Breaking the Communication-Privacy-Accuracy Tradeoff with $f$-Differential Privacy

We consider a federated data analytics problem in which a server coordinates the collaborative data analysis of multiple users with privacy concerns and limited communication capability. The commonly adopted compression schemes introduce information loss into local data while improving communication efficiency, and it remains an open problem whether such discrete-valued mechanisms provide any privacy protection. In this paper, we study the local differential privacy guarantees of discrete-valued mechanisms with finite output space through the lens of $f$-differential privacy (DP). More specifically, we advance the existing literature by deriving tight $f$-DP guarantees for a variety of discrete-valued mechanisms, including the binomial noise and the binomial mechanisms that are proposed for privacy preservation, and the sign-based methods that are proposed for data compression, in closed-form expressions. We further investigate the amplification in privacy by sparsification and propose a ternary stochastic compressor. By leveraging compression for privacy amplification, we improve the existing methods by removing the dependency of accuracy (in terms of mean square error) on communication cost in the popular use case of distributed mean estimation, therefore breaking the three-way tradeoff between privacy, communication, and accuracy. Finally, we discuss the Byzantine resilience of the proposed mechanism and its application in federated learning.

Paper

Similar papers

Peer review

Reviewer mVNo3/10 · confidence 3/52023-06-22

Summary

This paper studies distributed mean estimation under privacy and communication constraints. This paper focuses on characterizing the recently defined notion of $f$-DP for communication-efficient mechanisms, where $f$-DP can be converted to the standard $(\epsilon,\delta)$-DP. The paper analyzed the $f$-DP of different known mechanisms in the literature. Furthermore, a new algorithm named ternary compression is proposed.

Strengths

The distributed mean estimation is an important topic and has lots of applications in federated learning under privacy and communication constraints. The presentation is well written.

Weaknesses

Although the topic is interesting, my main concerns are about the contributions of this paper. * The first part of the paper is to analyze the $f$-DP of well-known discrete mechanisms. While analyzing the $f$-DP is useful, it is not hard to compute it. I don't know what are the major challenges in this analysis and if this analysis provides any new insights into analyzing the $f$-DP. Hence, in my opinion, this part isn't novel enough as a main contribution of this paper. * The expressions of the $f$-DP are not in a closed form; the expressions are functions of a set of probabilities that might be computationally expensive to compute for large system parameters. * The proposed mechanism of ternary compression is not novel. There are lots of similar schemes that don't send some coordinates with some probability from sampling the coordinates for example [13] and [23]. Actually, the Ternary mechanism can be seen as a combination of CLDP for a set of coordinates that are chosen i.i.d. with probability $B/A$. * In general, this ternary mechanism has higher privacy because it has lower accuracy, since with some non-zero probability (when $B>A$), the client will not send anything. * The optimal trade-offs between privacy, communication, and accuracy have already been characterized for LDP in different works in the literature, and hence, I don't understand what is the major difference in this paper in comparison with the existing work. * Typos: please define the abbreviation of GDP (Gaussian differential privacy) for using it. In Algorithm 1, $x_i\in\lbrace 0,1,\ldots,l \rbrace$ instead of square brackets. Figure 4 is small and the lines are close enough so that it is hard to distinguish the different mechanisms.

Questions

* It is mentioned in the abstract and also in the introduction that *it remains an open problem whether such discrete-valued mechanisms provide any privacy protection.* I don't know which open problem the authors referring to. If it is the distributed mean estimation under jointly local differential privacy and communication constraints, then this problem is already solved in the literature. * In line 51, *SQKR doesn't account for the privacy introduced during sparsification.* I don't understand this part. AFAIK, SQKR is order optimal, and hence, it doesn't lose privacy analysis. * In lines 259-261, what do these numbers of $\epsilon$ refer to, and from where it comes? * In lines 331-333, *we essentially remove the dependency of accuracy on the communication overhead.* Could you please explain more? In general, it is supposed that there is a trade-off between communication and accuracy, so the accuracy depends on the communication budget.

