SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Breaking the Communication-Privacy-Accuracy Tradeoff with  $f$ -Differential Privacy
Richeng Jin<sup>1</sup> Zhonggen Su<sup>1</sup> Caijun Zhong<sup>1</sup>  
Zhaoyang Zhang<sup>1</sup> Tony Q.S. Quek<sup>2</sup> Huaiyu Dai<sup>3</sup>
<sup>1</sup>Zhejiang University  <sup>2</sup>Singapore University of Technology and Design  <sup>3</sup>North Carolina State University
We consider a federated data analytics problem in which a server coordinates the collaborative data analysis of multiple users with privacy concerns and limited communication capability. The commonly adopted compression schemes introduce information loss into local data while improving communication efficiency, and it remains an open problem whether such discrete-valued mechanisms provide any privacy protection. In this paper, we study the local differential privacy guarantees of discrete-valued mechanisms with finite output space through the lens of  $f$ -differential privacy (DP). More specifically, we advance the existing literature by deriving tight  $f$ -DP guarantees for a variety of discrete-valued mechanisms, including the binomial noise and the binomial mechanisms that are proposed for privacy preservation, and the sign-based methods that are proposed for data compression, in closed-form expressions. We further investigate the amplification in privacy by sparsification and propose a ternary stochastic compressor. By leveraging compression for privacy amplification, we improve the existing methods by removing the dependency of accuracy (in terms of mean square error) on communication cost in the popular use case of distributed mean estimation, therefore breaking the three-way tradeoff between privacy, communication, and accuracy.
Nowadays, the massive data generated and collected for analysis, and consequently the prohibitive communication overhead for data transmission, are overwhelming the centralized data analytics paradigm. Federated data analytics is, therefore, proposed as a new distributed computing paradigm that enables data analysis while keeping the raw data locally on the user devices [1]. Similarly to its most notable use case, i.e., federated learning (FL) [2, 3], federated data analytics faces two critical challenges: data privacy and communication efficiency. On one hand, the local data of users may contain sensitive information, and privacy-preserving mechanisms are needed. On the other hand, the user devices are usually equipped with limited communication capabilities, and compression mechanisms are often adopted to improve communication efficiency.
Differential privacy (DP) has become the gold standard for privacy measures due to its rigorous foundation and simple implementation. One classic technique to ensure DP is adding Gaussian or Laplacian noises to the data [4]. However, they are prone to numerical errors on finite-precision computers [5] and may not be suitable for federated data analytics with communication constraints due to their continuous nature. With such consideration, various discrete noises with privacy guarantees have been proposed, e.g., the binomial noise [6], the discrete Gaussian mechanism [7], and the Skellam mechanism [8]. Nonetheless, the additive noises in [7] and [8] assume infinite range, which renders them less communication-efficient without appropriate clipping. Unfortunately, clipping
usually ruins the unbiasedness of the mechanism. [9] develops a Poisson binomial mechanism (PBM) that does not rely on additive noise. In PBM, each user adopts a binomial mechanism, which takes a continuous input and encodes it into the success probability of a binomial distribution. The output of the binomial mechanism is shared with a central server which releases the aggregated result that follows the Poisson binomial distribution. However, [9] focuses on distributed DP in which the server only observes the output of the aggregated results instead of the data shared by each individual user, and therefore, requires a secure computation function (e.g., secure aggregation [3]).
In addition to discrete DP mechanisms, existing works have investigated the fundamental tradeoff between communication, privacy, and accuracy under the classic  $(\epsilon, \delta)$ -DP framework (e.g., [10, 11, 12, 13]). Notably, in the case of distributed mean estimation, [13] incorporates Kashin's representation and proposed Subsampled and Quantized Kashin's Response (SQKR), which achieves order-optimal mean square error (MSE) that has a linear dependency on the dimension of the private data  $d$ . SQKR first computes Kashin's representation of the private data and quantizes each coordinate into a 1-bit message. Then,  $k$  coordinates are randomly sampled and privatized by the  $2^k$ -Random Response mechanism [14]. SQKR achieves an order-optimal three-way tradeoff between privacy, accuracy, and communication. Nonetheless, it does not account for the privacy introduced during sparsification.
