Differentially private bounded sum

Values are clipped to [a, b] and the sum released with Laplace noise of scale \((b-a)/\epsilon\).

Usage

morie_dp_sum(x, a, b, epsilon = 1, seed = NULL)

Arguments

x

values to sum.

a, b

clipping bounds, from outside the data.

epsilon

privacy budget.

seed

optional integer seed.

Value

list with release, true_sum (of the clipped values), noise_scale, sensitivity, clipped_fraction.

Details

The sensitivity IS the width of the clipping range, so the bounds must come from outside the data. Reading them off the sample – taking a min and a max – is a non-private query, and using them here voids the guarantee entirely rather than weakening it.

Heavy clipping biases the release toward the interior; the fraction clipped is reported and warned about past 10%.

References

Dwork, C. and Roth, A. (2014). FnTTCS, 9(3-4).

Examples

set.seed(1)
morie_dp_sum(rnorm(100), -3, 3, epsilon = 1, seed = 1)$sensitivity
#> [1] 6