# Mechanisms for Robust Local Differential Privacy

^{*}

## Abstract

**:**

## 1. Introduction

- We use a Rényi divergence to construct $\mathcal{F}$ and analyze the resulting structure and statistics of $\mathcal{F}$. In particular, we demonstrate that projections of $\mathcal{F}$ are again balls under the same divergence. Moreover, we bound the projected sets in terms of an ${\mathcal{l}}_{1}$ norm.
- A drawback of this method is that it relies on vertex enumeration and is, therefore, computationally unfeasible for large alphabets. Therefore, we introduce two low-complexity privacy mechanisms. The first is independent reporting (IR), in which S and U are reported through separate LDP mechanisms.
- We characterize the conditions that underlying LDP mechanisms have to satisfy in order for IR to ensure RLDP. Furthermore, while IR can incorporate any LDP mechanism, we show that it is optimal to use randomized response [19]. This drastically reduces the search space and allows us to find the optimal IR mechanism using low-dimensional optimization.
- The second low-complexity mechanism that we develop is called secret-randomized response (SRR) and is based on randomized response.
- We show that SRR maximizes mutual information in the low-privacy regime for the case that $\mathcal{F}$ is the entire probability simplex.
- We demonstrate the improved utility of RLDP over LDP with numerical experiments. In particular, we compare the performance of our mechanisms with generalized random response [5]. We provide results for both synthetic data sets and real-world census data.

## 2. Related Work

#### 2.1. The Pufferfish Framework

#### 2.2. Other Privacy Frameworks

#### 2.3. Robustness

#### 2.4. Miscellaneous

## 3. Model and Preliminaries

**Definition 1**

**.**Let $\epsilon \ge 0$ and $\mathcal{F}\subset {\mathcal{P}}_{\mathcal{X}}$. We say that $\mathcal{Q}$ satisfies $(\epsilon ,\mathcal{F})$-RLDP if for all $s,{s}^{\prime}\in \mathcal{S}$, all $y\in \mathcal{Y}$, and all $P\in \mathcal{F}$ we have

**Definition 2**

**.**Let $\epsilon \ge 0$. We say that $\mathcal{Q}:\mathcal{X}\to \mathcal{Y}$ satisfies ε-LDP if for all $x,{x}^{\prime}\in \mathcal{X}$ and all $y\in \mathcal{Y}$ we have

**Problem 1.**

**Example 1.**

## 4. Conditional Projection of $\mathcal{F}$

#### 4.1. Structure of ${\mathcal{F}}_{\mathcal{U}|s}$

**Theorem 1.**

#### 4.2. Statistics of ${\mathcal{F}}_{\mathcal{U}|s}$

**Proposition 1.**

#### 4.3. Special Case $\alpha =2$

**Lemma 1.**

**Proposition 2.**

- 1.
- One has$${L}_{u|s}\left(\mathcal{F}\right)=\frac{{\mathrm{e}}^{{B}_{s}}+2{\widehat{P}}_{u|s}-1-\sqrt{({\mathrm{e}}^{{B}_{s}}-1)({\mathrm{e}}^{{B}_{s}}-{(2{\widehat{P}}_{u|s}-1)}^{2})}}{2{\mathrm{e}}^{{B}_{s}}}.$$
- 2.
- Let ${u}_{min}=arg{min}_{u\in \mathcal{U}}{\widehat{P}}_{u|s}$. If ${B}_{s}\ge log(1+{(1-{\widehat{P}}_{{u}_{min}|s})}^{2})$, then$${\mathrm{rad}}_{s}\left(\mathcal{F}\right)=\frac{-{\mathrm{e}}^{{B}_{s}}+2{\widehat{P}}_{{u}_{min}|s}-1+\sqrt{({\mathrm{e}}^{{B}_{s}}-1)({\mathrm{e}}^{{B}_{s}}-{(2{\widehat{P}}_{{u}_{min}|s}-1)}^{2})}}{{\mathrm{e}}^{{B}_{s}}}.$$
- 3.
- If ${B}_{s}<log(1+{(1-{\widehat{P}}_{{u}_{min}|s})}^{2})$, one has ${\mathrm{rad}}_{s}\left(\mathcal{F}\right)\le \sqrt{{\mathrm{e}}^{{B}_{s}}-1}$.

**Example 2.**

## 5. Polyhedral Approximation: PolyOpt

**Definition 3.**

**Theorem 2.**

**Theorem 3.**

**Example 3.**

## 6. An Optimal Policy for $\mathcal{F}={\mathcal{P}}_{\mathcal{X}}$

**Proposition 3.**

**Proof.**

**Definition 4.**

**.**Let $\epsilon >0$. Then, the privacy mechanism ${\mathrm{SRR}}^{\epsilon}:\mathcal{X}\to \mathcal{X}$ is given by

**Lemma 2.**

**Example 4.**

**Theorem 4.**

## 7. Independent Reporting

**Definition 5.**

**Theorem 5.**

**Lemma 3.**

**Proof.**

**Proof**

**.**We start by showing that d is an upper bound for $\left|\right|{P}_{\mathcal{U}|s}-{P}_{\mathcal{U}|{s}^{\prime}}{\left|\right|}_{1}$. If $d=2$, this is certainly the case. Suppose $d={max}_{s}\left(2{d}_{s}\right)+{max}_{s,{s}^{\prime}}\left|\right|{\widehat{P}}_{\mathcal{U}|s}-{\widehat{P}}_{\mathcal{U}|{s}^{\prime}}{\left|\right|}_{1}$. Then, for all $s,{s}^{\prime}\in \mathcal{S}$ and $P\in \mathcal{F}$ we have

**Theorem 6.**

**Proof.**

**Example 5.**

## 8. Experiments

#### 8.1. Adult Data Set

#### 8.2. Synthetic Data

#### 8.3. Realized Privacy Parameter

#### 8.4. Utility Robustness

#### 8.5. Impact of $\beta $

## 9. Conclusions and Future Work

## Author Contributions

## Funding

## Institutional Review Board Statement

## Data Availability Statement

## Conflicts of Interest

## Appendix A. Proofs

#### Appendix A.1. Proof of Theorem 1

**Lemma A1.**

**Proof.**

**Lemma A2.**

**Proof.**

**Lemma A3.**

**Proof.**

**Lemma A4.**

**Proof.**

#### Appendix A.2. Proof of Proposition 1

**Lemma A5.**

**Proof.**

**Lemma A6.**

**Proof.**

**Proof**

**of**

**Proposition**

**1.**

#### Appendix A.3. Proof of Lemma 1 and Proposition 2

**Lemma A7.**

- 1.
- Let ${x}_{min}=arg{min}_{x\in \mathcal{X}}{\widehat{P}}_{x}$. If $\tilde{B}\ge {(1-{\widehat{P}}_{{x}_{min}})}^{2}$, then the maximum in (A6) is attained at ${\mathcal{X}}_{1}=\left\{{x}_{min}\right\}$.
- 2.
- If $\tilde{B}<{(1-{\widehat{P}}_{{x}_{min}})}^{2}$ one has ${sup}_{P\in \mathcal{F}}\left|\right|P-\widehat{P}{\left|\right|}_{1}\le \sqrt{\tilde{B}}$.

**Proof.**

#### Appendix A.4. Proof of Theorem 2

#### Appendix A.5. Proof of Theorem 3

#### Appendix A.6. Proof of Theorem 4

**Lemma A8.**

**Proof.**

**Proof**

**of**

**Theorem**

**4.**