Intuitively, as compression becomes more aggressive, less information will be shared by the users, which naturally leads to better privacy protection. However, formally quantifying the privacy guarantees of compression mechanisms remains an open problem. In this work, we close the gap by investigating the local DP guarantees of discrete-valued mechanisms, based on which a ternary stochastic compressor is proposed to leverage the privacy amplification by compression and advance the literature by achieving a better communication-privacy-accuracy tradeoff. More specifically, we focus on the emerging concept of  $f$ -DP [15] that can be readily converted to  $(\epsilon, \delta)$ -DP and Rényi differential privacy [16] in a lossless way while enjoying better composition property [17].
Our contributions. In this work, we derive the closed-form expressions of the tradeoff function between type I and type II error rates in the hypothesis testing problem for a generic discrete-valued mechanism with a finite output space, based on which  $f$ -DP guarantees of the binomial noise (c.f. Section 4.1) and the binomial mechanism (c.f. Section 4.2) that covers a variety of discrete differentially private mechanisms and compression mechanisms as special cases are obtained. Our analyses lead to tighter privacy guarantees for binomial noise than [6] and extend the results for the binomial mechanism in [9] to local DP. To the best of our knowledge, this is the first work that investigates the  $f$ -DP guarantees of discrete-valued mechanisms, and the results could possibly inspire the design of better differentially private compression mechanisms.
Inspired by the analytical results, we also leverage the privacy amplification of the sparsification scheme and propose a ternary stochastic compressor (c.f. Section 5). By accounting for the privacy amplification of compression, our analyses reveal that given a privacy budget  $\mu$ -GDP (which is a special case of  $f$ -DP) with  $\mu < \sqrt{4dr / (1 - r)}$  (in which  $r$  is the ratio of non-zero coordinates in expectation for the sparsification scheme), the MSE of the ternary stochastic compressor only depends on  $\mu$  in the use case of distributed mean estimation (which is the building block of FL). In this sense, we break the three-way tradeoff between communication overhead, privacy, and accuracy by removing the dependency of accuracy on the communication overhead. Different from existing works which suggest that, in the high privacy regime, the error introduced by compression is dominated by the error introduced for privacy, we show that the error caused by compression could be translated into enhancement in privacy. Compared to SQKR [13], the proposed scheme yields better privacy guarantees given the same MSE and communication cost. For the scenario where each user  $i$  observes  $x_{i} \in \{-c, c\}^{d}$  for some constant  $c > 0$ , the proposed scheme achieves the same privacy guarantee and MSE as those of the classic Gaussian mechanism in the large  $d$  regime, which essentially means that the improvement in communication efficiency is achieved for free. We remark that the regime of large  $d$  is often of interest in practical FL in which  $d$  is the number of training parameters.
Recently, there is a surge of interest in developing differentially private data analysis techniques, which can be divided into three categories: central differential privacy (CDP) that assumes a trusted central server to perturb the collected data [18], distributed differential privacy that relies on secure aggregation during data collection [3], and local differential privacy (LDP) that avoids the need for
the trusted server by perturbing the local data on the user side [19]. To overcome the drawbacks of the Gaussian and Laplacian mechanisms, several discrete mechanisms have been proposed. [18] introduces the one-dimensional binomial noise, which is extended to the general  $d$ -dimensional case in [6] with more comprehensive analysis in terms of  $(\epsilon, \delta)$ -DP. [20] analyzes the LDP guarantees of discrete Gaussian noise, while [7] further considers secure aggregation. [8] studies the Rényi DP guarantees of the Skellam mechanism. However, both the discrete Gaussian mechanism and the Skellam mechanism assume infinite ranges at the output, which makes them less communication efficient without appropriate clipping. Moreover, all the above three mechanisms achieve differential privacy at the cost of exploding variance for the additive noise in the high-privacy regimes.
