Differentially private variance of bounded data

The Laplace mechanism releases f(x) + Lap(GS_f / eps) where GS_f is the global sensitivity of f; the guarantee requires the data to lie in a known range, so points are clamped to [a, b] first. The variance is released by composing two Laplace queries on the clamped data, each spending half the budget: the mean, of sensitivity (b - a)/n, and the second raw moment, of sensitivity (sup t^2 - inf t^2)/n over t in [a, b]. The result is clipped into [0, ((b - a)/2)^2], Popoviciu's bound, which is post-processing and costs no privacy. The noise is drawn deterministically by inverting the Laplace CDF at van der Corput points in bases 2 and 3 so both language arms agree; a real deployment must use a cryptographic source.

Usage

Dpvar(x, a, b, epsilon, seed = 42L)

Arguments

x

Raw data.

a, b

Clamping bounds, a < b.

epsilon

Total privacy budget, split evenly between the two queries.

seed

Index into the deterministic low-discrepancy stream.

Value

List with estimate, var_dp, mean_dp, m2_dp, var_true, mean_true, sens_mean, sens_m2, scale_mean, scale_m2, n_clamped, epsilon, n.

References

Karwa, V. and Vadhan, S. (2018). Finite sample differentially private confidence intervals. ITCS 2018; arXiv:1711.03908, Sections 1.5 and 2. Dwork, C., McSherry, F., Nissim, K. and Smith, A. (2006). TCC, LNCS 3876, 265-284.

Examples

set.seed(22)
x <- rnorm(1000, 5, 2)
Dpvar(x, a = 0, b = 10, epsilon = 1)[c("var_dp", "var_true")]
#> $var_dp
#> [1] 3.840901
#> 
#> $var_true
#> [1] 4.006769
#>