Method and electronic device for estimating the accuracy of a differential private ratio

Abstract

A computer-implemented method (300) and electronic device (101) for estimating the accuracy of a differentially private ratio (F.1), wherein the differentially private ratio (F.1) is the division between two differentially private quantities that is generated by a differential privacy (DP) mechanism over a dataset comprising a number of records (c). The method comprises estimating the accuracy of a differentially private ratio (F.1) by determining an error bound (αr) of the differentially private ratio (F.1) that fulfils a predetermined error propagation criteria, wherein the predetermined error propagation criteria require certain conditions to be satisfied depending on whether the differentially private ratio (F.1) is a differentially private average (F.2) between the approximation of a differentially private sum (F.3) and the differentially private count (F.4), or a differentially private ratio (F.5) between the approximations of two differentially private sums (F.6).

Description

[0001] METHOD AND ELECTRONIC DEVICE FOR ESTIMATING THE ACCURACY OF A DIFFERENTIAL PRIVATE RATIO

[0002] TECHNICAL FIELD

[0003] The disclosure relates generally differential privacy (DP) mechanisms responding to randomized queries over data sets comprising a number of records. In particular, the disclosure relate to a computer-implemented method and electronic device for estimating the accuracy of a differentially private ratio, wherein the differentially private ratio is a division between two differentially private quantities that is generated by a DP mechanism over a dataset comprising a number of records. Also, the disclosure relate to a computer program product, and a computer program carrier.

[0004] BACKGROUND

[0005] Large amounts of data are being collected about subjects (individuals) by a variety of organizations like research institutions or companies. However, much of the collected data is private: it comprises details about subjects and their behavior. Privacy concerns about subjects restrict the way this information can be used and released, where utilizing subjects' data is therefore curbed for ethical, legal, or business reasons. It is often believed that data can be anonymized somehow in order to preserve the privacy of individuals. While a step forward, simply anonymizing data loses their effectiveness when additional knowledge can be exploited.

[0006] Differential privacy (DP) mechanisms enable data analyses to release statistical information about the population without compromising data subjects' privacy. A standard way to comply with a DP guarantee is adding statistical noise into the results of data analyses. Such statistical noise is typically sampled from Laplace or Gaussian distributions. However, this added statistical noise will also inversely affect the accuracy of the result based on the desired privacy level.

[0007] Here, estimating the accuracy of a DP query may be done through empirical or theoretical means. The empirical analysis involves executing the query repeatedly on synthetic data, measuring error as the difference between the values produced by the queries with and without the addition of noise. The theoretical analyses aim to provide probabilistic error bounds via the noise distribution’s inverse cumulative distribution function (iCDF), generating a confidence interval for where the unprotected result (i.e., without noise) lies. Though empirical methods offer tighter estimations, they are computationally demanding and depend on the accuracy of the synthetic data, thus they are less desirable.

[0008] While DP’s composability enables the creation of complex analyses (e.g., histograms and clustering analyses) by combining simpler ones with known privacy guarantees (e.g., a noisy count or a noisy sum), accuracy reasoning is less compositional. Most DP frameworks and tools lack support for tracking and reasoning about queries’ accuracy, whether empirically or theoretically. Although some DP frameworks integrate confidence intervals or error bounds for simple queries, they lack a general solution for complex ones - that is, those relying on the aggregation of results. On the other hand, in Lobo-Vesga, E., Russo, A., & Gaboardi, M. (2020, May) “A programming framework for differential privacy with accuracy concentration bounds” in 2020 IEEE Symposium on Security and Privacy (SP) (pp. 411-428), theoretical error bounds is combined with concentration bounds for the accuracy of simple queries and those formed as a linear aggregation of results produced by DP queries, yet it faces limitations with more complex queries like averages and ratios (i.e., non-linear combinations).

[0009] Error bounding average calculations pose significant challenges as the noise distribution arises from the ratio between two random variables, for example, one for the noisy sum and one for the noisy count. Analytically computing this ratio’s distribution is non-trivial. According to some solutions, average calculation accuracy may be addressed by “eliminating” one random variable, see e.g. Open DP Documentation, Working with Unknown Dataset Sizes (https: / / docs.opendp.org / en / stable / getting-started / examples / unknown-dataset-size.html). This method involves the human analyst estimating the dataset’s record count, e.g. via a resize transformation, and then sampling or inputting data accordingly. If the provided count is smaller than the actual value, the system may sample the guessed number of records; if it is larger, it inputs missing data with a provided default value. The noisy sum is then computed over the sampled or inputted records, and the noisy average is calculated as the noisy sum over the guessed number of records, see e.g. the discussion in Open DP Documentation Providing incorrect dataset size values (https: / / docs.opendp.org / en / stable / getting-started / examples / unknown-dataset-size.html). Since the record count is treated as constant and the noise distribution of a random variable divided by a constant is known, error estimation for the average calculation becomes straightforward. While a resourceful approach, this method relies on the human analyst’s guess, which may be inaccurate due to the analyst’s disconnection from the dataset and does not account for errors in guessing.

[0010] Therefore, there is a need for improved implementations of DP mechanisms, in particular when it comes to estimating the accuracy of differentially private ratios. SUMMARY

[0011] It is an object of the present disclosure to enable improved differential privacy (DP) mechanisms, and in particular improved estimations of the accuracy of differentially private ratios. This object is obtained by a computer-implemented method for estimating the accuracy of a differentially private ratio, wherein the differentially private ratio is the division between two differentially private quantities that is generated by a DP mechanism over a dataset comprising a number of records. The method comprises obtaining parameters used by the DP mechanism to respond to randomized queries for a dataset. Also, the method comprises obtaining a differentially private count and its privacy parameters of a randomized count query to the DP mechanism for the dataset. Further, the method comprises obtaining privacy parameters of one or two differentially private sums of one or two randomized sum queries, respectively, to the DP mechanism for the dataset. The method also comprises approximating the one or two differentially private sums based on the differentially private count, an error bound of the differentially private count, error bounds of the one or two differentially private sums, and a lower and an upper bound of elements in the one or two differentially private sum. Furthermore, the method comprises estimating the accuracy of a differentially private ratio by determining an error bound of the differentially private ratio such that an error propagation for the differentially private ratio fulfils a predetermined error propagation criteria. In case the differentially private ratio is a differentially private average between the approximation of a differentially private sum and the differentially private count, the predetermined error propagation criteria require one of the following conditions a) or b) to be satisfied in that: a) a relative error of the differentially private count is to be below a predetermined threshold value, and that the privacy parameters of the differentially private count and the privacy parameter of the differentially private sum is to satisfy the bounds inequality concerning the lower and upper bounds of elements in the sum,

[0012] b) the magnitude of the differentially private count is to be greater than the count’s error bound, and that an approximate relative error of the differentially private count is to be below a predetermined threshold value, and that a ratio is to be below a predetermined threshold value; and

[0013] wherein in case the differentially private ratio is a differentially private ratio between the approximations of two differentially private sums, the predetermined error propagation criteria require one of the following conditions c) or d) to be satisfied in that:

[0014] c) a relative error of the differentially private count is to be below a predetermined threshold value, and that the privacy parameters of the differentially private count and the privacy parameter of the dividend differentially private sum satisfy the bounds inequality concerning the lower and upper bound of the elements in the dividend differentially private sum, and that the privacy parameters of the differentially private count and the privacy parameter of the divisor differentially private sum satisfy the bounds inequality concerning the lower and upper bound of the elements in the divisor differentially private sum,

[0015] d) the magnitude of the differentially private count is to be greater than the count’s error bound, and that an approximate relative error of the dividend differentially private sum is below a predetermined threshold value, and that an approximate relative error of the divisor differentially private sum is below a predetermined threshold value.

[0016] The disclosed method determines the accuracy of differentially private ratios, such as, for example, averages or sum ratios, in the form of probabilistic error bounds by using a set of pre-condition checks to determine, with high probability, whether the conditions for applying certain error propagation equations are met. This introduce a new way of determining the accuracy of differentially private ratios and is particularly advantageous for two specialized cases of differentially private ratios, namely, for ratios between a private sum and a private count, which constitutes a differentially private average, and ratios between two private sums performed over the same dataset, i.e. non-linear combinations.

[0017] According to some aspects, the method may further comprise: selecting a corresponding error propagation criteria condition a), b), c), or d), to be applied based on the differentially private quantities of the differentially private ratio and on the DP mechanism generating the differentially private quantities, wherein error propagation criteria condition a) is selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio is the differentially private average, and wherein error propagation criteria condition c) is selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio is the differentially private ratio between the approximations of two differentially private sums, and wherein error propagation criteria condition a) and / or b) is selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio is the differentially private average, and wherein error propagation criteria condition c) and / or d) is selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio is the differentially private ratio between the approximations of two differentially private sums. One advantage of this way of selecting the error propagation criteria condition is that any of these distributions may be used to provide suitable random numbers for differential privacy mechanism, and still ensure suitable estimations of the accuracy of differentially private ratios. According to some aspects, the method may further comprise: estimating a minimum number of records required in order for the relative error bounds of the differentially private count to be below the predetermined threshold value. One advantage of this way of estimating a minimum number of records is that it provides insights into the minimum number of records necessary for satisfying the conditions of the error propagation equations. Equipped with this information, a data analysts is able to gauge how realistic the system's requirements are, e.g. the minimum number of records may be used as a benchmark to validate estimations, and thus be able to fine-tune the analysis parameters of the system accordingly. According to some aspects, the method may further comprise: obtaining desired privacy parameters for the differentially private count, and estimating a minimum number of records required in order for the relative error bounds of the differentially private count to be below the predetermined threshold value based on the obtained desired privacy parameters. Here, an advantage is that the minimum number of records necessary for satisfying the conditions of the error propagation equations and the desired privacy parameters may be obtained.

[0018] According to some aspects, the method may further comprise: obtaining a number of records in the dataset for a differentially private count and the privacy parameters for the differentially private count; estimating tuned privacy parameters for one or two differentially private sums based on the obtained number of records in the dataset; and performing the estimating of the accuracy of a differentially private ratio based on the privacy parameters for the differentially private count, as well as, the tuned privacy parameters for one or two differentially private sums. This introduces pre-processing steps that utilises the user’s estimate of the dataset size to recommend an appropriate strategy for setting the privacy levels for the count and sum queries. This is due to the fact that there is a relationship between the number of records in the dataset and the privacy parameters of the private count and sums queries, which is leveraged by the pre-processing steps. One advantage is here that an appropriate strategy for determining the privacy levels for the private count and sum (or sums), based on the desired level of protection for the overall ratio computation may be obtained and provided to a user. According to some aspects, the method may further comprise: obtaining a set of estimated number of records in the dataset; generating a set of different privacy parameters for the differentially private count, as well as, a set of different privacy parameters for the one or two differentially private sums based on the obtained set of estimated number of records in the dataset; and determining a minimal pair of different privacy parameters from the set of different privacy parameters for the differentially private count and the set of different privacy parameters for the one or two differentially private sums required in order for the relative error bounds of the differentially private count to be below predetermined threshold values. This advantageously provides a first and second mode of tuning operation which considers the overall privacy protection for the ratios, and generates different configurations of privacy levels for the count and sum queries. For each configuration, the minimum number of records required to satisfy the error propagation conditions may be computed. Using this information, along with the user’s estimate of the dataset size, the system may recommend the most suitable configuration, if any such exist. In other words, these first and second modes of tuning operation may advantageously assist users to determine the minimal number of records required to satisfy the preconditions for the ratio’s error estimation depending on the desired level of privacy for the private count. Additionally, a minimal privacy parameter for the sums that are likely to satisfy the preconditions may be suggested. Hence, these first and second modes may be advantageously used as an initial exploration before expending privacy processing budget on the private count that is required for the error estimation of the ratio. According to some aspects, the method may further comprise: determining a pair of different privacy parameters from the set of different privacy parameters for the differentially private count and the set of different privacy parameters for the one or two differentially private sums based on a set maximum value for the ratio’s privacy parameters that still fulfils the predetermined error propagation criteria. This provides a third mode of tuning operation which is advantageously designed for when the user has already obtained information about the number of records in the dataset by performing a DP-count and is interested in determining the privacy parameters for the sums such that the preconditions for the error propagation equations are likely valid. As such, the result of the private count is taken together with its corresponding privacy parameters, and returns the minimal privacy parameters for the sums. In other words, this third mode of tuning operation may advantageously considers the user’s estimated number of records and the minimum privacy protection for the ratio, which is equivalent to the maximum value for the ratio’s privacy parameters. With these inputs, the tuner operation may determine the minimal values of privacy parameters for the count and sum queries that satisfy the error propagation conditions. This third mode may be advantageous when the user wants to minimise privacy levels and save computer processing budget for DP, while still meeting the error propagation conditions.

