DP Lib v3.0.0

This is a major release with new features, improvements, deprecations, and bug fixes across the libraries. It includes breaking changes, which are listed below.

Note: All features not mentioned in the release notes are considered experimental for this release. In particular, the accounting library, the stochastic testing API in C++, and the PostgreSQL extension are experimental and likely to change or be removed in the future.

Changes since the 2.1.0 release

C++ DP Lib:

Breaking changes:

• Remove default L1 sensitivity for Laplace mechanisms. L1 sensitivity has to be set explicitly.
• Remove GetOutputConfidenceInterval from algorithms and clarify semantics of NoiseConfidenceInterval.
• Remove base::Status and migrate remaining API to absl::Status
• Remove logging soft-fork and use logging from absl instead.
• Remove deprecated protocol buffer fields.

New features:

• Add a payload to the Status output when approximate bounds could not find appropriate bounds.

Java DP Lib:

Breaking change:

• Noise interface in Java now has 2 additional addNoise() methods that accept delta of type double. Clients with their own implementation of the interface must implement the new methods to avoid compilation errors.

Deprecated:

• Deprecated the methods that accept delta of type Double in the Noise interface and aggregation primitives (e.g., Count, BoundedSum, etc). We will delete the deprecated methods in the next release. Please migrate to their overloaded versions that accept delta of type double in the meantime.

New feature: Long bounded sum.

Go DP Lib:

New features:

• Pre-thresholding for PreAggSelectPartitions and Count aggregation primitives.
• Add IncrementBy for the PreAggSelectPartitions aggregation primitive.
• Negative counts are now explicitly allowed when incrementing via IncrementBy in Count & PreAggSelectPartitions, meaning it is now possible to decrement privacy ID counts.

Privacy on Beam:

Breaking changes:

• New API for PrivacySpec and AggregationParams to enable new features.
• Test Mode is now a field in PrivacySpecParams, no need to use pbeamtest for enabling test mode.

Deprecated:

• Merge SelectPartitionsParams & PartitionSelectionParams. Both SelectPartitions and private partition selection of other aggregations now use PartitionSelectionParams. SelectPartitionsParams is deprecated and might be deleted in future releases.

New features:

• Pre-thresholding on top of DP thresholding, available for all aggregations. See pre-thresholding documentation for more details.
• Aggregation and partition selection budgets can be specified separately instead of being split automatically. This allows for granular budget allocation.
• Test mode can now also be used in non-test runs, e.g. in order to compare differentially private results with raw results.
• Scalable public partitions for <K, V> types. Previously, due to an issue with how we processed public partitions, only in-memory public partitions or small PCollections as public partitions worked with KV type aggregations. Now, it should be possible to use arbitrarily large public partitions. Note that this issue did not affect V-type aggregations (i.e. DistinctPrivacyID, Count).
• Add option to CountParams to allow negative outputs to allow more accurate statistical analysis of the output.