🤖 AI Summary
This study addresses the challenge of setting the privacy budget ε in differential privacy, which often lacks intuitive grounding and complicates the trade-off between privacy protection and data utility. The authors propose an interpretable method for calibrating ε by imposing a strict upper bound on an adversary’s posterior odds of inferring sensitive information, directly translating this constraint into a corresponding ε value. Grounded in differential privacy theory, Bayesian inference, and posterior odds analysis, the approach is empirically validated using case-control study data. Results demonstrate that the framework effectively maps real-world privacy requirements to concrete ε values, achieving rigorous privacy guarantees while preserving analytical accuracy, thereby significantly enhancing the practicality and operational feasibility of ε selection.
📝 Abstract
Differential privacy is a mathematical definition of what it means to protect data subjects' privacy in data releases. Differential privacy depends on a parameter $ε$ known as the privacy budget. The value of $\varepsilon$ determines the nature of the privacy guarantee, with smaller values generally offering more privacy. However, reducing $\varepsilon$ also tends to decrease the accuracy of results protected with differentially private algorithms. Setting a value for $\varepsilon$ that satisfactorily balances this risk/accuracy trade off is complicated in practice, and there is not a standard approach to doing so. In part this is because practitioners may struggle to understand the privacy guarantee afforded by $\varepsilon$. We present an approach to interpreting and setting $\varepsilon$ in which (i) the practitioner establishes bounds on the posterior odds that adversaries can learn sensitive information, and (ii) the practitioner converts these bounds to values of $\varepsilon$. We illustrate the approach using data from a case control study.