THE BOUNDED GAUSSIAN MECHANISM FOR DIFFERENTIAL PRIVACY

Abstract

The Gaussian mechanism is one differential privacy mechanism commonly used to protect numerical data. However, it may be ill-suited to some applications because it has unbounded support, and thus can produce invalid numerical answers to queries, such as negative ages or human heights in the tens of meters. One can project such private values onto valid ranges of data, but such projections lead to the accumulation of private query responses at the boundaries of ranges, thereby harming accuracy. Motivated by the need for both privacy and accuracy over bounded domains, we present a bounded Gaussian mechanism for differential privacy, which has support only on a given region. We present both univariate and multivariate versions of this mechanism, and illustrate a significant reduction in variance relative to comparable existing work.