Differential privacy (DP) offers strong theoretical privacy guarantees, but implementations of DP mechanisms may be vulnerable to side-channel attacks, such as timing attacks. When sampling methods such as MCMC or rejection sampling are used to implement a mechanism, the runtime can leak private information. We characterize the additional privacy cost due to the runtime of a rejection sampler in terms of both $(ε,δ)$-DP as well as $f$-DP. We also show that unless the acceptance probability is constant across databases, the runtime of a rejection sampler does not satisfy $ε$-DP for any $ε$. We show that there is a similar breakdown in privacy with adaptive rejection samplers. We propose three modifications to the rejection sampling algorithm, with varying assumptions, to protect against timing attacks by making the runtime independent of the data. The modification with the weakest assumptions is an approximate sampler, introducing a small increase in the privacy cost, whereas the other modifications give perfect samplers. We also use our techniques to develop an adaptive rejection sampler for log-Hölder densities, which also has data-independent runtime. We give several examples of DP mechanisms that fit the assumptions of our methods and can thus be implemented using our samplers.
Controlling Privacy Loss in Sampling Schemes: an Analysis of Stratified and Cluster Sampling
Boston University（波士顿大学）；Institute for Employment Research（就业研究所）；University of Maryland（马里兰大学）；Apple（苹果公司）；Harvard John A. Paulson School of Engineering and Applied Sciences（哈佛大学约翰·A·保尔森工程与应用科学学院）
Privacy Guarantees in Posterior Sampling under Contamination
Department of Statistics, University of Warwick（华威大学统计系）；Department of Mathematical Sciences, Durham University（杜伦大学数学科学系）；School of Mathematics, Statistics and Physics, Newcastle University（纽卡斯尔大学数学、统计与物理学院）
Protecting K-Nearest Neighbor Queries from Location Inference Attacks
Tongji University（同济大学）；Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；East China Normal University（华东师范大学）；Stevens Institute of Technology（史蒂文斯理工学院）
DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
