Fuzzi: a three-level logic for differential privacy

Abstract

Curators of sensitive datasets sometimes need to know whether queries against the data are differentially private [Dwork et al. 2006]. Two sorts of logics have been proposed for checking this property: (1) type systems and other static analyses, which fully automate straightforward reasoning with concepts like "program sensitivity" and "privacy loss, " and (2) full-blown program logics such as apRHL (an approximate, probabilistic, relational Hoare logic) [Barthe et al. 2016], which support more flexible reasoning about subtle privacypreserving algorithmic techniques but offer only minimal automation.We propose a three-level logic for differential privacy in an imperative setting and present a prototype implementation called Fuzzi. Fuzzi's lowest level is a general-purpose logic; its middle level is apRHL; and its top level is a novel sensitivity logic adapted from the linear-logic-inspired type system of Fuzz, a differentially private functional language [Reed and Pierce 2010]. The key novelty is a high degree of integration between the sensitivity logic and the two lower-level logics: the judgments and proofs of the sensitivity logic can be easily translated into apRHL; conversely, privacy properties of key algorithmic building blocks can be proved manually in apRHL and the base logic, then packaged up as typing rules that can be applied by a checker for the sensitivity logic to automatically construct privacy proofs for composite programs of arbitrary size.We demonstrate Fuzzi's utility by implementing four different private machine-learning algorithms and showing that Fuzzi's checker is able to derive tight sensitivity bounds.

A language for probabilistically oblivious computation

“…We believe that a promising way forward is to integrate λ obliv 's type-level mechanisms with richer systems for formal reasoning. For example, we could adopt the approach of semantic typing, embedding λ obliv 's type rules as lemmas in a richer logic, as done in RustBelt [Jung et al 2018] or Fuzzi [Zhang et al 2019b]. The logic of Barthe et al [2020] is a good candidate, but it needs further extensions too.…”

“…Some prior work aims to quantify the information released by a (possibly randomized) program (e.g., Köpf and Rybalchenko [2013]; Mu and Clark [2009]) according to entropy-based measures. Work on verifying the correctness of differentially private algorithms [Barthe et al 2013;Zhang and Kifer 2017;Zhang et al 2019b], essentially aims to bound possible leakage; by contrast, we enforce that no information leaks due to a program's execution.…”

“…Unfortunately, λ obliv 's strict ordering on probability regions is too strong, so the complete ostack implementation will not typecheck. An interesting future direction would be to apply the approach of Zhang et al [2019a] to integrate λ obliv 's type system with a general logic, such as that by Barthe et al [2020], which can be be used to justify that omitting the probability region order check is (locally) safe. We elaborate in Section 6 when we discuss related work and make the case that λ obliv subsumes previous work on type system design for oblivious computation.…”

Using Fuzzy Logic to Control Dynamic Loads on Road-Building Machine Construction Elements

“…The formalization of linguistic meanings within the theory of fuzzy sets is carried out through membership functions (MFs) . The most widespread methods of constructing MFs are based on the statistical processing of expert information and on paired comparisons [4][5][6][18][19][20][21][22][23]. These methods are mainly used in the development of pure expert systems that apply only expert knowledge [7][8][9][10].…”

Duet: an expressive higher-order language and linear type system for statically enforcing differential privacy

“…Type Systems Enriched with Program Logics. At a high level, Fuzzi [56] has a similar aim to Duet: supporting differential privacy for general-purpose programs and supporting recent variants of differential privacy. Duet is designed primarily as a fully-automated type system with a rich set of primitives for vector-based and higher-order programming; low-level mechanisms in Duet are opaque and trusted.…”