Coupled Relational Symbolic Execution for Differential Privacy

Abstract

Differential privacy is a de facto standard in data privacy with applications in the private and public sectors. Most of the techniques that achieve differential privacy are based on a judicious use of randomness. However, reasoning about randomized programs is difficult and error prone. For this reason, several techniques have been recently proposed to support designer in proving programs differentially private or in finding violations to it.In this work we propose a technique based on symbolic execution for reasoning about differential privacy. Symbolic execution is a classic technique used for testing, counterexample generation and to prove absence of bugs. Here we use symbolic execution to support these tasks specifically for differential privacy. To achieve this goal, we design a relational symbolic execution technique which supports reasoning about probabilistic coupling, a formal notion that has been shown useful to structure proofs of differential privacy. We show how our technique can be used to both verify and find violations to differential privacy.

Symbolic Execution for Randomized Programs

“…There are also many domain-specific automated analyses for specific probabilistic properties, such as termination and resource analysis [Chatterjee et al 2016;Moosbrugger et al 2021;Wang et al 2021], accuracy Smith et al 2019], reliability [Carbin et al 2012], differential privacy [Albarghouthi and Hsu 2018b;Barthe et al 2021] and other relational properties [Albarghouthi and Hsu 2018a;Farina et al 2021], and long-run properties of probabilistic loops [Bartocci et al 2019[Bartocci et al , 2020. Our approach aims to create a general-purpose analysis.…”

Compositional Vulnerability Detection with Insecurity Separation Logic

“…We presented the first compositional, incremental method for detecting memory-safety and information leakage vulnerabilities, free of false alarms. Existing techniques for the automatic discovery of these types of vulnerabilities include relational symbolic execution [Daniel et al 2020[Daniel et al , 2021Farina et al 2019Farina et al , 2021 and differential fuzzing [Nilizadeh et al 2019], which generalise the traditional vulnerability discovery techniques of symbolic execution and fuzzing respectively to allow them to compare program executions. Recent work also explores hybrid approaches that combine these techniques [Noller et al 2020].…”

DPGen: Automated Program Synthesis for Differential Privacy

“…Recent work [4,26,47] targets both proving and disproving differential privacy. CheckDP [47] also relies on the Randomness Alignment technique.…”

“…However, these programs only allow a bounded number of samples from the Laplace distribution, and their inputs and outputs are from a finite domain. Farina [26] builds a relational symbolic execution framework, which when combined with probabilistic couplings, is able to prove differential privacy for SVT or generate failing traces for its two incorrect variants.…”

“…Counterexample detectors for differential privacy [12,13,20,29] can find evidence that an (incorrect) privacy mechanism fails to satisfy its claimed privacy levels. Moreover, a few tools can combine both functionalities: either proving a mechanism is correct or finding a counterexample [4,26,47]. While these tools are invaluable for ensuring correctness of privacy mechanisms, they all require a putative differentially private algorithm as a starting point.…”