SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Adversarily Robust Distributed Count Tracking via Partial Differential Privacy
Zhongzheng Xiong
School of Data Science
zzxiong21@m.fudan.edu.cn
Xiaoyi Zhu
zhuxy22@m.fudan.edu.cn
Zengfeng Huang*
huangzf@fudan.edu.cn
We study the distributed tracking model, also known as distributed functional monitoring. This model involves  $k$  sites each receiving a stream of items and communicating with the central server. The server's task is to track a function of all items received thus far continuously, with minimum communication cost. For count tracking, it is known that there is a  $\sqrt{k}$  gap in communication between deterministic and randomized algorithms. However, existing randomized algorithms assume an "oblivious adversary" who constructs the entire input streams before the algorithm starts. Here we consider adaptive adversaries who can choose new items based on previous answers from the algorithm. Deterministic algorithms are trivially robust to adaptive adversaries, while randomized ones may not. Therefore, we investigate whether the  $\sqrt{k}$  advantage of randomized algorithms is from randomness itself or the oblivious adversary assumption. We provide an affirmative answer to this question by giving a robust algorithm with optimal communication. Existing robustification techniques do not yield optimal bounds due to the inherent challenges of the distributed nature of the problem. To address this, we extend the differential privacy framework by introducing "partial differential privacy" and proving a new generalization theorem. This theorem may have broader applications beyond robust count tracking, making it of independent interest.
In the distributed tracking model there are  $k$  sites and a single central server. Each site  $i$  receives items over time in a streaming fashion and can communicate with the server. Let  $S_{i}(t)$  be the stream that site  $i$  observes up to time  $t$ . The sever wants to track the value of a function  $f$  that is defined over the multiset union of  $\{S_{i}(t) \mid i = 1, \dots, k\}$  at all times. The goal is to minimize the communication cost, which is defined as the total number of words communicated between the server and all sites. Due to strong motivations from distributed system applications, this model has been extensively investigated, e.g., [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. The theoretical study of communication complexity was initiated by [5]. Count tracking is the most basic problem in distributed tracking, where  $f$  is simply the total number of items received so far. Since exact tracking requires sites to communicate every time an item arrives, incurring too much communication, the objective is to track
an  $(1 + \alpha)$ -approximation. For this problem, there is a simple deterministic algorithm with  $\tilde{O} (k / \alpha)^2$  communication. Huang et al. [13] proposed a randomized algorithm that achieves  $\tilde{O} (\sqrt{k} /\alpha)$ , but the correctness is under the assumption of an oblivious adversary, i.e., input streams are constructed in advance and are just given to sites one item at a time. In particular, the analysis assumes the input is independent of the algorithm's internal randomness. In interactive applications, this assumption is often unrealistic; the adversary can generate the next item based on previous answers from the server, making the independence assumption invalid. Moreover, the break of independence may occur unintentionally. For example, the tracking algorithm may be part of a larger system; the output of the algorithm can change the environment, from which the future input to the algorithm is generated. In such cases, we can no longer assume the independence between inputs and algorithm's internal state. The main question of this paper is: Whether the  $\sqrt{k}$  advantage of randomized count tracking algorithms is from randomness itself or the oblivious adversary assumption?
Designing robust randomized algorithms against adaptive adversaries has received much attention recently [14, 15, 16, 17, 18, 19, 20, 21, 22, 23]. Existing research focuses on centralized settings, and in this paper, we initiate the study of adversarial robustness for distributed tracking. We provide a new randomized algorithm with communication  $\tilde{O} (\sqrt{k} /\alpha)$ , which provably tracks the count within an  $\alpha$  relative error at all times, even in the presence of an adaptive adversary. As in [18], we utilize differential privacy (DP) to construct robust tracking algorithms. The main idea is to use DP to protect the internal randomness, so that the adversary cannot learn enough information about it to generate bad inputs. However, due to the "event-driven nature" of distributed tracking algorithms, we cannot protect the randomness in the usual sense of DP (which will be elaborated in more details below). Thus, the DP framework of [18] is not directly applicable.