Rating

3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

1 poor

Limitations

Yes

Reviewer VYNX7/10 · confidence 2/52023-07-07

Summary

This paper investigates the f-DP guarantee of several discrete-valued mechanisms in the local-DP model. In particular, closed-form expressions for binomial noise mechanism and Binomial mechanics are derived. Then, the paper considers the popular problem of aggregating d-dimensional vectors from local users subject to privacy communication constraints. Under the f-DP framework, this paper presents a new "ternary" mechanism and analyzes its f-DP privacy guarantee. Roughly, the ternary mechanism allows each local user to sparsify their vectors by keeping each coordinate with only a small probability and adding noises to the alive coordinates. The hope is that by sparsification and randomization, one can optimize communication (i.e., minimizing the messages from each user to the server) and privacy cost (e.g., each user has its signal "somewhat hidden" in the noises). The paper's main claim is that, by working with f-DP and the ternary mechanism, we can benefit in **both** privacy and communication by the sparsification process in the ternary mechanism. Intuitively, if the sparsifying threshold is high (i.e., we only keep very few coordinates), we can hope to add less noise to achieve privacy, as the sparsification has already introduced some uncertainty in the data. The paper claims that this is something that prior works cannot offer. The reviewer, unfortunately, did not have a chance to verify the claim.

Strengths

* Working with f-DP **and** in the local model seems like a new approach. * The proposed algorithm is natural and simple to implement, it is backed by the theory and performs favorably in the experiments.

Weaknesses

* It's a bit hard to interpret/digest the closed-form f-DP guarantee of all these mechanisms. Have some plot/converting to Renyi-DP or (eps,delta)-DP might help.

Questions

* Your algorithm sends **in expection** O(d * A/B) bits. Is there a way to improve this to a worst-case guarantee? How about, say, randomly selecting (A/B * d) coordinates? Is it possible to work out the f-DP (or any other reasonable DP notion) property of this variant?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Some future directions are mentioned in the paper.

Reviewer Mzdj4/10 · confidence 2/52023-07-07

Summary

This paper analyses the privacy that is provided by stochastic rounding methods when doing distributed mean estimation with local differential privacy. It finds that they can contribute to the privacy guarantee thus achieving a better tradeoff. It then "breaks" the privacy communication utility trade-off in the sense of pointing out that for the high privacy regime extra communication won't buy you any more accuracy.

Strengths

Previous naive means of implementing DP aggregation with randomised rounding have failed to take advantage of the privacy provided by stochastic compression. This should be utilised if possible which they attempt to do.

Weaknesses

The presentation fails to show a decent comparison showing hwo much is really gained by taking advantage of this randomness. It isn't clear the gain isn't negligible. There is a graph comparing ternary and binary quantisation but it isn't clear whether the parameters actually correspond to low communication, which would require sufficient sparsity. The supposed break of the three way trade off is really just the observation that in the high privacy regime there is no gain to lots of communication. This is not what break means, the title is overselling. What is more this observation is very far from new. The idea that O(epsilon) communication suffices goes back a long way for various problems. This was proven with complete generality in https://arxiv.org/pdf/2102.12099.pdf.

Questions

Fixing two of privacy/communication/utility how much does taking advantage of the randomness in the compression actually help the other one? Am I missing something with the breaking of the trade-off?

Rating

4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

2 fair

Contribution

2 fair

Limitations

They don't really talk about the limitations, indeed the limitations aren't really clear from the presentation.

Reviewer 191s6/10 · confidence 4/52023-07-10

Summary

In a federated setting where a server coordinates the collaborative analysis of multiple users with local data, communication efficiency and data privacy are two major issues of consideration. Classical DP mechanisms such as Laplace or Gaussian mechanisms add noises as real numbers -- at the same time, to save communication cost it is preferred to have discrete noises with limited range (resolution). This paper considers all three aspects: communication efficiency, privacy, and accuracy. Specifically, the authors would like to study privacy guarantee of data compression schemes, which intuitively introduces information loss and thus is good for protecting privacy. The authors use f-DP, and considers binomial mechanisms. Binomial mechanisms have been considered in [6] and [9], this paper provides tighter bounds. In addition, the authors also consider a compression scheme that optimizes for communication efficiency. This is a combination of a sign based quantization and sparsification.

Strengths

I like the motivation of the paper and the consideration of all three objectives, communication efficiency, privacy and accuracy together. The tighter analysis and mechanisms for communication efficiency is of use in practice. Although the work builds on prior work the improvement by considering compression for privacy amplification is nice. The paper is generally well written.

