Answering statistical queries over sensitive data under differential privacy (DP) is a common task in many settings, including databases, mobile computing, and data markets. In these scenarios, multiple analysts may issue the same query, while receiving answers generated under different privacy budgets due to differences in trust levels or willingness to pay. Existing approaches for such multi-tier DP queries either incur excessive cumulative privacy loss or suffer from suboptimal utility. In this paper, we propose a framework for multi-tier DP query release that simultaneously bound the cumulative privacy loss by the maximum privacy budget among all queries and achieve optimal utility comparable to that of single-tier mechanisms. Our framework applies to different classes of DP mechanisms. For noise-adding mechanisms (e.g., count queries with the two-sided Geometric mechanism in the curator model), we develop a general solution based on the characteristic functions of noise distributions. For other mechanisms (e.g., count queries under the local DP model with the Subset mechanism), we design mechanism-specific primitives for budget transformation and introduce a template-based strategy that attains optimal utility across different privacy regimes. Experimental results demonstrate the effectiveness of our framework.

翻译：在差分隐私（DP）下对敏感数据回答统计查询是许多场景中的常见任务，包括数据库、移动计算和数据市场。在这些场景中，多个分析者可能发布相同的查询，但由于信任级别或支付意愿的差异，他们会收到在不同隐私预算下生成的答案。现有的用于此类多层级DP查询的方法要么导致过度的累积隐私损失，要么遭受次优的效用。在本文中，我们提出了一个多层级DP查询发布框架，该框架同时将累积隐私损失限制在所有查询中的最大隐私预算内，并实现了与单层级机制相当的最优效用。我们的框架适用于不同类别的DP机制。对于加噪机制（例如，在策展人模型中使用双面几何机制进行计数查询），我们基于噪声分布的特征函数开发了一个通用解决方案。对于其他机制（例如，在局部DP模型下使用子集机制进行计数查询），我们设计了针对机制的预算转换原语，并引入了一种基于模板的策略，该策略在不同隐私机制下实现了最优效用。实验结果证明了我们框架的有效性。