Canonical noise distributions and private hypothesis tests

Abstract

f-DP has recently been proposed as a generalization of differential privacy allowing a lossless analysis of composition, post-processing, and privacy amplification via subsampling. In the setting of f-DP, we propose the concept of a canonical noise distribution (CND), the first mechanism designed for an arbitrary f-DP guarantee. The notion of CND captures whether an additive privacy mechanism perfectly matches the privacy guarantee of a given f. We prove that a CND always exists, and give a construction that produces a CND for any f. We show that private hypothesis tests are intimately related to CNDs, allowing for the release of private p-values at no additional privacy cost, as well as the construction of uniformly most powerful (UMP) tests for binary data, within the general f-DP framework.

We apply our techniques to the problem of difference-of-proportions testing, and construct a UMP unbiased (UMPU) “semiprivate” test which upper bounds the performance of any f-DP test. Using this as a benchmark, we propose a private test based on the inversion of characteristic functions, which allows for optimal inference on the two population parameters and is nearly as powerful as the semiprivate UMPU. When specialized to the case of $(\mathit{ϵ},0)$-DP, we show empirically that our proposed test is more powerful than any $(\mathit{ϵ}/\sqrt{2})$-DP test and has more accurate type I errors than the classic normal approximation test.