Flexible Differentially Private SQL
Abstract
creating DP platforms [21, 24, 26], especially differentially private SQL systems that ingest a non-experts SQL queries and produce accurate, privacy-preserving answers [2, 4, 1315, 18, 22, 23, 29, 30]. The plausible deniability model of differential privacy for singletable datasets is well-understood. However, applying differential privacy to relational databases is much trickier: each application needs flexibility in specifying the pieces of information about an entity, spread across multiple relations, that require plausible deniability guarantees. Existing differentially private SQL systems only support rigid privacy policies. Even seemingly small changes, such as specifying that some tables need to protect the existence of records while others only need to protect the record contents, require significant manual effort in updating their privacy accountants and proving their correctness.