Universal Exact Compression of Differentially Private Mechanisms

To reduce the communication cost of differential privacy mechanisms, we introduce a novel construction, called Poisson private representation (PPR), designed to compress and simulate any local randomizer while ensuring local differential privacy. Unlike previous simulation-based local differential privacy mechanisms, PPR exactly preserves the joint distribution of the data and the output of the original local randomizer. Hence, the PPR-compressed privacy mechanism retains all desirable statistical properties of the original privacy mechanism such as unbiasedness and Gaussianity. Moreover, PPR achieves a compression size within a logarithmic gap from the theoretical lower bound. Using the PPR, we give a new order-wise trade-off between communication, accuracy, central and local differential privacy for distributed mean estimation. Experiment results on distributed mean estimation show that PPR consistently gives a better trade-off between communication, accuracy and central differential privacy compared to the coordinate subsampled Gaussian mechanism, while also providing local differential privacy.

Paper

Similar papers

Peer review

Reviewer GP8R7/10 · confidence 2/52024-07-05

Summary

A new technique for compressing local differential privacy (LDP) reports is presented, based on Poisson functional representations, a tool from information theory that allows encoding a random variable in close to information-theoretically minimum number of bits (expected) in a "universal" manner that does not require the decoder to know about the distribution of the random variable. The paper presents a generalization called Poisson *private* representations (PPR) that preserves DP guarantees up to a multiplicative factor and has similar encoding efficiency (with a trade-off controlled by a parameter 𝛼). Unlike previous LDP compression techniques, PPR result in exactly the same distribution of decoded values as the original, uncompressed LDP protocol, so it preserves properties such as unbiasedness. The utility of PPR is investigated in a couple of case studies: distributed mean estimation and metric privacy.

Strengths

* Originality: Interesting techniques from information theory that have not, to my knowledge, been used in differential privacy or federated learning before * Quality and clarity: The paper is very well-written (but also dense and assumes a lot from the reader). * Significance: A little hard to gauge, but the generality of the methods suggest that they may be of interest in many settings. The "universality" is particularly striking and may have important applications.

Weaknesses

* I found the paper hard to read, in part because it uses math that I was not familiar with, in part because many details are hidden away in the appendices. Possibly, a more self-contained and accessible version could be achieved by focusing the exposition on a special case (e.g. simulating privUnit), and leaving the generalization for the appendices. * It is assumed that each client and the server share a common, random sequence. While this might be realized using a pseudorandom generator, communicating a short seed, this overhead may be significant in practice. (This weakness, it should be mentioned, is shared with several previous methods.) * PPR yields an overhead of more than a factor 2 in the privacy parameter * The running time is exponential in 𝜺 which may limit applications to the shuffle model, where amplification means that high values of epsilon may be used

Questions

* Is it correctly understood that your method is private even to an adversary who knows the shared randomness? * Is there any way that clients can use the same shared randomness, or should this by per-client? * In line 166 it is not clear that argmin is well-defined, can you comment on this? * Can you achieve a bound on the worst-case encoding size, say, by reverting to a simpler encoding if K is too large?

Rating

7

Confidence

2

Soundness

3

Presentation

2

Contribution

3

Limitations

The authors have adequately addressed limitations

Reviewer U6Tv7/10 · confidence 3/52024-07-08

Summary

The paper addresses the problem of reducing the communication cost of messages that are shared under differential privacy (DP) guarantees. This is an important problem in privacy preserving machine learning, where parties that share obfuscated large models could incur in significant communication overhead. Techniques to reduce communication exist, but they (a) require to share randomness between the encoder (i.e., the data subject that obfuscates its data) and a (possibly adversarial) analyst (or decoder), (b) resort into approximate and biased distribution estimations or (c) only work for specific distributions. The current paper proposes a compression technique that (i) achieves optimal and lossless compression rates without significant degradation of DP-guarantees, (ii) only requires a small amount of public information to be shared between encoder and decoder and (iii) are universal as they can be used for any DP-mechanism.