Another line of studies jointly considers privacy preservation and compression. [10, 11] propose to achieve DP by quantizing, sampling, and perturbing each entry, while [12] proposes a vector quantization scheme with local differential privacy. However, the MSE of these schemes grows with  $d^2$ . [13] investigates the three-way communication-privacy-accuracy tradeoff and incorporates Kashin's representation to achieve order-optimal estimation error in mean estimation. [21] proposes to first sample a portion of coordinates, followed by the randomized response mechanism [22]. [23] and [24] further incorporate shuffling for privacy amplification. [25] proposes to compress the LDP schemes using a pseudorandom generator, while [26] utilizes minimal random coding. [27] proposes a privacy-aware compression mechanism that accommodates DP requirement and unbiasedness simultaneously. However, they consider pure  $\epsilon$ -DP, which cannot be easily generalized to the relaxed variants. [9] proposes the Poisson binomial mechanism with Rényi DP guarantees. Nonetheless, Rényi DP lacks the favorable hypothesis testing interpretation and the conversion to  $(\epsilon, \delta)$ -DP is lossy. Moreover, most of the existing works focus on privatizing the compressed data or vice versa, leaving the privacy guarantees of compression mechanisms largely unexplored. [28] proposes a numerical accountant based on fast Fourier transform [29] to evaluate  $(\epsilon, \delta)$ -DP of general discrete-valued mechanisms. Recently, an independent work [30] studies privacy amplification by compression for central  $(\epsilon, \delta)$ -DP and multi-message shuffling frameworks. In this work, we consider LDP through the lens of  $f$ -DP and eliminate the need for a trusted server or shuffler.
Among the relaxations of differential privacy notions [31, 16, 32],  $f$ -DP [15] is a variant of  $\epsilon$ -DP with hypothesis testing interpretation, which enjoys the property of lossless conversion to  $(\epsilon, \delta)$ -DP and tight composition [33]. As a result, it leads to favorable performance in distributed/federated learning [34, 35]. However, to the best of our knowledge, none of the existing works study the  $f$ -DP of discrete-valued mechanisms. In this work, we bridge the gap by deriving tight  $f$ -DP guarantees of various compression mechanisms in closed form, based on which a ternary stochastic compressor is proposed to achieve a better communication-privacy-accuracy tradeoff than existing methods.
We consider a set of  $N$  users (denoted by  $\mathcal{N}$ ) with local data  $x_{i} \in \mathbb{R}^{d}$ . The users aim to share  $x_{i}$ 's with a central server in a privacy-preserving and communication-efficient manner. More specifically, the users adopt a privacy-preserving mechanism  $\mathcal{M}$  to obfuscate their data and share the perturbed results  $\mathcal{M}(x_{i})$ 's with the central server. In the use case of distributed/federated learning, each user has a local dataset  $S$ . During each training step, it computes the local stochastic gradients and shares the obfuscated gradients with the server. In this sense, the overall gradient computation and obfuscation mechanism  $\mathcal{M}$  takes the local dataset  $S$  as the input and outputs the obfuscated result  $\mathcal{M}(S)$ . Upon receiving the shared  $\mathcal{M}(S)$ 's, the server estimates the mean of the local gradients.
3.2 Differential Privacy
Formally, differential privacy is defined as follows.
Definition 1  $((\epsilon, \delta)$ -DP [18]). A randomized mechanism  $\mathcal{M}$  is  $(\epsilon, \delta)$ -differentially private if for all neighboring datasets  $S$  and  $S'$  and all  $O \subset \mathcal{O}$  in the range of  $\mathcal{M}$ , we have
$$
P (\mathcal {M} (S) \in O) \leq e ^ {\epsilon} P (\mathcal {M} \left(\tilde {S} ^ {\prime}\right) \in O) + \delta , \tag {1}
$$
in which  $S$  and  $S'$  are neighboring datasets that differ in only one record, and  $\epsilon, \delta \geq 0$  are the parameters that characterize the level of differential privacy.
3.3  $f$ -Differential Privacy
Assuming that there exist two neighboring datasets  $S$  and  $S'$ , from the hypothesis testing perspective, we have the following two hypotheses
$$
H _ {0}: \text {t h e} S, H _ {1}: \text {t h e} S ^ {\prime}. \tag {2}
$$
Let  $P$  and  $Q$  denote the probability distribution of  $\mathcal{M}(S)$  and  $\mathcal{M}(S')$ , respectively. [15] formulates the problem of distinguishing the two hypotheses as the tradeoff between the achievable type I and type II error rates. More precisely, consider a rejection rule  $0 \leq \phi \leq 1$  (which rejects  $H_0$  with a probability of  $\phi$ ), the type I and type II error rates are defined as  $\alpha_{\phi} = \mathbb{E}_P[\phi]$  and  $\beta_{\phi} = 1 - \mathbb{E}_Q[\phi]$ , respectively. In this sense,  $f$ -DP characterizes the tradeoff between type I and type II error rates. The tradeoff function and  $f$ -DP are formally defined as follows.
