Research map / Federated learning and privacy / Differential privacy
Prior-itizing Privacy: A Bayesian Approach to Setting the Privacy Budget in Differential Privacy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a framework that sets the differential privacy budget epsilon by translating an agency's acceptable Bayesian posterior-to-prior disclosure risk profile into a maximum epsilon, without using confidential data.
Problem
Choosing the privacy budget epsilon for differentially private releases is hard for agencies; they need a way to link epsilon to interpretable Bayesian disclosure risks for adversaries with given prior probabilities.
Approach
Agencies specify a risk profile r*(p,q) bounding the relative (posterior-to-prior) disclosure risk as a function of adversary prior probabilities of inclusion and disclosure; DP implies a bound on relative risk as a function of epsilon, which is inverted and minimized over (p,q) to yield a data-free epsilon.
Key results
- Under a constant relative risk bound r~, the recommended epsilon is log(r~)/2 (e.g., r~=3 gives about 0.55).
- For the Durham infant mortality example, the most aggressive profile (a~=0.5, r~=5) gives epsilon about 2.20 with RMSE about 0.53 to keep switch probability below 10% for a 0.25 deviation.
- Risk profiles allowing absolute risk a~ yield epsilon values much larger than the constant-ratio profile, e.g. about 1.09 to 2.10 vs about 0.55 in the survey example.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use a higher relative-risk tolerance, from r̃ = 1.5 to r̃ = 6, in the cancer count risk profile | Proposed risk-profile framework · Cancer count release example | epsilon recommendation: 0.51 -> 2.04 | Helped |
| Use a higher relative-risk tolerance, from r̃ = 1.5 to r̃ = 6, in the cancer count risk profile | Geometric mechanism · Cancer count release example | Prob. Exact: 25% -> 77% | Helped |
| Use a higher tolerated absolute disclosure risk, from ã = 0.025 to ã = 0.3 | Proposed risk-profile framework · Cancer survey example (p̃ = 0.05) | epsilon recommendation: 1.09 -> 2.10 | Helped |
| Use a higher tolerated absolute disclosure risk, from ã = 0.025 to ã = 0.3 | Geometric mechanism · Cancer survey example (p̃ = 0.05) | Noise Std. Dev.: 1.24 -> 0.56 | Helped |
| Use a risk profile that allows absolute disclosure risk for low prior probabilities, rather than a constant relative-risk profile | Proposed risk-profile framework · Cancer count release example | epsilon recommendation: ε ≈ 0.20 vs 0.51; ε ≈ 0.55 vs 1.30; ε ≈ 0.90 vs 2.04 | Helped |
| Allow ã > 0 in place of the corresponding constant risk profile | Proposed risk-profile framework · Durham infant mortality count | epsilon | Helped |
| Allow more absolute disclosure risk or relative disclosure risk in the Durham risk profile | Geometric mechanism · Durham infant mortality count | RMSE | Helped |
| Reduce the surveyed population proportion from p̃ = 0.05 to p̃ = 0.005, with ã = 0.025 and r̃ = 3 | Proposed risk-profile framework · Cancer survey example | epsilon recommendation: ε ≈ 1.09 -> ε ≈ 1.63 | Helped |
| Reduce the surveyed population proportion from p̃ = 0.005 to p̃ = 0.0005, with ã = 0.025 and r̃ = 3 | Proposed risk-profile framework · Cancer survey example | epsilon recommendation: ε ≈ 1.63 -> ε ≈ 3.94 | Helped |
Surprising findings
- Sampling uncertainty in a 5% survey lets much larger epsilon be recommended than the constant-ratio baseline, since adversaries have limited prior knowledge of inclusion.
Limitations
- Results require the assumption that the adversary uses the true mechanism and that beliefs about other individuals do not depend on inclusion of individual i.
- Where r*(p,q) exceeds 1/(pq) the bound on posterior risk is vacuous, so risk profiles must be designed carefully.
- Framework applies to one class of adversary attacks on one individual with exchangeable individuals; other attacks are not explicitly bounded.
Experimental setup
Datasets: Durham County NC 2020 infant mortality (public statistics)
Metrics: recommended epsilon relative disclosure risk bound RMSE of noisy count probability of switching target classification
Baselines: constant relative risk bound Lee and Clifton (2012) epsilon selection
Builds on: differential privacy geometric mechanism relative disclosure risk Lee and Clifton How Much is Enough
Closest papers by meaning
- Setting $\varepsilon$ is not the Issue in Differential Privacy (NeurIPS 2025 · similarity 0.91)
- Privacy Guarantees in Posterior Sampling under Contamination (NeurIPS 2026 · similarity 0.88)
- Bridging Central and Local Differential Privacy in Data Acquisition Mechanisms (NeurIPS 2022 · similarity 0.88)
- The Price of Differential Privacy under Continual Observation (ICML 2023 · similarity 0.87)
- On Inherent Privacy of Posterior Sampling: A Unified R\'enyi-Divergence Framework (NeurIPS 2026 · similarity 0.86)
- Mean Estimation in the Add-Remove Model of Differential Privacy (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.