Weaknesses

A few minor issues, see below.

Questions

Are there any lower bounds on the tradeoff of the three considerations? Any discussion here would be useful. Writing: it would be good to summarize somewhere in the paper the best recommendation for practitioners, what parameters to choose etc. Is there general improvement (amplification of privacy) using compression/sparsification? Can the authors elaborate/discuss this?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

N/A

Reviewer mVNo2023-08-14

Thanks for your rebuttal. Unfortunately, I am still seeing the contributions are limited. The proposed mechanism is not novel as mentioned earlier it can be represented by coordinate sampling and quantization. Due to these reasons, I keep my score.

Authorsrebuttal2023-08-15

Response to the follow-up comment

Dear Reviewer mVNo, Thanks for your follow-up comment. We cannot agree that the proposed ternary compressor being a combination of coordinate sampling and quantization makes the paper not novel. It is not rare that scientific research builds on prior works. For example, SQKR (reference [13] in the manuscript) combines Kashin's representation [R1], coordinate sampling, and the Randomized Response mechanism (which can be traced back to [R2]), while CLDP (reference [23] in the manuscript) combines the 1-bit quantizer (a special case of the randomized response mechanism) and coordinate sampling. These works make solid contributions to the area by demonstrating satisfactory accuracy/privacy performance or providing rigorous theoretical analyses (or both). Similarly, our contribution and novelty are not only proposing the ternary compressor (in fact, we have already mentioned in lines 243-244 of our manuscript that the ternary compressor is a combination of sign-based quantization and sparsification) but also providing the corresponding theoretical analyses on privacy guarantees in terms of the emerging and promising $f$-DP for both the proposed scheme and the existing mechanisms. For the proposed ternary compressor, its improvement in privacy compared to existing methods is backed by rigorous theoretical analyses. We also advance the literature by providing tighter privacy guarantees for the binomial noise and complementing privacy analysis for the Poisson binomial mechanism by showing its local differential privacy guarantee. Our results reveal that the binomial mechanism captures numerous existing compression and differential privacy mechanisms as special cases, which are valuable on their own. More importantly, although there are some existing works (e.g., SQKR) that utilize coordinate sampling and quantization, they adopt coordinate sampling merely for the purpose of improving communication efficiency and fail to account for its impact on privacy from the theoretical aspect. Studying the impact of sparsification on privacy is crucial, especially for applications like differentially private distributed learning where communication costs and privacy are the major bottlenecks and sparsification is one of the most effective and commonly adopted approaches to alleviate the communication burden. To the best of our knowledge, this is the first work that investigates the privacy protection brought by coordinate sampling, which shows that the loss in accuracy due to sparsification can be translated to amplification in privacy and therefore leads to significant improvement in terms of differential privacy guarantees compared to existing methods. Therefore, we believe that the results and findings in this paper are novel and of critical importance to the community. Again, we appreciate your time and effort in reading the paper and providing comments. Please let us know if you have further questions. Best regards, Authors of the paper [R1] Y. Lyubarskii and R. Vershynin, “Uncertainty principles and vector quantization,” IEEE Transactions on Information Theory, vol. 56, no. 7, pp. 3491–3501, 2010. [R2] S. L. Warner. "Randomized response: A survey technique for eliminating evasive answer bias." Journal of the American Statistical Association, 60(309):63–69, 1965.

Authorsrebuttal2023-08-18

Response to Reviewer Mzdj

Dear Reviewer Mzdj, We noticed that you have raised your score from 3 (reject) to 4 (borderline reject), and we appreciate it. We hope that we have clarified our contributions and addressed your concerns in our response above. One notable difference between the proposed method and the existing literature is that we capture the correlation between differential privacy and compression while the existing methods like SQKR do not account for privacy in compression. More specifically, the existing works have shown that in the high privacy regime, the error introduced by compression will be dominated by the error introduced by privacy constraints, while this work (to the best of our knowledge, this is also the first work) further proves that the former can be translated to enhancement in privacy (and therefore provides a better utility-privacy tradeoff as we verified in both theoretical and numerical results). Moreover, we believe that our analyses on the $f$-DP guarantees of the existing differentially private mechanisms and compression schemes are valuable on their own. Please let us know if you have further concerns or comments, and we will further clarify. Best regards, Authors of the paper

Reviewer Mzdj2023-08-21

This makes some sense but the gains still seem small to me. I am therefore neither willing to recommend an acceptance or express much confidence.

