What Can We Learn Privately? IV: Any ε-Local Algorithm Is Simulated by a Statistical Query Algorithm with O(t·e^ε) Expected Queries up to Statistical Difference βResearch Paper
Motivation
In the local model of differential privacy, no trusted curator holds the data: each individual randomizes their own record before handing it to the analyst. This is the model of randomized response in survey statistics and of the privacy-preserving telemetry deployed by large software vendors. Kasiviswanathan, Lee, Nissim, Raskhodnikova and Smith, What Can We Learn Privately? (arXiv:0803.0924v3, published in SIAM J. Comput. 40(3) (2011) 793–826, DOI 10.1137/090756090), asked which learning tasks remain possible in this model. Their answer (§5) is that local algorithms are exactly as powerful as statistical query (SQ) algorithms in the sense of Kearns (J. ACM 1998), up to polynomial factors. This mission formalizes one direction of that equivalence: every local algorithm run on i.i.d. data can be simulated by an SQ algorithm.
This is the fourth of five missions on the paper. Mission III formalizes the converse direction (Theorem 5.7). All theorem numbers refer to arXiv:0803.0924v3.
Setting
A database is . Here its entries are drawn i.i.d. from a probability distribution on .
- An -local randomizer (Definition 5.1) is a randomized map to a discrete set such that for all and .
- An -local algorithm making queries (Definitions 5.2, 5.3) sees the database only through an LR oracle. At its -th call it names an index and an -local randomizer , both possibly depending on its earlier answers, and receives a fresh sample of . For each index the budgets of the calls on sum to at most . is noninteractive if its calls do not depend on earlier answers. Its output is a function of the answers. Its output distribution is taken over and the randomizers' coins.
- An SQ oracle for (Definition 5.4) answers a query , with and tolerance , with any number such that . It may choose its answers adversarially and adaptively.
- An SQ algorithm (Definition 5.5) accesses only through such an oracle. It may use its own coins, and the number of queries it makes may be random and unbounded.
- The statistical difference of two distributions on a discrete space (p. 8) is .
Formalization targets
Goal: Lemma 5.8 (p. 21)
There is an absolute constant such that for every -local algorithm making queries there is an SQ algorithm with the following properties against every distribution and every valid oracle:
The constant is the paper's . The tolerance is the proof's own choice.
Milestones
- Display (5) (p. 22): a single query estimates within a factor , whatever valid answer the oracle gives.
- One rejection-sampling iteration (p. 23): every iteration terminates with probability at least . Conditioned on terminating, it outputs with probability in .
- The interactive estimate (p. 24): two queries estimate the conditional probability of the next answer given earlier answers on the same entry, within a factor .
- Claim 5.9 (p. 22): the noninteractive case, with the explicit bound on the expected number of queries.
Significance
The result. Lemma 5.8, combined with Theorem 5.7, shows that a concept class is learnable by a locally private algorithm if and only if it is learnable with statistical queries (Theorem 5.14). Every SQ lower bound therefore becomes a lower bound for local privacy. For instance, parity functions are privately learnable by a centralized algorithm (Theorem 4.4) but not by a local one, because parities need exponentially many statistical queries (Corollary 5.15, which also uses the SQ lower bound of Blum et al., STOC 1994).
Formalizing it. The result is proved on paper. As far as we know it has no machine-checked proof. The paper's proof is a few paragraphs and leaves the model implicit: what an SQ algorithm with a random number of queries is, how an adversarial oracle interacts with it, and in what sense the per-randomizer errors add up over adaptively chosen randomizers. The formal statement makes each of these explicit. The milestones isolate the estimates the proof uses, so they can be proved independently of the composition argument.
Difficulty
The estimates in the milestones are elementary inequalities. The difficulty is in the goal. First, the oracle's answers, and therefore the estimates , change from iteration to iteration, so the simulated distribution is not a fixed rejection sampler: the output law must be controlled iteration by iteration against an adversary. Second, the SQ algorithm has no bound on its number of steps. Its output law is a limit over an unbounded run, and its query count is an expectation that is finite only because every iteration terminates with probability bounded away from zero. Third, in the interactive case the randomizers applied to one entry are correlated through the entry. The simulation must sample from the conditional law given earlier answers on that entry, while the errors of all steps combine along adaptively chosen histories.
Formalization scope
- Local randomizers have discrete output:
R u : PMF W. The simulation uses the point probabilities . Every map is required to be measurable. - A local algorithm makes exactly calls. Its index, randomizer and budget at call are functions of the earlier answers. The budget is required along every answer sequence. Its own coins are calls to -local randomizers.
- An SQ algorithm is a state machine with a random start, random transitions depending on the answer, and an output on stopping. Its output law is a sub-probability mass function. Its expected query count lies in and counts every query, including those in rejected iterations.
- The oracle is an arbitrary deterministic function of the whole state trajectory, constrained only by Definition 5.4. The conclusions must hold for every valid oracle, not for the exact-mean oracle alone.
- is quantified before and sees only through answers, and every query of is a measurable -valued function with tolerance exactly . Without these two constraints the statement would be trivial: could hard-code , or rescale a query to shrink its effective tolerance.
- The constant is quantified outside every other object.
- The implicit hypotheses (the queries divide by ), and (so that and is defined) are stated. The paper's reference input is an arbitrary point .
- Claim 5.9 states " queries". Its proof gives at most , which is the bound stated.
- The paper's refinement "noninteractive yields nonadaptive " is not formalized. The simulation decides from each answer whether to stop, and so which randomizer the next query belongs to. It therefore does not prepare its queries before receiving answers in the sense of Definition 5.5. The goal is the adaptive statement for all local algorithms, which contains the noninteractive case. Claim 5.10, whose statement coincides with this goal, is represented by its estimate (milestone 3) rather than restated.
- The statistical difference is valued in , which avoids junk values of a real supremum.
Reusable beyond this mission: the SQ-algorithm state machine with expected query count, the statistical difference of sub-probability mass functions, and the model of interactive local algorithms. Welcome contributions include proofs of the estimate milestones, a general lemma bounding the statistical difference of sequentially composed approximate samplers, and the termination and expected-runtime analysis of rejection sampling with varying acceptance probabilities.
Selected references
- S. P. Kasiviswanathan, H. K. Lee, K. Nissim, S. Raskhodnikova, A. Smith, What Can We Learn Privately?, SIAM J. Comput. 40(3) (2011) 793–826; cited from arXiv:0803.0924v3. https://arxiv.org/abs/0803.0924 · https://doi.org/10.1137/090756090
- M. Kearns, Efficient noise-tolerant learning from statistical queries, J. ACM 45(6) (1998) 983–1006. https://doi.org/10.1145/293347.293351
- A. Blum, M. Furst, J. Jackson, M. Kearns, Y. Mansour, S. Rudich, Weakly learning DNF and characterizing statistical query learning using Fourier analysis, STOC 1994, 253–262. https://doi.org/10.1145/195058.195147
- C. Dwork, F. McSherry, K. Nissim, A. Smith, Calibrating noise to sensitivity in private data analysis, TCC 2006. https://doi.org/10.1007/11681878_14
- S. L. Warner, Randomized response: a survey technique for eliminating evasive answer bias, J. Amer. Statist. Assoc. 60 (1965) 63–69. https://doi.org/10.1080/01621459.1965.10480775