SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Private Distribution Learning with Public Data: The View from Sample Compression*
shai@uwaterloo.ca
yabie@uwaterloo.ca
Clément L. Canonne
clement.canonne@sydney.edu.au
Vikrant Singhal
vikrant.singhal@uwaterloo.ca
We study the problem of private distribution learning with access to public data. In this setup, which we refer to as public-private learning, the learner is given public and private samples drawn from an unknown distribution  $p$  belonging to a class  $Q$ , with the goal of outputting an estimate of  $p$  while adhering to privacy constraints (here, pure differential privacy) only with respect to the private samples.
We show that the public-private learnability of a class  $\mathcal{Q}$  is connected to the existence of a sample compression scheme for  $\mathcal{Q}$ , as well as to an intermediate notion we refer to as list learning. Leveraging this connection: (1) approximately recovers previous results on Gaussians over  $\mathbb{R}^d$ ; and (2) leads to new ones, including sample complexity upper bounds for arbitrary  $k$ -mixtures of Gaussians over  $\mathbb{R}^d$ , results for agnostic and distribution-shift resistant learners, as well as closure properties for public-private learnability under taking mixtures and products of distributions. Finally, via the connection to list learning, we show that for Gaussians in  $\mathbb{R}^d$ , at least  $d$  public samples are necessary for private learnability, which is close to the known upper bound of  $d + 1$  public samples.
Statistical analysis of sensitive data, and specifically parameter and density estimation, is a workhorse of privacy-preserving machine learning. To provide meaningful and rigorous guarantees on algorithm for these tasks, the framework of differential privacy (DP) [DMNS06] has been widely adopted by both algorithm designers and machine learning practitioners [App17, Abo18, XZA $^{+}$ 23], and is, by and large, one of the past decade's success stories in principled approaches to private machine learning, with a host of results and implementations [Goo19a, Goo19b, HBAL19, Ope20] for many of the flagship private learning tasks.
Yet, however usable the resulting algorithms may be, DP often comes at a steep price: namely, many estimation tasks simple without privacy constraints provably require much more data to be performed privately; even more dire, they sometimes become impossible with any finite number of data points, absent some additional strong assumptions.
The prototypical example in that regard is learning a single  $d$ -dimensional Gaussian distribution from samples. In this task, a learner receives i.i.d. samples from an unknown  $d$ -dimensional Gaussian  $p$
*Authors are listed in alphabetical order. Full paper: https://arxiv.org/abs/2308.06239.
and is tasked with finding an estimate  $q$  close to  $p$  in total variation (TV) distance. Without privacy constraints, it is folklore that this can be done with  $O(d^2)$  samples; yet once privacy enters the picture, in the form of pure differential privacy, no finite sample algorithm for this task can exist, unless a bound on the mean vector and covariance matrix are known.
This "cost of privacy" is, unfortunately, inherent to many estimation tasks, as the positive results (algorithms) developed over the years have been complemented with matching negative results (lower bounds). In light of these strong impossibility results, it is natural to wonder if one could somehow circumvent this often steep privacy cost by leveraging other sources of public data to aid the private learning process.
Recent work in finetuning machine learning models has tried to address the question whether, in situations where a vast amount of public data is available, one can combine the public data with a relatively small amount of private data to somehow achieve privacy guarantees for the private data and learning guarantees that would otherwise be ruled out by the aforementioned impossibility results. We, on the other hand, address the same question, but in the opposite setting, i.e., when the amount of public data available is much smaller than the amount of private data available. In other words, we answer the following question from new perspectives.
Can one leverage small quantities of public data to privately learn from sensitive data, even when private learning is impossible?
This question was the focus of a recent study of Bie, Kamath, and Singhal [BKS22], the starting point of our work. In this paper, we make significant strides in this direction, by obtaining new "plug and play" results and connections in this public-private learning setting, and using them to obtain new sample complexity bounds for a range of prototypical density estimation tasks.
First, we establish a connection between learning (in the sense of distribution learning or density estimation) with public and private data (Definition 2.4) and sample compression schemes for distributions (Definition 2.5; see  $\mathrm{[ABDH^{+}20}$ , Definition 4.2]), as well as an intermediate notion we refer to as list learning (Definition 3.2).
