Accountant

The DPSQL+ Accountant is responsible for managing the privacy budget across multiple queries.

We provide two implementations of the Accountant class: RenyiAccountant and PLDAccountant. PLDAccountant provides a tighter bound on privacy budget consumption than RenyiAccountant. However, it is slower and does not support fully adaptive settings, where users can determine privacy parameters based on the results of previous queries.

We also provide BasicAccountant for testing and debugging, but it is not recommended for production because RenyiAccountant provides tighter privacy guarantees at similar speed.

The properties of the Accountant classes are summarized as follows:

Accountant

Composition

Speed

Fully adaptive composition [3]

RenyiAccountant

Rényi DP composition [1]

Fast

✔️

PLDAccountant

PLD composition [2]

Slow

✖️
class dpsql.accountant.Accountant(epsilon: float, delta: float)[source]

Abstract class for an accountant that checks and updates the privacy budget.

Parameters:

  • epsilon (float) – Privacy budget epsilon.

  • delta (float) – Privacy budget delta. delta = 1 represents infinite budget.

MAX_REMAINING_QUERIES = 1000000
check_budget(agg_funcs: list[Aggregation], params: DPParams) → bool[source]

Check if the privacy budget is sufficient for the given parameters.

Parameters:

  • agg_funcs (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.

Returns:

True if the privacy budget is sufficient, False otherwise.

Return type:

bool

get_sensitivities(agg_funcs: list[Aggregation], params: DPParams) → list[float][source]

Get the sensitivities of the aggregation functions.

Parameters:

  • agg_funcs (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.

Returns:

The sensitivities of the aggregation functions.

Return type:

list[float]

abstractmethod remaining_queries(query_epsilon: float, query_delta: float) → int[source]

Calculate how many more queries can be executed with the given epsilon and delta.

Parameters:

  • query_epsilon (float) – The epsilon cost per query.

  • query_delta (float) – The delta cost per query.

Returns:

The maximum number of queries that can still be executed. Returns 0 if no more queries can be executed.

Return type:

int

abstractmethod update_budget(agg_funcs: list[Aggregation], params: DPParams) → None[source]

Update the privacy budget based on the given parameters.

Parameters:

  • agg_func (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.

class dpsql.accountant.BasicAccountant(epsilon: float, delta: float, warn_on_init: bool = True)[source]

Accountant which calculates the privacy budget using basic composition. Renyi Accountant and PLDAccountant provide advanced composition techniques, and thus yield tighter bounds on privacy budget consumption. Thus, BasicAccountant is mainly for testing and debugging purposes.

Parameters:

  • epsilon (float) – Privacy budget epsilon.

  • delta (float) – Privacy budget delta.

remaining_queries(query_epsilon: float, query_delta: float) → int[source]

Calculate how many more queries can be executed with the given epsilon and delta.

Parameters:

  • query_epsilon (float) – The epsilon cost per query.

  • query_delta (float) – The delta cost per query.

Returns:

The maximum number of queries that can still be executed. Returns 0 if no more queries can be executed.

Return type:

int

update_budget(agg_funcs: list[Aggregation], params: DPParams) → None[source]

Update the privacy budget based on the given parameters.

Parameters:

  • agg_func (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.

class dpsql.accountant.PLDAccountant(epsilon: float, delta: float, discretization_interval: float = 0.0001)[source]

Accountant based on numerical composition.

Parameters:

  • epsilon (float) – Privacy budget epsilon.

  • delta (float) – Privacy budget delta.

  • discretization_interval (float) – The discretization interval for the privacy loss distribution.

calculate_min_epsilon(pld: PrivacyLossDistribution) → float[source]

Calculate the minimum epsilon value which satisfies (epsilon, delta)-differential privacy.

Parameters:

pld (PrivacyLossDistribution) – The privacy loss distribution.

Returns:

The minimum epsilon value.

Return type:

float

compute_pld(agg_funcs: list[Aggregation], params: DPParams) → PrivacyLossDistribution[source]

Calculate the privacy loss distribution for aggregation functions.

Parameters:

  • agg_funcs (list[Aggregation]) – The aggregation functions to be executed.

  • params (DPParams) – The differential privacy parameters.

Returns:

The privacy loss distribution.

Return type:

PrivacyLossDistribution

remaining_queries(query_epsilon: float, query_delta: float) → int[source]

Calculate how many more queries can be executed with the given epsilon and delta.

Parameters:

  • query_epsilon (float) – The epsilon cost per query.

  • query_delta (float) – The delta cost per query.

Returns:

The maximum number of queries that can still be executed. Returns 0 if no more queries can be executed.

Return type:

int

update_budget(agg_funcs: list[Aggregation], params: DPParams) → None[source]

Update the privacy budget based on the given parameters.

Parameters:

  • agg_func (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.

class dpsql.accountant.RenyiAccountant(epsilon: float, delta: float)[source]

Accountant for zero-concentrated differential privacy (zCDP) based on Renyi differential privacy.

Parameters:

  • epsilon (float) – Privacy budget epsilon.

  • delta (float) – Privacy budget delta.

calculate_budget(agg_funcs: list[Aggregation], params: DPParams) → tuple[float, float][source]

Calculate the privacy budget for agg_funcs using zero-Concentrated Differential Privacy (zCDP).

Parameters:

  • agg_funcs (list[Aggregation]) – The aggregation functions to be executed.

  • params (DPParams) – The differential privacy parameters.

Returns:

parameters of beta-approximate alpha-zCDP.

Return type:

(alpha, beta) (tuple[float, float])

calculate_min_epsilon(alpha: float, beta: float) → float[source]

Calculate the minimum epsilon value which satisfies (epsilon, delta)-differential privacy.

Parameters:

  • alpha (float) – A parameter of beta-approximate alpha-zCDP.

  • beta (float) – A parameter of beta-approximate alpha-zCDP.

Returns:

The minimum epsilon value. Returns infinity if beta is greater than or equal to delta. Returns 0 if delta is greater than or equal to 1.

Return type:

float

remaining_queries(query_epsilon: float, query_delta: float) → int[source]

Calculate how many more queries can be executed with the given epsilon and delta.

Parameters:

  • query_epsilon (float) – The epsilon cost per query.

  • query_delta (float) – The delta cost per query.

Returns:

The maximum number of queries that can still be executed. Returns 0 if no more queries can be executed.

Return type:

int

update_budget(agg_funcs: list[Aggregation], params: DPParams) → None[source]

Update the privacy budget based on the given parameters.

Parameters:

  • agg_func (list[Aggregation]) – The aggregation functions.

  • params (DPParams) – The differential privacy parameters.