Differentially Private Mechanisms for Count Queries^∗111^∗This is a working paper. Comments to improve this work are welcome.

Conducting nationwide censuses is one of the most important tasks of national or federal agencies around the world. For example, the 2020 Census in the US is currently under way, which is conducted by the US Bureau of the Census every ten years [1]. In Australia, census is conducted by the Australian Bureau of Statistics (ABS) every five years and the next round is due in 2021 [2]. Responding to count queries about census outcomes is one of the most important tasks of such agencies. This can be important for distributing national funds, determining optimal voting districts and conducting various scientific or economic studies of the population. However, this might lead to dire privacy compromises.

In order to protect the privacy of individuals in the census records, the true census results are heavily guarded. Instead, noisy versions may be released to the public in a one-off general-purpose publication or privately disclosed to a data analyst in response to specific queries. There is clearly a tension between releasing an accurate and reliable version of the census outcome and protecting the privacy of individuals in a population. This tension gets aggravated particularly for underrespresented groups in small towns and counties. Oftentimes, their livelihoods and future funding depends on them being accurately accounted for in published census results. At the same, due to being very small in size, they are at the greatest risk of being re-identified even if perturbed versions of their data is published. For an interesting coverage of this issue in the 2010 and 2020 US Census rounds, the reader is referred to a recent article published in the New York Times [3].

Motivated by these applications, in this paper we are interested in formulating and studying optimal tradeoffs between utility and privacy when a data analyst sends a query to a data curator about the number of individuals with a common sensitive attribute in a large dataset. Assuming $n$ is the true count, the data curator releases a random variable $Y=n+Z$, where $Z$ is an integer-valued noise variable with a suitably-chosen probability distribution.

It is not surprising that the celebrated differential privacy (DP) framework [4] has been applied to integer-valued mechanisms for count queries. In fact, DP is a strong candidate for publishing private 2020 US Census outcomes [5]. Other countries such as Australia and New Zealand are closely watching this space and have already taken steps in evaluating the performance of their existing mechanisms “from the lens of differential privacy” [6].

A standard approach to preserving ${\varepsilon}$-DP is to perturb the count query by adding random noise $Z$ with Laplacian distribution whose variance is proportional to a certain property of the query (i.e., sensitivity). Adding continuous noise to an integer-valued query makes the output less interpretable. Geometric distribution, as the discrete counterpart of Laplace distribution, was shown in [7] to be ”optimal” for integer-valued queries with unit sensitivity. The optimality was defined in terms of minimizing the expected cost function (chosen from a family of utility functions with some mild regularity conditions) under a Bayesian framework. Their result, in particular, implies that adding (truncated or folded) geometric noise to the above-mentioned counting query preserves DP while minimizing the probability of error, $\Pr(Z\neq 0)$. This setting was extended to the mini-max setting in [8] and to queries with general sensitivity and under the worst case setting in [9]. The design and implementation of geometric distribution on finite-precision machines were investigated in [10].

More recently, the problem of minimizing the $L_{p}$-norm of error of the query output, subject to ${\varepsilon}$-DP, was revisited in [11]. It was argued that despite minimizing the probability of error, the geometric mechanism suffers from a number of limitations. Most importantly, the error $p(Y\neq n)$ depends on the true count $n$, leading to uneven accuracy for different queries. In the very high-privacy regime when ${\varepsilon}\to 0$, this unevenness in the distribution results in overwhelmingly reporting two extreme values $Y=0$ or $Y=\max~{}n$ (zero count or maximum possible count in the database). To address this issue, they proposed an explicit fair mechanism (EM). However, the noise in the EM method adds bias, that is, $\mathbb{E}[Y|n]\neq n$. Moreover, EM (and also truncated geometric) mechanism does not restrict the support size of the noise. As such, the output can be any number between the two extremes $y=0$ and $y=\max n$ with non-zero probability.

In a different, and quite recent, line of work, a discrete version of the Gaussian density was considered for designing privacy-preserving mechanism for count queries. In particular, it was shown in [12] that adding “discrete” Gaussian noise provides similar privacy and utility guarantees to those obtained by the well-understood Gaussian mechanism. Discrete Gaussian noise is supported over $\mathbb{Z}$ and thus the output of such mechanism can be all integers regardless of the domain of the query. This might lead to unpleasant outcomes in some practical scenarios. For example, according to the New York Times article [3], the population of a county in the 2010 US Census was over-reported by a factor of almost 8 (the true count was around 90, but was reported to be around 920). While post-processing (truncating or folding the probability mass function) can be used to limit the range of discrete Gaussian mechanisms, the question remains whether one can explicitly incorporate a finite support of the noise into the mechanism design process.