Theorem 1.1 (Sample compression schemes, public-private learning, and list learning (Informal; see Theorem D.1)). Let  $\mathcal{Q}$  be a class of probability distributions and  $m(\alpha, \beta)$  be a sample complexity function in terms of target error  $\alpha$  and failure probability  $\beta$ . Then the following are equivalent.
1.  $\mathcal{Q}$  has a sample compression scheme using  $O(m(\alpha, \beta))$  samples.
2.  $\mathcal{Q}$  is public-privately learnable with  $O(m(\alpha, \beta))$  public samples.
3.  $\mathcal{Q}$  is list learnable with  $O(m(\alpha, \beta))$  samples.
Despite its technical simplicity, this sample complexity equivalence turns out to be quite useful, and allows us to derive new public-private learners for an array of key distribution classes by leveraging known results on sample compression schemes. In particular, from the connection to sample compression schemes we are able to obtain new public-private learners for: (1) high-dimensional Gaussian distributions (Corollary E.1); (2) arbitrary mixtures of high-dimensional Gaussians (Theorem 1.2/Corollary E.2); (3) mixtures of public-privately learnable distribution classes (Theorem 4.3/E.5); and (4) products of public-privately learnable distribution classes (Theorem 4.3/E.7). For instance, the following is a consequence of the above connection.
Theorem 1.2 (Public-private learning for mixtures of Gaussians (Informal; see Corollary E.2)). The class of mixtures of  $k$  arbitrary  $d$ -dimensional Gaussians is public-privately learnable with  $m$  public samples and  $n$  private samples, where
$$
m = \tilde {O} \left(\frac {k d}{\alpha}\right) a n d n = \tilde {O} \left(\frac {k d ^ {2}}{\alpha^ {2}} + \frac {k d ^ {2}}{\alpha \varepsilon}\right),
$$
in which  $\alpha$  is the target error and  $\varepsilon$  the privacy parameter.
We also examine public-private distribution learning in a setting with relaxed distributional assumptions, in which the distributions underlying the public and private data: (1) may differ (the case of
public-private distribution shift); and (2) may not be members of the reference class of distributions, and so we instead ask for error close to the best approximation of the private data distribution by a member of the class (the agnostic case). We show that robust sample compression schemes for a class of distributions can be converted into public-private learners in this agnostic and distribution-shifted setting. As a consequence, we have the following result for learning distributions that can be approximated by Gaussians under public-private distribution shift.
Theorem 1.3 (Agnostic and distribution-shifted public-private learning for Gaussians (Informal; see Corollary F.1)). There is a public-private learner that takes  $m$  public samples and  $n$  private samples from any pair of distributions  $\tilde{p}$  and  $p$  over  $\mathbb{R}^d$  respectively, with  $\mathrm{TV}(\tilde{p}, p) \leq \frac{1}{3}$ , where
$$
m = O (d) \quad a n d \quad n = \tilde {O} \left(\frac {d ^ {2}}{\alpha} + \frac {d ^ {2}}{\alpha \varepsilon}\right),
$$
in which  $\alpha$  is the target error and  $\varepsilon$  the privacy parameter. With probability  $\geq \frac{9}{10}$ , the learner outputs  $q$  with  $\mathrm{TV}(q,p) \leq 3\mathrm{OPT} + \alpha$ , where OPT is the total variation distance between  $p$  and the closest  $d$ -dimensional Gaussian to it.
Next, using the aforementioned connection to list learning, we are able to establish a fine-grained lower bound on the number of public data points required to privately learn high-dimensional Gaussians.
Theorem 1.4 (Almost tight lower bound on privately learning Gaussians with public data (Informal; see Theorem 6.1)). The class of all  $d$ -dimensional Gaussians is not public-privately learnable with fewer than  $d$  public samples, regardless of the number of private samples.
