Inherent privacy guarantees of sampling from Bayesian posteriors clarified
On Inherent Privacy of Posterior Sampling: A Unified Rényi-Divergence Framework
Machine Learning
Summary
When we share information, protecting privacy is important, and one way to do this is by adding noise to data. This paper shows that some privacy protection can happen naturally when drawing samples from Bayesian statistical models, without extra noise. The authors develop a unified way to measure this built-in privacy using advanced math, covering many common models and situations. Their work helps understand when sampling alone can keep data private and how different factors affect this privacy.
What this means in practice
- •For data privacy engineers: Assess and certify the privacy guarantees of Bayesian sampling algorithms without adding extra noise for sensitive data analysis.
- •For machine learning practitioners: Design Bayesian models with inherent privacy protections by understanding which setups yield stronger natural privacy guarantees.
A theory result. No direct application yet.
Authors
Ruyu Zhou, Fang Liu
Abstract
Differential Privacy (DP) provides a rigorous framework for quantifying privacy guarantees. While most methods achieve DP by injecting calibrated random noise, the intrinsic randomness of certain procedures such as sampling can yield DP guarantees ``for free''. In this work, we develop a unified Rényi divergence framework to characterize the inherent DP guarantees of sampling from a Bayesian posterior distribution. We show that the privacy loss incurred by One-Posterior-Sampling (OPS) is governed by posterior exponential moments of the single-record log-likelihood ratio, and establish explicit DP guarantees under uniformly bounded, sub-Gaussian, or sub-exponential tail regimes. We apply the framework to representative Bayesian models, including categorical likelihoods with arbitrary priors, Gaussian-Gaussian conjugate pair, generalized linear models from the exponential family and linear regression with Gaussian likelihood, both with Gaussian priors on the regression coefficients. Our results elucidate sample size, model structure, neighboring relations in DP (bounded or unbounded), and how prior if applicable, jointly determine the inherent DP guarantees of OPS. Furthermore, our results recover the existing DP guarantees for OPS as special cases -- often with tighter privacy loss bounds -- and substantially broaden the class of Bayesian models for which the inherent DP guarantees of OPS can be rigorously characterized.