To address this difficulty, a relaxed version of differential privacy, called partial differential privacy, is introduced. Moreover, a new generalization theorem for partial DP is proved. In partial DP we allow an arbitrary small subset of the database to be revealed, and only require the privacy of the remaining dataset is protected. The power of the new definition comes from the fact that the privacy leaked set can be chosen by the algorithm after the interaction with the adversary and the set can depend on the actual transcript. Intuitively, an interactive mechanism satisfies partial DP as long as after the interaction, we can always find a large subset whose privacy is protected. On the other hand, since the set we try to protect is not fixed in advance, it is subtle to give the right notion of "protecting the privacy of a large part of the data". Besides this new notion of DP, our algorithm deviates from the framework of [18] in many other details. For instance, our algorithm does not treat existing oblivious algorithms as a black box; instead, we directly modify oblivious algorithms and perform a more fine-grained privacy analysis. The contributions of this paper are summarized as follows:
1. We initiate the study of adversarially robust distributed tracking and propose the first robust counting tracking algorithm with near optimal communication.
2. To overcome the inherent challenges that arise from the distributed nature of the problem, we introduce a relaxed (and more general) version of differential privacy and prove a new generalization theorem for this notion. We believe that this new generalization theorem can be of independent interest and may have broader applications beyond count tracking.
1.1 Problem Definitions and Previous Results
Throughout this paper, we use  $\mathcal{M}$  to denote the tracking algorithm/mechanism and  $\mathcal{A}$  to denote the adversary.  $N$  is used to denote the total number of items.
The model and its event-driven nature We assume there exists a point-to-point communication channel between each site and the server, and communication is instantaneous with no delay. It is convenient to assume that the time is divided into discrete time steps. In each step, the adversary picks one site and sends it a new item. The adversary is also allowed to skip the step and do nothing, and because of this, algorithms that can trigger new events based on the global time do not have an advantage over purely event-driven ones. For example, the server may have wanted to wait a random number of time steps before updating the output, but the adversary can always skip a large number of steps before sending the next item, which makes the waiting meaningless. That being said, it is not a restriction to only consider event-driven algorithms: the internal state of each site changes only when
2We use the  $\tilde{O}$  notation to suppress the dependency on all polylogarithmic factors.
it receives a new item or a new message from the server, and the server's state changes only if a new message from sites arrives.
Distributed count tracking The goal of a count tracking algorithm  $\mathcal{M}$  is to output an  $(\alpha, \beta)$ -approximation of the total number of items received by all sites. More specifically, with probability at least  $1 - \beta$ , the output of  $\mathcal{M}$  is  $(1 \pm \alpha)$ -accurate with respect to the true answer at all time steps simultaneously. We measure the complexity of the algorithm by the total communication cost between the server and all sites. Consistent with prior research, communication cost is expressed in terms of words unless otherwise stated. We assume that any integer less than  $N$  can be represented by a single word. To simplify the presentation, we assume  $k \leq \frac{1}{\alpha^2}$ . The case  $k > \frac{1}{\alpha^2}$  can be solved with the same technique, with an extra additive  $O(k \log N)$  term in the communication complexity<sup>3</sup>.
The adversarial model The setting can be viewed as a two-player game between the tracking algorithm  $\mathcal{M}$  and the adversary  $\mathcal{A}$ . At each time step  $t$ ,
1.  $\mathcal{A}$  generates a pair  $u_{t} = (i,x)$ , where  $x$  is the item and  $i$  is the site to send  $x$  to; and  $u_{t}$  depends on the previous items and previous outputs of  $\mathcal{M}$ .
2.  $\mathcal{M}$  processes  $u_{t}$  and outputs its current answer  $a_{t}$ .
The interaction between  $\mathcal{A}$  and  $\mathcal{M}$  generates a transcript  $\pi = (u_{1},a_{1},u_{2},a_{2},\dots)$ . The objective of  $\mathcal{A}$  is to cause  $\mathcal{M}$  to output an incorrect answer at some step  $t$ .
Existing results on count tracking Previous results and their main ideas are discussed here.
Deterministic complexity. There is a simple deterministic solution to count tracking. Each site notifies the server every time their counter increases by a factor of  $1 + \alpha$ . Then, the server always maintains an  $\alpha$ -approximation to each site's counter, and their sum is an  $\alpha$ -approximation to the total count. It is easy to see the communication complexity of this algorithm is  $O\left(\frac{k}{\alpha} \cdot \log N\right)$ . We note deterministic algorithms are trivially robust to adaptive inputs. A deterministic communication lower bound of  $\Omega\left(\frac{k}{\alpha} \cdot \log N\right)$  was proved in [6].
