A Theory of Composition for Differential Obliviousness

Differential obliviousness (DO) access pattern privacy is a privacy notion which guarantees that the access patterns of a program satisfy differential privacy. Differential obliviousness was studied in a sequence of recent works as a relaxation of full obliviousness. Earlier works showed that DO not only allows us to circumvent the logarithmic-overhead barrier of fully oblivious algorithms, in many cases, it also allows us to achieve polynomial speedup over full obliviousness, since it avoids padding to the worst-case behavior of fully oblivious algorithms. Despite the promises of differential obliviousness (DO), a significant barrier that hinders its broad application is the lack of composability. In particular, when we apply one DO algorithm to the output of another DO algorithm, the composed algorithm may no longer be DO (with reasonable parameters). More specifically, the outputs of the first DO algorithm on two neighboring inputs may no longer be neighboring, and thus we cannot directly benefit from the DO guarantee of the second algorithm. In this work, we are the first to explore a theory of composition for differentially oblivious algorithms. We propose a refinement of the DO notion called $(\epsilon, \delta)$-neighbor-preserving-DO, or $(\epsilon, \delta)$-NPDO for short, and we prove that our new notion indeed provides nice compositional guarantees. In this way, the algorithm designer can easily track the privacy loss when composing multiple DO algorithms. We give several example applications to showcase the power and expressiveness of our new NPDO notion. One of these examples is a result of independent interest: we use the compositional framework to prove an optimal privacy amplification theorem for the differentially oblivious shuffle model. In other words, we show that for a class of distributed differentially private mechanisms in the shuffle-model, one can replace the perfectly secure shuffler with a DO shuffler, and nonetheless enjoy almost the same privacy amplification enabled by a shuffler

Analysis of bias voltage scan data recorded with hybrid Timepix1 silicon pixel assemblies at the DESY testbeam

This report will present results from the analysis of bias voltage scans in Timepix1 testbeam data. Three assemblies of varying sensor thickness were used to collect data. The effect of the bias voltage on charge sharing, in particular cluster size, was investigated and found to have a significant impact. The effect of the bias voltage on energy collection was also studied, leading to estimates for the depletion voltage, donor concentration, mobility and resistivity of each assembly. Finally, the effect of the bias voltage on the two-hit cluster resolution and detection efficiency was investigated. This report contains extracts from a longer document (LCD-OPEN-2014-001)