[BKS22] showed that  $d$ -dimensional Gaussians are public-privately learnable with  $\tilde{O} \left( \frac{d^2}{\alpha^2} + \frac{d^2}{\alpha \varepsilon} \right)$  private samples, as soon as  $d + 1$  public samples are available. Thus, our result shows a very sharp threshold for the number of public data points necessary and sufficient to make private learning possible.
We also provide a general result for public-privately learning classes of distributions whose Yatracos class has finite VC dimension.
Theorem 1.5 (VC dimension bound for public-private learning (Informal; see Theorem 7.2)). Let  $\mathcal{Q}$  be a class of probability distributions over a domain  $\mathcal{X}$  such that the Yatracos class of  $\mathcal{Q}$ , defined as
$$
\mathcal {H} := \{\{x: f (x) > g (x) \}: f, g \in \mathcal {Q} \} \subseteq 2 ^ {\mathcal {X}}
$$
has bounded VC dimension. Denote by  $\mathrm{VC}(\mathcal{H})$  and  $\mathrm{VC}^*(\mathcal{H})$  the VC and dual VC dimensions of  $\mathcal{H}$  respectively. Then  $\mathcal{Q}$  is public-privately learnable with  $m$  public samples and  $n$  private samples, where
$$
m = \tilde {O} \left(\frac {\operatorname {V C} (\mathcal {H})}{\alpha}\right) a n d n = \tilde {O} \left(\frac {\operatorname {V C} (\mathcal {H}) ^ {2} \operatorname {V C} ^ {*} (\mathcal {H})}{\varepsilon \alpha^ {3}}\right),
$$
The  $\tilde{O}\left(\frac{\mathrm{VC}(\mathcal{H})}{\alpha}\right)$  public sample requirement is less than the known  $O\left(\frac{\mathrm{VC}(\mathcal{H})}{\alpha^2}\right)$  sample requirement to learn with only public data via the non-private analogue of this result [Yat85, DL01].
The most closely related work is that of Bie, Kamath, and Singhal [BKS22], which initiated the study of distribution learning with access to both public and private data. That work studied algorithms for specific canonical distribution classes, while the present paper aims to broaden our understanding of public-private distribution learning in general, via connections to other problems and providing more general approaches for devising sample efficient public-private learners. In addition, we prove the first lower bounds on the amount of public data needed for private distribution learning.
There is a long line of work on private distribution learning, especially with regards to Gaussians and mixtures of Gaussians. [KV18] studied univariate Gaussians, showing that logarithmic dependencies on parameter bounds are necessary and sufficient in the case of pure DP, but can be removed under approximate DP. The same is true in the multivariate setting [KLSU19, KMS+22, TCK+22, AL22,
KMV22, LKO22]. For mixtures of Gaussians, most studies have focused on parameter estimation of mixture components [NRS07, KSSU19,  $\mathrm{CKM}^{+}21$ ,  $\mathrm{CCd}^{+}23$ , AAL23b], and employ component separation and mixing weight assumptions. For density estimation (the setting studied in this work) [BKSW19, AAL21] give learnability results under various structural assumptions. The concurrent work of Azfali, Ashtiani, and Liaw [AAL23a] gives the first learnability result for general high-dimensional mixtures of Gaussians under approximate differential privacy.
Outside of distribution learning, there is a significant interest in using public data to improve private algorithms. Some problems studied include private query release, synthetic data generation, classification, mean estimation, empirical risk minimization, and stochastic convex optimization [JE13, BNS16, ABM19, NB20,  $\mathrm{BCM}^{+}20$ , BMN20, LVS  $^{+}21$ , KADV23, LLHR23]. The definition of public-private algorithms that we adopt is from [BNS16], which studied classification in the PAC model. The VC dimension bound we give for public-private distribution learning relies on results from public-private classification [ABM19] and uniform convergence  $[\mathrm{BCM}^{+}20]$ .
On the technical side, we establish connections with distribution compression schemes as introduced by  $\mathrm{[ABDH^{+}20]}$ , and directly apply their results to establish new results for public-public learning. Related compression schemes for PAC learning for binary classification have been shown to be necessary and sufficient for learnability in those settings [LW86, MY16]. For further discussion of related work, please see Appendix A.