Randomized complexity. A randomized algorithm with  $O\left(\frac{\sqrt{k}}{\alpha} \cdot \log N\right)$  communication and constant error probability was proposed in [13], which was shown to be optimal in the same paper. The main idea of their algorithm is as follows. Let  $N$  be the current number of items. Unlike the above deterministic algorithm, in which each site notifies its local count according to deterministic thresholds, now the thresholds are set randomly. Let  $e_i$  be the discrepancy between the true local count on site  $i$  and its estimation on the server, and the total error is  $e = \sum_{i}^{k} e_i$ . For deterministic algorithms, all  $e_i$  could have the same sign in the worst case, so on average,  $e_i$  has to be less than  $\alpha N / k$ . On the other hand, in the randomized algorithm, each  $e_i$  is a random variable. Suppose  $\mathsf{Var}[e_i] \leq (\alpha N)^2 / k$  for each  $i$ , the total variance  $\mathsf{Var}[e] \leq (\alpha N)^2$ , and it is sufficient to obtain an  $\alpha$ -approximation with constant probability by standard concentration inequalities. Compared to deterministic estimators, now each local error  $e_i$  may far exceed  $\alpha N / k$ .
Robustness to adaptive inputs. In the randomized approach described above, the analysis crucially relies on the independence assumption on  $e_i$ 's, since otherwise the variances do not add up and concentration inequalities cannot be applied. When the adversary is oblivious, the independence holds as long as each site uses independent random numbers. However, in the adaptive setting, this does not hold any more, and it becomes unclear whether the  $\sqrt{k}$  improvement is still achievable.
1.2 Existing Robust Streaming Frameworks
Distributed tracking is a natural combination of streaming algorithms [24] and communication complexity [25]. Robust streaming algorithms design has become a popular topic recently and several interesting techniques have been proposed. Next, we provide a brief overview on the existing frameworks for robust streaming algorithms. Let  $\mathcal{F}$  be the target function, for example, the number of distinct elements.
Note that this extra additive  $O(k \log N)$  term for  $k > \frac{1}{\alpha^2}$  also exists in previous work [13] on oblivious distributed streams.
Sketch switching [14] Given a stream of length  $N$  and an accuracy parameter  $\alpha$ , the flip number, denoted as  $\lambda_{\alpha,N}$ , is the number of times that the target function  $\mathcal{F}$  changes by a factor of  $1 + \alpha$ . For insertion-only streams and a monotone function  $\mathcal{F}$ ,  $\lambda = \frac{1}{\alpha} \cdot \log N$ . In sketch switching, we initialize  $\lambda$  independent copies of an oblivious algorithm, and items in the stream are fed to all copies. The stream can be divided into  $O(\lambda)$  phases; in each phase  $\mathcal{F}$  increases roughly by a factor of  $1 + \alpha$ . During the  $j$ th phase, the output remains the same, and the  $j$ th copy is used for tracking the value. When the estimate (from the  $j$ th copy) has become larger than the last released output by a factor of  $(1 + \alpha)$ , the output is updated and  $j \gets j + 1$ . The robustness holds because each copy is utilized no more than once, and once its randomness is revealed, the algorithm switches to a new copy. The space complexity is  $\lambda$  times the space of the oblivious algorithm. Applying sketch switching on the algorithm of [13] results in a robust count tracking algorithm. However, the communication complexity increases by a factor of  $\lambda$ , which can be worse than the deterministic bound.
Difference estimator Woodruff et al. [22] refined the sketch switching approach significantly and proposed the difference estimator (DE) framework. Informally, instead of using oblivious sketches as the switching unit, the DE framework divides the stream into blocks and uses sketches on each block as switching units. Consider a part of the stream, denoted by  $S$ , in which the value of  $\mathcal{F}$  increases from  $F$  to  $2F$ . A technique called difference estimator (DE) was proposed to estimate the difference between values of  $\mathcal{F}$  at current time  $t$  and some earlier time  $t_0$ . The estimator is generated by maintaining  $\ell = \log \frac{1}{\alpha}$  levels of DEs. In level 1,  $S$  is divided into  $\frac{1}{\alpha}$  blocks and the value of  $\mathcal{F}$  increases by  $\alpha F$  in each block. In the  $j$ th level,  $S$  is divided into  $\frac{1}{\alpha 2^{j-1}}$  blocks, and the DEs produce estimators with additive error  $\alpha F$ . [22] proved that for many important problems, the space complexity of such DEs is  $\alpha \mathrm{Space}(\mathcal{F}) 2^{j-1}$ , where  $\mathrm{Space}(\mathcal{F})$  is the space complexity of  $\mathcal{F}$  in the oblivious setting. Since there are  $\frac{1}{\alpha 2^{j-1}}$  DEs on the  $j$ th level, the total space of level  $j$  is  $\mathrm{Space}(\mathcal{F})$  and the space is  $\ell \mathrm{Space}(\mathcal{F})$  over all levels. Since blocks from all levels form a dyadic decomposition, the final estimator is the sum of  $\ell$  DEs, one from each level. Thus, the total error is  $\ell \alpha F$ , and by adjusting  $\alpha$  in the beginning by a factor of  $\ell$ , this produces the desired error. Applying the DE framework to distributed tracking, the communication bottleneck is from level 1, where there are  $1 / \alpha$  DEs. It requires synchronization at the beginning of each block, so that all sites and the server are able to agree to start a new DE. A synchronization incurs  $k$  communication; thus, even ignoring other cost, the total cost is at least  $\frac{k}{\alpha}$ , which is no better than the deterministic bound.
