标题： 超越最坏情况：将差分隐私保证扩展到现实中的对手 显示英文标题

标题： Beyond the Worst Case: Extending Differential Privacy Guarantees to Realistic Adversaries

摘要： 差分隐私（DP）是一组定义，这些定义限制了机制的最坏情况隐私泄露。 最坏情况DP保证的一个重要特性是，它自然地对具有较少先验信息、更复杂的攻击目标和复杂成功攻击度量的对手提供了保护。 然而，到目前为止，对抗模型与DP所提供的隐私保护之间的分析权衡还不清楚。 为此，这项工作揭示了DP的最坏情况保证对那些更符合现实世界隐私风险的攻击者成功的含义。 在本文中，我们提出了一种单一的灵活框架，该框架概括并扩展了先前工作中发现的DP机制的边界拼图。 我们的框架使我们能够在大量以前的边界无法捕捉的自然攻击设置上计算高概率保证。 其中一类设置是多个个体数据的近似重建，例如从噪声边缘中推断出表格数据集的几乎整个列，以及从DP训练的语言模型中提取敏感信息。 我们进行了两个实证案例研究，以说明我们边界的灵活性，并将它们与最先进的攻击的成功进行比较。 具体而言，我们研究了从DP训练的语言模型中提取非均匀个人身份信息（PII）的攻击，以及多列重建攻击，其中对手可以访问一些列，并试图重建每个人记录的其余列。 我们发现，攻击非均匀数据的绝对隐私风险高度依赖于对手的成功先验概率。 我们的高概率边界使我们能够对DP机制在各种之前研究不足的攻击设置中的隐私泄露有更细致的理解。 显示英文摘要

摘要： Differential Privacy (DP) is a family of definitions that bound the worst-case privacy leakage of a mechanism. One important feature of the worst-case DP guarantee is it naturally implies protections against adversaries with less prior information, more sophisticated attack goals, and complex measures of a successful attack. However, the analytical tradeoffs between the adversarial model and the privacy protections conferred by DP are not well understood thus far. To that end, this work sheds light on what the worst-case guarantee of DP implies about the success of attackers that are more representative of real-world privacy risks. In this paper, we present a single flexible framework that generalizes and extends the patchwork of bounds on DP mechanisms found in prior work. Our framework allows us to compute high-probability guarantees for DP mechanisms on a large family of natural attack settings that previous bounds do not capture. One class of such settings is the approximate reconstruction of multiple individuals' data, such as inferring nearly entire columns of a tabular data set from noisy marginals and extracting sensitive information from DP-trained language models. We conduct two empirical case studies to illustrate the versatility of our bounds and compare them to the success of state-of-the-art attacks. Specifically, we study attacks that extract non-uniform PII from a DP-trained language model, as well as multi-column reconstruction attacks where the adversary has access to some columns in the clear and attempts to reconstruct the remaining columns for each person's record. We find that the absolute privacy risk of attacking non-uniform data is highly dependent on the adversary's prior probability of success. Our high probability bounds give us a nuanced understanding of the privacy leakage of DP mechanisms in a variety of previously understudied attack settings.