Privacy-Aware Rejection Sampling
Privacy-Aware Rejection Sampling
复制标题
DOI：
--
复制
发表时间：
2021-08
期刊：
影响因子：
--
通讯作者：
Jordan Awan;Vinayak A. Rao
中科院分区：
文献类型：
--
作者：
Jordan Awan;Vinayak A. Rao
差分隐私（DP）提供了强大的理论隐私保证，但DP机制的实现可能容易受到侧信道攻击，如定时攻击。当使用MCMC或拒绝采样等采样方法来实现某个机制时，运行库可能会泄漏私有信息。我们的特点是额外的隐私成本，由于拒绝采样器的运行时间在两个$（\DELTA，\DELTA）$-DP以及$f$-DP。我们还表明，除非接受概率在数据库中是恒定的，否则拒绝采样器的运行时间不满足任何$\n $-DP。我们发现，有一个类似的故障在隐私与自适应拒绝采样器。我们提出了三个修改的拒绝采样算法，不同的假设，以防止定时攻击，使运行时独立的数据。最弱假设的修改是近似采样器，引入了隐私成本的小幅增加，而其他修改给出了完美的采样器。我们还使用我们的技术来开发一个自适应拒绝采样器的对数H\"{o}lder密度，它也有数据独立的运行时间。我们给出了几个DP机制的例子，适合我们的方法的假设，因此可以使用我们的采样器来实现。
Differential privacy (DP) offers strong theoretical privacy guarantees, but implementations of DP mechanisms may be vulnerable to side-channel attacks, such as timing attacks. When sampling methods such as MCMC or rejection sampling are used to implement a mechanism, the runtime can leak private information. We characterize the additional privacy cost due to the runtime of a rejection sampler in terms of both $(\epsilon,\delta)$-DP as well as $f$-DP. We also show that unless the acceptance probability is constant across databases, the runtime of a rejection sampler does not satisfy $\epsilon$-DP for any $\epsilon$. We show that there is a similar breakdown in privacy with adaptive rejection samplers. We propose three modifications to the rejection sampling algorithm, with varying assumptions, to protect against timing attacks by making the runtime independent of the data. The modification with the weakest assumptions is an approximate sampler, introducing a small increase in the privacy cost, whereas the other modifications give perfect samplers. We also use our techniques to develop an adaptive rejection sampler for log-H\"{o}lder densities, which also has data-independent runtime. We give several examples of DP mechanisms that fit the assumptions of our methods and can thus be implemented using our samplers.