In this paper we initiate the study of adaptive composition in differential privacy when the length of the composition, and the privacy parameters themselves can be chosen adaptively, as a function of the outcome of previously run analyses. This case is much more delicate than the setting covered by existing composition theorems, in which the algorithms themselves can be chosen adaptively, but the privacy parameters must be fixed up front. Indeed, it isn't even clear how to define differential privacy in the adaptive parameter setting. We proceed by defining two objects which cover the two main use cases of composition theorems. A privacy filter is a stopping time rule that allows an analyst to halt a computation before his pre-specified privacy budget is exceeded. A privacy odometer allows the analyst to track realized privacy loss as he goes, without needing to pre-specify a privacy budget. We show that unlike the case in which privacy parameters are fixed, in the adaptive parameter setting, these two use cases are distinct. We show that there exist privacy filters with bounds comparable (up to constants) with existing privacy composition theorems. We also give a privacy odometer that nearly matches non-adaptive private composition theorems, but is sometimes worse by a small asymptotic factor. Moreover, we show that this is inherent, and that any valid privacy odometer in the adaptive parameter setting must lose this factor, which shows a formal separation between the filter and odometer use-cases.

翻译：在本文中, 我们开始研究不同隐私的适应性构成, 当组成长度和隐私参数本身可以被适应性地选择时, 以适应性的方式选择不同隐私的适应性构成, 作为先前进行的分析结果的函数 。 本案比现有组成理论覆盖的设置更为微妙, 算法本身可以被适应性选择, 但隐私参数必须先加以修正 。 事实上, 我们甚至不清楚如何定义适应性参数设置中的不同隐私定义。 我们通过定义两个对象, 涵盖组成词的两个主要使用案例。 隐私过滤器是一个停止时间规则, 使分析员可以在他事先指定的隐私预算被超过之前停止计算。 隐私计量器比现有组成理论所涵盖的环境要复杂得多。 隐私计量器允许分析员跟踪已经实现的隐私损失, 而无需事先说明隐私预算。 我们显示, 在适应性参数设置中固定隐私参数的这两个案例是截然不同的。 我们显示, 隐私过滤器与现有隐私构成的两大约束体( 至常数) 。 我们还给出了一个更糟糕的隐私测量仪, 有时与非适应性私人因素的精确性结构显示, 。