Abstract
Differentially private (DP) mechanisms are difficult to interpret and calibrate because existing methods for mapping standard privacy parameters to concrete privacy risks -- re-identification, attribute inference, and data reconstruction -- are both overly pessimistic and inconsistent. In this work, we use the hypothesis-testing interpretation of DP ($f$-DP), and determine that bounds on attack success can take the same unified form across re-identification, attribute inference, and data reconstruction risks. Our unified bounds are (1) consistent across a multitude of attack settings, and (2) tunable, enabling practitioners to evaluate risk with respect to arbitrary (including worst-case) levels of baseline risk. Empirically, our results are tighter than prior methods using $\varepsilon$-DP, Rényi DP, and concentrated DP. As a result, calibrating noise using our bounds can reduce the required noise by 20% at the same risk level, which yields, e.g., more than 15pp accuracy increase in a text classification task. Overall, this unifying perspective provides a principled framework for interpreting and calibrating the degree of protection in DP against specific levels of re-identification, attribute inference, or data reconstruction risk.
Abstract (translated)
差分隐私（DP）机制难以解释和调整，因为现有的将标准隐私参数映射到具体隐私风险（如重新识别、属性推断和数据重建）的方法既过于悲观又不一致。在这项工作中，我们使用了差分隐私的假设检验解释（$f$-DP），并确定了攻击成功的界限在重新识别、属性推断和数据重建风险之间可以采用统一的形式。我们的统一界线具有以下特点：(1) 在多种攻击设置下保持一致性；(2) 可调，使从业者能够根据任意基准风险水平评估风险（包括最坏情况）。从实证角度看，与使用$\varepsilon$-DP、Rényi DP和集中化DP的方法相比，我们的结果更为精确。因此，在相同的风险级别下，利用这些界限校准噪声可以将所需的噪声减少20%，从而例如在文本分类任务中提高超过15个百分点的准确率。总体而言，这种统一的观点提供了一个原则性的框架来解释和调整差分隐私机制以抵御特定级别的重新识别、属性推断或数据重建风险的程度。
URL
https://arxiv.org/abs/2507.06969
