SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Privacy Amplification via Compression: Achieving the Optimal Privacy-Accuracy-Communication Trade-offs in Distributed Mean Estimation
Wei-Ning Chen
Stanford University
wnchen@stanford.edu
Dan Song  
Stanford University  
songdan@stanford.edu
Ayfer Özgür
Stanford University
aozgur@stanford.edu
Peter Kairouz  
Google Research  
kairouz@google.com
Privacy and communication constraints are two major bottlenecks in federated learning (FL) and analytics (FA). We study the optimal accuracy of mean and frequency estimation (canonical models for FL and FA respectively) under joint communication and  $(\varepsilon, \delta)$ -differential privacy (DP) constraints. We consider both the central and the multi-message shuffled DP models. We show that in order to achieve the optimal  $\ell_2$  error under  $(\varepsilon, \delta)$ -DP, it is sufficient for each client to send  $\Theta\left(n\min\left(\varepsilon, \varepsilon^2\right)\right)$  bits for FL and  $\Theta\left(\log\left(n\min\left(\varepsilon, \varepsilon^2\right)\right)\right)$  bits for FA to the server, where  $n$  is the number of participating clients. Without compression, each client needs  $O(d)$  bits and  $O(\log d)$  bits for the mean and frequency estimation problems respectively (where  $d$  corresponds to the number of trainable parameters in FL or the domain size in FA), meaning that we can get significant savings in the regime  $n\min\left(\varepsilon, \varepsilon^2\right) = o(d)$ , which is often the relevant regime in practice.
We propose two different ways to leverage compression for privacy amplification and achieve the optimal privacy-communication-accuracy trade-offs. In both cases, each client communicates only partial information about its sample and we show that privacy is amplified by randomly selecting the part contributed by each client. In the first method, the random selection is revealed to the server, which results in a central DP guarantee with optimal privacy-communication-accuracy trade-offs. In the second method, the random data parts from the clients are shuffled by a secure shuffler resulting in a multi-message shuffling scheme with the same optimal trade-offs. As a result, we establish the optimal three-way trade-offs between privacy, communication, and accuracy for both the central DP and multi-message shuffling frameworks.
In the basic setting of federated learning (FL) [68, 64, 61] and analytics (FA), a server wants to execute a specific learning or analytics task on raw data that is kept on clients' devices. Consider, for example, model updates in FL or histogram estimation in FA, both of which can be modeled as a distributed mean estimation problem. Clients communicate targeted messages to the server and the privacy of the users' data is ensured (in terms of explicit differential privacy (DP) [38] guarantees) by adding carefully calibrated noise to the computed mean at the server before releasing it to downstream modules (e.g., the server computes the average model update and corrupts it with the addition of
noise). This is called the trusted server or central DP model, as it entrusts the central server with privatization and is one of the most common ways in which federated learning and analytics are implemented today<sup>1</sup>.
In this paper, we ask the following question: given that the server needs to privatize the mean, can the clients communicate "less information" to the server? More precisely, can we leverage the fact that the server only needs to output a noisy (approximate) estimate of the mean to reduce the communication load without sacrificing accuracy? In recent years, there has been significant interest in the central DP model [1] as well as communication efficiency and privacy for FL and FA under different models, including local DP [78, 63, 58, 80, 17, 6, 16, 32], shuffle [40, 43] and distributed DP [9, 59, 8, 33, 34]; however, this basic question has remained open.
One natural way to reduce communication is to have clients communicate only partial information about their samples. For example, in the case of model updates, each client can update only a subset of the model coefficients. In histogram estimation, information about a client's sample can be "split" into multiple parts, and the client can communicate only one part. However, this results in less information at the server, or effectively fewer samples to estimate the target quantity, e.g., each model coefficient is now updated only by a subset of the clients. A quick calculation reveals that this increases the sensitivity of the estimate to each user's sample and therefore requires the addition of larger noise at the server to achieve the same privacy level. Hence, reducing communication reduces accuracy for the same privacy guarantee.