1.3 Limitations
Our work investigates the sample complexity of public-private learning, and does not give computationally efficient learners, or in some cases, algorithmic learners that run in finite time. In particular, all public-private learners we obtain from sample compression run in time exponential in the sample complexity. Also, for our VC dimension upper bounds, we enumerate all realizable labellings of the input sample as per the relevant Yatracos class  $\mathcal{H}$ , which is not computable for general  $\mathcal{H}$  [AABD+20]. Finally, dependence on  $\mathrm{VC}^* (\mathcal{H})$  in sample complexity is not ideal, as  $\mathrm{VC}^* (\mathcal{H})\leq 2^{\mathrm{VC}(\mathcal{H}) + 1} - 1$  is the best possible upper bound in terms of  $\mathrm{VC}(\mathcal{H})$  for general  $\mathcal{H}$  [Ass83].
We denote by  $\mathcal{X}$  the domain of examples. For a domain  $\mathcal{U}$ , denote by  $\Delta(\mathcal{U})$  the set of all probability distributions over  $\mathcal{U}$ . We refer to a set  $\mathcal{Q} \subseteq \Delta(\mathcal{X})$  as a class of distributions over  $\mathcal{X}$ .
We equip  $\Delta(\mathcal{X})$  with the total variation metric, which is defined as follows: for  $p, q \in \Delta(\mathcal{X})$ ,  $\mathrm{TV}(p, q) \coloneqq \sup_{B \in \mathcal{B}} |p(B) - q(B)|$ , where  $\mathcal{B}$  are the measurable sets of  $\mathcal{X}$ . For  $p \in \Delta(\mathcal{X})$  and a set of distributions  $L \subseteq \Delta(\mathcal{X})$ , we denote their point-set distance by  $\mathrm{dist}(p, L) \coloneqq \inf_{q \in L} \mathrm{TV}(p, q)$ .
We will let  $\tilde{\pmb{x}} = (\tilde{x}_1,\dots ,\tilde{x}_m)\in \mathcal{X}^m$  denote a public dataset and  $\pmb {x} = (x_{1},\ldots ,x_{n})\in \mathcal{X}^{n}$  denote a private dataset. Their respective capital versions  $\tilde{\pmb{X}},\pmb{X}$  denote random variables for datasets realized by sampling from some underlying distribution. For  $p\in \Delta (\mathcal{X})$ , we denote by  $p^m$  the distribution over  $\mathcal{X}^m$  obtained by concatenating  $m$  i.i.d. samples from  $p$ .
2.2 Public-private learning
Definition 2.1 (Differential privacy [DMNS06]). Fix an input space  $\mathcal{X}$  and an output space  $\mathcal{Y}$ . Let  $\varepsilon, \delta > 0$ . A randomized algorithm  $\mathcal{A}: \mathcal{X}^n \to \Delta(\mathcal{Y})$  is  $(\varepsilon, \delta)$ -differentially private  $((\varepsilon, \delta)-DP)$ , if for any private datasets  $x, x' \in \mathcal{X}^n$  differing in one entry,
$$
\underset {Y \sim \mathcal {A} (\boldsymbol {x})} {\mathbb {P}} \left\{Y \in B \right\} \leq \exp (\varepsilon) \cdot \underset {Y ^ {\prime} \sim \mathcal {A} \left(\boldsymbol {x} ^ {\prime}\right)} {\mathbb {P}} \left\{Y ^ {\prime} \in B \right\} + \delta \quad \text {f o r a l l m e a s u r a b l e} B \subseteq \mathcal {Y}.
$$
<sup>1</sup>The comment of reviewer rJcv points out an approach to address the non-constructive nature of the reduction of public-privately learning mixture classes to public-privately learning the base class. To summarize: fixing the  $m$  public samples and running the public-private learner on  $n$  "null samples" repeatedly (with different random coins) produces a cover containing the true distribution with high probability. From here, we can run this procedure on all subsamples of the public data and construct a cover containing the true (mixture) distribution.
The case where  $\delta = 0$  is referred to as pure differential privacy or  $\varepsilon$ -DP.