In this paper, we adopt a different approach than [11, 12]. We begin by enforcing three basic desired constraints on the noise distribution. These properties include zero bias, fixed hard support, and fixed error probability irrespective of the true count $n$. By varying the probability of error we can trade off accuracy with privacy. The hard support for $Z$ ensures that for any given $n$, the output $n+Z$ takes value in a pre-specified range with probability one; in particular $Y$ is required to be always non-negative. We first design a noise distribution satisfying above constraints and then use it to construct a differentially-private mechanism (under a mild condition on the dataset). The constraint on the noise support has two implications. First, the values of the noise added must depend on the true count $n$ (to ensure the non-negativity of the output). Second, the mechanism provides a slightly relaxed privacy guarantee: it is ${\varepsilon}$-DP with probability $1-\delta$ for some parameter $\delta>0$. This framework is known as approximate DP and usually denoted by $({\varepsilon},\delta)$-DP [13, 14]. While the proposed noise has similar distribution as discrete Gaussian (with slightly heavier tail), our numerical findings indicate that the privacy performance of our mechanism (in terms of ${\varepsilon}$ and $\delta$) is tighter than what would be obtained via discrete Gaussian mechanism with the same variance.

We can summarize our observations about the interplay of privacy and utility parameters as follows. As expected, a lower privacy requirement, i.e., higher ${\varepsilon}$, results in lower $\delta$ when the noise support size and probability of releasing an erroneous value are fixed. By moderately increasing the noise support size while keeping ${\varepsilon}$ and error probability fixed, we can also significantly improve $\delta$. For example, increasing the noise support from $2D+1=9$ to $2D^{\prime}+1=13$ we obtain significantly smaller $\delta$. It turns out that when ${\varepsilon}$ and the noise support size are fixed, reducing the error probability (and hence improving data reliability) can be tolerated up a certain threshold without significantly affecting $\delta$. However, further reducing the error probability below such a threshold can have severe effects on the privacy performance through increasing $\delta$ beyond typically acceptable levels.

Notation: For an integer $N\in\mathbb{N}$, we use $[N]$ to denote the set $\{1,2,\cdots,N\}$. For $a,b\in\mathbb{Z}$ and $a\leq b$, we use $[a:b]$ to denote the set $\{a,a+1,\cdots,b\}$.

Suppose a dataset of size at most $N$ is given. A query on the number of entries in the database that possess a certain sensitive attribute is received by the data curator. Assume $n\in[N]$ is the actual (positive) count of such attribute. To protect the privacy of individuals in the dataset, the data curator releases a noisy version of $n$ as

where $Z$ is an integer-valued noise variable. We assume the noise distribution $p_{Z}(\cdot|n)$ satisfies the following intuitive properties:

1. P1.

   Fix $D\in\mathbb{N}$. Noise variable $Z$ takes values in $[-A:D]$, where $A\doteq\min\{n,D\}$, i.e., $p_{Z}(z|n)=0$ if $z\notin[-A:D]$. This properties ensures that the mechanism’s output is always non-negative. A smaller $D$ implies a smaller noise support set, which in turn implies a larger accuracy in reporting the query.²²2Note that the support of the output for a given $n$ is limited to $[n-A:n+D]$. For $\max\{1,N-D+1\}\leq n\leq N$, we allow the output to be greater than the maximum possible real count $N$ (by at most $D$). If $N\gg D$, this overshoot is negligible.

2. P2.

   Fix $\eta\in(0,1)$. The probability of releasing the correct value is set to

   $$p_{Y}(Y=n)=\eta,$$

   irrespective of the true count $n$. Equivalently, the probability of releasing an erroneous value is

   $$p_{Y}(Y\neq n)=1-\eta\doteq\bar{\eta}.$$

   A larger $\eta$ means more reliability in releasing the correct value. Conversely, a smaller $\eta$ means better privacy in the sense of concealing the true count of the sensitive attribute in the dataset.

3. P3.

   In addition, the error must have zero bias. That is, $\mathbb{E}[Z|n]=0$, which is a statistically desirable property.³³3Note that if $n=0$, maintaining zero bias is not possible jointly with $\eta<1$ and P1. Hence, we limit ourselves to queries with $n\geq 1$.

The following proposition provides a simple family of noise distribution that satisfy these properties.

In light of this proposition, we can obtain that any convex combination of $p^{(i_{1},i_{2})}_{Z}(z|n)$, i.e.,

with non-negative coefficients $\alpha_{i_{1},i_{2},n}$ satisfying $\sum_{i_{1}=-A}^{-1}\sum_{i_{2}=1}^{D}\alpha_{i_{1},i_{2},n}=1$, also meets P1-P3. We can thus use this convex combination to obtain a general data-dependent noise distribution satisfying P1-P3. The following example makes this construction clear.

In this section, we show that if the true count satisfies $n\geq D$, then $\delta^{*}$ can be readily derived.

Notice that the assumption $n\geq D$ enables us to design a noise distribution that satisfies P1-P3 while being independent of the query (i.e., $n$). The simple mechanism given in Proposition 3 can be represented by the matrix

where for exposition we have assumed $N=2D$. Each column of this matrix represents $p_{Y}(y|n)$ for $y\in[0:3D]$.