[0019] According to some aspects, obtaining parameters used by the DP mechanism further comprises: obtaining a noise parameter indicative of a statistical noise distribution applied by the DP mechanism, one or more privacy parameters indicative of desired differential privacy guarantee applied by the DP mechanism, a sensitivity parameter indicative of a query sensitivity applied by the DP mechanism, and a confidence parameter indicative of a desired confidence for the accuracy in the DP mechanism. This, for example, advantageously enables the DP parameters to be retrieved or received by the device operating the method in case the DP mechanism is running on a different device than the device that is performing the method. If operating on the same device, this enables the DP parameters to be readily available to be used by the device operating the method.

[0020] According to some aspects, the method may further comprise providing information indicating one or more of: the determined error bounds of the differentially private ratio; the estimated minimum number of records; the differentially private count; the estimated tuned privacy parameters for the differentially private count; the estimated tuned privacy parameters for the one or two differentially private sums; and the minimal pair, or pair of, of different privacy parameters from the set of different privacy parameters for the differentially private count and the set of different privacy parameters for the one or two differentially private sums. This advantageously is able to visualize to the user the results of the accuracy determination of a differentially private ratio, e.g. to a user via a display or by transmitting the result to a remote query device.

[0021] There is also disclosed herein an electronic device associated with the above-discussed advantages. The electronic device comprises at least one processing circuitry and a memory, the at least one processing circuitry being configured to perform the method discussed above. There is also disclosed herein a computer program product associated with the abovediscussed advantages. The computer program product comprising instructions which, when executed on at least one processing circuitry, cause the at least one processing circuitry to carry out any of the methods discussed above.

[0022] There is also disclosed herein a computer program carrier associated with the abovediscussed advantages. The computer program carrier carries a computer program product according to the discussion above. The computer program carrier is one of an electronic signal, optical signal, radio signal, or computer-readable storage medium.

[0023] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the element, apparatus, component, means, step, etc." are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated. Further features of, and advantages with, the present disclosure will become apparent when studying the appended claims and the following description. The skilled person realizes that different features of the present disclosure may be combined to create embodiments other than those described in the following, without departing from the scope of the present disclosure.

[0024] BRIEF DESCRIPTION OF THE DRAWINGS With reference to the appended drawings, below follows a more detailed description of embodiments of the present disclosure cited as examples. In the drawings:

[0025] Fig. 1 is a schematic block diagram illustrating an example system;

[0026] Fig. 2 is a schematic block diagram illustrating an exemplary electronic device;

[0027] Fig. 3 is a flowchart depicting embodiments of a method performed by an electronic device; Figs. 4-8 are a schematic block diagrams illustrating respective exemplary methods;

[0028] Figs. 9-22 are a diagrams and tables illustrating different aspects of the accuracy estimations according to some embodiments.

[0029] DETAILED DESCRIPTION

[0030] The present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain aspects of the present disclosure are shown. The present disclosure may, however, be embodied in many different forms and should not be construed as limited to the embodiments and aspects set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art. Like numbers refer to like elements throughout the description.

[0031] It is to be understood that the present disclosure is not limited to the embodiments described herein and illustrated in the drawings; rather, the skilled person will recognize that many changes and modifications may be made within the scope of the appended claims.

[0032] As part of the developing of the embodiments described herein, it has been realized that by applying the use and understanding of measurement errors and how they propagate through operations, known as error propagation, in experimental physics to private data analysis, it is possible to derive a method that determines the accuracy of differentially private ratios, such as, for example, averages or sum ratios (i.e. non-linear combinations), in the form of probabilistic error bounds as described in the embodiments presented below. For example, in Taylor, J. R., & Thompson, W. (1982). An introduction to error analysis: the study of uncertainties in physical measurements (Vol. 2, pp. 193-200). Mill Valley, CA: University science books, error propagation equations are provided to handle uncertainties in measurements and their operations, particularly in determining error in the ratio of two measurements with uncertainties, assuming instrument errors are both independent and small. It should be noted that applying any of these error propagation equations in the context of differential privacy is non-trivial and not straightforward, as the magnitude of the noise introduced to protect privacy can vary considerably, thus the assumption of dealing with small uncertainties is not directly applicable.

[0033] Fig. 1 shows a schematic block diagram illustrating an example system. In Fig. 1, reference numeral 100 may be a system for estimating the accuracy of a differentially private ratio, wherein the differentially private ratio is the division between two differentially private quantities that is generated by a DP mechanism over a dataset comprising a number of records. The system comprise an electronic device 101 arranged to perform calculations and operate data analyses on data sets and / or accuracy estimations of data analyses and on data sets and data structures. Data analyses may for instance be statistical analyses and machine learning analyses but other types of analyses incorporating differential privacy mechanisms and noise generation may be performed as well.

[0034] The electronic device is optionally connected to a display 102 for interacting with a user and displaying settings and results from provided functionality. The electronic device 101 may be arranged to receive information about data analyses to be performed, information about data sets, data structure information, or parameters relating to data analyses from a remote query device 110 communicating with the electronic device via a digital communications network 120 and network communication lines 115. Furthermore, the electronic device may be arranged to transmit results to the remote device in the same manner. It should be noted that the electronic device may receive data sets, data analyses, and / or data structure information using other means, such as using portable memory modules such as universal storage bus modules or similar. The network communication may be based on Ethernet or other communication protocols using wired or wireless technologies as physical transmission media. Using a communications interface the electronic device may receive relevant information for estimating the accuracy of a differentially private ratio as a service to different entities and the remote entities may perform further processing, such as, generating the two differentially private quantities of the differentially private ratio over a dataset comprising a number of records, e.g. by a DP mechanism. However, the electronic device may also comprise a DP mechanism, i.e. be arranged to perform randomization of a DP query, to generate the two differentially private quantities of the differentially private ratio over a dataset comprising a number of records. As can be seen in Fig. 2, the electronic device 101 comprises at least one processing circuitry 210, which may be one or more processors or processing units, one or more memory 211 for storing data and / or instruction sets for operating functionality, at least one communication interface 215, and optionally a user interface (Ul) 216 interface. The least one processing circuitry comprises one or several modules for operating different types of functionalities, such as an instruction set operation module 220 arranged to operate calculations and other functionality of the processing unit and a communication module 230 for handling receiving and transmitting data via the digital communications network 120. Furthermore, the processing circuitry 210 may comprise a user interface module 240 for handling user interface functionality such as displaying data and functionality on a display 102 and / or receiving user instructions from a keyboard, mouse or other user interface devices (not shown).

[0035] The at least one processing circuitry 210 may comprise any suitable processor or combination of processors arranged to operate instruction sets for operating software functions. For example, the processing unit may be a central processing unit (CPU), microprocessor, digital signal processor (DSP), a graphical processing unit (GPU), a field programmable gate array (FPGA), application specific integrated circuit (ASIC), or any other similar device arranged to operate processing functionality and calculations.

[0036] Memory 211 of the electronic device 101 can include one or more non-transitory computer-readable storage mediums, for storing computer-executable instructions, which, when executed by processing circuitry 210, for example, can cause the computer processors to perform the techniques and actions described below. A computer-readable storage medium can be any medium that can tangibly contain or store computer-executable instructions for use by or in connection with the instruction execution system, apparatus, or device. In some examples, the storage medium is a transitory computer-readable storage medium. In some examples, the storage medium is a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium can include, but is not limited to, magnetic, optical, and / or semiconductor storages. Examples of such storage include magnetic disks, optical discs based on CD, DVD, or Blu-ray technologies, as well as persistent solid-state memory such as flash, solid-state drives, and the like. The computer-readable storage medium stores one or more programs configured to be executed by the one or more processors of an electronic device, the one or more programs including instructions or instruction sets for performing functions and methods as described in this document.

[0037] The electronic device 101 is arranged to operate instruction sets and functionality for operating the computer-implemented method for estimating the accuracy of a differentially private ratio presented herein.

[0038] Definition (Differential Privacy)

[0039] Differential privacy is a quantitative notion of privacy that bounds how much a single individual's private data can affect the result of a data analysis. Formally, differential privacy is a property of a randomized query Q(-). A query Q is a deterministic function representing a data analysis, where Q takes a dataset D in db and returns a vector in R”, i.e., Q-.db -> R”. Here, R” is the space of all n-dimensional vectors of real numbers. The randomized query can be defined as Q(D) = Q(D) + rj, where 77 is a sample of statistical noise, and D is a dataset in db. Thus, <?(■): db -> ”.

[0040] A randomized query Q(-) satisfies (e, ^-differential privacy if and only if for any two datasets D₁ and D2in db, which differ in one row, and for every output set S' c pR1, jt holds that Pr[(?( ) e S] < e£■ Pr[Q(D2) e S] + 8.

[0041] In the definition above, the parameters s, 8 determine a bound on the distance between the distributions induced by Q(-) when adding or removing an individual from the dataset. When the equation above is fulfilled for predetermined s > 0 and 1 > 8 > 0, it can be said that the randomized query meets predetermined differential privacy guarantees.

[0042] When the parameter 8 = 0, the definition above is referred as pure differential privacy, while when 8 > 0 is called approximated differential privacy.

[0043] To protect all the different ways in which an individual's data can affect the result of a query, the noise should be calibrated to the maximal change that the result of the query can have when changing an individual's data. This is formalized through the notion of sensitivity.

[0044] Definition (Sensitivity)

[0045] The (global) sensitivity of a query Q is the quantity Ao= max{|<2( i)>Q (^2) I) f°r tw0datasets D₁ and D2in db, which differ in one row.

[0046] A standard way to achieve differential privacy is adding some calibrated noise to the result of a query, where it is also important the choice of the kind of noise that one adds. A standard approach to achieve pure differential privacy is based on the addition of noise sampled from the Laplace distribution. A standard approach to achieve approximated-DP is based on the addition of noise sampled from the Gaussian distribution.

[0047] Theorem (Laplace mechanism)

[0048] Let Q: db R" be a deterministic query with sensitivityQ. Let Q(-) •• db Rnbe a randomized query defined as Q(D) = Q(D) + 77, where

[0049]

[0050] is sample from the Laplace distribution with mean

[0051]

[0052] = 0 and scale b =Q / E. Then, <?() is (e, O)-differentially private, or simply e-differentialy private. The function generating such sample from the Laplace distribution may be written as Lap^ / e), Lap(A0, e), orLap(A) where A may, e.g., be A = AC / £. The Laplace mechanism may be written as LapMech = <2(£>) + Lap^ / e).

[0053] Theorem (Gaussian mechanism)

[0054] Let Q: db R" be a deterministic query with sensitivity AQ. Let s > 0 and 1 > 8 > 0 be respective parameters. Let Q(-) ■ db R" be a randomized query defined as (?(£>) = <2(£>) + T, where T] is sample from the Gaussian distribution with mean n = 0 and standard deviation

[0055]

[0056] log(1.25 / <5) / e. Then, <?(■) is (e, 5)-differentialy private. The function generating such sample from the Gaussian distribution may be written as Gauss( Q, s, 8\ The Gaussian mechanism may be written as GaussMech = Q(D) + Gauss^^e, 5).

[0057] Fig. 3 illustrates an overall view of a computer-implemented method 300 for estimating the accuracy of a differentially private ratio (r). Here, the differentially private ratio (r) is the division between two differentially private quantities that is generated by a differential privacy (DP) mechanism over a dataset comprising a number of records (c). It should also be noted that the division between two differentially private quantities may either be an average ratio, i.e. a division between a private sum and a private count, or a ratio between two private sums performed over the same dataset. The flowchart in Fig. 3 depicts an illustrated example of actions or operations which may be taken by and performed in an electronic device 101 as discussed previously in this document with reference to Figs. 1-2. The method comprises a number of actions for operating different functions, which are described below.

[0058] Action 301. The electronic device 101 obtains parameters used by the DP mechanism to respond to randomized queries for a dataset. This means, for example, the electronic device 101 retrieves or receives the privacy strategy employed by the DP mechanism. According to some embodiments, obtaining the parameters used by the DP mechanism may comprise obtaining one or more of:

[0059] a noise parameter indicative of a statistical noise distribution applied by the DP mechanism,

[0060] one or more privacy parameters e, 8 indicative of desired differential privacy guarantee applied by the DP mechanism,

[0061] a sensitivity parameter Aoindicative of a query sensitivity applied by the DP mechanism, and

[0062] a confidence parameter (8 indicative of a desired confidence for the accuracy in the DP mechanism.