Our focus is on understanding the public data requirements for privately learning different classes of distributions. We seek to answer the following question:
For a class of distributions  $\mathcal{Q}$ , how much public data is necessary and sufficient to render  $\mathcal{Q}$  privately learnable?
To do so, we give the formal notion of "public-private algorithms" – algorithms that take public data samples and private data samples as input, and guarantee differential privacy with respect to the private data – as studied previously in the setting of binary classification [BNS16, ABM19]. We restrict our attention to public-private algorithms that offer a pure DP guarantee to private data.
Definition 2.2 (Public-private  $\varepsilon$ -DP). Fix an input space  $\mathcal{X}$  and an output space  $\mathcal{Y}$ . Let  $\varepsilon > 0$ . A randomized algorithm  $\mathcal{A} \colon \mathcal{X}^m \times \mathcal{X}^n \to \Delta(\mathcal{Y})$  is public-private  $\varepsilon$ -DP if for any public dataset  $\tilde{\boldsymbol{x}} \in \mathcal{X}^m$ , the randomized algorithm  $\mathcal{A}(\tilde{\boldsymbol{x}}, \cdot) : \mathcal{X}^n \to \Delta(\mathcal{Y})$  is  $\varepsilon$ -DP.
Definition 2.3 (Public-private learner). Let  $\mathcal{Q} \subseteq \Delta(\mathcal{X})$ . For  $\alpha, \beta \in (0,1]$  and  $\varepsilon > 0$ , an  $(\alpha, \beta, \varepsilon)$ -public-private learner for  $\mathcal{Q}$  is a public-private  $\varepsilon$ -DP algorithm  $\mathcal{A}: \mathcal{X}^m \times \mathcal{X}^n \to \Delta(\Delta(\mathcal{X}))$ , such that for any  $p \in \mathcal{Q}$ , if we draw datasets  $\tilde{\boldsymbol{X}} = (\tilde{X}_1, \dots, \tilde{X}_m)$  and  $\boldsymbol{X} = (X_1, \dots, X_n)$  i.i.d. from  $p$  and then  $Q \sim \mathcal{A}(\tilde{\boldsymbol{X}}, \boldsymbol{X})$ ,
$$
\mathop{\mathbb{P}}_{\substack{\tilde{\boldsymbol{X}}\sim p^{m},\boldsymbol {X}\sim p^{n}\\ Q\sim \mathcal{A}(\tilde{\boldsymbol{X}},\boldsymbol {X})}}\left\{\mathrm{TV}(Q,p)\leq \alpha \right\} \geq 1 - \beta .
$$
Definition 2.4 (Public-privately learnable class). We say that a class of distributions  $\mathcal{Q} \subseteq \Delta(\mathcal{X})$  is public-privately learnable with  $m(\alpha, \beta, \varepsilon)$  public and  $n(\alpha, \beta, \varepsilon)$  private samples if for any  $\alpha, \beta \in (0,1]$  and  $\varepsilon > 0$ , there exists an  $(\alpha, \beta, \varepsilon)$ -public-private learner for  $\mathcal{Q}$  that takes  $m = m(\alpha, \beta, \varepsilon)$  public samples and  $n = n(\alpha, \beta, \varepsilon)$  private samples.
When  $\mathcal{Q}$  satisfies the above, we may omit the private sample requirement, and say that  $\mathcal{Q}$  is public-privately learnable with  $m(\alpha, \beta, \varepsilon)$  public samples.
Denote by  $\mathrm{SC}_{\mathcal{Q}}(\alpha, \beta)$  the sample complexity of learning  $\mathcal{Q}$ . Our primary interest lies in determining when non-privately learnable  $\mathcal{Q}$  can be public-privately learned with  $m(\alpha, \beta, \varepsilon) = o(\mathrm{SC}_{\mathcal{Q}}(\alpha, \beta))$  public samples (at a target  $\varepsilon$ ).
2.3 Sample compression schemes
One of the main techniques that we use in this work to create public-private learners for various distribution families is the robust sample compression scheme from  $\mathrm{[ABDH^{+}20]}$ . Roughly speaking, if every member  $q$  of a class of distributions  $\mathcal{Q}$  admits a way to encode enough information about itself in a small number of samples from  $q$  and extra bits, such that it can be approximately reconstructed by a fixed and deterministic decoder,  $\mathcal{Q}$  can be learned.