Strengths

In terms of novelty, the paper proposes an original idea that leverages the Poisson functional representation to avoid shared randomness between the encoder and decoder, allowing the use of the compression technique in the local DP setting. The work is of good quality as - it appropriately backs its claims with proofs - provides an extensive analysis of the compression and privacy properties of the proposed technique. First, it shows that it achieves optimal compression (up to a logarithmic factor) which yields to compression rates that are similar to non-private techniques. Next, it provides DP bounds of the compression technique, characterizing the trade-offs between compression and privacy and showing that significant compression can be achieved with acceptable privacy degradation. Finally, it shows how these guarantees boil down to distributed mean estimation (DME) and metric privacy. A strong point on the impact of the contribution is the universality property, which allows the simulation of any distribution. This makes the technique widely applicable, unlike previous solutions that are tailored to specific problems.

Weaknesses

The main drawback of the contribution is in the lack of a more detailed comparison with other previous techniques. While the proposed technique successfully positions itself with respect to related work, it is not clear how the advantages (universality, exact simulation, lack of shared randomness between encoder and decoder) lead to significant improvements in machine learning. As said before, it is clear that universality is a potentially interesting property. However, it is not completely clear the disadvantage of shared randomness when these randomness does not break the privacy guarantee (as it seems to be the case in [5,30]). It seems that this shared randomness would imply a larger communication cost, but the final compromises between compression, accuracy and privacy are not clear. The advantages of an exact simulation are also not illustrated. It might be the case that the degradation of accuracy (or privacy) of approximate solutions is not significant. Since these aspects are not more accurately illustrated, I am not sure about the actual advantages of the current technique. Finally, empirical illustrations don't to show more than a marginal advantage with respect to GSGM [18], which only apply in permissive privacy regimes (e.g. $\epsilon > 1$). Therefore, these illustrations do not help to clarify the advantages of the current contribution in practice. A minor comment is the lack of a more complete presentation of Poisson functional representation, which could be expanded for clarity.

Questions

Can de authors address weaknesses raised in my review? Especially, two aspects that would clarify the advantages of the work are: - The disadvantages of shared randomness between encoder and decoder, which in the paper is discussed in two different contexts: At the end page 2 of the paper, shared randomness appear to break privacy guarantees if the decoder is an adversary. Then, at the beginning of page 3 under the compression of local DP mechanisms, shared randomness is also discussed, but disadvantages here are not clear (see the related point in the weaknesses I described in my review). - From Figure 1, I can only see the advantages of PPR in permissive privacy regimes. However, distributed mean estimation is a canonical task that in machine learning is used under composition, leading to further privacy degradation. Therefore it is important to understand the properties of the protocol under more conservative regimes (e.g. $\epsilon < 1/2$). Could PPR perform better with respect to CSGM with further compression (e.g., 25 bits or 10 bits) under such regimes?

Rating

7

Confidence

3

Soundness

3

Presentation

2

Contribution

2

Limitations

I don't see additional limitations other than the discussed by the authors.

Reviewer VD1w6/10 · confidence 3/52024-07-12

Summary

The paper investigates the problem of compressing the output of differentially private algorithms, particularly focusing on the local model. Given a Local Differential Privacy (LDP) algorithm $ A $ that induces a conditional distribution $ p_{Z \mid X} $ where $ Z = A(X) $, the objective is to generate a message using minimum bits, allowing the server to recreate a random variable following the distribution $ p_{Z \mid X} $. The paper introduces a novel compression algorithm leveraging shared randomness between the server and clients. Key points include: 1. The compression algorithm applies universally to every local randomized algorithm, provided there is agreement on the output space. 2. The size of the compressed output matches the mutual information lower bound $ I(X; Z) $, with an additive logarithmic term. 3. Using the compressed outputs, the server can reconstruct random variables that exactly follow the distributions of the outputs of the local randomizers of the clients. A central component of this approach is the Poison functional representation, a channel simulation scheme. Initially not differentially private, the paper extends it to ensure differential privacy using a technique akin to the exponential mechanism. Experimental results demonstrate improved performance of the proposed algorithm compared to previous approaches.

Strengths

1. Viewing the problem of compressing the output of Local Differential Privacy (LDP) algorithms as a channel simulation problem is inspiring, as it allows leveraging insights and results from the extensive study of channel simulation. 2. The proposed algorithm is versatile and applicable to a wide range of LDP algorithms, effectively reducing their communication costs to nearly optimal levels. It can serve as a fundamental primitive: LDP algorithm designers can focus on the privacy-utility trade-off without significant concerns about communication costs.