[0063] Here, it should be noted that the noise parameter indicative of a statistical noise distribution applied by the DP mechanism may be a parameter indicating if the noise distribution is a Laplace or Gaussian distribution.

[0064] Action 302. The electronic device 101 also obtains a differentially private count c and its privacy parameters EC, 8Cof a randomized count query to the DP mechanism for the dataset. This means, for example, the electronic device 101 retrieves or receives a result of a query regarding the count of the data set performed by the DP mechanism.

[0065] Action 303. The electronic device 101 further obtains privacy parameters ES1, 6SIES2, 8S2of one or two differentially private sums

[0066]

[0067] for the dataset. This means, for example, that the electronic device 101 retrieves or receives privacy strategy of at least one sum query for the data set performed by the DP mechanism.

[0068] Action 304. After the obtaining in Actions 301-303, the electronic device 101 approximates the one or two differentially private sums s{,s^ based on the differentially private count c, an error bound acof the differentially private count c, error bounds aSi, aS2of the one or two differentially private sums

[0069]

[0070] and a lower a,a2and an upper b1,b2bound of elements in the one or two differentially private sums s,s2. This means, for example, that the electronic device 101 may, if only one differentially private sum is to be approximated, then the electronic device 101 may determine the accuracy of the average in Action 305 (i.e. between the differentially private sum and the differentially private count); while, if two differentially private sums are to be approximated, the electronic device 101 may determine the accuracy of the ratio in Action 305 (i.e. between the two differentially private sums). Further, the electronic device 101 may determine whether to obtain the accuracy estimation of an average or a ratio of two sums based on the number of obtained privacy parameters and sensitivity information in Actions 301-303. Examples of how the electronic device 101 approximates the one or two differentially private sums s),s^ is described by the following equation Eq. 304a:

[0071]

[0072] It should also be noted that this is also shown, for example, in the equation Eq. 7 in the Appendix wherein the approximations are described in term of the real count of the number of records c. In general, the one or two differentially private sums s,s2^ may be approximated by the electronic device 101 by their confidence intervals in terms of the differentially private count c.

[0073] Action 305. After approximating the one or two differentially private sums

[0074]

[0075] in Action 304, the electronic device 101 estimates the accuracy of a differentially private ratio f by determining an error bound arof the differentially private ratio f that fulfils a predetermined error propagation criteria. Here, in case the differentially private ratio f is a differentially private average avg between the approximation of a differentially private sum and the differentially private count c, the predetermined error propagation criteria require one of the following conditions a) or b) to be satisfied in that:

[0076] a) a relative error ac / |c| of the differentially private count c is to be below a predetermined threshold value y, and that the privacy parameters EC, 8Cof the differentially private count c and the privacy parameter ESI, 8S1of the differentially private

[0077]

[0078] is to satisfy the bounds inequality, bi / eS1< (cii / ec) * (1 - y / 1 + y) and 8C= 8S1, concerning the lower a and upper brbounds of elements in the sum s^, or

[0079] b) the magnitude of the differentially private count c is to be greater |c| > acthan the count’s error bound ac, and that an approximate relative error, ac / (|c| - ac), of the differentially private count c is to be below a predetermined threshold value yc, and that a ratio, bi / (eS1* (|c| - ac)), is to be below a predetermined threshold value ySi.

[0080] Alternatively, in case the differentially private ratio f is a differentially private ratio

[0081]

[0082] between the approximations of two differentially private sums

[0083]

[0084] the predetermined error propagation criteria require one of the following conditions c) or d) to be satisfied in that: c) a relative error ac / |c| of the differentially private count c is to be below a predetermined threshold value y, and that the privacy parameters EC, 8Cof the differentially private count c and the privacy parameter ESI, 8S1of the dividend differentially private sum satisfy the bounds inequality, br / ESI<

[0085]

[0086] * (1 - y / 1 + y) and 8C= 8S1, concerning the lower a and upper brbound of the elements in the dividend differentially private sum s^, and that the privacy parameters ec, 8Cof the differentially private count c and the privacy parameter sS2, 8S2of the divisor differentially private sum s2satisfy the bounds inequality, b2 / ES2(a2 / ec) * (1 - y / 1 + y) and 8C= 8S2, concerning the lower a2and upper b2bound of the elements in the divisor differentially private sum s2, or

[0087] d) the magnitude of the differentially private count c is to be greater |c| > acthan the count’s error bound ac, and that an approximate relative error,

[0088]

[0089] of the dividend differentially private sum

[0090]

[0091] is below a predetermined threshold value ySi, and that an approximate relative error,

[0092]

[0093] of the divisor differentially private sum s2^ is below a predetermined threshold value yS2. This means, for example, that the electronic device 101 may, depending on the applied statistical noise distribution, check an appropriate set of pre-conditions to determine if the error propagation equations may be applied to the differentially private ratio at hand, e.g. a ratio between a private sum and a private count, which constitutes a differentially private average, or a ratio between two private sums performed over the same dataset. Further, as seen in section C.1 of the Appendix below, the detailed derivation of the pre-conditions are described that must be satisfied under the Laplace mechanism. The equation Eq. 13 in the Appendix summarizes the pre-conditions and accuracy estimation when the ratio corresponds to a differentially private average, while the equation Eq. 16 in the Appendix summarizes the pre-conditions and accuracy estimation when the ratio corresponds to a differentially private ratio of sums. Similarly, section C.2 in the appendix comprise the detailed derivation of the pre-conditions for the Gaussian mechanism; here, the equation Eq. 25 in the Appendix summarizes the pre-conditions and accuracy estimation when the ratio corresponds to a differentially private average, and the equations Eq. 27-31 in the Appendix summarizes the pre-conditions and accuracy estimation when the ratio corresponds to a differentially private ratio of sums. When the Gaussian mechanism is applied, the electronic device 101 may check the pre-conditions, as described in Section C.1 in the appendix, as well as, those described in Section C.2 of the appendix. Then, if both conditions are satisfied, the electronic device 101 may, for example, apply the approach yielding the tightest (i.e. smallest) error estimation. This is possible because the approach described in Section C.1 in the Appendix is non-parametric. This means that this approach does not depend on the distribution of the noise; contrary to, for example, the approach described in Section C.2 in the Appendix that is parametric on the Gaussian distribution. This is also illustrated in Fig. 4 wherein the electronic device 101 comprise an accuracy estimator 400 or module. The accuracy estimator 400 may obtain the input signals 401-405 as described in Actions 301-303 above, and output the error bound ar, 411. In other words, the accuracy estimator 400 may use standard parameters from differentially privacy, DP, for the accuracy analysis, such as, the statistical noise distribution type (e.g. Laplace or Gaussian), the privacy parameters (e.g. s and 8 of the one or two sums), the sensitivity of the analysis (i.e. the sensitivity of the count and one or two sums), and the confidence parameter, (8. Additionally, the accuracy estimator 400 may use the result of a DP count along with its privacy parameter. Based on this information, the accuracy estimator 400 may determine error bounds for the ratio whether it is an average or a ratio of sums.

[0094] According to some embodiments, the electronic device 101 may select a corresponding error propagation criteria condition a), b), c), or d), to be applied based on the differentially private quantities of the differentially private ratio f and on the DP mechanism generating the differentially private quantities. For example, the error propagation criteria condition a) may be selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio f is the differentially private average avg. Also, the error propagation criteria condition c) may be selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio f is the differentially private ratio between the approximations of two differentially private sums Further, the error propagation criteria condition a) and / or b) may be selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio f is the differentially private average d g. Furthermore, the error propagation criteria condition c) and / or d) may be selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio f is the differentially private ratio

[0095]

[0096] between the approximations of two differentially private sums

[0097]

[0098] This means, for example, that the electronic device 101 may apply any statistical noise distribution, e.g. Laplace or Gaussian, and be used to provide suitable random numbers for differential privacy mechanism, and still ensure suitable estimations of the accuracy of differentially private ratios.

[0099] In some embodiments, the electronic device 101 may also estimate a minimum number of records cminrequired in order for the relative error bounds ac / |c| of the differentially private count c to be below the predetermined threshold value yc. This means, for example, that the electronic device 101 may provide the minimum number of records required to satisfy the conditions as determined by the equation Eq. 4 in the appendix. This may then advantageously be used, for example, by a user as a benchmark to validate the estimation. This is also illustrated in Fig. 4 wherein the electronic device 101 comprising the accuracy estimator 400 which, besides the error bound ar, 411, also may output the minimum number of records 412 required to satisfy the conditions.

[0100] In Fig. 5, the electronic device 101 may further comprise a parameter tuner 511. Here, the electronic device 101 may comprise the parameter tuner 511, an DP engine / mechanism 512, and the accuracy estimator 400 shown in Fig. 4. Besides the input signals 401-405 as described in Actions 301-303 above, the electronic device 101 may obtain an input signal comprising the private dataset 501 and an input signal comprising an estimated number of records 502. Here, it should be noted that the satisfiability of the conditions for error propagation depends on several factors, including the relationship between the number of records in the dataset and the privacy parameters of the private count and sums queries. As described above, the parameter tuner 511 in the electronic device 101 may leverage this relationship by, for example, utilize an estimate of the dataset size (i.e. an estimate number of records 502 in the data set, e.g. obtained from the user) to recommend an appropriate strategy for setting the privacy levels for the count and sum queries. After the privacy parameters are set for the count and sum queries, a DP mechanism 512 in the electronic device 101 may determine the DP count based on the obtained private dataset 501. The accuracy estimator 400 in the electronic device 101 may then proceed to estimating the accuracy by determining the error bounds for the ratio based on the determined DP count. The electronic device 101 may thus, for example, output the error bounds 411, the minimum number of records 412 required to meet the error propagation conditions, the chosen privacy levels or parameters for the count and sum queries (i.e. the privacy strategy 521), and the result of the DP count 522. As shown in Fig. 6-8, the parameter tuner 511 in the electronic device 101 may operate in three different modes as described below.

[0101] According to some embodiments and in a first mode depicted in Fig. 6, the parameter tuner 511 in the electronic device 101 may obtain desired privacy parameters EC, 8Cfor the differentially private count c. Thus, the parameter tuner 511 in the electronic device 101 may estimate a minimum number of records cminrequired in order for the relative error bounds ac / |c| of the differentially private count c to be below the predetermined threshold value ycbased on the obtained desired privacy parameters EC, 8C. This means, for example, that the parameter tuner 511 in the electronic device 101 may, in a first mode as shown in Fig. 6, determine the minimal number of records 521a required to satisfy the preconditions for the ratio’s error estimation depending on the desired level of privacy for the private count, i.e. the count’s privacy and confidence parameters EC, 8Cmay be inputs 601, 602 to the parameter tuner 511 in Fig. 5. This is described by equation Eq. 4 in the appendix. Additionally, in this first mode, the parameter tuner 511 in the electronic device 101 may also suggest the minimal privacy parameters 521b for the sums that are likely to satisfy the preconditions. This is described by equation Eq. 32 in the appendix. This first mode is thus useful as an initial exploration before expending the existing computer processing budget on the private count that is required for the error estimation of the ratio.

[0102] According to some embodiments and in a second mode depicted in Fig. 7, the parameter tuner 511 in the electronic device 101 may obtain a number of records in the dataset for a differentially private count c and the privacy parameters sc,8cfor the differentially private count c. The electronic device 101 may then estimate tuned privacy parameters E'SI, 8'S1s'S2, 8’S2for one or two differentially private sums

[0103]

[0104] based on the obtained number of records c in the dataset. Thereafter, the electronic device 101 may perform the estimation of the accuracy of a differentially private ratio f based on the privacy parameters EC, 8Cfor the differentially private count c, as well as, the tuned privacy parameters e'Si, <5'S1; E'S2, 8'S2for one or two differentially private sums

[0105]

[0106] This means, for example, that the parameter tuner 511 in the electronic device 101 may obtain the result of the DP count together with its corresponding privacy parameters and return the minimal privacy parameters for the sums. This is performed according to equation Eq. 32 in the appendix. This second mode advantageously allows a user that has already obtained information about the number of records in the dataset by performing a DP-count to determine the privacy parameters for the sums such that the preconditions for the error propagation equations are likely valid, hence offering insights in the settings of a DP mechanism for the private dataset.

