Privately Evaluating Untrusted Black-Box Functions

2025-03-25

AI Summary

To address secure sharing of sensitive data by data owners with untrusted parties under unknown analytical tasks, this paper proposes a novel differential privacy wrapper. The wrapper provides high-accuracy responses—or safely rejects—black-box function queries without prior knowledge of query semantics. Its key contributions are: (1) the first declarative and automated dual-paradigm sensitivity detection mechanism; (2) the first privacy wrapper achieving accuracy independent of both sensitivity bounds and domain size under declaratively specified sensitivity; and (3) near-optimal trade-offs among accuracy, locality, and query complexity. Theoretical analysis rigorously guarantees ε-differential privacy while significantly reducing query overhead. This work establishes an efficient, robust privacy-preserving paradigm for dynamic data sharing in untrusted environments.

Technology Category

• Machine Learning: Privacy
• Search and Optimization: Distributed Search
• Data Mining & Knowledge Management: Intelligent Query Processing

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

We provide tools for sharing sensitive data when the data curator doesn't know in advance what questions an (untrusted) analyst might ask about the data. The analyst can specify a program that they want the curator to run on the dataset. We model the program as a black-box function $f$. We study differentially private algorithms, called privacy wrappers, that, given black-box access to a real-valued function $f$ and a sensitive dataset $x$, output an accurate approximation to $f(x)$. The dataset $x$ is modeled as a finite subset of a possibly infinite set $U$, in which each entry represents data of one individual. A privacy wrapper calls $f$ on the dataset $x$ and on some subsets of $x$ and returns either an approximation to $f(x)$ or a nonresponse symbol $perp$. The wrapper may also use additional information (that is, parameters) provided by the analyst, but differential privacy is required for all values of these parameters. Correct setting of these parameters will ensure better accuracy of the wrapper. The bottleneck in the running time of our wrappers is the number of calls to $f$, which we refer to as queries. Our goal is to design wrappers with high accuracy and low query complexity. We introduce a novel setting, the automated sensitivity detection setting, where the analyst supplies the black-box function $f$ and the intended (finite) range of $f$. In the previously considered setting, the claimed sensitivity bound setting, the analyst supplies additional parameters that describe the sensitivity of $f$. We design privacy wrappers for both settings and show that our wrappers are nearly optimal in terms of accuracy, locality (i.e., the depth of the local neighborhood of the dataset $x$ they explore), and query complexity. In the claimed sensitivity bound setting, we provide the first accuracy guarantees that have no dependence on the size of the universe $U$.

Problem

• Privately evaluating untrusted black-box functions on sensitive data
• Designing differentially private wrappers for accurate function approximation
• Optimizing query complexity and accuracy in automated sensitivity detection

Innovation

• Differentially private wrappers for black-box functions
• Automated sensitivity detection for improved accuracy
• Near-optimal query complexity and locality guarantees