Abstract:As a mathematically rigorous framework that has amassed a rich theoretical literature, differential privacy is considered by many experts to be the gold standard for privacy-preserving data analysis. Others argue that while differential privacy is a clean formulation in theory, it poses significant challenges in practice. Both perspectives are, in our view, valid and important. To bridge the gaps between differential privacy's promises and its real-world usability, researchers and practitioners must work together to advance policy and practice of this technology. In this paper, we outline pressing open questions towards building usable differential privacy and offer recommendations for the field, such as developing risk frameworks to align with user needs, tailoring communications for different stakeholders, modeling the impact of privacy-loss parameters, investing in effective user interfaces, and facilitating algorithmic and procedural audits of differential privacy systems.
What problem does this paper attempt to address?
The main problem that this paper attempts to solve is: **How to bridge the gap between the theoretical advantages of Differential Privacy (DP) and its usability in practical applications**. Specifically, the authors believe that although Differential Privacy is regarded as the "gold standard" in privacy - protected data release, it faces many challenges and confusions in actual deployment.
### Main problems of the paper
1. **Disconnection between theory and practice**:
- Differential Privacy has a strict mathematical definition and strong privacy - protection capabilities in theory. However, in practical applications, especially when involving different fields and stakeholders, there are controversies in aspects such as motivation, communication, design, and policy choices.
- For example, computer scientists have reached a consensus on the basic definition and assumptions of Differential Privacy. But when this framework is extended to other fields and interacts with various stakeholders, its practical use faces new doubts and negotiations.
2. **Differences in risk assessment and understanding of privacy threats**:
- Different communities have different understandings of the privacy risks of statistical information release. Differential Privacy focuses on relative privacy risks (i.e., the probability that an attacker guesses sensitive information with or without individual data), while some stakeholders are more concerned about absolute privacy risks (i.e., the probability that an attacker can guess sensitive information regardless of whether the individual is in the data set or not).
- Such differences in understanding lead to different views on effective privacy protection, especially when assessing privacy threats.
3. **Understanding of situational requirements**:
- Privacy is a broad and complex concept, which is meaningful only in its social, legal, technical, and political contexts. The definition of Differential Privacy ignores these social contexts. Although it helps to limit the specific discussion of privacy risks, its algorithmic formalization does not consider its sociotechnical environment.
- Therefore, more research is needed to make Differential Privacy pay more attention to the social and technical contexts and evaluate the comprehensive impact of privacy harm.
4. **Alignment of institutional incentives**:
- Institutions face perceived tensions, practical incompatibilities, and practical obstacles when deploying Differential Privacy. For example, privacy is usually regarded as opposed to data accuracy, innovation, and profitability. But in fact, privacy is the key to providing trust, thereby improving data accuracy, promoting innovation, and ensuring security.
- Research needs to explore how to position privacy as a value - adding thing, which can bring greater returns in the future even if it incurs initial costs.
5. **Integration with other privacy practices**:
- Although Differential Privacy is a powerful privacy - protection tool, it is only part of the privacy and security tool suite. When an organization considers using Differential Privacy, it should also ensure the combination of the best security practices, such as encrypted data storage, secure communication channels, and access control mechanisms.
- In addition, research on Differential Privacy primitives is also needed to provide broader protection or more favorable trade - offs, such as the choice between the central model and the local model.
### Summary
The goal of the paper is not only to outline the known challenges but also to attempt to define the unknown obstacles, so as to better regulate the use of Differential Privacy and incorporate its principles into laws and policies. By solving these problems, researchers and practitioners can work together to improve the usability and effectiveness of Differential Privacy in practical applications.