Noisy marginals are a common form of confidentiality protecting data release and are useful for many downstream tasks such as contingency table analysis, construction of Bayesian networks, and even synthetic data generation. Privacy mechanisms that provide unbiased noisy answers to linear queries (such as marginals) are known as matrix mechanisms. We propose ResidualPlanner and ResidualPlanner+, two highly scalable matrix mechanisms. ResidualPlanner is both optimal and scalable for answering marginal queries with Gaussian noise, while ResidualPlanner+ provides support for more general workloads, such as combinations of marginals and range queries or prefix-sum queries. ResidualPlanner can optimize for many loss functions that can be written as a convex function of marginal variances (prior work was restricted to just one predefined objective function). ResidualPlanner can optimize the accuracy of marginals in large scale settings in seconds, even when the previous state of the art (HDMM) runs out of memory. It even runs on datasets with 100 attributes in a couple of minutes. Furthermore, ResidualPlanner can efficiently compute variance/covariance values for each marginal (prior methods quickly run out of memory, even for relatively small datasets). ResidualPlanner+ provides support for more complex workloads that combine marginal and range/prefix-sum queries (e.g., a marginal on race, a range query on age, and a combined race/age tabulation that answers age range queries for each race). It even supports custom user-defined workloads on different attributes. With this added flexibility, ResidualPlanner+ is not necessarily optimal, however it is still extremely scalable and outperforms the prior state-of-the-art (HDMM) on prefix-sum queries both in terms of accuracy and speed.

翻译：带噪声的边缘统计量是一种常见的隐私保护数据发布形式，常用于列联表分析、贝叶斯网络构建乃至合成数据生成等下游任务。提供对线性查询（如边缘查询）无偏噪声答案的隐私机制称为矩阵机制。我们提出了两种高度可扩展的矩阵机制：ResidualPlanner 与 ResidualPlanner+。ResidualPlanner 在使用高斯噪声回答边缘查询时兼具最优性与可扩展性，而 ResidualPlanner+ 则为更通用的工作负载（如边缘查询、范围查询或前缀求和查询的组合）提供支持。ResidualPlanner 可针对多种可写为边缘方差凸函数的损失函数进行优化（此前工作仅局限于一种预定义目标函数）。即使在先前最优方法（HDMM）因内存耗尽而失效的大规模场景下，ResidualPlanner 仍能在数秒内完成边缘统计量的精度优化，甚至在包含100个属性的数据集上仅需数分钟即可运行。此外，ResidualPlanner 能高效计算每个边缘的方差/协方差值（而先前方法即使处理相对较小的数据集也会迅速耗尽内存）。ResidualPlanner+ 则支持结合边缘查询与范围查询/前缀求和查询的更复杂工作负载（例如，对种族进行边缘查询、对年龄进行范围查询，以及按种族汇总年龄区间查询的种族/年龄联合制表）。它甚至支持用户对不同属性自定义工作负载。尽管这种灵活性未必能保证 ResidualPlanner+ 的最优性，但其仍具备极高的可扩展性，并在前缀求和查询的精度与速度上均优于先前最优方法（HDMM）。