Abstract:Differential privacy is a de facto standard for statistical computations over databases that contain private data. The strength of differential privacy lies in a rigorous mathematical definition that guarantees individual privacy and yet allows for accurate statistical results. Thanks to its mathematical definition, differential privacy is also a natural target for formal analysis. A broad line of work uses logical methods for proving privacy. However, these methods are not complete, and only partially automated. A recent and complementary line of work uses statistical methods for finding privacy violations. However, the methods only provide statistical guarantees (but no proofs). We propose the first decision procedure for checking the differential privacy of a non-trivial class of probabilistic computations. Our procedure takes as input a program P parametrized by a privacy budget $\epsilon$, and either proves differential privacy for all possible values of $\epsilon$ or generates a counterexample. In addition, our procedure applies both to $\epsilon$-differential privacy and $(\epsilon,\delta)$-differential privacy. Technically, the decision procedure is based on a novel and judicious encoding of the semantics of programs in our class into a decidable fragment of the first-order theory of the reals with exponentiation. We implement our procedure and use it for (dis)proving privacy bounds for many well-known examples, including randomized response, histogram, report noisy max and sparse vector.

Privacy and Statistical Risk: Formalisms and Minimax Bounds

Local privacy and statistical minimax rates

Minimax optimal procedures for locally private estimation

Local privacy and minimax bounds: Sharp rates for probability estimation

The Cost of Privacy: Optimal Rates of Convergence for Parameter Estimation with Differential Privacy

On the Statistical Complexity of Estimation and Testing under Privacy Constraints

Privacy aware learning

Minimax Rates of Estimating Approximate Differential Privacy

The Right Complexity Measure in Locally Private Estimation: It is Not the Fisher Information.

High-probability minimax lower bounds

Privacy accounting $\varepsilon$conomics: Improving differential privacy composition via a posteriori bounds

A Statistical Viewpoint on Differential Privacy: Hypothesis Testing, Representation and Blackwell's Theorem

Statistical Inference in the Differential Privacy Model

Statistical Quantification of Differential Privacy: A Local Approach

Statistical Approximating Distributions under Differential Privacy.

Private measures, random walks, and synthetic data

A Statistical Framework for Differential Privacy

Quantifying Privacy: A Novel Entropy-Based Measure of Disclosure Risk

Deciding Differential Privacy for Programs with Finite Inputs and Outputs

Minimax Optimal Two-Sample Testing under Local Differential Privacy

Better and Simpler Lower Bounds for Differentially Private Statistical Estimation