Accuracy-First Rényi Differential Privacy and Post-Processing Immunity
For data analysts needing adaptive privacy bounds with post-processing immunity, this work provides a practical definition and tools, though it is an incremental extension of existing Rényi DP.
The paper identifies that existing accuracy-first differential privacy definitions lack post-processing immunity, except for pure ex-post privacy which lacks practical tools. The authors propose a new definition based on Rényi differential privacy that has post-processing immunity and develop practical tools, demonstrating its utility in synthetic data generation and image classifier fine-tuning.
The accuracy-first perspective of differential privacy addresses an important shortcoming by allowing a data analyst to adaptively adjust the quantitative privacy bound instead of sticking to a predetermined bound. Existing works on the accuracy-first perspective have neglected an important property of differential privacy known as post-processing immunity, which ensures that an adversary is not able to weaken the privacy guarantee by post-processing. We address this gap by determining which existing definitions in the accuracy-first perspective have post-processing immunity, and which do not. The only definition with post-processing immunity, pure ex-post privacy, lacks useful tools for practical problems, such as an ex-post analogue of the Gaussian mechanism, and an algorithm to check if accuracy on separate private validation set is high enough. To address this, we propose a new definition based on Rényi differential privacy that has post-processing immunity, and we develop basic theory and tools needed for practical applications. We demonstrate the practicality of our theory with applications to synthetic data generation and image classifier fine-tuning, where our algorithm successfully adjusts the privacy bound until an accuracy threshold is met on a private validation dataset.