notebooks/dp-budget.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## The Privacy Budget"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "collapsed": true
   },
   "source": [
    "### Composition Theorem\n",
    "It is critical to recognize that privacy losses *accumulate*. When two answers are returned to an adversary, the total privacy loss can be twice as large, and the privacy guarantee half as strong. This cumulative property is a consequence of the **composition theorem**. In essence, with each new query, additional information about the sensitive data is released. \n",
    "\n",
    "### Maximum Privacy Loss\n",
    "How does differential privacy work if the privacy loss grows so quickly? To ensure a meaningful privacy guarantee, data curators can enforce a **maximum privacy loss**. If the number of queries exceeds the threshold, then the privacy guarantee becomes too weak and the curator stops answering queries. The maximum privacy loss is called the privacy budget. We can think of each query as a privacy ‘expense’ which incurs an incremental privacy loss. Setting the privacy budget is ultimately a policy question.\n",
    "\n",
    "One of the most powerful features of differential privacy is its robustness under composition. While it cannot get around the fundamental law that privacy risk increases when multiple analyses are performed on the same individual’s data, differential privacy guarantees that privacy risk accumulates in a bounded way. Despite the accumulation of risk, two differentially private analyses cannot be combined in a way that leads to a privacy loss greater than the sum of what would be caused by each analysis in isolation.\n",
    "\n",
    "### Utilizing Your Privacy Budget\n",
    "The privacy loss parameter ε can be thought of as a “privacy budget” to be spent by different analyses of individuals’ data. If a single analysis is expected to be performed on a given set of data, then one might allow this analysis to exhaust the entire privacy budget ε. However, a more typical scenario is that several analyses are expected to be run on a dataset, and, therefore, one needs to calculate the total utilization of the privacy budget by these analyses. \n",
    "\n",
    "There are two methods to use budget when working with multiple analyses: \n",
    "1. **Parallel Composition** - If you can prove that each analysis releases information on a *disjoint* set of individuals, parallel compositions applies, and the privacy budget of the set of analyses is equal to the maximum espsilon of the analyses.\n",
    "2. **Sequential Composition** - Unless you can prove that parallel composition applies, you must use sequential compositon to calculate your privacy budget. In this case, your privacy budget is calculated by adding the epsilons of each analsis.\n",
    "\n",
    "#### Example Case 1:\n",
    "Let's consider a dataset that covers the state demographics of California. We want to release the mean and median age of California residents. In this case, we are doing multiple analyses over the same geographic location, so sequential composition applies. Our total budget will be the sum of each epsilon.\n",
    "\n",
    "`\n",
    "dataset = CaliforniaDemographics.csv\n",
    "mean_age = average(dataset.age)\n",
    "median_age = median(dataset.age)\n",
    "mean_epsilon = 1\n",
    "median_epsilon = 1\n",
    "total_budget = mean_epsilon + median_epsilon = 2\n",
    "`\n",
    "\n",
    "#### Example Case 2:\n",
    "Our dataset is stil the state demographics of California, but this time we are breaking down the demographics by county, and want to find the mean age of each of three counties. In this case, we are doing the same analysis over different geographic locations. Parallel composition applies because each county contains information over a disjoint set of individuals. Our total budget will be the maximum of each epsilon.\n",
    "\n",
    "`\n",
    "dataset = CaliforniaDemographics.csv\n",
    "county1_mean_age = average(dataset.county1.age)\n",
    "county2_mean_age = average(dataset.county2.age)\n",
    "county3_mean_age = average(dataset.county3.age)\n",
    "county1_mean_epsilon = 1\n",
    "county2_mean_epsilon = 2\n",
    "county3_mean_epsilon = 1\n",
    "total_budget = max(county1_mean_epsilon, county2_mean_epsilon, county3_mean_epsilon) = 2\n",
    "`\n",
    "\n",
    "### Budget Maintainer\n",
    "**Matthew Haubach (Census/CED FED)** maintans privacy budgets at a project level. Contact him at [matthew.e.haubach@census.gov]() for budget-related concerns."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}