Differential Privacy at Risk: Bridging Randomness and Privacy Budget
  The calibration of noise for a privacy-preserving mechanism depends on the
sensitivity of the query and the prescribed privacy level. A data steward must
make the non-trivial choice of a privacy level that balances the requirements
of users and the monetary constraints of the business entity. We analyse roles
of the sources of randomness, namely the explicit randomness induced by the
noise distribution and the implicit randomness induced by the data-generation
distribution, that are involved in the design of a privacy-preserving
mechanism. The finer analysis enables us to provide stronger privacy guarantees
with quantifiable risks. Thus, we propose privacy at risk that is a
probabilistic calibration of privacy-preserving mechanisms. We provide a
composition theorem that leverages privacy at risk. We instantiate the
probabilistic calibration for the Laplace mechanism by providing analytical
results. We also propose a cost model that bridges the gap between the privacy
level and the compensation budget estimated by a GDPR compliant business
entity. The convexity of the proposed cost model leads to a unique fine-tuning
of privacy level that minimises the compensation budget. We show its
effectiveness by illustrating a realistic scenario that avoids overestimation
of the compensation budget by using privacy at risk for the Laplace mechanism.
We quantitatively show that composition using the cost optimal privacy at risk
provides stronger privacy guarantee than the classical advanced composition.
