Unifying Privacy Measures via Maximal (α, β)-Leakage (MαbeL)

We introduce a family of information leakage measures called <italic>maximal</italic> (&#x03B1;, &#x03B2;)-<italic>leakage</italic> (M&#x03B1;beL), parameterized by real numbers &#x03B1; and &#x03B2; greater than or equal to 1. The measure is formalized via an operational definition involving an adversary guessing an unknown (randomized) function of the data given the released data. We obtain a simplified computable expression for the measure and show that it satisfies several basic properties such as monotonicity in &#x03B2; for a fixed &#x03B1;, non-negativity, data processing inequalities, and additivity over independent releases. We highlight the relevance of this family by showing that it bridges several known leakage measures, including maximal &#x03B1;-leakage (&#x03B2; = 1), maximal leakage (&#x03B1; = &#x221E;, &#x03B2; = 1), local differential privacy (LDP) (&#x03B1; = &#x221E;, &#x03B2; = &#x221E;), and local R&#x00E9;nyi differential privacy (LRDP) (&#x03B1; = &#x03B2;), thereby giving an operational interpretation to local R&#x00E9;nyi differential privacy. We also study a conditional version of M&#x03B1;beL on leveraging which we recover differential privacy and R&#x00E9;nyi differential privacy. A new variant of LRDP, which we call <italic>maximal R&#x00E9;nyi leakage</italic>, appears as a special case of M&#x03B1;beL for &#x03B1; = &#x221E; that smoothly tunes between maximal leakage (&#x03B2; = 1) and LDP (&#x03B2; = &#x221E;). Finally, we show that a vector form of the maximal R&#x00E9;nyi leakage relaxes differential privacy under Gaussian and Laplacian mechanisms.