Technical Summary: Persuasive Privacy

Problem Statement

The paper addresses the limitations of current data privacy standards, particularly Differential Privacy (DP), in several key areas. While DP has become the de facto standard, it faces conceptual challenges regarding the interpretation of its parameters, gaps between technical guarantees and legal/social notions of privacy, and the often vacuous nature of privacy loss budgets in real-world deployments. Crucially, existing DP frameworks struggle to provide non-vacuous guarantees for deterministic algorithms (e.g., invariant statistics like the US Decennial Census summaries), as these mechanisms inherently leak information about the input data without the addition of noise. Furthermore, semantic interpretations of DP are often constructed post-hoc, making them difficult to tailor to specific use cases or understand intuitively.

The authors propose a need for a framework that:

1. Generates privacy definitions that are "fit for purpose" yet rigorously justified.
2. Assesses existing privacy guarantees using a unified approach.
3. Evaluates the privacy of deterministic algorithms, a capability currently lacking in DP and most of its variants.

Methodology

The authors introduce Persuasive Privacy (PP), a novel framework grounded in Bayesian game theory. The framework models the data release process as a two-player Stackelberg game involving:

• Sender: The custodian of sensitive data $x \in \mathcal{X}$ who designs a mechanism $M$ to release information.
• Receiver: An adversary with uncertainty about $x$, represented by a prior distribution $Q$. The Receiver observes the output of $M$ and updates their belief to a posterior $Q_T$, then takes an action $d$ that affects the Sender's privacy.

Core Components

1. Privacy Functions and Scores: The Sender's privacy is quantified via a privacy function $\rho(d, x)$, representing the Sender's preference over the Receiver's decisions. This is equivalently framed using proper scoring rules $S(P, x)$, where the Receiver's decision is the distribution $P$ that minimizes expected loss. The "privacy score" measures how well the Receiver's belief predicts the true data.
2. Relative Privacy Loss: The framework focuses on the change in privacy caused by the release of data. The relative privacy score is defined as $\Delta(Q, T, x) = S(Q, x) - S(Q_T, x)$. A lower value indicates greater privacy retention.
3. Robustness Assumptions:
   • Transparency: The Sender shares the mechanism $M$ and the privacy class $C$ (generated by the definition) with the Receiver, but these definitions must not depend on the specific data $x$.
   • Bayesian Rationality: The Receiver acts as a Bayes-optimal agent, updating beliefs via Bayes' rule and choosing actions to minimize expected loss.
   • Worst-Case Assessment: The Sender assesses privacy robustly against the worst-case data-prior $Q$ within a specified class $\mathcal{Q}_x$ and the worst-case dataset $x$.
4. Definition of Persuasive Privacy: A mechanism $M$ is $(\mathcal{S}, \mathcal{Q}_x, \kappa, \delta)$-PP if, for all scoring rules in a set $\mathcal{S}$, all datasets $x$, and all priors $Q \in \mathcal{Q}_x$, the probability that the relative privacy loss exceeds a threshold $\kappa$ is at most $\delta$:
   $$\inf_{S \in \mathcal{S}} \inf_{x \in \mathcal{X}} \inf_{Q \in \mathcal{Q}_x} P_x [\Delta_S(Q, T, x) \le \kappa] \ge 1 - \delta$$

Key Contributions and Results

1. Theoretical Unification and Recovery of Existing Definitions

The framework successfully recovers established privacy definitions as special cases, providing them with a new game-theoretic semantics:

• Probabilistic Differential Privacy (PDP): The authors prove that a mechanism is $(\epsilon, \delta)$-PDP if and only if it is $(\mathcal{L}, \mathcal{H}, \epsilon, \delta)$-PP, where $\mathcal{L}$ is the negative log-probability score and $\mathcal{H}$ is a class of two-component discrete priors representing neighboring datasets. This interprets PDP as protecting against a worst-case where the Receiver has vanishingly small probability on the true data.
• Rényi Differential Privacy (RDP) and f-Divergence Privacy: By modifying the assessment condition from a tail probability (Assumption 4) to an expected value condition (Assumption 4*), the framework yields Persuasive Privacy in Expectation (PPE). This variant recovers RDP and f-divergence privacy, linking them directly to the expected change in privacy scores.

2. Post-Processing Properties

The paper distinguishes between two types of post-processing:

• Receiver Post-Processing: The framework satisfies this property, meaning the Receiver cannot gain additional information by post-processing the output. This aligns with the standard justification for DP's adversarial robustness.
• Sender Post-Processing: The framework does not satisfy the standard Sender Post-Processing inequality (where a private mechanism composed with a kernel remains private). The authors show this is a known limitation of PDP as well. However, they demonstrate that a Sender can trivially satisfy the guarantee by releasing the joint output of the original and transformed mechanisms, effectively controlling the privacy loss.

3. Privacy for Deterministic Mechanisms

A primary contribution is the ability to define non-vacuous privacy guarantees for deterministic mechanisms, which are typically excluded from DP. The paper provides two concrete examples:

• Private Empirical Average: Using the Marginal Dawid–Sebastiani Score (DSS) and restricting the class of Receiver priors (specifically bounding the distance between the prior mean and the true mean relative to variance), the authors establish a persuasive privacy guarantee for releasing the exact empirical average without noise.
• Private Cell Suppression: For mechanisms that suppress small counts in contingency tables, the framework establishes a guarantee using the log-probability score. The privacy parameter is determined by the Receiver's prior belief strength regarding small cell counts.

Significance and Claims

The paper claims that Persuasive Privacy offers a semantics-first approach to data privacy. Unlike DP, where semantic interpretations are often derived after the fact, PP constructs definitions from an agent-based game where assumptions (e.g., the Receiver's prior class, the loss function) are explicit and can be tested against real-world contexts.

The significance of this work lies in:

• Flexibility: It allows for the generation of purpose-driven privacy definitions tailored to specific data contexts (e.g., deterministic summaries) by selecting appropriate scoring rules and prior classes.
• Robustness: By explicitly modeling the Receiver as a Bayesian agent and assessing worst-case scenarios over priors and data, the framework provides rigorous, game-theoretic justifications for privacy guarantees.
• Bridging the Gap: It provides a formal connection between deterministic disclosure control methods (common in official statistics) and modern privacy theory, addressing a critical gap where current standards fail to protect invariant statistics.

The authors acknowledge that while the framework is flexible, care must be taken to ensure that the chosen scoring rules and prior classes are appropriate for the specific deployment context to avoid misusing the flexibility. They also note that determining the utility-optimal mechanisms within a given persuasive privacy class remains an open area for future research.