Differential privacy via output perturbation has been a \textit{de facto} standard for releasing query or computation results on sensitive data. However, we identify that all existing Gaussian mechanisms suffer from the curse of full-rank covariance matrices, and hence the expected accuracy losses of these mechanisms equal the trace of the covariance matrix of the noise. To lift this curse, we design a Rank-1 Singular Multivariate Gaussian (R1SMG) mechanism. It achieves -DP on query results in by perturbing the results with noise following a singular multivariate Gaussian distribution, whose covariance matrix is a \textbf{randomly} generated rank-1 positive semi-definite matrix. In contrast, the classic Gaussian mechanism and its variants all consider \textbf{deterministic} full-rank covariance matrices. Our idea is motivated by a clue from Dwork et al.'s seminal work on the classic Gaussian mechanism that has been ignored: when projecting multivariate Gaussian noise with a full-rank covariance matrix onto a set of orthonormal basis in , only the coefficient of a single basis can contribute to the privacy guarantee. We make the following contributions. The R1SMG mechanisms achieves -DP guarantee on query results in , while its expected accuracy loss is lower bounded by , where and . We show that has a decreasing trend as increases, and converges to as approaches infinity. Compared with other mechanisms, the R1SMG mechanism is more stable and less likely to generate noise with large magnitude that overwhelms the query results.
View on arXiv