[0107] According to some embodiments and in a third mode depicted in Fig. 8, the parameter tuner 511 in the electronic device 101 may obtain a set of estimated number of records cestin the dataset. The electronic device 101 may then generate a set of different privacy parameters E'C, 8'Cfor the differentially private count c, as well as, a set of different privacy parameters E'S, 8'Sfor the one or two differentially private sums

[0108]

[0109] based on the obtained set of estimated number of records cestin the dataset. Here, the electronic device 101 may also determine the minimal pair of different privacy parameters from the set of different privacy parameters e'c, 8'cfor the differentially private count c and the set of different privacy parameters e's, 8'sfor the one or two differentially private sums

[0110]

[0111] required in order for the relative error bounds ac / |c| of the differentially private count c to be below predetermined threshold values ys, yc. This means, for example, that the parameter tuner 511 in the electronic device 101 may obtain a range of maximal values for the ratio’s privacy parameters [(E, 5)1;(E, 5)2,... ] 801, as well as, a range of estimates for the number of records in the dataset [cesti, cest2,...] 802, and then provide the minimal privacy parameters 803 for the count (see equations Eq. 33-34 in the appendix) and the sums (see equations Eq. 32 in the appendix) for each combination ((E, 8),, cest) such that they are likely to satisfy the preconditions for the ratio’s error estimation. This third mode advantageously allows a user to minimise privacy levels while still meeting the conditions, and thus be able to increase the privacy protection and saving in on the computer processing budget for the differential privacy calculations. Thus, the third mode is useful to assist users to explore different privacy strategies for the count and sums that are likely to satisfy the preconditions for the ratio’s error estimation. Further examples on possible outputs from the parameter tuner 511 in the electronic device 101 for each of the three modes as described in Section C.3 in the appendix.

[0112] In some embodiments, the parameter tuner 511 in the electronic device 101 may determine a pair of different privacy parameters from the set of different privacy parameters e'c, 8'cfor the differentially private count c and the set of different privacy parameters e's, 8'sfor the one or two differentially private sums s),s^ based on a set maximum value for the ratio’s privacy parameters er, 8rthat still fulfils the predetermined error propagation criteria. This means, for example, that the electronic device 101 may obtain an appropriate strategy for determining the privacy levels for the differentially private count and sum (or sums), based on the desired level of protection for the overall ratio computation. Action 306. After estimating the accuracy of a differentially private ratio f by determining an error bound arof the differentially private ratio f in Action 304, the electronic device 101 may provide information indicating one or more of: the determined error bounds arof the differentially private ratio f, the estimated minimum number of records, the differentially private count c, the estimated tuned privacy parameters s'c, 8'cfor the differentially private count c, the estimated tuned privacy parameters (S1,6'S1; s'S2,8'S2for the one or two differentially private sums s, and the minimal pair, or pair of, of different privacy parameters from the set of different privacy parameters e'c, 8'cfor the differentially private count c and the set of different privacy parameters e's, 8'sfor the one or two differentially private sums This means, for example, that the electronic device 101 may, after the determining the error propagation conditions under which the equations in Action 305 may be applied in the context of differential privacy, offer insights to a user regarding the minimum number of records necessary for their application, e.g. to a user via a display 102 or by transmitting the result to a remote query device 110. The electronic device 101 may here also recommend an appropriate strategy to the user for determining the privacy levels for the private count and sum by generating different strategies with their corresponding minimal number of records and automatically selecting the configuration that better matches the number of records estimation provided by the user. Additionally, by taking the maximum privacy parameter for the average (or the ratio of sums) and the estimated number of records from the user, determining the minimal values for the count’s and sum’s privacy parameters that satisfy the error propagation condition, and returning the suggested values for all the privacy parameters, the electronic device 101 may here recommend to a user an appropriate strategy for determining the privacy levels or parameters for the private average or ratio of sums, DP count and DP sum. APPENDIX

[0113] A BACKGROUND

[0114] Large amounts of data are being collected about subjects (individuals) by a variety of organizations like research institutions or companies. However, much of the collected data is private: it contains details about subjects and their behavior. Privacy concerns about subjects restrict the way this information can be used and released, where utilizing subjects’ data is therefore curbed for ethical, legal, or business reasons. It is often believed that data can be anonymized somehow in order to preserve the privacy of individuals. While a step forward, simply anonymizing data loses its effectiveness when additional knowledge can be exploited. Differential Privacy (DP) [3] enables to write data analyses to release statistical information about the population without compromising data subjects’ privacy. A standard way to comply with the DP definition is by adding (carefully calibrated) statistical noise into the results of data analyses. While an effective method to protect individual’s privacy, the noise added to the data analyses affects their accuracy. Estimating the accuracy of a DP query can be done through empirical or theoretical means. The empirical analysis involves executing the query repeatedly on synthetic data, measuring error as the difference between the values produced by the queries with and without the addition of noise. Theoretical analyses aim to provide probabilistic error bounds via the noise distribution’s inverse cumulative distribution function (iCDF), generating a confidence interval for where the unprotected result (i.e., without noise) lies. Though empirical methods offer tighter estimations, they are computationally demanding and depend on the accuracy of the synthetic data, thus they are less desirable.

[0115] While DP’s composability enables the creation of complex analyses (e.g., histograms and clustering analyses) by combining simpler ones with known privacy guarantees (e.g., a noisy count or a noisy sum), accuracy reasoning is less compositional. Most DP frameworks and tools lack support for tracking and reasoning about queries’ accuracy, whether empirically or theoretically [10, 2, 1, 8, 13, 15, 17, 16, 12, 5]. Although frameworks like GUPT

[0011] , PSI [6], Apex [7], and OpenDP [4] integrate confidence intervals or error bounds for simple queries, they lack a general solution for complex ones - that is, those relying on the aggregation of results. On the other hand, DPella [9] combines theoretical error bounds with concentration bounds for the accuracy of simple queries and those formed as a linear aggregation of results produced by DP queries, yet it faces limitations with more complex queries like averages and ratios (i.e., non-linear combinations). Error bounding average calculations pose significant challenges as the noise distribution arises from the ratio between two random variables', one for the noisy sum and one for the noisy count. Analytically computing this ratio’s distribution is non-trivial. In OpenDP, average calculation accuracy is addressed by “eliminating” one random variable. This method involves the analyst estimating the dataset’s record count and then sampling or imputing data accordingly. If the provided count is smaller than the actual value, the system samples the guessed number of records; if it is larger, it imputes missing data with a provided default value. The noisy sum is then computed over the sampled or imputed records, and the noisy average is calculated as the noisy sum over the guessed number of records. Since the record count is treated as constant and the noise distribution of a random variable divided by a constant is known, error estimation for the average calculation becomes straightforward. While a resourceful approach, this method relies on the analyst’s guess, which may be inaccurate due to the analyst’s disconnection from the dataset and does not account for errors in guessing.

[0116] The pursuit of accuracy estimations under noise or uncertainties extends beyond private data analysis. In physics, for instance, understanding measurement errors and how they propagate through operations — known as error propagation — is fundamental to the day-to-day work of physics. This issue has been extensively studied and addressed through various methods. In "An Introduction to Error Analysis" by I. R. Taylor

[0014] , equations are provided to handle uncertainties in measurements and their operations, particularly in determining error in the ratio of two measurements with uncertainties, assuming instrument errors are both independent and small. If we were to view the noisy sum and count as similar to two measurements with associated uncertainties, these equations could potentially estimate the accuracy of a noisy average. However, in the context of differential privacy, where the magnitude of noise introduced to protect privacy can vary considerably, the assumption of dealing with small uncertainties is not directly applicable.

[0117] B DEFINITIONS AND NOTATIONS

[0118] Differential Privacy (DP) is a quantitative notion of privacy that bounds how much a single individual’s private data can affect the result of a data analysis. Formally, differential privacy is a property of a randomized query Q -) that representing the data analysis, as follows.

[0119] Definition 1 (Differential Privacy [3])

[0120] A randomized query Q(-): db —> R satisfies (s, 6) -differential privacy if and only if for all pairs of neighboring datasets £>i and £>2 in db differing in at most one element, and for all measurable sets 5 in the range of Q (i.e., 5 c R), it holds that

[0121] Pr[C(£>i) e S] < eePr[G(£>2) e S] + <5.

[0122] In the definition above, the parameters (s, 5) determine a bound on the distance between the distributions induced by Q -) when adding or removing an individual from the dataset. When the parameter 5 = 0, the definition above is known as pure-DP, while when d > 0 is called approximated-DP.

[0123] To protect all the different ways in which an individual’s data can affect the result of a query, the noise needs to be calibrated to the maximal change that the result of the query can have when changing an individual’s data. This is formalized through the notion of sensitivity.

[0124] Definition 2 (Sensitivity [3])

[0125] The sensitivity (global) of a deterministic query is a measure of how much the result of the query can change when adding or removing an individual from the dataset. Concretely the sensitivity of a query Q (•): db — » R is defined as the quantity:

[0126] Ae= max{|2(£>i) - 2(£>2)|}

[0127] for £>i, £>2 differing in at most one row.

[0128] 2 A standard way to achieve DP is adding some carefully calibrated noise to the result of a query, where it is also important the source of noise that one adds. A standard approach to achieve pure-DP is based on the addition of noise sampled from the Laplace distribution, this method is known as the Laplace mechanism.

[0129] Theorem 1 (Laplace Mechanism [3])

[0130] Let Q(-): db — > IR, be a deterministic query with sensitivity AQ. Let Q(-): db — » IR, be a randomized query defined as

[0131] 2(D) = 2(D) + Lap

[0132]

[0133] where Lapi-^j denotes the Laplace distribution with scale mean = 0 and scale b =

[0134]

[0135] Then, Q -) is (s, 0) -differentially private, or simply s -differential private.

[0136] A standard approach to achieve approximate-DP is based on the addition of noise sampled from the Gaussian distribution, this method is known as the Gaussian mechanism.

[0137] Theorem 2 (Gaussian Mechanism [3])

[0138] Let Q(-): db — > ft be a deterministic query with sensitivity AQ. Let Q(-): db — » ft be a randomized query defined as

[0139]

[0140] where s > 0, 8 e (0, 1), and N ^2 * log ( i-25 / rs) * (Ao / e)j denotes the Gaussian distribution with scale mean ji = 0 and standard deviation a = -^2 * log(i-25 / >5) * (A<? / e)- Then, >(•) is (s, 8) -differentially private. In general, the notion of accuracy using confidence intervals can be defined as follows.

[0141] Definition 3 (Accuracy [3])

[0142] Given an (s, < S)-differentialy private query Q( ), a target deterministic query Q(fi), a distance function d(-), a bound a, and the probability ft; Q(fi) is (d(-), a, / ^-accurate with respect to Q(-) if and only if for any dataset D, it holds that

[0143] Pr[d(£ (£>), £ (£>)) > a] < P

[0144] This definition allows one to express data-independent error statements such as: with probability at least 1 -ft the result of the query Q(fi diverges from the result of Q(-), in terms of the distance d(-), for at most a. Then, we will refer to a as the error, ft as the confidence probability, and [-a, a] as the confidence interval. For the rest of the document, the considered distance function is that on real numbers: d(x, y) = |x - y|. There are known results about the accuracy of queries using the Laplace and Gaussian Mechanisms. Definition 4 (Accuracy for the Laplace Mechanism [3])

[0145] Given an s-differentially private query Q(fi): db —> El implemented with the Laplace Mechanism, it holds that:

[0146]

[0147] Definition 5 (Accuracy for the Gaussian Mechanism [3])

[0148] Given a (s, 8) -differentially private query Q -): db ft implemented with the Gaussian Mechanism, it holds that:

[0149]

[0150]

[0151] whit standard deviation a = \l2 * log ( 1 -25 / c5) * (Ao / e).

[0152] These definitions use the inverse cumulative distribution function (iCDF) of the noise distribution to provide the corresponding error bounds. Concretely, from the definitions above we have that the iCDF of the Laplace distribution is given by icdf(Z>, ft) = log ( JB) *Ao / e, and the iCDF of the Gaussian distribution is given by icdf(cr, / ?) = a * -^2 * log / ).

[0153] In the field of physics, reasoning about the uncertainties in measurements and how they propagate through operations is a fundamental task. In the book “An Introduction to Error Analysis”

[0014] , Taylor presents an algebra of error propagation assuming small and independent errors on the measurements being combined. In particular, the author provides a formula for the error propagation for the ratio of two independent measurements with uncertainties, and a general formula for computing the standard deviation of a Gaussian distributed random variable computed as the combination of two independent Gaussian variables.

