Abstract:Concern about how to aggregate sensitive user data without compromising individual privacy is a major barrier to greater availability of data. The model of differential privacy has emerged as an accepted model to release sensitive information while giving a statistical guarantee for privacy. Many different algorithms are possible to address different target functions. We focus on the core problem of count queries, and seek to design mechanisms to release data associated with a group of n individuals. Prior work has focused on designing mechanisms by raw optimization of a loss function, without regard to the consequences on the results. This can leads to mechanisms with undesirable properties, such as never reporting some outputs (gaps), and overreporting others (spikes). We tame these pathological behaviors by introducing a set of desirable properties that mechanisms can obey. Any combination of these can be satisfied by solving a linear program (LP) which minimizes a cost function, with constraints enforcing the properties. We focus on a particular cost function, and provide explicit constructions that are optimal for certain combinations of properties, and show a closed form for their cost. In the end, there are only a handful of distinct optimal mechanisms to choose between: one is the well-known (truncated) geometric mechanism; the second a novel mechanism that we introduce here, and the remainder are found as the solution to particular LPs. These all avoid the bad behaviors we identify. We demonstrate in a set of experiments on real and synthetic data which is preferable in practice, for different combinations of data distributions, constraints, and privacy parameters.

Noisy Measurements Are Important, the Design of Census Products Is Much More Important

Making Differential Privacy Work for Census Data Users

The 2020 United States Decennial Census Is More Private Than You (Might) Think

Evaluating bias and noise induced by the U.S. Census Bureau's privacy protection methods

Differential Privacy in the 2020 Decennial Census and the Implications for Available Data Products

An In-Depth Examination of Requirements for Disclosure Risk Assessment

Escalation of Commitment: A Case Study of the United States Census Bureau Efforts to Implement Differential Privacy for the 2020 Decennial Census

Comment: The Essential Role of Policy Evaluation for the 2020 Census Disclosure Avoidance System

Differential Privacy Protections in 2020 U.S. Decennial Census Data Do Not Impede Measurement of Racial and Ethnic Disparities

Information Design for Differential Privacy

Confidentiality Protection in the 2020 US Census of Population and Housing

Census TopDown: The Impacts of Differential Privacy on Redistricting

Understanding and Mitigating the Impacts of Differentially Private Census Data on State Level Redistricting

When Privacy Protection Goes Wrong: How and Why the 2020 Census Confidentiality Program Failed

Quantifying Privacy Risks of Public Statistics to Residents of Subsidized Housing

The Complexities of Differential Privacy for Survey Data

Differential Privacy for Government Agencies -- Are We There Yet?

Balancing data privacy and usability in the federal statistical system

Constrained Differential Privacy for Count Data

Impacts of Differential Privacy on Fostering more Racially and Ethnically Diverse Elementary Schools

An Examination of the Alleged Privacy Threats of Confidence-Ranked Reconstruction of Census Microdata