=============================
Theory: Gaussian DP Framework
=============================

This section provides an overview of the theoretical foundation of Gaussian Differential Privacy (GDP) and explains why it offers advantages over the traditional (ε, δ) formulation.

The Hypothesis Testing Interpretation
=====================================

Differential Privacy can be interpreted through the lens of hypothesis testing. Consider an adversary who sees an output of a mechanism and tries to determine whether it came from dataset D or a neighboring dataset D'.

The adversary's task is essentially a hypothesis testing problem:
- Null hypothesis H₀: The output came from D
- Alternative hypothesis H₁: The output came from D'

The privacy guarantees of a mechanism can be characterized by the trade-off curve between the Type I error (false positive rate) and Type II error (false negative rate) of the most powerful test the adversary could perform.

Trade-off Function
==================

For any mechanism M, we can define the tradeoff function T(M(D), M(D')) as:

.. math::

   T(M(D), M(D'))(α) = \inf_{S: Pr[M(D) \in S] \leq α} Pr[M(D') \notin S]

This function maps Type I error (α) to the minimum achievable Type II error (β) for any statistical test.

Properties of a good tradeoff function:
- T(0) = 1: If we never allow false positives, we always get false negatives
- T(1) = 0: If we always allow false positives, we never get false negatives
- T is convex and non-increasing

Gaussian Differential Privacy
=============================

The GDP framework characterizes privacy with a single parameter μ, which represents the standard deviation of the privacy loss random variable when it's normally distributed.

For a μ-GDP mechanism, the tradeoff function is:

.. math::

   T_μ(α) = Φ(Φ^{-1}(1-α) - μ)

where Φ is the CDF of the standard normal distribution.

Key properties of μ-GDP:
- Smaller μ means stronger privacy
- Simple composition: If M₁ is μ₁-GDP and M₂ is μ₂-GDP, then their composition is √(μ₁² + μ₂²)-GDP
- Conversion to (ε,δ): For any δ>0, μ-GDP implies (μ²/2 + μ·Φ⁻¹(1-δ), δ)-DP

Approximating with GDP
======================

For mechanisms that aren't exactly Gaussian, we can approximate with GDP by finding the smallest μ such that:

.. math::

   T_μ(α) ≤ T(M(D), M(D'))(α) \text{ for all } α \in [0,1]

The "regret" of this approximation is the measure of the difference between the true tradeoff curve and the GDP approximation.

Advantages of GDP
=================

1. **Interpretability**: μ can be easily operationally inteprreted via its trade-off curve.
2. **Composability**: GDP composes naturally with simple arithmetic
3. **Tighter Analysis**: GDP provides tighter privacy bounds than (ε,δ)-DP

For a comprehensive treatment, see the original paper by Dong, Roth, and Su: `The Gaussian Mechanism for Differential Privacy <https://arxiv.org/abs/1905.02383>`_.

Comparison to (ε,δ)-DP
======================

Traditional (ε,δ)-DP requires two parameters and has several drawbacks:

1. **Interpretation Difficulty**: ε and δ lack a clear statistical interpretation
2. **Parameter Selection**: No clear guidance on how to set δ
3. **Complex Composition**: Advanced composition theorems are complicated
4. **Loose Bounds**: Standard composition theorems give loose bounds

GDP addresses these issues with a single parameter that has a clear interpretation and composes naturally.

Implementation in gdpnum
========================

The ``gdpnum`` library implements this theory by:

1. Working with Privacy Loss Distributions (PLDs) from the ``dp_accounting`` package
2. Computing the tradeoff curve for a given mechanism
3. Finding the smallest μ such that the μ-GDP tradeoff curve dominates the actual curve
4. Computing the regret to quantify the approximation error

For most mechanisms in practice (especially those based on Gaussian noise), the GDP approximation is very accurate, with minimal regret.