Weaknesses

See ``Limitations''

Questions

1. On page 2, line 75, "lower bound I(X;Y)" - - > "lower bound I(X;Z)". 2. In the experiment section, the paper only mentions the running time for $ \epsilon = 0.05 $ (line 335). It would be informative to include the running time for larger values of $ \epsilon $ experimented in the paper, such as $ \epsilon = 10 $. Specifically, it would be useful to know how does the running time scale with $ \epsilon $.

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

1. 1. The running time of the compression algorithm is exponential in the mutual information $ I(X; Z) $. While this aspect is crucial, it is currently mentioned in the limitation section rather than explicitly in the main theorem describing the properties of the compression algorithm. 2. 2. The proposed compression algorithm does not strictly preserve the privacy guarantee of the Local Differential Privacy (LDP) algorithm. Instead, it can inflate the privacy guarantee by a constant factor: an $ \epsilon $-LDP algorithm, after compression, might become $ 2\alpha \epsilon $-LDP, where $ \alpha > 1 $. This trade-off is acceptable when focusing on the asymptotic privacy-utility trade-off of LDP algorithms. However, for LDP algorithms that achieve optimal errors with optimal constants, applying the compression algorithm may result in algorithms with suboptimal constants.

Reviewer NbQx7/10 · confidence 3/52024-07-12

Summary

The paper designs Poisson private representation (PPR) to compress and simulate any local randomizer while ensuring local differential privacy. PPR exactly preserves the joint distribution of the data and the output of the original local randomizer, and also achieves a compression size within a logarithmic gap from the theoretical lower bound. The authors also a provides an order-wise trade-off between communication, accuracy, central and local differential privacy for distributed mean estimation. Numerical experiments are conducted to validate theoretical justifications.

Strengths

* The paper designs a compressor that can simulate any local or central DP mechanism and enables exact simulation * The trade-off between communication, accuracy, and privacy for distributed mean estimation are analyzed * The paper is well-organized and easy to follow * The comparisons with previous results and the limitations of the proposed PPR are discussed

Weaknesses

The privacy analysis in Corollary 5.2 is only suitable for cases where n, the number of local clients, is small. However, in practical scenarios such as federated learning, n is typically very large. An analysis that addresses privacy for large n would be appreciated.

Questions

Why does the privacy analysis in Corollary 5.1 not relate to n?

Rating

7

Confidence

3

Soundness

3

Presentation

3

Contribution

2

Limitations

Limitations are clearly stated in the paper.

Reviewer GP8R2024-08-08

Thanks for the rebuttal

I have no further questions

Authorsrebuttal2024-08-14

Thank you for your response to our rebuttal.

We thank the reviewer for the time reading our paper and rebuttal.

Reviewer NbQx2024-08-13

I appreciate the authors' thorough responses to my questions. I will keep my positive score.

Authorsrebuttal2024-08-14

Thank you for your response to our rebuttal.

We thank the reviewer for the time evaluating our manuscript.

Reviewer U6Tv2024-08-13

Thank you for your rebuttal and your efforts for clarifying concerns. I appreciate the clarifications on the use of shared randomness and the advantages with respect to CSGM [18]. You have addressed these points successfully. However, I still feel that the proposed technique should be further compared with related work. It is not clear to me why [18] is the only work for which you should compare concrete trade-offs. Even if you have been clear about the conceptual advantages of exact simulation (i.e., unbiased distributions, "summable" noise), it does not seem clear why approximate simulation would imply biased estimates. Therefore, I don't fully understand why other techniques mentioned in "Generic compression of local DP mechanisms" and "DME under DP" paragraphs of Section 2 are excluded from more concrete comparisons made in Section 7. In particular (and as already raised in the discussion), the proposed protocol inflates the privacy budget. Therefore if we want to obtain a compressed mechanisms with the exact same $(\epsilon, \delta)$ parameters as the original, your protocol should simulate a distribution that provides privacy with lower privacy budget, modifying (even if probably slightly) the distribution parameters. I don't see why this is not a distortion of the original distribution as claimed for other techniques. Therefore, my impression is that the work should either compare with a more extensive number of techniques, putting more illustrations of concrete privacy-accuracy-communication trade-offs on the table or better clarify why these comparisons are not relevant.

