martinthomson / dap-dp-ext

DAP extensions to support differentially-private submissions
Other
0 stars 0 forks source link

Cap on the privacy budget #7

Open martinthomson opened 1 month ago

martinthomson commented 1 month ago

We use a unit of $\text{m}\varepsilon$, so there's a good chance that this will need two bytes to encode some useful values. It is unlikely that anything more than that will be necessary. Google's ARA experiment allows for an $\varepsilon=64$ but that is a truly ludicrous value to attach to a single query.

Options then:

  1. Allow any number of bytes, but allow implementations to reject values that are more than two bytes.
  2. Allow one or two bytes.
  3. Allow two bytes only.

Given where we stand, the difference between options 2 and 3 is negligible. I can see reasons for either.