[0154] Definition 6 (Error propagation for the ratio of two measurements

[0014] )

[0155] Given two measurements x and y with uncertainties 6Xand 6y, the error propagation for the ratio r = * / y is given by:

[0156]

[0157] with 'L / l.vl andAv / |y | being small.

[0158] Definition 7 (Error propagation for combination of two Gaussian variables

[0014] )

[0159] Given two measurements (samples) x and y from two independent gaussian variables with small deviationsxandy, the result of the computation f(x, y) can be approximated as:

[0160]

[0161] where pxand pyare the means of the gaussian variables, and f / dx and f / dy are the partial derivatives of f with respect to x and y respectively. Then f(x, y) is gaussian distributed with mean Pf = f px,py) and standard deviation:

[0162]

[0163] This patent invention focuses on using error propagation for the ratio of two measurements to estimate the accuracy of a differentially private average. As such, we define the differentially private average as the ratio of two differentially private queries: a count and a sum. Concretely, we define the DP average and its privacy guarantees as follows:

[0164] Definition 8 (Differetially Private Average)

[0165] Given an (sc, dc-differentially private count c and an (s.v, 6S) -differentially private sum s. Then avg = 4 is an (sc+ ss, 6C+ 6S) -differentially private average of the dataset.

[0166] 4 Given that the distribution of the resulting random variable avg is unknown, as it arises from the ratio of two random variables, this work proposes to use the error propagation for the ratio of two measurements to estimate the accuracy of the differentially private average as follows:

[0167] Definition 9 (Accuracy for a non-parametric Differentially Private Average)

[0168] Given an (sc, 6C) -differentially private count c with error bound computed as ac= icdf(Ar / ec, / ?c), and given an (s.v, 6S) -differentially private sum s with error bound computed as as= icdf(A / es, / ?.?)• If “c / |c| and “s / |.v| are small, then the query avg =s / c has an error bound aavgand confidence ft = ftc+ fts given by:

[0169]

[0170] where s and c are the true sum and count of the dataset, respectively.

[0171] In the definition above, no assumptions are made about the noise distribution of the count and sum, however, when dealing with DP operations using the Gaussian mechanism we can provide a more specific definition for the accuracy of a DP average.

[0172] Definition 10 (Accuracy for a Differentially Private Average under the Gaussian Mechanism) Given an (sc, < SC) -differentially private count c computed using the gaussian mechanism with standard deviationcand an (sv, 5v) -differentially private sum s computed using the gaussian mechanism with standard deviations. Ifcandsare small, then the query avg =s / c has an error bound aavggiven by:

[0173]

[0174] where s and c are the true sum and count of the dataset, respectively, and

[0175]

[0176] C DETAILED DESCRIPTION

[0177] The invention introduces a new method for estimating the accuracy of differentially private averages. With this method, the system can determine, with high probability, whether the conditions for applying error propagation equations are met. Specifically, we enhance the accuracy estimation process to not only yield the error bound of the average but also to:

[0178] • Provide insights into the minimum number of records necessary for satisfying the conditions of the error propagation equations. With this information, analysts can gauge how realistic the system’s requirements are and fine-tune analysis parameters accordingly.

[0179] • Recommend an appropriate strategy for determining the privacy levels for the private count and sum based on the desired level of protection for the overall average computation.

[0180] 5 C.l NON-PARAMETRIC AVERAGE

[0181] In order to estimate the accuracy of a differentially private average using the non-parametric approach we need to satisfy two preconditions, namely:ac / \c\ < ycand “s / l’l 7s, where ycand y, are small quantities. For simplicity, we take yc= ys= y. If these conditions are met, we can apply the error propagation formula for the ratio of two measurements with uncertainties as presented in Definition 9.

[0182] To test the correctness of the error estimation, we compare the theoretical error bound with the empirical error computed from the noisy average. Specifically, for a given dataset with c records, and privacy parameters scand e„ we can take the confidence parameter / 3, called to vary between the range [0.005,0.3]. For each value of / %. we can compute several DP-counts and DP-sums to obtain empirical and theoretical values for aavg. Concretely, the empirical error is defined as the absolute value of the difference between the noisy average and the true average, while the theoretical error is determined by the error propagation formula from Definition 9:

[0183]

[0184] Moreover, for each pair of sampled (c, s) we check whether or not the conditions are satisfied and provide validity percentages of all the samples defined as:

[0185] # of samples where °t / |c| < y # of samples where “s / l’l 7 vahdc= - valid, = - # of samples ' # of samples

[0186] We can then calculate an empirical value for / 3, called / femp, by checking the proportion of empirical errors tavg emp that are above the theoretical bound computed using the non-parametric formula tavg-th- A correct estimation of the error bound should yield / femp< Pth, indicating that the error estimation is indeed an upper bound of the real error.

[0187] In FIG. 9 and FIG. 10, we show examples of the correctness exploration. Concretely, FIG. 9 depicts the case where c = 32000, sc= 0.8, ss= 0.2, y = 0.1, and the preconditions are always satisfied, this is evident by the fact that all cases are marked as • and the validity percentages (validcand valid,) are 100%. In this scenario, we always obtained a correct error estimation, as the values of / fempremain lower than those of On the other hand, FIG. 10 shows the case where there are not sufficient records (c = 10) to satisfy the preconditions, we can see that this is the case since all points are marked as X and the validity percentages are 0%; here we obtain an incorrect error estimation as the empirical error always surpasses the empirical bound. A more detailed depiction of some of the results obtained in this test can be found in Table 1. These experiments highlight the importance of satisfying the preconditions for the error propagation equations from Definition 9. To estimate whether or not the conditions are likely to be satisfied we provide an upper bound over the upper limits (i.e., the maximum values) for both the DP-count and the DP-sum. If we can ensure (with a certain probability) that these upper bounds satisfy the preconditions, then we can be confident that the error propagation equations are likely to hold. Concretely, we want to find uppercand upper, such that “c / |c| < uppercand “s / l ’l upper,. Then if we can ensure that upperc< y and upper, < y,

[0188]

[0189]

[0190] Table 1: Results for the experiments in FIG. 9 and FIG. 10

[0191] we can conclude that the preconditions are likely to be satisfied.

[0192] Let’s start by considering the case of the DP-count, where the error bound is given by ac= icdf(A<- / ec,^c):

[0193] with prob. (1 - / 3C)

[0194] by reverse triangular inequality

[0195] (1)

[0196]

[0197] To check if “c / |c| < y we can see if its upper limit is also less or equal to y, this is:

[0198]

[0199] From this analysis, we can conclude that there is a minimum number of records required to satisfy the first preconditions, concretely from equation (2), we have:

[0200]

[0201] we use this result to determine the minimum number of records necessary to satisfy the conditions of the error propagation equations, we call it cm;n.

[0202]

[0203]

[0204] We can elaborate on the upper bound for the sum following the same approach as that of the count, where the error bound is given by as= icdf(A.s / e.s,?v) with Av= max{|a|, |Z?|}, and a, b the lower and upper bounds of the values in the dataset, respectively.

[0205] | J - s| < aswith prob. (1 - ps)

[0206] => ||s| - |s|| < |s - s| < asby reverse triangular inequality => ||s| - s| < as

[0207] => -as< |J| - s < <r

[0208] => s - as< |J| < s + as

[0209] = c * a - as< s - as< |s| < s + a < c * b + assince c * a < s < c * b

[0210] =^> c * a - as< |J| < c * b + as

[0211] c * b1+ as< ~ |J1| < ~ c * a1- as

[0212] asasas

[0213] (5) c * b + as~ |J| - c * a - as

[0214] As with the count’s invariant, we check if “s / l’l < 7 by analyzing its upper limit:

[0215] as0'

[0216] — < - - - y

[0217] |.s| c * a - as

[0218]

[0219] Since a < b this inequality can only be satisfied when ss> scand a + 0. Then we conclude that for a < b, a + 0, pc= ps, and asand ascomputed using the Laplacian mechanism, the following implication holds:

[0220]

[0221]

[0222] and consequently, the conditions for applying the error propagation are likely to be satisfied.

[0223] Observe that the previous equations require access to the true count c, which is not available in practice, instead, we would like to use the value of the differentially-private count c. Moreover, when inspecting the formula for averages’ error estimation it is clear that the error bound is dependent on the DP-count’s value, as well as the DP-sum’s result. In order to provide feedback as soon as possible to the analyst, before committing to spend the budget on both the count and the sum, we propose to use the DP-count’s value to provide a lower bound on the result of the sum corresponding to the practice of spending some privacy budget into performing a DP-count and obtaining the size of the database for which the average can then be computed. This way, we will be able to compute the average’s error bound (and its preconditions) using only the DP-count’s value. Specifically, we define the function s( |c|) such that s( |c|) < |s| and we want to satisfy the condition “s / .v(|c|) < y.

[0224] ||s| - s| < as<=> -as< |s| - s < aswith prob. 1 - / 3S

[0225]

[0226] We know (with probability 1 - / 3C) that |c - c| < ac, and by inverse triangular inequality it must be the case that ||c| - c| < ac; expanding we have:

[0227] | |c| - c| < ac<=> -ac< |c | - c < ac; with prob. 1 - [ic

[0228] <=> c - ac< |c | < c + ac

[0229] => a * |c| < a * c + a * ac

[0230] <=> a * |c| - as< a * c + a * ac- as

[0231] <=> a * |c| - as- a * ac< a * c - as

[0232] <=> a * (|c| - ac) - as< a * c - as(8) From (7) and (8) we get

[0233] a * (|c| - ac) - as< a * c - as< |s|; with prob. (1 - / 3S) * (1 - / 3C) => a * (|c| - ac) - as< |s|

[0234] 0's 0's

[0235] (9) |s| ~~ a * (|c| - ac) - as

[0236] Now that we have found a lower bound for | J| in terms of the noisy count |c|, we need to check under which conditions this value will satisfy sum’s invariant “s / l’l 7- Let’s inspect the count invariant:

[0237]

[0238]

[0239] From (9) and (10) we have:

[0240]

[0241] [ a * ac* 1 - y)

[0242] <=> av< y * - as

[0243] \ y

[0244] as< a * ac* (1 - y) - y * as

[0245] as+ y * as< a * ac* ( 1 - y)

[0246] <=> ay * ( 1 + y) < a * ac* ( 1 - y)

[0247] _ as<, a * ac* - - y

[0248] \ 1 + y

[0249] / 1 \ b / 1 \ 1 ( 1 - y\

[0250] <=> log — * — < a * log — * — * -; for Laplace \Ps ) \Pc j sc\ l + y /

[0251] b a / 1 - y \

[0252] <=> — < — * -; when pc= ps

[0253] ESEC\ 1 + y

[0254] Finally, we conclude:

[0255]

[0256] => — < y; with prob. (1 - ps) * (1 - pc) (11) Observe that this condition assumes the Laplace mechanism is used for the DP-sum, however, the same analysis can be done for the Gaussian mechanism:

[0257] 10

[0258]

[0259] yielding the same condition as the one for the Laplace mechanism with the assumptions that pc= psand 6C=S.

[0260] At this point, we have found a way to provide preconditions for the error propagation equations using only the result of the DP-count, now we would like to propose a new equation for the error bound of the average that does not depend on the result of the DP- sum but rather on an approximation in terms of the DP-count. Recall the formula for computing average’s error a la Taylor aavg= |’ / c| * (“c / |c| + “s / l’l)> withac / \£\ 7 and “s / l’l 7- Moreover, we know that, given certain conditions, “s / l’l “’ / «* (Rl -ac) - as< y by (11). Then we propose the following upper bound for aavgwhen using the Laplace Mechanism:

[0261]

[0262] with a, b, |c| > 0 and / 3C= Ps-

[0263]

[0264] Table 2: Results for the experiments in FIG. 11 and FIG. 12 where Ah = 0.05 and a = 1

[0265] We would like to test if this error bound is appropriate, and if the preconditions derived in (11) are sufficient to ensure this equation is applicable. In other words, we want to check if the following implication holds:

[0266]

[0267] To do so, we take several values for the privacy parameters scand sv, importantly, we only consider the cases where ss> scsince we need to satisfy the inequalityb / es< « / ec* (i-r / i+y). For each pair of privacy parameters, we compute the minimal number of records required to satisfy count’s precondition cmjnusing equation (4) and generate a synthetic dataset with cmmrecords with values within the range [a, b\. Over this dataset, we compute the real and noisy average (under the Laplace Mechanism), together with its sub-queries, and we compare the theoretical error bound (as proposed in equation (12)) with the empirical error. As with previous experiments, when analyzing the proportion of empirical errors surpassing the theoretical error bound, we expect to have Amp < Ah- In FIG. 11 and FIG. 12, we show the results of the experiments for the error estimation of the average independent of the DP-sum’s result. Concretely, FIG. 11 depicts the case where a = 1, b = 10, y = 0.1, and Ah = 0.05. In this case, we can see that all cases satisfy the first conditionac / \c\ with high probability, as the validity percent is always above 98% (i.e., there are no cells marked as <> ). Unfortunately, this is not the case for the second condition, as the majority of cases are marked as > indicating thatb / es> « / ec* Y where Y = (i-r / i+y) and consequently rendering the error estimation invalid. These results foreshadow the importance of correctly distributing the privacy budget between the count and the sum, as well as the necessity of having a big enough dataset to ensure the applicability of the error estimation. Observe that for those cases where the conditions hold, the error empirical error remains below the theoretical one as desired (these are the cases of the cells marked as • ) which indicates that the conditions are an appropriate constraint to ensure the correctness of the error estimation.

[0268] FIG. 12 shows the case where the range of data is increased to b = 100, the effect of this change is that there are even more cases where the second preconditionb / es< « / ec* Y is not satisfied, leading to a higher proportion of cells marked in yellow, this is because sum’s sensitivity is determined by the upper bound b, then, the bigger b, the bigger s, should be in order to reduceb / es. However, for those cases where the conditions hold, the error estimation remains correct.

[0269]

[0270] Up to this point, we have proposed a new method for estimating the error of a differentially private average that is based on the error propagation for the ratio of two measurements. We have derived our unique error bound for the average that is independent of the DP-sum’s result, as well as the preconditions that are to be satisfied in order for the error estimation to be correct. We have tested this method and inspected that both the error bound is sound and the preconditions are sufficient. What remains to be done is to analyze the tightness of the provided bound. We can do this by inspecting the average’s relative uncertainty “av6(|c|) / avg, the lower this ratio, the tighter the bound.

[0271] In FIG. 13, we show the average’s relative uncertainty for different dataset dimensions and fixed parameters sc= 0.01, ss= 0.5, a = 1, b = 10 and / 3 = 0.05. We can see that the relative uncertainty decreases as the number of records in the dataset increases, nonetheless, the relative uncertainty remains below 1 for all cases, indicating a tight bound.

[0272] In conclusion, we have proposed a new method for estimating the error of a differentially private average that is based on the error propagation for the ratio of two measurements. We have derived our unique error bound for the average that is independent of the DP-sum’s result, as well as the preconditions that are to be satisfied in order for the error estimation to be correct. We have tested this method and inspected that both the error bound is sound and the preconditions are sufficient. Finally, we have analyzed the tightness of the provided bound and found that it is tight for all cases.

[0273] This method can applied to other types of queries, such as the ratio between two DP-sums. Concretely, let Ji and s2be the DP-sums of two different queries over the same dataset or two datasets with the same number of records c. Letsi be computed over values in the range |«|. / q | and s^ over values in the range [a^ b^]. Then the noisy ratio of these two sums defined as

[0274]

[0275] has an error bound a.,, / (c) in function of the DP-count c such that:

[0276]

[0277] where sq and sq are the true sums of the queries and asi / sis determined by the error propagation for the ratio of two measurements (see Definition 6):

[0278] c

[0279]

[0280] with 01,02, |c| > 0. As per the Definition 6, two conditions need to be satisfied in order for the error estimation to be correct: “si / iq | < ySland “^ / ILI < y.v2"bh T.vi and 7s2being small. As before, we analyze the upper limits of these ratios and derive the conditions that need to be satisfied in order to ensure that they are bound by the small values yV1= yS2= y. Let’s inspect the case of one of these ratios, the other case is analogous.

[0281]

[0282]

[0283] As seen before, the case for the Gaussian mechanism is analogous to the Laplace mechanism, with the assumption that

[0284]

[0285]

[0286] C.2 GAUSSIAN AVERAGE

[0287] When the Gaussian mechanism is used for computing the differentially-private average, we propose using Taylor’s approximation to estimate its error bound as specified in Definition 10. This method differs from the previous one in that instead of finding conditions to ensure the validity of an error calculation, we want to find the conditions in which the approximation to the noisy average is valid. Once we have a valid approximation we have a high certainty that the noisy average is drawn from a Gaussian distribution with known parameters, and as such, we can use the error estimation for the Gaussian mechanism using the corresponding iCDF to compute its bound.

[0288] To find the preconditions for the approximation to be valid, we can use the same approach as before, where we consider the extremes of the DP-count and DP-sum. First, let’s interpret Taylor’s approximation for the case of a DP-average:

[0289] 14 > s davg davg

[0290] avg(s, c) = ~ avg(s,c) + — — * (s - - — — * (c -c)

[0291] C S OC

[0292]

[0293] Moreover, let’s consider the following facts:

[0294]

[0295] Now, by looking at the extreme cases of the DP-average (i.e., its upper and lower limits), we can derive under which circumstancess / c is (likely) approximated by the equation (17). Intuitively, if we can ensure that the approximation is valid for the extreme cases, then it will be valid for all cases in between. We will consider four different scenarios:

[0296] 1. Maximum sum (s = c * b, s = c * b + oj and maximum count (c = c + <r(j

[0297]

[0298] 15 From this analysis, we can conclude that Taylor’s approximation holds whenas / c tends to zero. This condition can be expressed asai / c < yswith yssmall.

[0299] Maximum sum (s = c * b, s = c * b + as) and minimum count (c = c - ac)

[0300]

[0301] Once again, the approximation holds whenai / c tends to zero, i.e.,ai / c < yswith yssmall.

[0302] Minimum sum (s = c * a, S = c * a - as) and maximum count (c = c + ac)

[0303]

[0304] As before, the approximation holds whenas / c tends to zero.

[0305] 16 4. Minimum sum (s = c * a, S = c * a - <r and minimum count (c = c - ac)

[0306]

[0307] Similarly to the previous cases, the approximation holds whenas / c tends to zero.

[0308] Based on the observations from 1-4 we can conclude thats / c can be approximated as described in (17) whenac / c< yc, as / c< ys and yc,ysare small, meaning 0 < yc,ysc 1- Observe that the first conditionac / c< ycis derived as an assumption to get the second conditionas / c < ys.

[0309] Now, we expand the second condition to simplify the analysis:

[0310] 0's

[0311] — c < Y.

[0312] O-.5 *2* log(^)

[0313]

[0314] 2* b * log(^) * log(^)

[0315] = -;- — < ys« with big values of c, since 0.5

[0316]

[0317] => < y

[0318]

[0319] s

[0320] To test whether these bounds help provide an appropriate estimation of the average’s error, we devised the following algorithm:

[0321]

[0322] 1. Input Parameters: Start by specifying a range of values for the dataset dimension (the actual count c) and a range for the upper bound of the values in the dataset (b). Additionally, set fixed values for the lower bound a, the privacy parameters scand ss, as well as the confidence parameter for the average’s error, Ah- 2. Standard Deviations and Gaussian Error: For each unique pair (c, b), calculate the standard deviations and Gaussian error for the noisy count and noisy sum, using / 3C= = Ah / 2.

[0323] 3. Pre-conditions Check: Verify if the conditionsac / c< ycandh / (es*c) < ysare met for given values yc, yse (0, 1). If these conditions are not satisfied, mark the iteration as “False pre-cond” and move to the next pair. If they are satisfied, proceed to the next step.

[0324] 4. Generate Random Dataset: Create a random dataset with c values in the interval [a, b], for the fixed a and the b of the current iteration.

[0325] 5. Compute Real Values: Calculate the real sum (s) and the real average (avg) of the dataset.

[0326] 6. Compute Noisy Values: Perform multiple iterations where for each iteration:

[0327] (a) Sample a noisy count (c) from N c, er ).

[0328] (b) Sample a noisy sum (s) from N s, ).

[0329] (c) Compute noisy average as avg =s / c.

[0330] 7. Calculate Average’s Standard Deviation: Use Taylor’s formula to determine the standard deviation of the average:

[0331]

[0332] Then, compute the average’s error bound using Gaussian’s inverse cumulative distribution function (iCDF) as follows:

[0333] tavg - Cavg ' m 2 ■ log Iu I

[0334] \Ah /

[0335] 8. Empirical Error Calculation: Determine the empirical error |avg - avg| for each iteration.

[0336] 9. Empirical Confidence: Calculate the empirical confidence / ?emp by finding the ratio of iterations where the empirical error exceeds the theoretical error. A valid approximation must satisfy / femp< Ah- By following these steps, the algorithm aims to test and validate that the preconditionsac / c< ycandbl(estc) < ysare sufficient to ensure (with high probability) that the conditions for Taylor’s approximation are satisfied, and as such, the random variable described by the noisy average avg =s / e distributes as a Gaussian and the error bound can be estimated using the Gaussian iCDF.

[0337] FIG. 14 and FIG. 15 show the results of testing the preconditions for the error estimation of the average using the Gaussian mechanism with sc= ss= 0.1, d =l / c, and Ah = 0.05. FIG. 14 depicts the case where the preconditions are strict, this is, the values for ycand ysare small (0.01). In this case, we can see that the preconditions are sufficient to ensure the validity of the approximation, since for all the cases where the conditions are met (i.e., the cells are not marked as X ), the empirical error is below the theoretical one

[0338] 18

[0339]

[0340] Table 3: Results for the experiments in FIG. 14 and FIG. 15 where / n = 0.05 and a = 1

[0341] (marked as • cells in the graph). On the other hand, FIG. 15 shows the case where the preconditions are relaxed, this is, the values for ycand ysare increased to 0.9. In this case, the preconditions are still sufficient and more combinations of (c, b) values yield valid error estimations. By comparing these results, we can conclude that while analytically the values for ycand ysshould be small, in practice, they can be relaxed and the conditions will hold to provide a valid error estimation. However, one should consider that the conditionac / crepresents the count’s relative error, then, a reasonable bound for this ratio should not exceed 0.5 requiring a relatively accurate DP count. Table 3 shows a granular view of the results for the experiments in FIG. 14 and FIG. 15.

[0342] We have established that ensuring that the ratiosa- / cand b / (e^c) are small is sufficient to provide a suitable error estimate for a noisy average using Taylor’s approach. However, these quantities depend on secret information (i.e., the real count c) rendering them impractical for deployment. Then, we need to find an approximation for c that is public information, for that we will use noisy count’s iCDF:

[0343] with prob. 1 -c

[0344] by reverse triangle inequality

[0345] since c > 0

[0346] (21)

[0347]

[0348] With these bounds for c, and consequently

[0349]

[0350] we can provide the respective ranges for the ratios:

[0351]

[0352] Observe that ycand ysimpose upper bounds on their respective ratios, as such, we focus on providing a bound for the ratios’ upper limits as follows:

[0353] 19

[0354]

[0355] Table 4: Results for the experiments in FIG. 17, FIG. 18, and FIG. 19 where / 7h = 0.05 and a = 1

[0356] (22) (23)

[0357]

[0358] (24) Besides the two preconditions we had before, we require an extra invariant (24) to ensure that the ratios are never negative and there are no divisions by zero. Now that our preconditions do not depend on secret data, we test if satisfying them is still sufficient to ensure a good error estimate for the noisy averages, in other words, we want to test the following implication:

[0359]

[0360] For this purpose, we follow the same procedure as before.

[0361] FIG. 17, FIG. 18, and FIG. 19 show some results of the described tests. Concretely, FIG. 17 and FIG. 18 depict the cases where the preconditions are strict and relaxed with respect to the bounds ycand ys. In both cases, we can see that the preconditions are sufficient to ensure the validity of the approximation, as in the cases where the conditions are met, the empirical error remains below the theoretical one - marked as •. In both these examples, we use the same inputs as in the previous experiment, with sc= ss= 0.1, d = / c, and / 7h = 0.05. Observe that 6 is defined in terms of the real count c, this is done for simplicity as this value is readily available to us during the test, however, in practice, d could be defined in terms of a public estimation of the number of records in the dataset or any other desired value. When comparing these results with those in FIG. 14 and FIG. 15 we see that the correctness remains the same, however, the combinations of (c, b) values that satisfy the preconditions are reduced in this scenario. This is because the preconditions are stricter, as we are imposing upper bounds on the over-approximations of the ratios.