Definition 2 (tradeoff function [15]). For any two probability distributions  $P$  and  $Q$  on the same space, the tradeoff function  $T(P, Q): [0,1] \to [0,1]$  is defined as  $T(P, Q)(\alpha) = \inf \{ \beta_{\phi}: \alpha_{\phi} \leq \alpha \}$ , where the infimum is taken over all (measurable) rejection rule  $\phi$ .
Definition 3 (f-DP [15]). Let  $f$  be a tradeoff function. With a slight abuse of notation, a mechanism  $\mathcal{M}$  is  $f$ -differentially private if  $T(\mathcal{M}(S), \mathcal{M}(S')) \geq f$  for all neighboring datasets  $S$  and  $S'$ , which suggests that the attacker cannot achieve a type II error rate smaller than  $f(\alpha)$ .
$f$ -DP can be converted to  $(\epsilon, \delta)$ -DP as follows.
Lemma 1. [15] A mechanism is  $f(\alpha)$ -differentially private if and only if it is  $(\epsilon, \delta)$ -differentially private with
$$
f (\alpha) = \max  \{0, 1 - \delta - e ^ {\epsilon} \alpha , e ^ {- \epsilon} (1 - \delta - \alpha) \}. \tag {3}
$$
Finally, we introduce a special case of  $f$ -DP with  $f(\alpha) = \Phi (\Phi^{-1}(1 - \alpha) - \mu)$ , which is denoted as  $\mu$ -GDP. More specifically,  $\mu$ -GDP corresponds to the tradeoff function of two normal distributions with mean 0 and  $\mu$ , respectively, and a variance of 1.
4 Tight  $f$ -DP Analysis for Existing Discrete-Valued Mechanisms
In this section, we derive the  $f$ -DP guarantees for a variety of existing differentially private discrete-valued mechanisms in the scalar case (i.e.,  $d = 1$ ) to illustrate the main ideas. The vector case will be discussed in Section 6. More specifically, according to Definition 3, the  $f$ -DP of a mechanism  $\mathcal{M}$  is given by the infimum of the tradeoff function over all neighboring datasets  $S$  and  $S'$ , i.e.,  $f(\alpha) = \inf_{S,S'} \inf_{\phi} \{\beta_{\phi}(\alpha) : \alpha_{\phi} \leq \alpha\}$ . Therefore, the analysis consists of two steps: 1) we obtain the closed-form expressions of the tradeoff functions, i.e.,  $\inf_{\phi} \{\beta_{\phi}(\alpha) : \alpha_{\phi} \leq \alpha\}$ , for a generic discrete-valued mechanism (see Section A in the supplementary material); and 2) given the tradeoff functions, we derive the  $f$ -DP by identifying the mechanism-specific infimums of the tradeoff functions over all possible neighboring datasets. We remark that the tradeoff functions for the discrete-valued mechanisms are essentially piece-wise functions with both the domain and range of each piece determined by both the mechanisms and the datasets, which renders the analysis for the second step highly non-trivial.
4.1 Binomial Noise
In this subsection, we consider the binomial noise (i.e., Algorithm 1) proposed in [6], which serves as a communication-efficient alternative to the classic Gaussian noise. More specifically, the output of stochastic quantization in [6] is perturbed by a binomial random variable.
Algorithm 1 Binomial Noise [6]
Input:  $x_{i} \in [0,1,\dots ,l]$ ,  $i \in \mathcal{N}$ , number of trials  $M$ , success probability  $p$ .
