Differential privacy (DP) is the de facto notion of privacy both in theory and in practice. However, despite its popularity, DP imposes strict requirements which guard against strong worst-case scenarios. For example, it guards against seemingly unrealistic scenarios where an attacker has full information about all but one point in the data set, and still nothing can be learned about the remaining point. While preventing such a strong attack is desirable, many works have explored whether average-case relaxations of DP are easier to satisfy [HWR13,WLF16,BF16,LWX23]. In this work, we are motivated by the question of whether alternate, weaker notions of privacy are possible: can a weakened privacy notion still guarantee some basic level of privacy, and on the other hand, achieve privacy more efficiently and/or for a substantially broader set of tasks? Our main result shows the answer is no: even in the statistical setting, any reasonable measure of privacy satisfying nontrivial composition is equivalent to DP. To prove this, we identify a core set of four axioms or desiderata: pre-processing invariance, prohibition of blatant non-privacy, strong composition, and linear scalability. Our main theorem shows that any privacy measure satisfying our axioms is equivalent to DP, up to polynomial factors in sample complexity. We complement this result by showing our axioms are minimal: removing any one of our axioms enables ill-behaved measures of privacy.

翻译：差分隐私（DP）是当前理论和实践中事实上的隐私定义标准。然而，尽管其应用广泛，DP设定了严格的约束条件以防范极端最坏情况。例如，它防范了看似不现实的攻击场景：攻击者拥有除单个数据点外数据集的全部信息，却仍无法获知该剩余点的任何信息。虽然防御此类强攻击是必要的，但已有诸多研究探讨平均情形下放松DP约束是否更易实现[HWR13,WLF16,BF16,LWX23]。本工作的研究动机在于探究是否存在替代性的、更弱的隐私定义：弱化的隐私概念是否仍能保障基本隐私水平，同时能否更高效地实现隐私保护，并/或适用于更广泛的任务集合？我们的主要结果表明答案是否定的：即使在统计设定下，任何满足非平凡组合性的合理隐私度量均等价于DP。为证明此结论，我们确立了四个核心公理或需求准则：预处理不变性、禁止公然非隐私、强组合性以及线性可扩展性。我们的主定理表明，满足这些公理的任何隐私度量均等价于DP，仅在样本复杂度上存在多项式因子差异。我们通过证明这些公理的最小性来补充该结果：移除任一公理将导致病态的隐私度量。