Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates the impact of differential privacy on an adversary's belief regarding an individual's inclusion in a dataset by deriving upper and lower bounds on the posterior-to-prior ratios of inclusion beliefs. The authors assume a worst-case scenario where the adversary has access to all but one participant's information, allowing them to establish bounds applicable to any adversary. Their findings reveal that the actual failure rate of the Gaussian mechanism is significantly lower than the theoretical upper limit, suggesting that practical inferential privacy guarantees may be much stronger than previously thought.
Adversaries may have far less insight into individual inclusion in datasets than theoretical models suggest, with practical privacy guarantees proving much stronger than expected.
Differential privacy has become the standard for generating privacy-protected data releases. However, differential privacy does not translate intuitively to disclosure risk. In particular, it remains unclear how much an adversary's belief about an individual's inclusion in a dataset can change after observing a protected release. To address this question, we derive upper and lower bounds on the posterior-to-prior ratios of inclusion beliefs under bounded probabilistic and approximate differential privacy. By assuming a worst-case adversary with all-but-one auxiliary information, i.e., knowledge of all except for one of the participants in a dataset, we obtain bounds that apply to any adversary. Because these bounds may fail with non-zero probability, we study the corresponding failure probability for the Gaussian mechanism. We derive a theoretical upper limit on this probability and compare it with Monte Carlo estimates across a wide range of parameter settings. The observed failure rate is several orders of magnitude smaller than its theoretical upper limit, indicating that the latter is highly conservative. These findings suggest that the inferential privacy guarantees provided by differentially private mechanisms may be substantially stronger in practice than what is implied by the theoretical upper limit.