Privatization:  $Z_{i}\triangleq x_{i} + \operatorname{Binom}(M,p)$
Theorem 1. Let  $\tilde{Z} = \operatorname{Binom}(M, p)$ , the binomial noise mechanism in Algorithm 1 is  $f^{bn}(\alpha)$ -differentially private with
$$
f ^ {b n} (\alpha) = \min  \left\{\beta_ {\phi , \operatorname {i n f}} ^ {+} (\alpha), \beta_ {\phi , \operatorname {i n f}} ^ {-} (\alpha) \right\}, \tag {4}
$$
$$
\beta_ {\phi , \inf } ^ {+} (\alpha) = \left\{ \begin{array}{l l} P (\tilde {Z} \geq \tilde {k} + l) + \frac {P (Z = \tilde {k} + l) P (\tilde {Z} <   \tilde {k})}{P (\tilde {Z} = \tilde {k})} - \frac {P (\tilde {Z} = \tilde {k} + l)}{P (\tilde {Z} = \tilde {k})} \alpha , \\ \text {f o r} \alpha \in [ P (\tilde {Z} <   \tilde {k}), P (\tilde {Z} \leq \tilde {k}) ], \tilde {k} \in [ 0, M - l ], \\ 0, \quad \text {f o r} \alpha \in [ P (\tilde {Z} \leq M - l), 1 ]. \end{array} \right. \tag {5}
$$
$$
\beta_ {\phi , \inf } ^ {-} (\alpha) = \left\{ \begin{array}{l l} P (\tilde {Z} \leq \tilde {k} - l) + \frac {P (\tilde {Z} = \tilde {k} - l) P (\tilde {Z} > \tilde {k})}{P (\tilde {Z} = \tilde {k})} - \frac {P (\tilde {Z} = \tilde {k} - l)}{P (\tilde {Z} = \tilde {k})} \alpha , & \\ \text {f o r} \alpha \in [ P (\tilde {Z} > \tilde {k}), P (\tilde {Z} \geq \tilde {k}) ], \tilde {k} \in [ l, M ], \\ 0, & \text {f o r} \alpha \in [ P (\tilde {Z} \geq l), 1 ]. \end{array} \right. \tag {6}
$$
Given that  $P(\tilde{Z} = k) = \binom{M}{k} p^k (1 - p)^{M - k}$ , it can be readily shown that when  $p = 0.5$ , both  $\beta_{\phi, \inf}^{+}(\alpha)$  and  $\beta_{\phi, \inf}^{-}(\alpha)$  are maximized, and  $f(\alpha) = \beta_{\phi, \inf}^{+}(\alpha) = \beta_{\phi, \inf}^{-}(\alpha)$ .
Fig. 1 shows the impact of  $M$  when  $l = 8$ , which confirms the result in [6] that a larger  $M$  provides better privacy protection (recall that given the same  $\alpha$ , a larger  $\beta_{\alpha}$  indicates that the attacker makes mistakes in the hypothesis testing more likely and therefore corresponds to better privacy protection). Note that the output of Algorithm 1  $Z_{i} \in \{0,1,\dots,M + l\}$ , which requires a communication overhead of  $\log_2(M + l + 1)$  bits. We can readily convert  $f(\alpha)$ -DP to  $(\epsilon ,\delta)$ -DP by utilizing Lemma 1.
Remark 1. The results derived in this work improve [6] in two aspects: (1) Theorem 1 in [6] requires  $M p(1 - p) \geq \max(23 \log(10d / \delta), 2l / s) > \max(23 \log(10), 2l / s)$ , in which  $1 / s \in \mathbb{N}$  is some scaling factor. When  $p = 1 / 2$ , it requires  $M \geq 212$ . More specifically, for  $M = 500$ , [6] requires  $\delta > 0.044$ . Our results imply that there exists some  $(\epsilon, \delta)$  such that Algorithm 1 is  $(\epsilon, \delta)$ -DP as long as  $M > l$ . For  $M = 500$ ,  $\delta$  can be as small as  $4.61 \times 10^{-136}$ . (2) Our results are tight, in the sense that no relaxation is applied in our derivation. As an example, when  $M = 500$  and  $p = 0.5$ , Theorem 1 in [6] gives (3.18, 0.044)-DP while Theorem 1 in this paper yields (1.67, 0.039)-DP.
Figure 1: Impact of  $M$  on Algorithm 1 with  $l = 8$ .
