Archive for Lipschitz continuity

Hands-On Differential Privacy [book review]

Posted in Books, R, Statistics, University life with tags , , , , , , , , , , , , , , , , , , , on October 2, 2024 by xi'an

Hands-On Differential Privacy was published just a few months ago (from September  2024!) by (the US publisher) O’Reilly, famous for its programming and technical books with animal covers! A slate pencil sea urchin in the present case. The book is indeed classical O’Reilly’s, with lots of notes, little theory (or maths!) and symbols, a loose structuring of the chapters (no section numbers) and highly detailed examples, and of course plenty of OpenDP code inserts. For instance, in the present case, a case study about the privatization of a sample average x̄ that takes about ten pages. Terrible equation rendering btw (what’s wrong with LATEX?!).  Overall, I am quickly lost in most of the chapters due to a lack of a driving narrative, facing instead a catalogue of possible scenari and procedures, appearing one after the other as in a fashion show.

Hands-On Differential Privacy is written by Ethan Cowan, Michael Shoemate, and Mayana Pereira. I came across the book during the OpenDP workshop at Harvard [that took place right after my return from the Pacific Northwest] and it is definitely linked with OpenDP, all authors being  actually involved at one stage or another in the OpenDP Team. The style of the book is once again in tune with the O’Reilly manuals, which sort of clashes with my preferences. For instance, the introduction of differential privacy (Chapter 2) is quite extensive. Chapter 3 proceeds to teach about private data transform(ation)s, stability (a rewording of Lipschitz-ianity), with code illustrations, often repeating the earlier derivation (see eg p203), while Chapter 4 is its equivalent for private mechanisms. (With the diagrams Figures 3-1 and 4-1 differing only in highlighting/bolding different functions in a privatized data processing pipeline.) Returning to differential privacy with a privacy loss parameter and to Laplace and exponential mechanisms, Chapter 5 proposes several notions of privacy, all closed under post-processing. This includes Wasserman and Zhou (2010) interpretation of privacy as hypothesis testing, except it is not exploited further than connecting type I and type II with (ε,δ) parameters. Chapter 6 concludes Part I about concepts with a series of (fearless) combinators, keeping stability and privacy. With an increasing proportion of coding excerpts which I [imho] did not find particularly helpful.

Nothing about statistical loss of information or efficiency, bias, &tc. until Chapter 8 (p199) and even then so little. Part II is about practice, with a first Chapter  7 on setting a privacy unit (e.g., a person-month) before ensuring their privacy is protected. And discussing unbounded contributions (not unbounded data!). While Chapter 8 very thinly covers statistical modelling, while remaining agnostic about the choice of statistical procedures (Bayes being solely and naïvely mentioned for classification, furthermore with data-based evaluation of the class “prior” probabilities, p211). At this stage, procedures are often only defined through spinets of code, like the private Theil-Sen estimator (pp204-205). The continuous case boils to a Normality assumption, with its pmf being defined (p212) as

\text{Pr}(x=\mu)=\frac{1}{\sqrt{2\pi\sigma}}e^{-(x-\mu)/2\sigma^2}

which contains at least three errors! Chapter 9 is the equivalent of Chapter 8 for machine learning, mostly centred on private gradient descent. And a Pytorch section (pp232-235). Completed by a light Chapter 10 on synthetic data, which does not seem to broach upon the issue of large dimension covariates, providing instead a list of GAN synthetizers.

Part III (Deploying differential privacy) is even more about practice, with Chapter 11 on privacy attacks, Chapter 12 on calibrating a privacy mechanism (co-written with Jayshree Sarathy), and good practice (like codebooks and data annotations), with the appearance of contextual integrity I discovered if not perfectly understood last year at the BIRS workshop in Kelowna. And Chapter 13 on planning a privacy project, with an 11 step checklist, most of which are quite vague [imho] and do include strategies to make the data owners confident their privacy is safe.

[Disclaimer about potential self-plagiarism: this post or an edited version will eventually appear in my Books Review section in CHANCE]

Leave a comment »

differential privacy for Bayesian inference

Posted in Books, pictures, Statistics, Travel, University life with tags , , , , , , , , , , , on July 30, 2024 by xi'an

As I was reading it in preparation for my JSM²⁴ lecture, I found anew that, in this landmark paper of Dimitrikakis et al. (2017), some limitations of the concept of differential privacy were most apparent:

– a requirement to bend both the model and the prior to fit differential privacy, like switching to Lipschitz constraints or using new (e.g., truncated) priors, which runs contrary to Bayesian principles, although the former can be seen as a form of randomization akin to ABC when the randomization itself is accounted for in the derivation of the “exact” posterior distribution (as in the paper of Berah, Favaro, and Rao (2023) on running MCMC for Bayesian non-parametric estimation on privatized (noisy) data I discussed a few days ago);

– a subtle switch of the randomness from the (privatization) procedure itself (as in Dwork (2006)) to the uncertainty about the parameter, not that it clashes per se with Bayesian principles (even though there is an unclear randomness statement in Theorem 9, when the prior itself seems to become random (?)). Which actually means that producing one realisation from the posterior is the (privatization) procedure, as I realised when discussing with Shenggang Hu in Warwick;

– a linear degradation of the privacy parameter ε when moving from one realisation of the posterior to a simulated sample, assuming iid realisations (I wonder whether or not releasing a dependent sample could involve the ESS instead of the number of MCMC iterations). The upper bound means that no privacy whatsoever is guaranteed for an infinite posterior sample, hence for delivering de facto the posterior (despite the paper producing an (ε,0) bound on the Kullback-Leibler measure of the difference between posteriors);

– an absence of prior knowledge or modelling on the data itself, unless the distance from the actual data to an hypothetical alternative, ρ(x,y), can be interpreted as minus a score function conditional on the actual data, eg the opposite of the log predictive

  • the occurrence of an “exponential prior” that is exp p/m ell (theta) with ell a Lipschitz constant for the associated likelihood

  • the assumption that the data user is not an adversary of the data keeper, in that their utility function is about the parameter (and publicly available)

Leave a comment »