Differential privacy Hassidim et al. [18] proposed a framework using tools from DP. Instead of switching to fresh sketches, this framework protects the randomness in the sketch using DP. The random bits in each copy of the oblivious sketch are viewed as a data point in the database, and the adversary generates an item (considered as a query in DP) at each time and observes the privatized output. By the generalization theorem of DP, if the interaction transcript satisfies DP w.r.t. the random bits, then the error in the output is close to the error of an oblivious algorithm in the non-adaptive setting (the closeness depends on the magnitude of the noise injected). Similar as in sketch switching, the output is updated only when it changes by a  $(1 + \alpha)$  factor, and thus there are only  $\lambda$  time steps in which the adversary observes "useful information". Therefore, it is not surprising that the sparse vector technique [26] is applied. By the advanced composition theorem of DP [27],  $\tilde{O} (\sqrt{\lambda})$  independent copies of the oblivious algorithm is enough for  $\lambda$  outputs. Therefore, compared with sketch switching, the space increases by only a factor of  $\sqrt{\lambda}$ . Attias et al. [23] gave an improvement by incorporating difference estimator to the DP framework.
However, there is a fundamental challenge in applying the DP framework to distributed tracking. As discussed in Section 1.1, all distributed tracking algorithms are essentially event-driven. Now let us focus on a time step  $t$  where the server updates its output. Because of the event-driven nature, this update is triggered by the event that some site  $i$  just sent a message. Similarly, site  $i$  sending the message is also triggered by another event, and so on and so forth. The start of this event chain must be that the adversary sends an item to some site  $j$ , triggering  $j$  to send the first message. This causes additional privacy leakage. For example, suppose whether to send a message is indicated by a binary function  $f(n_{j}, r_{j})$  where  $r_{j}$  is the random number used in the tracking algorithm and  $n_{j}$  is the local count on site  $j$ . At time  $t$ , the adversary knows  $f(n_{j}, r_{j}) = 1$ , which makes the algorithm have no privacy guarantee. This problem is attributed to the fact that the server can update the output only after it receives a message. So to achieve the desired level of privacy, one has to add noise to  $f$  locally on each site, but the total noise from all sites can be too large.
1.3 Our Method
Technical overview In our algorithm, each site divides its stream into continuous blocks of size  $\Delta = \tilde{O} \left( \frac{\alpha N}{\sqrt{k}} \right)$ . For each block  $j$ , the site draws a random integer  $r_j$  with uniform distribution in  $[\Delta]$ . The site sends a message to the server when the number of items in a block  $j$  reaches the threshold  $r_j$ . The server output  $m\Delta$ , where  $m$  is the number of messages received from all sites. By a similar analysis as in [13], the estimator has  $\alpha N$  additive error. To robustify this algorithm, we also use DP. To overcome the limitations of the existing DP framework, we make several critical changes. First, instead of running multiple independent copies of the oblivious algorithm, we run a single copy of the above oblivious algorithm. Secondly, we perform a more refined privacy analysis, in which each random number  $r_j$  is treated as the privacy unit. Therefore, the analysis framework is quite different from [18]. Thirdly, and most importantly, we do not require the algorithm to have a privacy guarantee in the traditional sense; instead, we privatize the algorithm so that, at any time, we can always find a large set of random numbers whose privacy is protected. However, it is unclear how to change the original DP definition to capture the meaning of "protecting a large subset of the dataset", since this set depends on the current transcript, and may change at each time step. Moreover, for this weaker DP, we need to prove that the generalization theorem still holds. To this end, we introduce partial DP and prove a generalization theorem for it. We believe partial DP is quite general and will have more applications beyond robust distributed tracking. The main results of this paper are summarized in the next theorem.