4.2 Binomial Mechanism
Algorithm 2 Binomial Mechanism [9]
Input:  $c > 0$ ,  $x_{i} \in [-c, c]$ ,  $M \in \mathbb{N}$ ,  $p_{i}(x_{i}) \in [p_{\min}, p_{\max}]$
Privatization:  $Z_{i}\triangleq \operatorname {Binom}(M,p_{i}(x_{i}))$
In this subsection, we consider the binomial mechanism (i.e., Algorithm 2). Different from Algorithm 1 that perturbs the data with noise following the binomial distribution with the same success probability, the binomial mechanism encodes the input  $x_{i}$  into the success probability of the binomial distribution. We establish the privacy guarantee of Algorithm 2 as follows.
Theorem 2. The binomial mechanism in Algorithm 2 is  $f^{bm}(\alpha)$ -differentially private with
$$
f ^ {b m} (\alpha) = \min  \left\{\beta_ {\phi , \inf } ^ {+} (\alpha), \beta_ {\phi , \inf } ^ {-} (\alpha) \right\}, \tag {7}
$$
$$
\beta_ {\phi , \inf} ^ {+} (\alpha) = 1 - [ P (Y <   k) + \gamma P (Y = k) ] = P (Y \geq k) + \frac {P (Y = k) P (X <   k)}{P (X = k)} - \frac {P (Y = k)}{P (X = k)} \alpha ,
$$
for  $\alpha \in [P(X < k), P(X \leq k)]$  and  $k \in \{0, 1, 2, \dots, M\}$ , where  $X = \operatorname{Binom}(M, p_{max})$  and  $Y = \operatorname{Binom}(M, p_{min})$ , and
$$
\beta_ {\phi , \inf } ^ {-} (\alpha) = 1 - [ P (Y > k) + \gamma P (Y = k) ] = P (Y \leq k) + \frac {P (Y = k) P (X > k)}{P (X = k)} - \frac {P (Y = k)}{P (X = k)} \alpha ,
$$
for  $\alpha \in [P(X > k), P(X \geq k)]$  and  $k \in \{0, 1, 2, \dots, M\}$ , where  $X = \operatorname{Binom}(M, p_{\min})$  and  $Y = \operatorname{Binom}(M, p_{\max})$ . When  $p_{\max} = 1 - p_{\min}$ , we have  $\beta_{\phi, \inf}^{+}(\alpha) = \beta_{\phi, \inf}^{-}(\alpha)$ .
Remark 2 (Comparison to [9]). The binomial mechanism is part of the Poisson binomial mechanism proposed in [9]. More specifically, in [9], each user  $i$  shares the output of the binomial mechanism
$Z_{i}$  with the server, in which  $p_i(x_i) = \frac{1}{2} +\frac{\theta}{c} x_i$  and  $\theta$  is some design parameter. It can be readily verified that  $p_{max} = 1 - p_{min}$  in this case. The server then aggregates the result through  $\bar{x} = \frac{c}{MN\theta} (\sum_{i\in \mathcal{N}}Z_i - \frac{MN}{2})$ . [9] requires secure aggregation and considers the privacy leakage of releasing  $\bar{x}$ , while we complement it by showing the LDP, i.e., the privacy leakage of releasing  $Z_{i}$  for each user. In addition, we eliminate the constraint  $\theta \in [0,\frac{1}{4} ]$ , and the results hold for any selection of  $p_i(x_i)$ . Moreover, the privacy guarantees in Theorem 2 are tight since no relaxation is involved. Fig. 2 shows the impact of  $M$  on the privacy guarantee. In contrast to binomial noise, the privacy of the binomial mechanisms improves as  $M$  (and equivalently communication overhead) decreases, which implies that it is more suitable for communication-constrained scenarios. We also derive the  $f$ -DP of the Poisson binomial mechanism, which are presented in Section C in the supplementary material.
In the following, we present two existing compressors that are special cases of the binomial mechanism.
Example 1. We first consider the following stochastic sign compressor proposed in [36].
Definition 4 (Two-Level Stochastic Compressor [36]). For any given  $x \in [-c, c]$ , the compressor sto-sign outputs
$$
\operatorname {s t o - s i g n} (x, A) = \left\{ \begin{array}{l} 1, \text {w i t h p r o b a b i l i t y} \frac {A + x}{2 A}, \\ - 1, \text {w i t h p r o b a b i l i t y} \frac {A - x}{2 A}, \end{array} \right. \tag {8}
$$
where  $A > c$  is the design parameter that controls the level of stochasticity.
Figure 2: Impact of  $M$  on Algorithm 2.