]

Apart from the setting of privacy, the exponential mechanism has also been studied in the context of auction theory and classification algorithms.[8] In the case of auctions the exponential mechanism helps to achieve a truthful auction setting.

## References

1. ↑ Frank McSherry
2. ↑ Kunal Talwar
3. ↑ "Past Winners of the PET Award". https://www.petsymposium.org/award/winners.php.
4. ↑ F.McSherry and K.Talwar. Mechanism Design via Differential Privacy. Proceedings of the 48th Annual Symposium of Foundations of Computer Science, 2007.
5. ↑ Avrim Blum,Katrina Ligett,Aaron Roth. A Learning Theory Approach to Non-Iteractive Database Privacy.In Proceedings of the 40th annual ACM symposium on Theory of computing, 2008
6. ↑ Christos Dimitrakakis, Blaine Nelson, Aikaterini Mitrokotsa, Benjamin Rubinstein. Robust and Private Bayesian Inference. Algorithmic Learning Theory 2014
7. ↑ Yu-Xiang Wang, Stephen E. Fienberg, Alex Smola Privacy for Free: Posterior Sampling and Stochastic Gradient Monte Carlo. International Conference on Machine Learning, 2015.
8. ↑ Shiva Prasad Kasiviswanathan, Homin K. Lee, Kobbi Nissim, Sofya Raskhodnikova, Adam Smith. What Can We Learn Privately? Proceedings of the 2008 49th Annual IEEE Symposium on Foundations of Computer Science. arXiv:0803.0924

## External links

* The Algorithmic Foundations of Differential Privacy by Cynthia Dwork and Aaron Roth, 2014.

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Exponential_mechanism_(differential_privacy)&oldid=269482"