Theorem 1 (Main theorem). With probability  $1 - \delta$ , our mechanism  $\mathcal{M}$  comprised of Algorithm 1 and 2 outputs an  $\alpha$ -approximate to the total count at all times in the adversarial setting. The
communication complexity is  $O\left(\frac{C\sqrt{k}\log N}{\alpha}\right)$  where  $C = \sqrt{\left(\left(\log\sqrt{k}\right)^{1.5} + 1\right)\cdot\log\left(\frac{8\sqrt{k}\log N}{\alpha\delta}\right)}$ .
Compared to the optimal randomized bound in the oblivious setting, the cost of handling adaptive adversaries is at most an extra factor of  $C$ .
Notation Let  $\Pi$  be the space of all possible transcripts of the interaction between  $\mathcal{M}$  and  $\mathcal{A}$ . We use  $\Pi$  to denote the transcript random variable,  $\pi \in \Pi$  to denote a realization of  $\Pi$ . The Laplace distribution with 0 mean and  $2b^{2}$  variance is denoted by  $\mathrm{Lap}(b)$ . We use the notation  $S \sim \mathcal{P}^m$  to indicate that  $S$  is a dataset comprised of  $m$  i.i.d samples from distribution  $\mathcal{P}$ . The conditional distribution of  $S$  given the transcript  $\pi$  is represented by  $\mathcal{Q}_{\pi}$ . The query function is denoted by  $q: \mathcal{X}^m \to [0,1]$  and  $q_{t}$  denotes the query function at time step  $t$ . If  $q_{t}$  is a linear query, then  $q_{t}(S) = \frac{1}{m} \sum_{i=1}^{d} q_{t,i}(S_{i})$ , where  $q_{t,i}: \mathcal{X} \to [0,1]$  is a sub-query function on a single sample. The expectation of  $q$  over the distribution  $\mathcal{P}^m$  is denoted by  $q(\mathcal{P}^m) = \mathsf{E}_{S \sim \mathcal{P}^m}[q(S)]$ . And  $q(Q_{\pi}) = \mathsf{E}_{S \sim Q_{\pi}}[q(S)]$ .
Differential privacy Let  $S \in \mathcal{X}^m$  be the database that  $\mathcal{M}$  needs to protect, for example in our case, the random numbers (thresholds) in  $\mathcal{M}$ . Denote the interaction between  $\mathcal{A}$  and  $\mathcal{M}$  by  $I(\mathcal{M},\mathcal{A};S)$ .
Definition 1 (Differential Privacy).  $\mathcal{M}$  is  $(\varepsilon, \delta)$ -differentially private if for any  $\mathcal{A}$ , any two neighboring database  $S \sim S' \in \mathcal{X}^m$  differing only in one position, and any event  $E \subseteq \Pi$ , we have
$$
\operatorname * {P r} _ {\Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \Pi \in E \right] \leq e ^ {\varepsilon} \cdot \operatorname * {P r} _ {\Pi \sim I (\mathcal {M}, \mathcal {A}; S ^ {\prime})} \left[ \Pi \in E \right] + \delta .
$$
Lemma 1 (Laplace Mechanism [28]). Let  $x, x' \in \mathbb{R}$  and  $|x - x'| \leq l$ . Let  $\sigma \sim \mathsf{Lap}(l / \varepsilon)$  be a Laplace random variable. For any measurable subset  $E \subseteq \mathbb{R}$ ,  $\operatorname*{Pr}[x + \sigma \in E] \leq e^{\varepsilon} \cdot \operatorname*{Pr}[x' + \sigma \in E]$ .
Private continual counting Consider the continual counting problem: Given an input stream consists of  $\{0,1\}$ , continual counting requires to output an approximate count of the number of 1's seen so far at every time step. Different techniques have been proposed to achieve differential privacy under continual observation [29, 30]. In this paper, we make use of the Binary Mechanism (BM) [30] (see appendix for its pseudo code).
Theorem 2. ([30]) BM is  $(\varepsilon, 0)$ -differentially private with respect to the input stream. With probability at least  $1 - \delta$ , the additive error is  $O\left(\frac{1}{\varepsilon} \cdot (\log T)^{1.5} \cdot \log \left(\frac{T}{\delta}\right)\right)$  at all time steps  $t \in [T]$ .
Remark. Note that although the input of BM is bits, it can directly extend to real numbers without any modification. The same privacy and utility guarantees hold.