Session Types for the Concurrent Composition of Interactive Differential Privacy
Types de sessions pour la composition concurrente de la confidentialité différentielle interactive
Résumé
Differential privacy (DP) is a statistical definition of privacy which ensures that the outcome of a computation by an analyst only depends in a negligible way on the presence of a single record in the dataset. This framework has been extended first to the interactive setting where the analyst can ask an adaptive sequence of queries, and then to the concurrent interactive setting where the adaptive queries can be performed concurrently on the dataset. A key result of such frameworks is that of composition theorems, which allow data curators to combine several algorithms to obtain a new algorithm that continues to satisfy DP, with certain privacy parameters. Obtaining composition theorems in the concurrent interactive framework and for advanced notions of DP is delicate and some results have been obtained recently. On the other hand a variety of tools have been proposed for certifying that some given analysis are DP. Among them, the typing approach embodied by the Fuzz language consists in using a functional programming language and a type system ensuring that well-typed programs can automatically be rendered differentially private. However this setting does not allow to represent concurrent interactive systems. We thus propose to extend it by using as language a process calculus similar to the π-calculus, and we define a trace semantics for it which allows to formulate the DP property as an approximation trace equiva-lence. Moreover, we introduce a type system in the approach of session types and prove a soundness result stating that if a system of processes is well-typed, then it is differentially private.
Origine | Fichiers produits par l'(les) auteur(s) |
---|