Authorsrebuttal2023-08-21

Response to Reviewer Mzdj's follow-up comment

Dear Reviewer Mzdj, Thanks for your further comment. It is indeed not easy to interpret the privacy guarantee in terms of $f$-DP, and we would like to further clarify from the following different aspects. **In terms of type II error rate**: Note that as we mentioned in our global response, for the examined scenario in Fig. 4 of the manuscript, compared to SQKR, the proposed ternary compressor increases the type II error rate (which measures the probability that the attacker makes a wrong guess about the true data in hypothesis testing) from $f(\alpha) = 0.068$ to $f(\alpha) = 0.484$ (when $\alpha=0.5$ and $\epsilon = 2$). **In terms of $\epsilon$-DP given the same MSE and communication cost**: As we discussed in our global response, given the same MSE and communication cost as that of SQKR with $\epsilon_{SQKR} = \\{1,2,5\\}$, the proposed ternary compressor yields approximately $\epsilon_{ternary} = \\{0.05,0.2,3.9\\}$. Note that by definition, for differentially private mechanisms $M$ and all neighboring datasets $D_{1}$ and $D_2$, $e^{\epsilon} = \max_{S}\frac{P(M(D_{1}) \in S)}{P(M(D_{2}) \in S)}$, in which $S$ is the subset of the image of $M$. In this sense, $e^{\epsilon}$ measures the ratio of probabilities that the attacker observing $S$ given neighboring datasets $D_{1}$ and $D_2$. A smaller ratio implies that it is more difficult for the attacker to distinguish $D_{1}$ and $D_{2}$. As an example, improving from $\epsilon_{SQKR} = 5$ to $\epsilon_{ternary} = 3.9$ means that this ratio of probabilities decreases by a factor of $e^{5-3.9} \approx 3$. **In terms of MSE given the same $\epsilon$ and communication cost**: Recall that the MSE of SQKR is proportional to $var = \frac{1}{k}(\frac{e^{\epsilon}+2^{k}-1}{e^{\epsilon}-1})^{2}$ (here we only keep the terms that are related to the communication cost and the privacy requirement $\epsilon$ for ease of discussion), and $\epsilon_{SQKR} = 5$ corresponds to $var = 6.31$ (let $k =10$). We note that for the same $var = 6.31$, the ternary compressor yields $\epsilon_{ternary} = 3.9$. We can also readily examine the MSE of SQKR when it attains $\epsilon_{SQKR} = 3.9$ (i.e., the same privacy as that of the ternary compressor with $var = 6.31$), which gives $var = 49.08$. This means that to achieve the privacy guarantee of $\epsilon_{SQKR} = 3.9$, SQKR yields an MSE that is $49.08/6.31 \approx 6.35$ times that of the proposed ternary compressor. Overall, we believe that such an improvement is not small. **In terms of the improvement in communication efficiency given the same privacy and utility**: Since we use different measures of differential privacy from SQKR, directly comparing the ternary compressor with SQKR is difficult in this case. Therefore, we adopt the classic Gaussian mechanism (which is order-optimal in terms of privacy-utility tradeoff) as the baseline in the right figure in Fig. 4 of the manuscript. Our results imply that the privacy-utility tradeoff of the proposed ternary compressor matches that of the classic Gaussian mechanism well, i.e., the communication efficiency is obtained with negligible loss. Note that our results hold as long as $\mu < \sqrt{4dr/(1-r)}$, in which $\mu$ is the privacy guarantee and $r$ the sparsity ratio. Even when $r = 1$, the ternary compressor leads to an improvement of 32x in communication efficiency (if 32 bits are used to represent a float) compared to the Gaussian mechanism. The improvement is supposed to be larger when $r$ decreases. Finally, we would like to mention that the contributions of this paper are not limited to the proposed ternary compressor. The analyses of tight $f$-DP guarantees for a variety of recently proposed differentially privacy mechanisms and compression schemes are valuable on their own. We hope the above clarification further alleviates your concern. Please let us know if there are further questions. Best regards, Authors of the paper

Reviewer VYNX2023-08-18

Thank you

Thank you very much to the authors for answering my questions. I would like to keep my current score.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC