SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Instead of the usual private count sketch, S will send a difference sketch  $C = \mathrm{DS}_{b,h,s,\varepsilon}(D_S)$  defined as follows to R, along with the parameters  $b,h,s,\varepsilon$ .
Definition E.1. The difference sketch  $\mathrm{DS}_{b,h,s,\varepsilon}(D_S) \in \mathbf{Z}^b$  is only defined when  $Y = \{-1,1\}$  (so  $k = 2$ ). It equals  $\mathrm{PrivCountSketch}_{b,h,s,\varepsilon}(\mathrm{id}_S(D_S,1) - \mathrm{id}_S(D_S, - 1))$ , where  $\mathrm{id}_S(D_S,y)$  is the collection of identities associated with  $y$  in  $D_{S}$ . As usual, the four parameters  $b,h,s,\varepsilon$  should be published along with  $\mathrm{DS}_{b,h,s,\varepsilon}(D_S)$ .
Based on this and  $D_R$ , party R builds a dataset  $D = D(b, h, s, D_R, C)$  which is similar to the one described in §6.2, but does not have weights:
Definition E.2. To construct  $D = D(b, h, s, D_R, C)$ , for each element  $(\mathrm{id}, x) \in D_R$ , R checks whether  $s(\mathrm{id})C_{h(\mathrm{id})}$  is positive, negative, or zero. If it is positive or negative, R adds the element  $(x, 1)$  or  $(x, -1)$  to  $D$ , respectively, and if it is zero, R does not add anything to  $D$  (we say  $(\mathrm{id}, x)$  is dropped).
One justification for using the difference sketch is that as  $b \to \infty$  (so there are no hash collisions) and  $\varepsilon \to \infty$  (so no noise is added for privacy),  $D(b, h, s, D_R, C)$  approaches the true join  $D_R \bowtie D_S$  (but without an id column). Besides avoiding negative weights, an advantage of using a difference sketch instead of an ordinary private count sketch is that each time  $R$  processes an element  $(\mathrm{id}, x) \in D_R$ , only one noise sample perturbs the result (the noise that was added to  $C_{h(\mathrm{id})}$ ), whereas with an ordinary private count sketch, two noise samples would affect the answer (the noise values added to  $C_{h(\mathrm{id},1)}$  and  $C_{h(\mathrm{id},2)}$ ).
In our experiments, we found the approach from §6.2 sufficient. We leave the application of difference sketches to future work.
F Experiments with linear queries
We consider the question of how accurately we can estimate a joint distribution using linear queries. Suppose R has a categorical feature race that takes values such as white, asian-pac islander and etc., and S has label income  $\leq 50\mathrm{K}$  or  $>50\mathrm{K}$ . In Table 1, we show the true counts of the actual number of people who fall into the combination of race and income, e.g., the fraction of asian pacific islanders who make less than  $50\mathrm{K}$ . We use the training set of 32,562 rows of the UCI Adult dataset in this experiment.
Below the true counts in the table are counts estimated by noisy sketches. The estimated count for the above example can be obtained by a linear query for which  $f(x, y) = 1$  for  $y = 0$  and  $x =$  asian-pac islander. Recall that  $y \in \{1..k\}$ , and for this example  $k = 2$  with  $y = 0$  and  $y = 1$  corresponding to  $\leq 50\mathrm{K}$  or  $> 50\mathrm{K}$  respectively.
For this experiment, we set  $\varepsilon = 1$  and the sketch dimension is set to  $500\mathrm{K}$ . In the event a linear query produces a negative answer or 0, we change it 1 to avoid negative fractions. In order to compute the error of the distribution, we compute the average of the absolute difference between the true fraction who make less than  $50\mathrm{K}$  for each value of  $x$  and the estimated fraction. Note that a linear query that involves a smaller number of people is more likely to misestimated, e.g., American Indian/ Eskimo. Conversely, linear queries that involve a larger number of people are better estimated. We expect this outcome. Even if one party held all of the data, i.e., no joins, but we wanted a differentially private answer the TGeom  $(e^{-\varepsilon})$  noise drowns out the signal for a small number of people.
Next, we fix the sketch dimension to 500K and vary the differential privacy parameter  $\varepsilon$  in the top panel of Fig. 7. Note how the error drops with increasing  $\varepsilon$  as expected. We also repeat this
S:Income	R: White	R: Asian-Pac Islander	R: Amer-Indian Eskimo	R: Other	R: Black
True counts	≤ 50K	20699	763	275	246	2737
>50K	7117	276	36	25	387
True fraction < 50K	0.74	0.73	0.88	0.91	0.88
Estimated counts	≤ 50K	20307.0	774.0	307.0	201.0	2787.0
>50K	7308.0	297.0	36.0	22.0	478.0
Estimated fraction < 50K	0.74	0.72	0.90	0.90	0.85
Table 1: Estimating the joint distribution when R holds a feature "race" and S holds income  $>50\mathrm{K}$ . S publishes a noisy sketch of their data and R downloads the noisy sketch along with the parameters  $k, b, h, s, \varepsilon$ . R's goal is to estimate the joint distribution, e.g., what fraction of the Asian-pacific islander population makes less than  $50\mathrm{K}$ . The true counts and fraction are shown in the top half of the table. The estimated counts are shown in the bottom half. The average error across all feature categories is 0.01. In this table,  $\epsilon = 1$  and the sketch dimension is  $500\mathrm{K}$ .
experiment for other categorical variables such as sex, education, marital-status and etc. Note the feature with the highest average error: native-country. This is because there are some categories in this feature, e.g., Holland, with just a few people in the dataset.
In Fig. 7(b), we fix  $\varepsilon = 1.0$  and show the effect of the sketch dimension on average error. As expected, error drops with increasing sketch dimension.
Figure 7: (a) The average error in estimating the joint distribution declines as  $\varepsilon$  rises. (b) The average error fluctuates with sketch dimension less than  $10\mathrm{K}$ , but above  $10\mathrm{K}$  is relatively flat. Note that the feature workclass has a large number of buckets with a few people.
G Training details
G.1 UCI Adult Dataset
R has the features race, education, etc, and S has the label income  $\leq 50\mathrm{K}$  or  $>50\mathrm{K}$ . R would like to predict the label column given the feature columns. We one-hot encode the categorical columns for every feature and implement logistic regression in PyTorch with full batch gradient descent for 1K epochs with a learning rate of  $1\times 10^{-3}$ . The dataset has 48,845 rows split into a training set of 32,562 rows and a test set of 16,283 rows. S creates a sketch for rows belonging to the train set; the test set is only used to evaluate the model.
G.2 Extended MNIST
EMNIST is an extension of the widely used MNIST dataset of handwritten characters. We use the 240K (40K) images of digits to train (test) our protocol. The images are 28x28 pixels with labels "0" through "9". The sender S generates a private count sketch of the (id, label) pairs and the receiver R possesses the feature vectors. R would like to learn to predict labels given features.
Stochastic gradient descent plays the role of WeightedOpt, and the function  $f(x,y)$  is modelled by a fully connected neural net with cross-entropy loss with input features  $x$  and output labels  $y$ . The neural net has 5 hidden layers with dropout, batch norm, residual connections and ReLU
activations for a total of 1M parameters. In the non-private setting, we train it using the Adam optimizer and a learning rate of  $10^{-4}$ , batch size of 128 and obtain a test accuracy of  $98.04\%$ . In the presence of privacy, we conduct experiments to quantify the change in accuracy as we vary  $d$ ,  $\varepsilon$  and  $|D_R| / |D_R \bowtie D_S|$ . We use AdamW with a learning rate of  $1 \times 10^{-5}$  and a batch size of 2048 for 200 epochs.
For the experiment involving different  $k$  in Fig. 4, we use the EMNIST bymerge dataset of 760K images. We train a ResNet of 11M parameters, using AdamW with a batch size of 1024 and learning rate of  $1 \times 10^{-6}$  for 25 epochs. For each experiment, we randomly sample  $k$  classes from a total of 47 different classes, and train the model from scratch.
H Comparison to local differential privacy
The repository setting explored in this work is similar in some ways to local differential privacy, also called randomized response [19]. In the local model, individuals perturb their responses before releasing them, so that their privacy is preserved even if the server gathering responses is untrusted.
Definition H.1 (Local differential privacy). Let  $\varepsilon$  be a positive real number. A mechanism  $M$  is  $\varepsilon$ -locally differentially private if it consists of applying some randomized algorithm  $A$  to each element of the input and publishing the results:
$$
M \left(x _ {1}, \dots , x _ {n}\right) = \left(A \left(x _ {1}\right), \dots , A \left(x _ {n}\right)\right)
$$
and that algorithm  $A$  satisfies, for any two possible private values  $x, x' \in X$  and any  $S \subseteq \operatorname{Range}(A)$ :
$$
\frac {\operatorname * {P r} [ A (x) \in S ]}{\operatorname * {P r} [ A (x ^ {\prime}) \in S ]} \leq e ^ {\varepsilon}
$$
For example, suppose we wish to estimate the fraction of people who have cancer, with  $X = \{-1, +1\}$ , where  $+1$  means an individual has cancer. The algorithm  $A$  could randomly flip an individual's answer with probability  $1 / (1 + e^{\varepsilon})$ :
$$
A (x) = \left\{ \begin{array}{l l} x, & \text {w i t h p r o b a b i l i t y} e ^ {\varepsilon} / (1 + e ^ {\varepsilon}) \\ - x, & \text {w i t h p r o b a b i l i t y} 1 / (1 + e ^ {\varepsilon}) \end{array} \right.
$$
and, after gathering the responses, an appropriate correction could be applied to the fraction of  $+1$  responses to compensate for the flipped answers.
By contrast, in the repository model, illustrated in Fig. 1, each party holds a dataset of many individuals' responses keyed by unique and sensitive identifiers which must not be revealed. The challenge is for one party to release a representation of their entire dataset which is differentially private which another party can combine with their dataset to approximate the result of joining on the private identifiers. This is an instance of function release in the curator model; the definition of "differentially private" in Section 3 replaces Definition H.1.
H.1 Is it possible to join on individual identifiers in the local setting?
Ye et al. [38] show how (key, value) pairs can be released in the local model. However, their approach only works well with keys that appear many times, so it is not a feasible way to join on identifiers which appear at most once each.
A naive way to adapt our approach to the local model is illustrated in Fig. 8. Each individual holding a pair  $(\mathrm{id}_i, y_i)$  could release a private count sketch  $c_i = \operatorname{PrivCountSketch}_{b,h,s,\varepsilon}(\{(id,y)\}) \in \mathbf{Z}^b$  of just their own data. The sender could then publish the sum  $C = \sum_{i=1}^{n_S} c_i \in \mathbf{Z}^b$  of these individual responses, instead of  $\operatorname{PrivCountSketch}_{b,h,s,\varepsilon}(D_S)$ . The problem with this method is that each coordinate of  $C$  has  $n_S$  independent noise values  $Z_\varepsilon \sim \mathrm{TGeom}(e^{-\varepsilon})$  added to it, compared to just one in the repository setting. This makes it impractical to recover any useful information from  $C$ .
Although this example shows the settings are different, there may be better ways to solve this problem in the local setting. Moreover, techniques from the local differential privacy literature may be useful, when appropriately adapted to the repository setting.
Figure 8: One interpretation of local DP in the joinable setting is that each party individually publishes a locally private sketch of their data – denoted by a “1” in a green circle. Next the public repository receives each locally private sketch and sums them up to create one sketch, denoted with “2” In the green circle. Note that the noise in the ensuing summed sketch is now a function of the number of users in the database. As the number of users in the database grows, the noise drowns out the signal. The centralized setting requires less noise. (There may be other ways of interpreting local DP in the joinable setting, this is only one interpretation.)
I Multi-way joins and non-unique identifiers
In this appendix, we conduct some experiments to study multi-way joins and the effects of having non-unique identifiers.
I.1 Multi-way joins
In the repository setting the receiver party can in principle join with as many senders as it wants. In §§4-6, we studied the case where the receiver joins with the dataset of one sender. Here we study the case of two senders for the Adult UCI dataset.
As before, we simulate the join setting by adding a unique id to each row of the dataset and split its columns. The receiver has education, one sender has relationship and the other sender has income. The receiver trains a logistic regression model using education and relationship as features to predict income (more or less than 50K). The test accuracy for different values of  $\varepsilon$  is shown in blue on the right side of Fig. 9. Note that the  $\varepsilon$  value is per sketch, so the total privacy cost of the three-way join (blue line) is  $2\varepsilon$ . For comparison, the red line shows test accuracy if the receiver does a two-way join using only the income sketch, so their model's only feature is education. The difference between the red and blue lines shows that for sufficiently high  $\varepsilon$  the receiver is able to make use of the three-way join.