We circumvent this challenge with a simple but insightful observation: when each client communicates only partial information about its sample, we can amplify privacy by randomly selecting the part contributed by each client. This random selection is hidden from a downstream module which has only access to the estimate revealed by the server, which leads to privacy amplification. Privacy amplification by subsampling has been studied in [66, 14] but usually refers to the selection of a random subset of the clients (from a larger pool of available clients). In our case, it is the "piece of information" that is randomly selected at each client. We call this gain privacy amplification via compression as it emerges from the fact that each client does not fully communicate its sample. We use it to establish the optimal communication-privacy-accuracy trade-off for central DP. Note that this same type of gain cannot be leveraged in the local DP model where the server is untrusted. The server needs to know the random selection at each client to construct an estimate. Indeed, in the local DP model, the privacy-accuracy trade-off is known to be significantly worse than the central DP model (see Table 1).
This naturally leads to a follow-up question: can we leverage privacy amplification via compression and achieve the same three-way trade-off by using secure aggregation [33] and shuffling [40] type models which hide information from the server? For secure aggregation, the three-way trade-off has been studied in [31] and the communication cost is significantly larger than the communication cost for central DP proved in this paper (see Table 1). For shuffling, the optimal communication cost has been posed as an open problem in [31]. We resolve this problem by showing that the optimal central DP trade-off can also be achieved with a multi-message shuffling scheme, establishing the optimal communication cost. (We note that a similar result has been concurrently and independently proved in [54] under the shuffle DP setting.) As before, our scheme leverages a privacy amplification gain. Each client communicates partial information about its sample; the identity of the message is erased by the secure shuffler, and hence the untrusted server does not know which part is contributed by each client. We show that to achieve the optimal trade-off, it is critical for each client to split its information into multiple messages and employ multiple shuffling rounds by carefully splitting the privacy budget across different rounds. In contrast, the linearity of secure aggregation requires all participating clients to communicate consistent information (same parts), hence precluding privacy amplification by compression. See Table 1 for a detailed comparison.
Our contributions. We study distributed mean and frequency estimation as canonical building blocks for FL and FA. We consider both the central DP and the multi-message shuffling models. We characterize the order-optimal privacy-accuracy-communication trade-offs for distributed mean estimation and provide an achievable scheme for frequency estimation (in Appendix A) under the central DP model. Our results reveal that privacy and communication efficiency can be achieved simultaneously with no additional penalty for accuracy. In particular, we show that  $\tilde{O}\left(n\min \left(\varepsilon ,\varepsilon^{2}\right)\right)$
<sup>1</sup>We assume a trusted service provider who applies the DP mechanism faithfully. This can be enforced by implementing the DP mechanism inside of a remotely attestable trusted execution environment [11].
Communication (bits)	l22 error
Local DP [32, 42]	Θ (Γε)	Θ (d/n min(ε2, ε))
Distributed DP (with SecAgg) [33]	O(n2min(ε, ε2))	Θ (d/n2min(ε2, ε))
Central DP (Theorem 4.4)	O(n min(ε, ε2))	O(d log d/n2min(ε2, ε))
Shuffle DP (Theorem 5.3, [54])	O(n log(d) min(ε, ε2))	O(d/n2min(ε2, ε))
Table 1: Comparison of the communication costs of  $\ell_2$  mean estimation under local, distributed, central, and shuffle DP (with  $\delta$  terms hidden). Compared to local DP, we see that error under central DP decays much faster (e.g.,  $1/n^2$  as opposed to  $1/n$ ); compared to distributed DP with secure aggregation, our schemes achieve similar accuracy but save the communication cost by a factor of  $n$ .
and  $\tilde{O}\left(\log \left(n\min \left(\varepsilon ,\varepsilon^{2}\right)\right)\right)$  bits of (per-client) communication are sufficient to achieve the order-optimal error under  $(\varepsilon ,\delta)$ -privacy for mean and frequency estimation respectively, where  $n$  is the number of participating clients. Without compression, each client needs  $O(d)$  bits and  $\log d$  bits for the mean and frequency estimation problems respectively (where  $d$  is the number of trainable parameters in FL or the domain size in FA), which means that we can get significant savings in the regime  $n\varepsilon^2 = o(d)$  (assuming  $\varepsilon = O(1)$ ). We note that this is often the relevant regime not only for cross-silo but also for cross-device FL/FA. For instance, in practical FL,  $d$  usually ranges from  $10^{6}$  to  $10^{9}$ , and  $n$ , the per-epoch sample size, is usually much smaller (e.g., of the order of  $10^{3}$  to  $10^{5}$ ). For distributed mean estimation, we show that the central DP trade-off can also be achieved with a multi-message shuffling scheme (within a log  $d$  factor in communication cost). Hence our paper establishes the three-way trade-off between privacy, communication, and accuracy for both the central DP and multi-message shuffling frameworks, both of which were open problems in the prior literature. Compared with local DP where 1 bit is sufficient when  $\varepsilon = O(1)$ , this shows that central/shuffling DP has a larger communication cost but can achieve much smaller error (by a factor of  $n$ ) and hence is usually preferable in practical applications. Compared with distributed DP where the server aggregates local (encoded) messages with secure multi-party computation (e.g., [23, 8, 34]), we can improve the communication cost by a factor of  $n$ , therefore showing that the communication cost can be reduced with a trusted server or shuffler. We summarize the comparisons of our main results to local and distributed DP in Table 1.
Notation. Throughout this paper, we use  $[m]$  to denote the set of  $\{1,\dots,m\}$  for any  $m\in \mathbb{N}$ . Random variables (vectors)  $(X_{1},\ldots ,X_{m})$  are denoted as  $X^{m}$ . We also make use of Bachmann-Landau asymptotic notation, i.e.,  $O,o,\Omega ,\omega$ , and  $\Theta$ .
We first present the distributed mean estimation (DME) [74] problem under differential privacy. Note that DME is closely related to federated learning with SGD (or similar stochastic optimization methods, such as FedAvg [68]), where in each iteration, the server updates the global model by a noisy mean of the local model updates. This noisy estimate is typically obtained by using a DME scheme, and thus one can easily build a distributed DP-SGD scheme (and hence a private FL scheme) from a differentially private DME scheme. Moreover, as shown in [49], as long as we have an unbiased estimate of the gradient at each round, the convergence rates of SGD (or DP-SGD) depend on the  $\ell_2$  estimation error.
Distributed mean estimation. Consider  $n$  clients each with local data  $x_{i} \in \mathbb{R}^{d}$  that satisfies  $\| x_{i}\|_{2} \leq C$  for some constant  $C > 0$  (one can think of  $x_{i}$  as a clipped local gradient). A server wants to learn an estimate  $\hat{\mu}$  of the mean  $\mu (x^n) \triangleq \frac{1}{n}\sum_i x_i$  from  $x^{n} = (x_{1},\ldots ,x_{n})$  after communicating with the  $n$  clients. Toward this end, each client locally compresses  $x_{i}$  into a  $b$ -bit message  $Y_{i} = \operatorname{enc}_{i}(x_{i}) \in \mathcal{V}$  through a local encoder  $\operatorname{enc}_{i}: \mathcal{X} \mapsto \mathcal{Y}$  (where  $|\mathcal{Y}| \leq 2^b$  and sends it to the central server, which upon receiving  $Y^{n} = (Y_{1},\dots ,Y_{n})$  computes an estimate  $\hat{\mu} = \mathrm{dec}(Y^{n})$  that satisfies the following differential privacy:
Definition 2.1 (Differential Privacy). The mechanism  $\hat{\mu}$  is  $(\varepsilon, \delta)$ -differentially private if for any neighboring datasets  $x^n \coloneqq (x_1, \dots, x_i, \dots, x_n)$ ,  $x^{tn} \coloneqq (x_1, \dots, x_i', \dots, x_n)$ , and measurable  $S \subseteq \mathcal{V}$ ,
$$
\Pr \left\{\hat {\mu} \in S \mid x ^ {n} \right\} \leq e ^ {\varepsilon} \cdot \Pr \left\{\hat {\mu} \in S \mid x ^ {\prime n} \right\} + \delta ,
$$
where the probability is taken over the randomness of  $\hat{\mu}$ .
Our goal is to design schemes that minimize the  $\ell_2^2$  estimation error:
$$
\min  _ {(\mathsf {e n c} _ {1} (\cdot), \dots , \mathsf {e n c} _ {n} (\cdot), \mathsf {d e c} (\cdot))} \max  _ {x ^ {n}} \mathbb {E} \left[ \| \hat {\mu} \left(\mathsf {e n c} _ {1} (x _ {1}), \dots , \mathsf {e n c} _ {n} (x _ {n})\right) - \mu (x ^ {n}) \| _ {2} ^ {2} \right],
$$
subject to  $b$ -bit communication and  $(\varepsilon, \delta)$ -DP constraints.
Distributed frequency estimation. Similarly, frequency estimation can also be formulated as a mean estimation problem but with sparse (one-hot) vectors. Let each user  $i$  hold an item  $x_{i}$  in a size  $d$  domain  $\mathcal{X}$ . The server aims to estimate the histogram of the  $n$  items. Without loss of generality, we can assume that  $\mathcal{X} \coloneqq \{e_1, \dots, e_d\} \in \{0, 1\}^d$  (where  $e_j$  is the  $j$ -th standard basis vector in  $\mathbb{R}^d$ ), i.e., each item is expressed as a one-hot vector. Then, the histogram of the  $n$  items can be expressed as  $\pi(x^n) \coloneqq \sum_{i \in [n]} x_i$ . Similar to the mean estimation problem, clients locally compute and then send  $Y_i = \operatorname{enc}_i(x_i) \in \mathcal{V}$  (for some  $\mathcal{V}$  such that  $|\mathcal{V}| \leq 2^b$ ), and the central server computes the estimate  $\hat{\pi} = \operatorname{dec}(y^n)$ . Our goal is to design schemes that minimize the  $\ell_2^2$  or  $\ell_1$  error:
$$
\min  _ {(\mathsf {e n c} _ {1} (\cdot), \ldots , \mathsf {e n c} _ {n} (\cdot), \mathsf {d e c} (\cdot))} \max  _ {x ^ {n}} \mathbb {E} \left[ \| \hat {\pi} \left(\mathsf {e n c} _ {1} (x _ {1}), \ldots , \mathsf {e n c} _ {n} (x _ {n})\right) - \pi (x ^ {n}) \| \right],
$$
subject to communication and DP constraints (where  $\|\cdot\|$  can be  $\ell_1$  or  $\ell_2^2$ ).
Federated learning and distributed mean estimation. Federated learning [64, 68, 60] emerges as a decentralized machine learning framework that provides data confidentiality by retaining clients' raw data on edge devices. In FL, communication between clients and the central server can quickly become a bottleneck [68], so previous works have focused on compressing local model updates via gradient quantization [68, 10, 48, 74, 79, 77, 24], sparsification [18, 56, 41]. To further enhance data security, FL is often combined with differential privacy [38, 1, 9]. Among these works, [?] also employs gradient sparsification (or gradient subsampling) to reduce the problem dimensionality. However, the sparsification takes place after the aggregation of local gradients, so the randomness introduced during sparsification cannot be leveraged to amplify the differential privacy guarantee. As a result, this approach leads to a suboptimal trade-off between privacy and communication compared to our scheme.
Note that in this work, we consider FL (or more specifically, the distributed mean estimation) under a central-DP setting where the server is trusted, which is different from the local DP model [63, 37, 70, 76, 22, 32] and the distributed DP model with secure aggregation [23, 21, 59, 8, 33, 34].
A key step in our mean estimation scheme is pre-processing the local data via Kashin's representation [67]. While various compression schemes, based on quantization, sparsification, and dithering have been proposed in the recent literature, Kashin's representation has also been explored in a few works for communication efficiency [47, 73, 29, 71] and for LDP [42] and is particularly powerful in the case of joint communication and privacy constraints as it helps spread the information in a vector evenly in every dimension.
Distributed frequency estimation and heavy hitters. Distributed frequency estimation (a.k.a. histogram estimation) is another canonical task that has been heavily studied under a distributed setting with DP. Prior works either focus on 1) the local DP model with or without communication constraints, e.g., [20, 19, 25, 26, 57] (under an  $\ell_{\infty}$  loss for heavy hitter estimation) and [58, 80, 76, 6, 5, 32, 46, 72, 45] (under an  $\ell_1$  or  $\ell_2$  loss), or 2) the central DP model without communication constraints [38, 52, 65, 27, 13, 81, 36]. As suggested in [37, 3, 2, 4, 16], compared to central DP, local DP models usually incur much larger estimation errors and can significantly decrease the utility. In this work, we consider central DP but with explicit communication constraints.
Note that the  $\ell_1$  error corresponds to the total variation distance between the true and estimated frequency vectors.
Local DP with shuffling. A recent line of works [40, 35, 12, 43, 50, 51] considers shuffle-DP, showing that one can significantly boost the central DP guarantees by randomly shuffling local (privatized) messages. In this work, we show that the same shuffling technique can be used to achieve the optimal central DP error with nearly optimal communication cost. Therefore, we can obtain the same level of central DP with small communication costs while weakening the security assumption: achieving the optimal communication cost (under central DP) only requires a secure shuffler (as opposed to a fully trusted central server).
4 Distributed Mean Estimation
In this section, we present a mean estimation scheme that achieves the optimal  $\tilde{O}_{\delta}\left(\frac{C^2d}{n^2\varepsilon^2}\right)$  error under  $(\varepsilon ,\delta)$ -DP while only using  $\tilde{O} (n\varepsilon^{2})$  bits of per-client communication.
We first consider a slightly simpler, discrete setting with  $\ell_{\infty}$  geometry (as opposed to the  $\ell_{2}$  mean estimation stated in Section 2): assume each client observes  $x_{i} \in \{-c, c\}^{d}$  where  $c > 0$  is a constant, and a central server aims to estimate the mean  $\mu(x^n) \coloneqq \frac{1}{n} \sum_{i=1}^{n} x_i$  by minimizing the  $\ell_{2}^{2}$  error subject to the privacy and communication constraints. We argue later that solutions to the above  $\ell_{\infty}$  problem can be used for  $\ell_{2}$  mean estimation by applying Kashin's representation.
To solve the aforementioned  $\ell_{\infty}$  mean estimation problem, first observe that each client's local data can be expressed in  $d$  bits since each coordinate of  $x_{i}$  can only take values in  $\{c, -c\}$ . To reduce the communication load to  $o(d)$  bits, each client adopts the following subsampling strategy: for each coordinate  $j \in [d]$ , client  $i$  chooses to send  $x_{i}(j)$  to the server with probability  $\gamma$ . We assume that this subsampling step is performed with a seed shared by the client and the server<sup>3</sup>, hence the server knows which coordinates are communicated by each client. Therefore upon receiving the client messages, it can compute the mean of each coordinate and privatize it by adding Gaussian noise. The key observation we leverage is that the randomness in the compression algorithm can be used to amplify privacy or equivalently reduce the magnitude of the Gaussian noise that is needed for privatization. Note that such randomness needs to be kept private from an adversary as the privacy guarantee of the scheme relies on it.
We summarize the scheme in Algorithm 1 and state its privacy and utility guarantees in the following theorem.
Theorem 4.1 ( $\ell_{\infty}$  mean estimation.). Let  $x_{1}, \ldots, x_{n} \in \{-c, c\}^{d}$  and  $\varepsilon, \delta > 0$ . There exists a
$$
\sigma^ {2} = O \left(\frac {c ^ {2} \log (1 / \delta)}{n ^ {2} \gamma^ {2}} + \frac {c ^ {2} d (\log (d / \delta) + \varepsilon) \log (d / \delta)}{n ^ {2} \varepsilon^ {2}}\right) \tag {1}
$$
such that Algorithm 1 is  $(\varepsilon, \delta)$ -DP and the  $\ell_2^2$  estimation error of  $\hat{\mu}$  is at most
$$
\begin{array}{l} \mathbb {E} \left[ \| \hat {\mu} - \mu \| _ {2} ^ {2} \right] \leq \frac {d c ^ {2}}{n \gamma} + d \sigma^ {2} \\ = O \left(\frac {d ^ {2} c ^ {2}}{n b} + \frac {d ^ {3} c ^ {2} \log (d / \delta)}{n ^ {2} b ^ {2}}\right) (2) \\ \left. + \frac {c ^ {2} d ^ {2} (\log (1 / \delta) + \varepsilon) \log (d / \delta)}{n ^ {2} \varepsilon^ {2}}\right). (3) \\ \end{array}
$$
In addition, the (average) per-client communication cost is  $\gamma d = b$  bits, and Algorithm 1 yields an unbiased estimator of  $\mu$ .
Algorithm 1 Coordinate Subsampled Gaussian Mechanism (CSGM)
Input: users' data  $x_{1},\ldots ,x_{n}$ , sampling parameters  $\gamma \coloneqq b / d$  DP parameters  $(\varepsilon ,\delta)$
Output: mean estimator  $\hat{\mu}$
for user  $i\in [n]$  do
for coordinate  $j\in [d]$  do
Draw  $Z_{i,j}\stackrel {\mathrm{i.i.d.}}{\sim}\mathrm{Bern}(\gamma)$
if  $Z_{i,j} = 1$  then
Send  $x_{i}(j)$  to the server.
Server computes the average  $\hat{\mu}_j\coloneqq \frac{1}{n\gamma}\sum_{i:Z_{ij} = 1}x_i(j) + N(0,\sigma^2)$ , where  $\sigma^2$  is computed according to (1) in Theorem 4.1.
Return:  $\hat{\mu} \coloneqq (\hat{\mu}_1, \hat{\mu}_2, \dots, \hat{\mu}_d)$ .
Remark 4.2 (Unbiasedness). Note that for
mean estimation, we usually want the final mean estimator to be unbiased since standard convergence analyses of SGD [49] require an unbiased estimate of the true gradient in each optimization
In practice, such randomness can be agreed by both sides ahead of time, or it can be generated by the server and communicated to each client.
round. Given that our proposed mean estimation schemes (Algorithm 1 and Algorithm 2 in the next section) are all unbiased, we can combine them with SGD/federated averaging and readily apply [49] to obtain a convergence guarantee for the resulting communication-efficient DP-SGD.
For the  $\ell_2$  mean estimation task formulated in Section 2, we pre-process local vectors by first computing their Kashin's representations and then performing randomized rounding [62, 75, 42, 32]. Specifically, if  $x_{i}$  has  $\ell_2$  norm bounded by  $C$ , then its Kashin's representation (with respect to a tight frame  $K\in \mathbb{R}^{d\times D}$  where  $D = \Theta (d)$ )  $\tilde{x}_i$  has bounded  $\ell_{\infty}$  norm:  $\| \tilde{x}_i\|_{\infty}\leq c = O\left(\frac{C}{\sqrt{d}}\right)$  and satisfies  $x_{i} = K\tilde{x}_{i}$ . This allows us to convert the  $\ell_2$  geometry to an  $\ell_{\infty}$  geometry. Furthermore, by randomly rounding each coordinate of  $\tilde{x}_i$  to  $\{-c,c\}$  (see for example [32]), we can readily apply Algorithm 1 and obtain the following result for  $\ell_2$  mean estimation as a corollary:
Corollary 4.3 ( $\ell_2$  mean estimation). Let  $x_{1},\ldots ,x_{n}\in \mathcal{B}_{2}(C)$  (i.e.,  $\| x_i\| _2\leq C$  for all  $i\in [n]$ ). Then for any  $\varepsilon, \delta >0$ , Algorithm 1 combined with Kashin's representation and randomized rounding yields an  $(\varepsilon, \delta)$ -DP unbiased estimator for  $\mu$  with  $\ell_2^2$  estimation error bounded by