Privacy Leak via Data-Dependent Domain Inference

[tudorcebere]

Description
In dpmm/src/dpmm/models/base/mechanisms/mechanism.py, the mechanism's domain is automatically inferred by calculating the maximum value of the raw input dataframe.
In a Differential Privacy (DP) context, any operation performed on the raw data must be accounted for in the privacy budget ($\epsilon, \delta$). Calculating a global max() is a non-private operation that leaks information about the dataset's tail distribution.

Location
File: dpmm/src/dpmm/models/base/mechanisms/mechanism.py
Line: 113

_domain = (df.astype(int).max(axis=0) + 1).to_dict()

By calculating df.max(axis=0) directly on the private dataframe, the specific maximum value of a sensitive attribute is revealed without any noise or privacy cost.

Suggested Patch
The domain should be treated as a hyperparameter or a private statistic. Consider one of the following approaches:

1. User-Provided Bounds: Require the user to pass a domain or bounds argument derived from public knowledge or data schemas.
2. Private Max Computation: Use a DP-compliant mechanism to find a noisy upper bound, and subtract the cost from the total privacy budget.

[sofiane87]

Thank you for your interest in dpmm and for raising this issue!

The domain calculation in dpmm/src/dpmm/models/base/mechanisms/mechanism.py is dead code and is never used in practice. To make this more clear, we made the following two changes:

• In dpmm/README.md, we documented that the intended use of dpmm is through a Pipeline (preprocessing + generation); the preprocessing layer takes care of the domain extraction in a DP way;
• In dpmm/src/dpmm/models/base/mechanisms/mechanism.py, we deleted the domain calculation and made it a required input argument.

I believe this will fix the flagged issue.

[jkapar]

As previously stated, the documentation now suggests that setting domain=None would handle domain extraction automtically in a DP way, which would be indeed a great feature.

For numerical variables, I found the approx_bounds function which I suppose to handle this if no domain is specified?
Could you please clarify what happens for categorical columns? Without domain specification, these kind of warnings are printed: PrivacyLeakage: No categorical domain provided for Column <colname> - will be imputed. The wording "PrivacyLeakage" sort of suggests that the domain for categorical variables is not extracted in a DP-manner as opposed to the statement in the documentation.

Would you please clarify this?