Amplification by Shuffling: From Local to Central Differential - PowerPoint PPT Presentation

Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity Vitaly Feldman Ulfar Erlingsson Ilya Mironov Ananth Raghunathan Kunal Talwar Abhradeep Thakurta

Local Differential Privacy (LDP) 𝐵 1 𝑦 1 For all 𝑗 , 𝐵 𝑗 is a local 𝜗 -DP randomizer: 𝐵 2 𝑦 2 for all 𝑤, 𝑤′ ∈ 𝑌 𝑦 3 𝐵 3 Server 𝐵 𝑗 (𝑦 𝑗 = 𝑤) 𝐵 𝑗 (𝑦 𝑗 = 𝑤′) [Warner ‘65; EGS ‘03; KLNRS ‘08] 𝐵 𝑜 𝑦 𝑜 Compute (approximately) 𝑔(𝑦 1 , 𝑦 2 , … , 𝑦 𝑜 )

Outline Benefits of anonymity: Online monitoring with LDP privacy amplification by shuffling 3

Online monitoring time 𝑦 𝑗,𝑘 ∈ {0,1} 𝑦 1,1 𝑦 1,2 𝑦 1,3 𝑦 1,𝑒 Status of user 𝑗 on day 𝑘 𝑦 2,1 𝑦 2,2 𝑦 2,3 𝑦 2,𝑒 Assume that each user’s status 𝑦 3,1 𝑦 3,2 𝑦 3,3 𝑦 3,𝑒 changes at most 𝑙 times • only for utility 𝑦 𝑜,1 𝑦 𝑜,2 𝑦 𝑜,3 𝑦 𝑜,𝑒 𝑇 𝑜 𝑇 1 𝑇 2 𝑇 3 Estimate the daily counts 𝑇 𝑦 𝑗,𝑘 for all 𝑘 ∈ [𝑒] 𝑜 𝑘 = σ 𝑗=1 4

Monitoring with LDP There exists an 𝜗 -LDP algorithm that constructs estimates 𝑇 1 , መ መ 𝑇 2 , … , መ 𝑇 𝑒 such that with high prob. for all 𝑘 ∈ [𝑒] , 𝑜𝑙 (log 𝑒) 2 𝑘 − መ 𝑇 𝑇 𝑘 = 𝑃 𝜗 • Report the status changes (only first 𝑙 ) • Maintains a tree of counters each over an interval of time • Based on [DNPR ‘10; CSS ‘11] 5

Encode-Shuffle-Analyze (ESA) [Bittau et al. ‘17] 𝐵 1 𝑦 1 𝐵 2 𝑦 2 𝐵 3 𝑦 3 Server 𝐵 𝑜 𝑦 𝑜 Shuffle and anonymize 6

Privacy amplification by shuffling For any 𝜗 = 𝑃(1) and any sequence of 𝜗 -LDP algorithms (𝐵 1 , … , 𝐵 𝑜 ) , let 𝐵 shuffle 𝑦 1 , … , 𝑦 𝑜 = 𝐵 1 𝑦 𝜌 1 , 𝐵 2 𝑦 𝜌 2 , … , 𝐵 𝑜 𝑦 𝜌 𝑜 for a random and uniform permutation 𝜌: 𝑜 → 𝑜 Then 𝐵 shuffle is 𝜗′, 𝜀 -DP in the central model for 𝜗 ′ = 𝑃 𝜗 log 1/𝜀 𝑜 Holds for adaptive case: 𝐵 𝑗 may depend on outputs of 𝐵 1 , … , 𝐵 𝑗−1 7

Comparison with subsampling Running 𝜗 -DP algorithm on random 𝑟 -fraction of elements is ≈ 𝑟𝜗 -DP ( 𝜗 ≤ 1) [KLNRS ‘08] Shuffling includes all elements so 𝑟 = 1 Output 𝐵 1 𝑦 𝑗 1 , 𝐵 2 𝑦 𝑗 2 , … , 𝐵 𝑜 𝑦 𝑗 𝑜 where 𝑗 1 , 𝑗 2 , … , 𝑗 𝑜 ∼ [𝑜] (independently) is 𝜗′, 𝜀 -DP for 𝜗 ′ = 𝑃 𝜗 log 1/𝜀 𝑜 e.g. [BST ‘14 ] Advantages of shuffling: does not affect the statistics of the dataset • does not increase LDP cost • 8

Implications for ESA 𝐵 1 𝑦 1 𝐵 2 𝑦 2 Set 𝑇 ⊆ [𝑜] with the same randomizer 𝑦 3 𝐵 3 Server 𝐵 𝑜 𝑦 𝑜 Shuffle and anonymize 𝜗 log 1/𝜀 For every 𝑗 ∈ 𝑇 , the output is 𝑃 , 𝜀 -DP for element at position 𝑗 𝑇 9

Special case: binary randomized response RR : For 𝑦 ∈ 0,1 , return 𝑦 flipped with probability 1/3 . Satisfies (log 2) -LDP Output distribution is determined by 𝑛 = # 1 (RR(𝑦 1 ), … , RR(𝑦 𝑜 )) 𝑛 ∼ Bin 𝑙, 2 3 + Bin 𝑜 − 𝑙, 1 3 , where 𝑙 = # 1 (𝑦 1 , … , 𝑦 𝑜 ) For a neighboring dataset: 𝑙 ′ = 𝑙 ± 1 Bin 𝑙, 2 3 + Bin 𝑜 − 𝑙, 1 Bin 𝑙 + 1, 2 3 + Bin 𝑜 − 𝑙 − 1, 1 ≈ log 1/𝜀 3 3 ,𝜀 𝑜 [DKMMN ‘06] Also given in [Cheu,Smith,Ullman,Zeber,Zhilyaev ‘18] (independently) 10

Conclusions • Monitoring with LDP and log dependence on time • General privacy amplification technique o Match state of the art in the central model o Can be used to derive lower bounds for LDP • Provable benefits of anonymity for ESA-like architectures • To appear in SODA 2019 • arxiv.org/abs/1811.12469 11