Agenda Request - Private measurement of single events

[csharrison]

Agenda+: Private measurement of single events

I wanted to discuss patcg/docs-and-reports#41 with the group. Here I outline a potential implication of using differential privacy as our primary privacy definition, and I want to gauge the group's comfort with this. Given that we are already roughly aligned on at least DP for our privacy definition, the outcome of this discussion would be to either:

• Further entrench that differential privacy matches what we want
• Augment our privacy definition to include some auxiliary privacy notion to protect us more against measuring single events

Time

30-60 minutes

Links

• Private measurement of single events docs-and-reports#41
• Consider a randomized-response-like privacy mechanism patcg-individual-drafts/ipa#60 where I proposed a mechanism for IPA in this setting
• Existing research in the "label DP" setting (1, 2) that is motivating me in part to pursue these kinds of mechanisms.

[AramZS]

Adding to the Agenda!

[benjaminsavage]

I'm looking forward to discussing this. I think it's an important discussion to have.

In the context of this discussion, I'd like to discuss the various approaches one could attempt to deploy if we were to decide that we did not want to enable the "private measurement of single events".

For example, we could have an initial pass over the inputs, to ensure that there were at least K input events from a given breakdown key.

Such a system would still not completely prevent websites from attempting to measure single events, since they could just generate K-1 fake events and combine it with one real event.

But such a system could potentially make it economically unattractive to do so, by effectively multiplying the cost of such measurement by a factor of K.

[benjaminsavage]

I would really like to hear @johnwilander weigh in on this topic (Private Measurement of Single Events).

John, do you think you'll be able to make it to the next PAT-CG to talk about this? I think it's really important to make sure Webkit's stance on this is on the record.

[csharrison]

Here is the deck I plan on presenting tomorrow.

[AramZS]

Hi all, it appears we have come to an agreement on merging in the discussed changes in the meeting. I think it is reasonable to close on Thursday (2 weeks following the proposal). I wanted to note in this repo in case folks had missed it that this was text change was near resolution - patcg/docs-and-reports#43