一句话：提出基于隐私过滤器与类型化函数式编程的自适应组合框架，并实现语言 Adaptive Fuzz，以收紧隐私预算界。
差分隐私为敏感数据分析提供强隐私保证，但现有差分隐私语言对自适应分析支持不足：分析常需根据先前结果选择下一步函数及其隐私参数，而它们通常仅用简单组合定理，导致隐私代价界过松，浪费隐私预算。本文提出一个优雅、实用且可实现的自适应组合框架：基于类型化函数式编程重新表述 privacy filters，并设计实现新语言 Adaptive Fuzz。该语言将 Fuzz 的核心静态类型系统移植到自适应场景，通过外层自适应层包装 Fuzz 类型检查器与运行时，使 Fuzz 程序可按需构造并即时类型检查。作者实现解释器，并通过两个真实数据集案例研究验证其能有效实现常见统计算法。
Differential privacy is a widely studied theory for analyzing sensitive data with a strong privacy guarantee—any change in an individual's data can have only a small statistical effect on the result—and a growing number of programming languages now support differentially private data analysis. A common shortcoming of these languages is poor support for adaptivity . In practice, a data analyst rarely wants to run just one function over a sensitive database, nor even a predetermined sequence of functions with fixed privacy parameters; rather, she wants to engage in an interaction where, at each step, both the choice of the next function and its privacy parameters are informed by the results of prior functions. Existing languages support this scenario using a simple composition theorem , which often gives rather loose bounds on the actual privacy cost of composite functions, substantially reducing how much computation can be performed within a given privacy budget. The theory of differential privacy includes other theorems with much better bounds, but these have not yet been incorporated into programming languages. We propose a novel framework for adaptive composition that is elegant, practical, and implementable. It consists of a reformulation based on typed functional programming of privacy filters , together with a concrete realization of this framework in the design and implementation of a new language, called Adaptive Fuzz . Adaptive Fuzz transplants the core static type system of Fuzz to the adaptive setting by wrapping the Fuzz typechecker and runtime system in an outer adaptive layer , allowing Fuzz programs to be conveniently constructed and typechecked on the fly. We describe an interpreter for Adaptive Fuzz and report results from two case studies demonstrating its effectiveness for implementing common statistical algorithms over real data sets.
@article{Winograd-CortHR17,
title = {A framework for adaptive differential privacy},
author = {Daniel Winograd-Cort and Andreas Haeberlen and Aaron Roth and Benjamin C. Pierce},
journal = {Proceedings of the ACM on Programming Languages},
volume = {1},
number = {ICFP},
year = {2017},
doi = {10.1145/3110254}
}