[0362] 20

[0363]

[0364] Table 5: Results for the experiments in FIG. 20, FIG. 21, and FIG. 22 with a = 1 and 6, = 6S= 104

[0365] Finally, in FIG. 19 we show the case where the sum’s privacy parameter s, is decreased to 0.01, thus increasing the magnitude of the second precondition. As expected, the number of valid combinations of (c, b) values is reduced (when compared with FIG. 17), as the preconditions are harder to satisfy. For instance, see the case where c = 109and b = 105, marked as X indicating that the preconditions are not satisfied, the same cell in FIG. 17 is marked as •, instead. Despite the reduction in the number of valid combinations, from all these experiments we can conclude that the invariants (22) - (24) are sufficient to ensure that the average’s error using Taylor’s approximations yield a good error estimate. For a more explicit comparison, we show in Table 4 the results of the experiments for certain combinations of (c, b) values. Lastly, we can analyze if the provided error bound for the average using Taylor’s approximation is sound, as we did with the non-parametric approach. Concretely, for a given dataset with c records in the range [a, b], privacy parameters sc, ss, and 6C= 6S= 10-4, and Ah varying in the range [0.005,0.3], we can compute the empirical and theoretical errors for the average using Taylor’s approximation. For each value of Ah we have several iterations where we sample a noisy count and sum, and compute the noisy average, with these values we can provide a preconditions’ validity percentage and the corresponding empirical error. Finally, we record the proportion of cases where the empirical error surpasses the theoretical error, named / 3emp, as before, we expect mp < Ah when the validity percentage is high.

[0366] In FIG. 20, FIG. 21, and FIG. 22 we show the results of the experiments for the error estimation of the average using Taylor’s approximation under the Gaussian mechanism. Concretely, FIG. 20 depicts the case where the conditions are always satisfied, i.e., validc = validc= valid., = 100% indicating that preconditions |c| > ac,ac / (\c\-ac) < 0.1 and * / es*(|c|-ac) < 0.1, are met by all the sampled DP-counts. In this case, we can see that the error estimation is correct, as the empirical error is always below the theoretical one. On the other hand, FIG. 21 and FIG. 22 show the case where one of the preconditions is not satisfied. In the first case, the condition * / (es*(|c|-ac)) < ysis not met, however, the error estimation remains correct, indicating that some of the invariants might be too conservative. In the second case, the conditionac / {\c\-ac) < ycis not satisfied, leading to some incorrect error estimations (see points over the diagonal line when Ah < 0.05). From these experiments, we can conclude that the error estimation for the average using the Gaussian mechanism with Taylor’s approximation is sound, as long as the preconditions are satisfied, and the preconditions, while conservative, are sufficient to provide a valid error estimate.

[0367] As done with the non-parametric approach, we can apply this method to other queries, in particular, the ratio

[0368] 21 between two DP-sums. As before, consider si and s2as two noisy sums performed over the same dataset or two datasets with the same number of records c. In this case, both Ji and s2are obtained using the Gaussian mechanism with parameters (sV1, < SV1) and (sV2, 5V2), respectively. Then, according to Taylor’s approximation from Definition 7 we have that under certain conditions, the noisy ratio (Si,2) =s' / s2can be approximated as follows:

[0369]

[0370] ~ r si, s2) + — * (si - si) + — 7 * («2 - «2) (26)

[0371] S'222

[0372] with si and s2the true sums, and r(si, s2) =si / s2. As before, we need to find the conditions that ensure that the approximation in (26) is valid-with a high probability. As such, we inspect the ratios’ extreme cases: 1. Maximum sq (. i = c * b\, Ji = c * b\ + aV1) and maximum s2(s'2 = c * b2,?2 = c * b2+ aS2)

[0373]

[0374] From this analysis, we conclude that Taylor’s approximation for the ratio of two DP-sums holds whenas2 / c<fb2< yS2and yS2is small.

[0375] Observe that a different condition could have been imposed on the equation at (t). Expanding the definitions of aviand aS2and simplifying the expression, we obtain:

[0376] 22

[0377]

[0378] If we take svi= sV2, <5V1= <5V2, and / 3SI= ftS2, then both these ratios are the same, this is “si / c*Z;i = “s2 / c*Z;2= I / J. Then, the equation at (f) becomes:

[0379]

[0380] Thus making Taylor’s approximation to hold. We have opted to use the first condition as it is more general and allows for different privacy parameters for each sum, which can be useful in practice. Maximum q ( q = c * b\, Ji = c * b\ + aV1) and minimum S

[0381]

[0382]

[0383] In this case, Taylor’s approximation holds when “s2 / c*a2 < yS’2and yS’2is small.

[0384] 23 Minimum.s'i (.s'i = c * a i, Ji = c * a\ - aV1) and maximum si (si = c * bi, si = c * bi + aS2)

[0385]

[0386] Minimum.sq (.sq = c * a i, sq = c * a\ - aV1) and minimum si (si = c * ai, si = c * ai - aS2)

[0387] 24tvi c * a\ - a1

[0388] ~ — + — * («1 - si) - * («2 - «2); by approximation (26) sz c * az - aS2Z $Z Sz1

[0389]

[0390] Similarly, Taylor’s approximation holds when “s2 / c*a2< yS'2,a°\ / c*a\ < ySiand y', ysiare small. From the analysis above, we can conclude that the conditions for the ratio of two DP-sums to be approximated by Taylor’s equation are as follows:

[0391]

[0392] with yS2, yS'2, ysibeing small. Observe that these conditions can be simplified, given that <22 <

[0393]

[0394] thenas2 / c*b2<as2 / c*a2, as such, it is enough to impose “s2 / c*a2< yS2.

[0395] Lastly, to express the conditions in terms of the DP-count c instead of the unaccessible true count c, we refer to the limits of the ratio 1 / c as expressed in equation (21). Then, we can provide an upper bound for the conditions as follows:

[0396]

[0397] ai, 12 > 0

[0398] 25

[0399]

[0400] C.3 SUGGESTION SYSTEM (TUNER)

[0401] The Tuner provides users with useful information regarding the privacy parameters and / or the minimal number of records required to satisfy the preconditions for average’s error estimation to be likely valid. The Tuner is designed to work in three different modes of exploration, each of which is useful for different scenarios:

[0402] Mode I (Unknown dataset dimension): This mode is designed to help users determine the minimal number of records required to satisfy the precondition “c / |c| for the average’s error estimation depending on the desired level of privacy for the count sc. In this mode, the Tuner takes as input the desired label of privacy for the count scand its confidence parameter pc, then, based on the equation (4) the system provides the minimal number of records cm;n, additionally, the tuner suggests the minimal privacy parameter for the sum sssuch that it satisfies the preconditionsb / ^mr.ale-- * (1-r / 1+r)- Mode II (Known dataset dimension): This mode is designed for when the user has already obtained information about the number of records in the dataset by performing a DP-count and is interested in determining the privacy parameters for the sum such that the preconditions for the average’s error estimation are likely valid. As such, the Tuner takes as input the result of the DP-count c together with the used privacy budget sc, and produces sSminsuch thath / eSiaill<a / ec* ( ' w / l +y ) is likely satisfied.

[0403] 26 Mode III (Budget optimization)-. This mode is designed to help users explore different privacy strategies for the count and sum that are likely to satisfy the preconditions for the average’s error estimation. In this setting, the Tuner takes a range of maximal values for average’s privacy level [fiavg-max £avg-max2, • • •, £avg-max„]aswell as a range of estimates for the number of records [ci, C2,..., cmJ. The Tuner then provides the minimal privacy parameters for the count sCminand the sum sVminfor each combination (savg-maxPcj) with 1 < i < n; 1 < j < m such that the preconditions for the average’s error estimation are likely satisfied.

[0404] In these descriptions, we assume that the lower and upper limits for the range of values in the dataset (i.e., [a, b]) are known by the suggestion system. Additionally, we referred to the preconditions for the average’s error estimation when using the non-parametric approach with the Laplace mechanism, however, the Tuner can be adapted to work with the other approaches and mechanisms.

[0405] The Tuner is a useful tool for practitioners as it provides them with a clear path to follow when setting the privacy parameters for the average’s error estimation. It is important to note that the Tuner is not a silver bullet, and it is the responsibility of the user to ensure that estimations and inputs reflect the reality of the dataset. To illustrate the Tuner’s functionality on each of its modes, we provide proceed with some examples and tests.

[0406] Exploring Mode I (Unknown dataset dimension). In this setting, we are interested in obtaining the minimal number of records and the minimal privacy parameter for the sum such that the preconditions for average’s error estimation are likely satisfied. We have already seen in equation (4) that the minimal number of records cmmcan be determined based on the desired privacy level for the count scand the count’s parameter / 3Cin such a way that the condition “c / |c| < y holds. To determine the minimal privacy parameter for the sum sVmin, we elaborate on the conditionb / es< « / ec* (1-r / l+r) which applies for both the Laplace and Gauss mechanism:

[0407]

[0408] To illustrate the Tuner’s functionality in this mode, let’s consider several values for the count’s privacy parameter sce [0.001,0.1) and its confidence parameter pce 0.05,0.1,0.2, a = 1, b = 10, and y = 0.1. For each combination (EC, PC we use the tuner to provide the minimal number of records cmmand the minimal privacy parameter for the sum sVmin. Table 6 shows some of the results obtained.

[0409] As we can see, the minimal number of records cmmdecreases as the privacy level for the count scand the confidence parameter p, increases. On the other hand, the minimal privacy parameter for the sum sVminincreases proportionally to the privacy level for the count scas determined by the equation.

[0410] Exploring Mode ll (Known dataset dimension). This mode is similar to the previous one, however, it is designed for when the user has already obtained information about the number of records in the dataset c.

[0411] 27

[0412]

[0413] Table 6: Exploring required dimension and sum’s minimal privacy parameter.

[0414] By taking the count’s privacy parameter sc, using the equation (32) the Tuner provides the minimal privacy parameter for the sum s.Vrain. Note that the suggested value only concerns the satisfiability of the preconditionsb / ^mr.ale- * (1“ i+r)- Exploring Mode Hl (Budget optimization). Lastly, the Tuner’s Mode III is designed to help users explore different privacy strategies for the count and sum that (i) are likely to satisfy the preconditions for the average’s error estimation, and (ii) are minimal in terms of privacy budget consumption.

[0415] Based on an estimated number of records in the dataset c we can determine the minimal value for scthat satisfies the first precondition “c / |c| < y by elaborating on the ratio’s upper limit as follows:

[0416]

[0417]

[0418]

[0419] Observe that while the derivations of the equations (33) and (34) use the real count c, the suggested value for sCminis defined in terms of the estimated count c, thus relying only on accessible information. Users should be aware that the suggested value for scmight not be optimal, as it is based on the estimated count. Once the value for sCminis chosen, we can determine the minimal value for svby applying the equation (32) with varepsilonc= sCmm.

[0420] To illustrate and test the Tuner’s Mode III, let’s consider the following setup: / 7,vg= 0.05, a = 1, b = 10, y = 0.1, focusing on the equations regarding the Laplace mechanism. Now, this mode takes as input exploratory values for average’s maximal privacy level eavgand the estimated number of records c. For this example, we consider £avgm.,x6 [0.001,0.1) and c e [100, 100000]. For each combination (eavg,<?), the tuner will suggest the values for sCminand sVminas per the equations (33) and (32). To test the validity of these suggestions, we follow the next steps:

[0421] 1. Check if the suggested value for sCminexceeds the maximal value savg. If this is the case, mark with X the corresponding cell.

[0422] 2. Define sav„ as the addition of srand

[0423]

[0424] and check if is less or equal to sav„. If this is not the case, mark with A.

[0425] 3. Provided both checks are passed, create a random dataset in the range [a, b\ with cmmrecords. 4. Compute the real sum s and real average avg =s / cmm.

[0426] 5. Use the Laplace mechanism to generate several (e.g., 1000) DP-counts c, DP-sums s, and DP-averages avg = s / c.

[0427] 6. Obtain the error bounds ac, asusing Laplace’s iCDF (see Definition 4) with (3C= (3S= Ah / 2.

[0428] 7. Check the validity of the first condition ‘A / |C| < y as the ratio between the samples satisfying this condition and the total number of samples. We consider the condition to be satisfied if at least 98% of the samples meet it. If the condition is not satisfied, mark with > the corresponding cell.

[0429] 29

[0430]

[0431] Table 7: Results from the example of Tuner Mode III in FIG. 16.

[0432] 8. Check the validity of the second conditionb / es< « / ec* (1-r / i+y). Since only depends on constants, we consider the condition to be satisfied if it holds. If the condition is not satisfied, mark o the corresponding cell.

