Differential privacy (DP) is a mathematical privacy notion increasingly deployed across government and industry. With DP, privacy protections are probabilistic: they are bounded by the privacy budget parameter, $\epsilon$. Prior work in health and computational science finds that people struggle to reason about probabilistic risks. Yet, communicating the implications of $\epsilon$ to people contributing their data is vital to avoiding privacy theater -- presenting meaningless privacy protection as meaningful -- and empowering more informed data-sharing decisions. Drawing on best practices in risk communication and usability, we develop three methods to convey probabilistic DP guarantees to end users: two that communicate odds and one offering concrete examples of DP outputs. We quantitatively evaluate these explanation methods in a vignette survey study ($n=963$) via three metrics: objective risk comprehension, subjective privacy understanding of DP guarantees, and self-efficacy. We find that odds-based explanation methods are more effective than (1) output-based methods and (2) state-of-the-art approaches that gloss over information about $\epsilon$. Further, when offered information about $\epsilon$, respondents are more willing to share their data than when presented with a state-of-the-art DP explanation; this willingness to share is sensitive to $\epsilon$ values: as privacy protections weaken, respondents are less likely to share data.
翻译:差异隐私(DP)是一个数学隐私权概念,它越来越多地在政府和行业中被运用。有了DP,隐私保护就具有概率性:它们受隐私预算参数($\ epsilon$)的约束。先前的健康和计算科学工作发现,人们在争辨概率风险方面挣扎。然而,向提供数据的人传达美元($\epsilon$)的影响对于避免隐私剧院至关重要 -- -- 提出毫无意义的隐私保护是有意义的 -- -- 并赋予更知情的数据共享决定权力。根据风险沟通和使用性方面的最佳做法,我们开发了三种方法来向终端用户传达概率DP保障:两种方法是交流概率,一种是提供DP产出的具体例子。我们在Vignette调查研究($=963$)中对这些解释方法进行了定量评估:客观风险理解、对DP保证的主观隐私理解以及自我有效性。我们发现基于争议的解释方法比(1)基于产出的方法更有效,以及(2)最先进的方法,是将关于$\\epslon$的信息丢失。此外,当提供有关美元的数据时,我们提供的关于DP-epslon-resent represent resent resent resent resmission resmission resmissional resmission resmission des des resmission to the lapal des des lapal des latime latime lap latime latime des latime des des latime latime lati latis latis des des latis des des lap res res des res res res res res res res lade lax lax lade lade lap res p p p pres p pres pres pres pres res res res res res p p p p p p p p p p p p p p p p p p p p p p p pres res res res lap lap res res res res res res res res res res lap lap res lati lap latis lati latis la</s>