We revisit the distributed hypothesis testing (or hypothesis testing with communication constraints) problem from the viewpoint of privacy. Instead of observing the raw data directly, the transmitter observes a sanitized or randomized version of it. We impose an upper bound on the mutual information between the raw and randomized data. Under this scenario, the receiver, which is also provided with side information, is required to make a decision on whether the null or alternative hypothesis is in effect. We first provide a general lower bound on the type-II exponent for an arbitrary pair of hypotheses. Next, we show that if the distribution under the alternative hypothesis is the product of the marginals of the distribution under the null (i.e., testing against independence), then the exponent is known exactly. Moreover, we show that the strong converse property holds. Using ideas from Euclidean information theory, we also provide an approximate expression for the exponent when the communication rate is low and the privacy level is high. Finally, we illustrate our results with a binary and a Gaussian example.

We introduce a family of information leakage measures called maximal $(\alpha,\beta)$ -leakage ( $\text{M}\alpha $ beL), parameterized by real numbers $\alpha $ and $\beta $ greater than or equal to 1. The measure is formalized via an operational definition involving an adversary guessing an unknown (randomized) function of the data given the released data. We obtain a simplified computable expression for the measure and show that it satisfies several basic properties such as monotonicity in $\beta $ for a fixed $\alpha $ , non-negativity, data processing inequalities, and additivity over independent releases. We highlight the relevance of this family by showing that it bridges several known leakage measures, including maximal $\alpha $ -leakage $(\beta =1)$ , maximal leakage $(\alpha =\infty,\beta =1)$ , local differential privacy (LDP) $(\alpha =\infty,\beta =\infty)$ , and local Rényi differential privacy (LRDP) $(\alpha =\beta)$ , thereby giving an operational interpretation to local Rényi differential privacy. We also study a conditional version of $\text{M}\alpha $ beL on leveraging which we recover differential privacy and Rényi differential privacy. A new variant of LRDP, which we call maximal Rényi leakage, appears as a special case of $\text{M}\alpha $ beL for $\alpha =\infty $ that smoothly tunes between maximal leakage ( $\beta =1$ ) and LDP ( $\beta =\infty $ ). Finally, we show that a vector form of the maximal Rényi leakage relaxes differential privacy under Gaussian and Laplacian mechanisms.

We introduce a family of information leakage measures called maximal $\alpha,\beta$-leakage, parameterized by real numbers $\alpha$ and $\beta$. The measure is formalized via an operational definition involving an adversary guessing an unknown function of the data given the released data. We obtain a simple, computable expression for the measure and show that it satisfies several basic properties such as monotonicity in $\beta$ for a fixed $\alpha$, non-negativity, data processing inequalities, and additivity over independent releases. Finally, we highlight the relevance of this family by showing that it bridges several known leakage measures, including maximal $\alpha$-leakage $(\beta=1)$, maximal leakage $(\alpha=\infty,\beta=1)$, local differential privacy $(\alpha=\infty,\beta=\infty)$, and local Renyi differential privacy $(\alpha=\beta)$.