[0433] 9. If the conditions are satisfied, compute the average’s error bound aavg(cr) as specified in equation (12), and the empirical error |avg - avg|.

[0434] 10. Compute the empirical confidence parameter / fempas the ratio between the samples whose empirical error is less than the error bound.

[0435] 11. Mark with • the corresponding cell in the matrix if the / fempAh, otherwise mark with KI.

[0436] FIG. 16 shows the results for the example described above. As we can see, the suggested values for sCminand sSminconstant for all the values of eavgand are only affected by the changes in c. This is expected as the equations for sCminand s.Vminare independent of £avgm.,x• Instead, £avgm.,xis used as a filter to discard suggestions that exceed the desired level of privacy protection. Another interesting result is that the suggested parameters for the count and sum, whenever they do not exceed the maximal value £aVgm.,x, are valid as they satisfy the preconditions for the average’s error estimation-i.e., no cells are marked as > or o. Table 7 shows some specific results for this example.

[0437]

[0438] D DESCRIPTION OF THE ILLUSTRATIONS

[0439]

[0440]

Claims

1. REFERENCES2.[1] Gilles Barthe et al. “Differentially private bayesian programming”. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 2016, pp. 68-79.3.[2] Skye Berghel et al. “Tumult analytics: a robust, easy-to-use, scalable, and expressive framework for differential privacy”. In: arXiv preprint arXiv:2212.04133 (2022).4.[3] Cynthia Dwork, Aaron Roth, et al. “The algorithmic foundations of differential privacy”. In: Foundations and Trends® in Theoretical Computer Science 9.3-4 (2014), pp. 211-407.5.[4] Marco Gaboardi, Michael Hay, and Salil Vadhan. “A programming framework for opendp”. In:6.Manuscript, May (2020).7.[5] Marco Gaboardi et al. “Linear dependent types for differential privacy”. In: Proceedings of the 40th annual ACM SIGPLAN- SIG ACT symposium on Principles of programming languages. 2013, pp. 357- 370.8.[6] Marco Gaboardi et al. “Psi ({\Psi}): aprivatedata sharing interface”. In: arXiv preprint arXiv: 1609.04340 (2016).9.[7] Chang Ge et al. “Apex: Accuracy-aware differentially private data exploration”. In: Proceedings of the 2019 International Conference on Management of Data. 2019, pp. 177-194.10.[8] Noah Johnson, Joseph P Near, and Dawn Song. “Towards practical differential privacy for SQL queries”. In: Proceedings of the VLDB Endowment 11.5 (2018), pp. 526-539.11.[9] Elisabet Lobo-Vesga, Alejandro Russo, and Marco Gaboardi. “A programming framework for differential privacy with accuracy concentration bounds”. In: 2020 IEEE Symposium on Security and Privacy (SP). IEEE. 2020, pp. 411-428.12.[10] Frank D McSherry. “Privacy integrated queries: an extensible platform for privacy-preserving data analysis”. In: Proceedings of the 2009 ACM SIGMOD International Conference on Management of data. 2009, pp. 19-30.13.[11] Prashanth Mohan et al. “GUPT: privacy preserving data analysis made easy”. In: Proceedings of the 2012 ACM SIGMOD International Conference on Management of Data. 2012, pp. 349-360.14.[12] Jason Reed and Benjamin C Pierce. “Distance makes the types grow stronger: a calculus for differential privacy”. In: Proceedings of the 15th ACM SIGPLAN international conference on Functional programming. 2010, pp. 157-168.15.[13] Indrajit Roy et al. “Airavat: Security and privacy for MapReduce.” In: NSDI. Vol.

10. 2010, pp. 297- 312.16.[ 14] John Robert Taylor and William Thompson. An introduction to error analysis: the study of uncertainties in physical measurements. Vol.

2. Springer, 1982.17.[15] Daniel Winograd-Cort et al. “A framework for adaptive differential privacy”. In: Proceedings of the ACM on Programming Languages 1. ICFP (2017), pp. 1-29.18.[16] Dan Zhang et al. “Ektelo: A framework for defining differentially-private computations”. In: Proceedings of the 2018 International Conference on Management of Data. 2018, pp. 115-130.19.[17] Danfeng Zhang and Daniel Kifer. “LightDP: Towards automating differential privacy proofs”. In:20.Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages. 2017, pp. 888-901.21.32 CLAIMS1. A computer-implemented method for estimating the accuracy of a differentially private ratio (r), wherein the differentially private ratio (r) is the division between two differentially private quantities that is generated by a differential privacy (DP) mechanism over a dataset comprising a number of records (c), comprising:23.obtaining (301) parameters used by the DP mechanism to respond to randomized queries for a dataset;24.obtaining (302) a differentially private count (c) and its privacy parameters (ec, 5C) of a randomized count query to the DP mechanism for the dataset;25.obtaining (303) privacy parameters (ES1, 8S1; sS2, 8S2) of one or two differentially private sums s^s^) for the dataset;26.approximating (304) the one or two differentially private sums (s^s^) based on the differentially private count (c), an error bound (ac) of the differentially private count (c), error bounds (aSi, aS2) of the one or two differentially private sums (s^,s^), and a lower (cq, a2) and an upper (b1;b2) bound of elements in the one or two differentially private sums (sl,s^); and27.estimating (305) the accuracy of a differentially private ratio (r) by determining an error bound (ar) of the differentially private ratio (r) that fulfils a predetermined error propagation criteria,28.wherein in case the differentially private ratio (r) is a differentially private average ( vg) between the approximation of a differentially private sum (s^) and the differentially private count (c), the predetermined error propagation criteria require one of the following conditions a) or b) to be satisfied in that:29.a) a relative error (ac / |c|) of the differentially private count (c) is to be below a predetermined threshold value (y), and that30.the privacy parameters (ec, 5C) of the differentially private count (c) and the privacy parameter (eSi, 5S]) of the differentially private sum (s^) is to satisfy the bounds inequality, b- sSi< a^ / Ec) * (1 - y / 1 + y) and 8C= <5S1, concerning the lower (a ) and upper {b^ bounds of elements in the sum (s^), b) the magnitude of the differentially private count (c) is to be greater (|c| > ac) than the count’s error bound (ac), and that an approximate relative error, ac / (|c| - «c). of the differentially private count (c) is to be below a predetermined threshold value (yc), and that a ratio, bi / (eS1* (|c| - ac)), is to be below a predetermined threshold value (ySi);31.and wherein in case the differentially private ratio (r) is a differentially private ratio between the approximations of two differentially private sums32.

33. the predetermined error propagation criteria require one of the following conditions c) or d) to be satisfied in that:34.c) a relative error (ac / |c|) of the differentially private count (c) is to be below a predetermined threshold value (y), and that35.the privacy parameters (ec, 5C) of the differentially private count (c) and the privacy parameter (eSi, 5S]) of the dividend differentially private sum (s^) satisfy the bounds inequality, b1 / ES1< (a Ec) * (1 - y / 1 + y) and 8C= <5S1, concerning the lower (a ) and upper {b^ bound of the elements in the dividend differentially private sum ( 0, and that36.the privacy parameters (ec, 5C) of the differentially private count (c) and the privacy parameter (eS2, 5S2) of the divisor differentially private sum (s^) satisfy the bounds inequality, b2 / ES2(a2 / £c) * (1 - y / 1 + y) and 8C= 8S2, concerning the lower (a2) and upper (b2) bound of the elements in the divisor differentially private sum (s^),37.d) the magnitude of the differentially private count (c) is to be greater (|c| > ac) than the count’s error bound (ac), and that38.an approximate relative error, aS1 / ((|c| - ac) * a-, of the dividend differentially private sum (s^) is below a predetermined threshold value (ySi), and that an approximate relative error, aS2 / ((|c| - ac) * a2), of the divisor differentially private sum (s^) is below a predetermined threshold value (yS2).

2. The computer-implemented method according to claim 1, further comprising:40.selecting a corresponding error propagation criteria condition a), b), c), or d), to be applied based on the differentially private quantities of the differentially private ratio (r) and on the DP mechanism generating the differentially private quantities, wherein error propagation criteria condition a) is selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio (r) is the differentially private average (d g), and wherein error propagation criteria condition c) is selected in case the statistical noise distribution applied by the DP mechanism is a Laplace distribution and the differentially private ratio (r) is the differentially private ratio41.

42. between the approximations of two differentially private sums43.

44. and wherein error propagation criteria condition a) and / or b) is selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio (r) is the differentially private average (dug), and wherein error propagation criteria condition c) and / or d) is selected in case the statistical noise distribution applied by the DP mechanism is a Gaussian distribution and the differentially private ratio (r) is the differentially private ratio45.

46. between the approximations of two differentially private sums47.

3. The computer-implemented method according to claim 1 or 2, further comprising:50.estimating a minimum number of records (cmin) required in order for the relative error bounds (ac / |c|) of the differentially private count (c) to be below the predetermined threshold value (yc).

4. The computer-implemented method according to any of the claims 1-3, further comprising:52.obtaining desired privacy parameters (ec, 5C) for the differentially private count (c),53.estimating a minimum number of records (cmin) required in order for the relative error bounds (ac / |c|) of the differentially private count (c) to be below the predetermined threshold value (yc) based on the obtained desired privacy parameters (ec. <5C)-5. The computer-implemented method according to any of the claims 1-3, further comprising:55.obtaining a number of records in the dataset for a differentially private count (c) and the privacy parameters (ec, 5C) for the differentially private count (c);56.estimating tuned privacy parameters57.

58. s'S2, 8'Sz) for one or two differentially private sums59.

60. based on the obtained number of records (c) in the dataset; and61.performing the estimating (305) of the accuracy of a differentially private ratio (r) based on the privacy parameters (ec, 5C) for the differentially private count (c), as well as, the tuned privacy parameters62.

63. E'S2, 8'Sz) for one or two differentially private64.

65.

6. The computer-implemented method according to any of the claims 1-3, wherein the estimating (301) further comprises66.obtaining a set of estimated number of records (cest) in the dataset; generating a set of different privacy parameters (e'c, 8'c) for the differentially private count (c), as well as, a set of different privacy parameters (e's, 8's) for the one or two differentially private sums67.

68. based on the obtained set of estimated number of records (cest) in the dataset; and69.determining a minimal pair of different privacy parameters from the set of different privacy parameters (e'c, 8'c) for the differentially private count (c) and the set of different privacy parameters (e's, 8's) for the one or two differentially private sums required in order for the relative error bounds (ac / |c|) of the differentially private count (c) to be below predetermined threshold values (ys, yc).

7. The computer-implemented method according to claim 6, wherein further comprises determining a pair of different privacy parameters from the set of different privacy parameters (e'c, 8'c) for the differentially private count (c) and the set of different privacy parameters (e's, 8's) for the one or two differentially private sums based on a set maximum value for the ratio’s privacy parameters (er, <5r) that still fulfils the predetermined error propagation criteria.

8. The computer-implemented method according to any of claims 1-7, wherein obtaining parameters used by the DP mechanism further comprises:72.obtaining a noise parameter indicative of a statistical noise distribution applied by the DP mechanism, one or more privacy parameters (e, 5) indicative of desired differential privacy guarantee applied by the DP mechanism, a sensitivity parameter (AQ) indicative of a query sensitivity applied by the DP mechanism, and a confidence parameter (?) indicative of a desired confidence for the accuracy in the DP mechanism.

9. The computer-implemented method according to any of claims 1-8, further comprising:74.providing (305) information indicating one or more of:75.- the determined error bounds (ar) of the differentially private ratio (r);76.- the estimated minimum number of records;77.- the differentially private count (c); - the estimated tuned privacy parameters (e'c, <5'c) for the differentially private count (c);78.- the estimated tuned privacy parameters (e's, 8's) for the one or two differentially private sums (s); and79.- the minimal pair, or pair of, of different privacy parameters from the set of different privacy parameters (e'c, 8'c) for the differentially private count (c) and the set of different privacy parameters (e's, 8's) for the one or two differentially private sums80.

10. An electronic device (101) comprises at least one processing circuitry (210) and a memory (211), the at least one processing circuitry being configured to perform the method of any of claims 1-9.

11. A computer program product comprising instructions which, when executed on at least one processing circuitry (210), cause the at least one processing circuitry (210) to carry out the method of any of claims 1-9.

12. A computer program carrier carrying a computer program product according to claim 11, wherein the computer program carrier is one of an electronic signal, optical signal, radio signal, or computer-readable storage medium.

Images