Deciding Differential Privacy for Programs with Finite Inputs and Outputs

Barthe, Gilles; Chadha, Rohit; Jagannath, Vishal; Sistla, A. Prasad; Viswanathan, Mahesh

doi:10.1145/3373718.3394796

Cited by 26 publications

(55 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This semantics, though not natural, can be shown to be equivalent to the Markov kernel semantics. The proof of equivalence is similar to the one given by Barthe et al [2020b]. We spend the rest of this section highlighting the main aspects of the DTMC semantics that help us underscore the ideas behind our decision procedure.…”

Section: Semanticsmentioning

confidence: 92%

“…There is a natural σ -algebra that can be defined on such states, and the semantics defines a Markov kernel over this algebra. Such a semantics for DiPWhile+ would be similar to the one for DiPWhile given by Barthe et al [2020b], and is skipped here. Throughout the paper, we shall also assume that DiPWhile+ programs terminate with probability 1 on all inputs.…”

Section: Semanticsmentioning

confidence: 99%

“…Proof Sketch. The formal construction of the parametrized DTMC [[P ϵ ]] is very similar the one outlined in Barthe et al [2020b] for (the restricted) DiPWhile programs. Here, we just sketch the main ideas.…”

Section: Semanticsmentioning

confidence: 99%

“…In the case of privacy, these guarantees relate executions of the differentially private algorithm on adjacent databases. These privacy guarantees are an instance of relational properties, and they have been extensively studied in the context of program verification [Albarghouthi and Hsu 2018;Barthe et al 2020aBarthe et al , 2013Gaboardi et al 2013;Reed and Pierce 2010;Zhang and Kifer 2017] and program testing [Bichsel et al 2018;Ding et al 2018]. In the case of accuracy, these guarantees relate the execution of the differentially private algorithm to that of an łidealž algorithm, which can be assumed to be deterministic.…”

Section: Introductionmentioning

confidence: 99%

“…Therefore, we focus on decidability for some specific class of programs. We follow the approach from Barthe et al [2020a], where the authors propose a decision procedure for (ϵ, δ )differential privacy of a non-trivial class of (parametric) programs, DiPWhile, with a finite number of inputs and output variables taking values in a finite domain. Specifically, we carve out a class of programs, called DiPWhile+, whose operational semantics have a clever encoding as a finite state discrete-time Markov chain.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Deciding accuracy of differential privacy schemes

Barthe

Chadha

Krogmeier

et al. 2021

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

Differential privacy is a mathematical framework for developing statistical computations with provable guarantees of privacy and accuracy. In contrast to the privacy component of differential privacy, which has a clear mathematical and intuitive meaning, the accuracy component of differential privacy does not have a generally accepted definition; accuracy claims of differential privacy algorithms vary from algorithm to algorithm and are not instantiations of a general definition. We identify program discontinuity as a common theme in existing ad hoc definitions and introduce an alternative notion of accuracy parametrized by, what we call, — the of an input x w.r.t. a deterministic computation f and a distance d , is the minimal distance d ( x , y ) over all y such that f ( y )≠ f ( x ). We show that our notion of accuracy subsumes the definition used in theoretical computer science, and captures known accuracy claims for differential privacy algorithms. In fact, our general notion of accuracy helps us prove better claims in some cases. Next, we study the decidability of accuracy. We first show that accuracy is in general undecidable. Then, we define a non-trivial class of probabilistic computations for which accuracy is decidable (unconditionally, or assuming Schanuel’s conjecture). We implement our decision procedure and experimentally evaluate the effectiveness of our approach for generating proofs or counterexamples of accuracy for common algorithms from the literature.

show abstract

Section: Semanticsmentioning

confidence: 92%

Section: Semanticsmentioning

confidence: 99%

Section: Semanticsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Deciding accuracy of differential privacy schemes

Barthe

Chadha

Krogmeier

et al. 2021

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

show abstract

Coupled Relational Symbolic Execution for Differential Privacy

Farina

Chong

Gaboardi

2021

Programming Languages and Systems

View full text Add to dashboard Cite

Differential privacy is a de facto standard in data privacy with applications in the private and public sectors. Most of the techniques that achieve differential privacy are based on a judicious use of randomness. However, reasoning about randomized programs is difficult and error prone. For this reason, several techniques have been recently proposed to support designer in proving programs differentially private or in finding violations to it.In this work we propose a technique based on symbolic execution for reasoning about differential privacy. Symbolic execution is a classic technique used for testing, counterexample generation and to prove absence of bugs. Here we use symbolic execution to support these tasks specifically for differential privacy. To achieve this goal, we design a relational symbolic execution technique which supports reasoning about probabilistic coupling, a formal notion that has been shown useful to structure proofs of differential privacy. We show how our technique can be used to both verify and find violations to differential privacy.

show abstract