Authorsrebuttal2024-08-14

We thank Reviewer U6Tv for the thoughtful comments. Please find our responses below. **1. The reason for comparing to CSGM [18]** We chose to compare to CSGM [18] since [18] is asymptotically optimal and compares favorably to several previous algorithms, as demonstrated in the experiments in [18]. By showing that our proposed scheme compares favorably to [18], we show that our scheme compares favorably to those previous works as well. **2. Regarding comparison to other techniques** Regarding Feldman and Talwar [30]: [30] mentioned applying [30, Theorem 3.4] to Gaussian mechanism. The main obstacle in comparing [30, Theorem 3.4] to our result is that [30] relies on a computational hardness assumption on the pseudorandom number generator, and it is unclear how many bits of random seed (communication) are necessary to guarantee computational indistinguishability. Also, [30] does not prove that their scheme has a communication cost close to the theoretical minimum. Regarding Bassily and Smith [5]: [5] does not exactly preserves the distribution of the simulated mechanism (there is a 50% chance that the data is dropped). Additional (likely non-trivial) analyses are necessary to characterize its central-DP guarantee for mean estimation, to be compared to our scheme in Figure 1. [65] is also non-exact, making their central-DP guarantees unclear. **3. About whether "approximate simulation would imply biased estimates"** We emphasize that unbiasedness is a mathematical property that requires proof. If an approximate method cannot be proved to be unbiased, then it should not be considered to be unbiased, regardless of how close to zero the bias appears to be in experiments (the bias might become large outside of the cases experimented). For some specific approximate methods, it may be possible to add a debiasing step with a proof of unbiasedness (e.g., [65]), though the feasibility of such a step depends on the specific task and the mathematical tractability of the output distribution. The advantage of exactness is that it can readily imply unbiasedness, and no additional steps are necessary. In sum, approximate method does not necessarily imply biasedness (e.g., [65]), but an approximate method without a proof of unbiasedness should not be considered to be unbiased. Therefore, unbiasedness is an advantage of our exact method over other approximate methods without proofs of unbiasedness. This is a theoretical advantage that does not require experiments to show. **4. Regarding distortion for a fixed $(\\varepsilon, \\delta)$ and approximate techniques** Indeed, if $(\\varepsilon, \\delta)$ is fixed, then we have to reduce the $\\varepsilon, \\delta$ of the simulated mechanism. However, this reduction can be small according to Theorem 4.8. Also, the distortion introduced by lowering $\\varepsilon, \\delta$ is considerably different from the distortion introduced by the methods in [30,65,71]. If we exactly simulate the Gaussian mechanism with a lower $\\varepsilon, \\delta$, the noise is still exactly Gaussian (with a larger variance), and can be added to other Gaussian noises nicely. This "summable" noise is the key to providing central DP guarantees (in addition to local DP). However, if we simulate the Gaussian mechanism using the approximate techniques in [30,65,71], the noise introduced has a mathematically intractable distribution, which will be an obstacle in obtaining theoretic guarantees for downstream tasks (e.g., for distributed mean estimation, we do not know the overall noise distribution and its central-DP properties after summing all the data). The main benefits of exactness are mathematical tractability and ease of proving guarantees for downstream tasks. **5. The benefits of simple theoretical guarantees** Also, we believe that the theoretical contributions of our work, namely the privacy-communication trade-off given in Theorems 4.3-4.8 given in simple and clean expressions, with exact preservation of the output distribution, is noteworthy in itself. To the best of our knowledge, our work is the first method for compressing DP mechanisms that has a bound on its compression size universally close to the I(X;Z) lower bound (i.e., the bound depends on the simulated mechanism only through I(X;Z) as in Theorem 4.3, and hence is always almost-optimal regardless of the situation). Even though we agree that more experiments can be beneficial, experiments are not strictly necessary to demonstrate the almost-optimality of our method, when we have a mathematical proof of its universal almost-optimality for the compression size. We believe these simple guarantees (in terms of simple quantities like I(X;Z)) and exact distribution preservation can make the proposed method a useful general technique for designing more specific DP mechanisms in the future. We hope that we have adequately addressed the concerns and questions, and kindly invite the reviewer to consider updating the score.

Reviewer U6Tv2024-08-14

Dear authors, Thank you for your reply. I highly appreciate your efforts in clarifying concerns. I am leaning to increase my score, but in that case I will do it after discussing with the other reviewers.

Authorsrebuttal2024-08-14

Thank you for your response to our rebuttal.

We thank the reviewer for the time reading our rebuttal and providing constructive feedbacks.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC