Answering Query Workloads with Optimal Error under Blowfish Privacy

Recent work has proposed a privacy framework, called Blowfish, that generalizes differential privacy in order to generate principled relaxations. Blowfish privacy definitions take as input an additional parameter called a policy graph, which specifies which properties about individuals should be hidden from an adversary. An open question is whether Blowfish privacy definitions indeed permit mechanisms that incur significant lower error for query answering compared to differentially privacy mechanism. In this paper, we answer this question and explore error bounds of sets of linear counting queries under different Blowfish policy graphs. We begin by generalizing the matrix mechanism lower bound of Li and Miklau (called the SVD bound) for differential privacy to find an analogous lower bound for our privacy framework. We show that for many query workloads and instantiations of the framework, we can achieve a much lower error bound than differential privacy. Next, we develop tools that use the existing literature on optimal or near optimal strategies for answering workloads under differential privacy to develop near optimal strategies for answering workloads under our privacy framework. We provide applications of these by finding strategies for a few popular classes of queries. In particular, we find strategies to answer histogram queries and multidimensional range queries under different instantiations of our privacy framework. We believe the tools we develop will be useful for finding strategies to answer many other classes of queries with low error.