I.2 Non-unique identifiers
We also analyse the case where the identifier is not unique. There are many practical reasons to consider such a scenario. For instance if two datasets are being joined on legal name, there will be several rows that correspond to different persons but have the same legal name. Our sketch (Definition 3.5) is well-defined even if values in the id column (legal name here) are repeated. However, our Theorems 5.1 and 6.4 no longer apply when identities are not unique, and it is possible to construct adversarial examples where false matches steer Algorithms 2 or 3 in the wrong direction. Finding a better solution is a great direction for future work.
In Fig. 10, we show the performance of our method on the EMNIST dataset. We first add a unique identity to the digits (240K examples), and create sender and receiver datasets with labels and images respectively. Then we add extra rows to  $D_{S}$  which duplicate the identities of existing rows, but with
Figure 9: Test accuracy of logistic regression on the UCI Adult salary prediction task (§7.1) for a three-way join. The receiver  $R$  joins his features education, with relationship and income.  $R$  then learns a logistic regression model to predict income from relationship and education. The  $\varepsilon$  value is per-sketch, so the total privacy budget for a 3-way join (blue line) is  $2\varepsilon$ .
Figure 10: Test accuracy on EMNIST image classification task (§7.1) with non-unique identifiers. The  $x$ -axis refers to the number of times an identifier appears in  $D_S$ .
random labels, and apply our method with  $\varepsilon = 1$ . At  $x = 1$  no new rows are added and at  $x = 8$  each identity appears an average of 8 times in  $D_{S}$ , once with the true label and 7 times with random labels. We left  $D_{R}$  unchanged. This simulates a situation where "pseudo" identifiers may be repeated but are independent of the data. The test accuracy on the  $y$ -axis shows that our method is robust and gives useful results even when the randomly-labelled false matches significantly outnumber the true matches.
Note that assuming duplicate rows have random labels is a strong assumption. Again consider the use case where legal name is the identifier, and the receiver has the features of a biomedical dataset. Different people with the same legal name might have non-trivial correlations. For instance, if a particular legal name is predominant amongst males, certain biological features will be correlated amongst the duplicate rows having that legal name. Although, it is possible that this correlation might benefit our method.
J Comparison with secure function evaluation
Secure function evaluation (SFE) protocols are cryptographic protocols for two parties holding values  $x_{A}$  and  $x_{B}$  to jointly compute a function  $f(x_{A},x_{B})$  with neither party learning anything other than
the value of the function [37, 23]. If  $x_{A}$  and  $x_{B}$  are sets with  $f(x_{A},x_{B}) = x_{A}\cap x_{B}$  then the problem is called private set intersection (PSI), and if  $f(x_{A},x_{B}) = |x_{A}\cap x_{B}|$  then it is called private set intersection cardinality (PSI-CA). These problems can be generalized to joining datasets to answer linear queries or solve optimization problems. Unfortunately, implementations require multiple rounds of communication, and we are unaware of a protocol that would allow efficient large neural network training [35, 9, 11, 28, 27, 34]. PSI is an active area of research, and we expect future developments to increase efficiency. There are some qualitative differences between our method and PSI(-CA):
- Interaction: Our method requires no interaction. With PSI, two parties mutually agree to estimate the intersection of their inputs. With our method parties do not have to pre-agree on a joint function, and can use the same sketch to estimate joint distributions or train neural networks using stochastic gradient descent.
- Exact vs. Approximate Answers: While the generality of our sketch implies that more functions can be estimated without interaction, this flexibility comes at the cost of more noise and therefore lower accuracy than SFE, which can either give exact answers or add just enough noise to satisfy DP.
- Simple Implementation: SFE protocols can be quite complex to implement. This paper proposes a simple implementation with two hash functions and some noise.
- Data Discovery in the Wild: We are targeting a data repository of one-time sketches enabling data discovery in the wild. The proposed method lowers the barrier to private joins Data repositories such as UCI ML repository and MIMIC (healthcare data) presently, rightly conceal information about individuals making it challenging to join.
A sketch-based public repository enables fast and easy data discovery.