Extremal Mechanisms for Local Differential Privacy

Local differential privacy has recently surfaced as a strong measure of privacy in contexts where personal information remains private even from data analysts. Working in a setting where both the data providers and data analysts want to maximize the utility of statistical analyses performed on the released data, we study the fundamental trade-off between local differential privacy and utility. This trade-off is formulated as a constrained optimization problem: maximize utility subject to local differential privacy constraints. We introduce a combinatorial family of extremal privatization mechanisms, which we call staircase mechanisms, and show that it contains the optimal privatization mechanisms for a broad class of information theoretic utilities such as mutual information and $f$-divergences. We further prove that for any utility function and any privacy level, solving the privacy-utility maximization problem is equivalent to solving a finite-dimensional linear program, the outcome of which is the optimal staircase mechanism. However, solving this linear program can be computationally expensive since it has a number of variables that is exponential in the size of the alphabet the data lives in. To account for this, we show that two simple privatization mechanisms, the binary and randomized response mechanisms, are universally optimal in the low and high privacy regimes, and well approximate the intermediate regime.Comment: 52 pages, 10 figures in JMLR 201

Privately Releasing Conjunctions and the Statistical Query Barrier

Suppose we would like to know all answers to a set of statistical queries C on a data set up to small error, but we can only access the data itself using statistical queries. A trivial solution is to exhaustively ask all queries in C. Can we do any better? + We show that the number of statistical queries necessary and sufficient for this task is---up to polynomial factors---equal to the agnostic learning complexity of C in Kearns' statistical query (SQ) model. This gives a complete answer to the question when running time is not a concern. + We then show that the problem can be solved efficiently (allowing arbitrary error on a small fraction of queries) whenever the answers to C can be described by a submodular function. This includes many natural concept classes, such as graph cuts and Boolean disjunctions and conjunctions. While interesting from a learning theoretic point of view, our main applications are in privacy-preserving data analysis: Here, our second result leads to the first algorithm that efficiently releases differentially private answers to of all Boolean conjunctions with 1% average error. This presents significant progress on a key open problem in privacy-preserving data analysis. Our first result on the other hand gives unconditional lower bounds on any differentially private algorithm that admits a (potentially non-privacy-preserving) implementation using only statistical queries. Not only our algorithms, but also most known private algorithms can be implemented using only statistical queries, and hence are constrained by these lower bounds. Our result therefore isolates the complexity of agnostic learning in the SQ-model as a new barrier in the design of differentially private algorithms

Leveraging private capital for climate mitigation: evidence from the clean development mechanism

To mitigate climate change, states must make significant investments into energy and other sectors. To solve this problem, scholars emphasize the importance of leveraging private capital. If states create institutional mechanisms that promote private investment, they can reduce the fiscal cost of carbon abatement. We examine the ability of different international institutional designs to leverage private capital in the context of the Kyoto Protocol's Clean Development Mechanism (CDM). Empirically, we analyze private capital investment in 3749 climate mitigation projects under the CDM, 2003–2011. Since the CDM allows both bilateral and unilateral implementation, we can compare the two modes of contracting within one context. Our model analyzes equilibrium private investment in climate mitigation. When the cost of mitigation is high, unilateral project implementation in one host country, without foreign collaboration, draws more investment than bilateral contracting, whereby foreign investors participate in the project

Differential Privacy and the Fat-Shattering Dimension of Linear Queries

In this paper, we consider the task of answering linear queries under the constraint of differential privacy. This is a general and well-studied class of queries that captures other commonly studied classes, including predicate queries and histogram queries. We show that the accuracy to which a set of linear queries can be answered is closely related to its fat-shattering dimension, a property that characterizes the learnability of real-valued functions in the agnostic-learning setting.Comment: Appears in APPROX 201

Mechanisms of Endogenous Institutional Change

This paper proposes an analytical-cum-conceptual framework for understanding the nature of institutions as well as their changes. In doing so, it attempts to achieve two things: First, it proposes a way to reconcile an equilibrium (endogenous) view of institutions with the notion of agents’ bounded rationality by introducing such concepts as a summary representation of equilibrium as common knowledge of agents. Second, it specifies some generic mechanisms of institutional coherence and change -- overlapping social embededdness, Schumpeterian innovation in bundling games and dynamic institutional complementarities -- useful for understanding the dynamic interactions of economic, political, social and organizational factors.