We study privacy filters, which enable privacy accounting for differentially private (DP) mechanisms with adaptively chosen privacy characteristics. We develop a general theory that characterizes the worst-case privacy loss of an interaction involving an analyst that respects some restrictions on what queries they may issue. We apply this theory to develop residue filters, which unifies existing privacy filters. We develop the Gaussian DP (GDP) residue filter, which strictly improves upon the naïve GDP filter. We also show that residue filters capture the natural filter, which promises greater utility by leveraging exact privacy accounting techniques. Earlier privacy filters consider only simple privacy parameters such as Rényi-DP or GDP parameters. Natural filters account for the entire privacy profile of every query, promising more efficient use of a given privacy budget. We show that, contrary to other forms of DP, natural privacy filters are not free in general. We present a characterization of when a family of private queries admits free natural filters for a given budget. In particular, only families of privacy mechanisms that are totally-ordered when composed admit free natural privacy filters with respect to an arbitrary privacy budget. Finally, we show that, while the natural approximate-DP filter can fail in the presence of adaptive adversary, it cannot fail too badly: the output remains approximate-DP with parameters at most poly-logarithmically worse than the intended privacy parameters.

翻译：我们研究隐私滤波器，其能够对具有自适应选择隐私特性的差分隐私（DP）机制进行隐私核算。我们发展了一个通用理论，表征在分析师遵守一定查询限制的交互场景中最坏情况下的隐私损失。应用该理论，我们构建了残差滤波器，统一了现有的隐私滤波器。我们开发了高斯DP（GDP）残差滤波器，其严格优于朴素GDP滤波器。我们还展示残差滤波器捕获了自然滤波器，后者通过利用精确隐私核算技术承诺更高的效用。早期的隐私滤波器仅考虑简单隐私参数（如Rényi-DP或GDP参数）。自然滤波器则核算每次查询的完整隐私轮廓，承诺更高效地使用给定隐私预算。我们证明，与其它形式的DP相反，自然隐私滤波器在一般情况下并非免费。我们给出何时一组私有查询在给定预算下允许自由自然滤波器的表征。特别地，仅当组合后构成全序的隐私机制族，才相对于任意隐私预算允许自由自然滤波器。最后，我们展示，尽管自然近似DP滤波器在存在自适应对手时可能失效，但其失效程度有限：输出仍满足近似DP，其参数最多比预期隐私参数差多项式对数级别。