Differential privacy defines "privacy" of a mechanism $A$ as the "closeness" of the two distribution $Pr[A(D) \in S]$ and $Pr[A(D') \in S]$ where $D,D'$ differ in one element. And the distance between these distributions is multiplicative, i.e.
$\left| \frac{Pr[A(D) \in S]}{Pr[A(D') \in S]} \right| \leq e^\epsilon$
I have difficulty in understanding this choice of this multiplicative distance measure, as opposed to the standard distance (statistical difference) as in cryptography (indistinguishability), i.e.
$|Pr[A(D) \in S] - Pr[A(D') \in S]| \leq neg(.)$
The paper "Calibrating Noise to Sensitivity in Private Data Analysis" by Dwork et al. put forth two reasons for using the multiplicative distance:
- It is more stringent, since if one probability is 0, the other must also be 0 (which is not guaranteed when using standard measure of statistical difference). This, I understand.
- The leakage (distance between the distributions) must be non-negligible for the utility of the mechanism. This I really struggle to understand. Could anyone give an simple example to illustrate this, please?