Definition 2.5 (Robust sample compression [ABDH+20, Definition 4.2]). Let  $r \geq 0$ . We say  $\mathcal{Q} \subseteq \Delta(\mathcal{X})$  admits  $(\tau(\alpha, \beta), t(\alpha, \beta), m(\alpha, \beta))$ $r$ -robust sample compression if for any  $\alpha, \beta \in (0,1]$ , letting  $\tau = \tau(\alpha, \beta)$ ,  $t = t(\alpha, \beta)$ ,  $m = m(\alpha, \beta)$ , there exists a decoder  $g: \mathcal{X}^{\tau} \times \{0,1\}^{t} \to \Delta(\mathcal{X})$  such that the following holds:
For any  $q \in \mathcal{Q}$  there exists an encoder  $f_q \colon \mathcal{X}^m \to \mathcal{X}^\tau \times \{0,1\}^t$  satisfying for all  $\pmb{x} \in \mathcal{X}^m$  that for all  $i \in [\tau]$ , there exists  $j \in [m]$  with  $f_q(\pmb{x})_i = \pmb{x}_j$ , such that for every  $p \in \Delta(\mathcal{X})$  with  $\mathrm{TV}(p,q) \leq r$ , if we draw a dataset  $\pmb{X} = (X_1, \dots, X_m)$  i.i.d. from  $p$ , then
$$
\underset {\boldsymbol {X} \sim p ^ {m}} {\mathbb {P}} \left\{\mathrm {T V} (g (f _ {q} (\boldsymbol {X})), q) \leq \alpha \right\} \geq 1 - \beta .
$$
When  $\mathcal{Q}$  satisfies the above, we may omit the compression size complexity function  $\tau (\alpha ,\beta)$  and bit complexity function  $t(\alpha ,\beta)$ , and say that  $\mathcal{Q}$  is  $r$ -robustly compressible with  $m(\alpha ,\beta)$  samples. When  $r = 0$ , we say that  $\mathcal{Q}$  admits  $(\tau (\alpha ,\beta),t(\alpha ,\beta),m(\alpha ,\beta))$  realizable compression and is realizably compressible with  $m(\alpha ,\beta)$  samples.
Both robust and realizable compression schemes satisfy certain useful properties that we use to develop public-private distribution learners in different settings. For example, the existence of a realizable compression scheme is closed under taking mixtures or products of distributions.
3 The connection to sample compression schemes
In this section we prove Theorem 1.1/D.1, the sample complexity equivalence between sample compression (Definition 2.5), public-private learning (Definition 2.4), and an intermediate notion we refer to as list learning (Definition 3.2). We do so by giving sample-efficient reductions between the three notions (Propositions 3.1, 3.4, and 3.5). The propositions state the quantitative translations between: compression size  $\tau$  and number of bits  $t$ , number of private samples  $n$ , and list size  $\ell$ .
3.1 Compression implies public-private learning
We start by establishing that the existence of a sample compression scheme for  $\mathcal{Q}$  implies the existence of a public-private learner for  $\mathcal{Q}$ .
Proposition 3.1 (Compression  $\Rightarrow$  public-private learning). Let  $\mathcal{Q} \subseteq \Delta(\mathcal{X})$ . Suppose  $\mathcal{Q}$  admits  $(\tau(\alpha, \beta), t(\alpha, \beta), m_C(\alpha, \beta))$  realizable sample compression. Then  $\mathcal{Q}$  is public-privately learnable with  $m(\alpha, \beta, \varepsilon) = m_C\left(\frac{\alpha}{6}, \frac{\beta}{2}\right)$  public and  $n(\alpha, \beta, \varepsilon) = O\left(\left(\frac{1}{\alpha^2} + \frac{1}{\alpha\varepsilon}\right) \cdot \left(t\left(\frac{\alpha}{6}, \frac{\beta}{2}\right) + \tau\left(\frac{\alpha}{6}, \frac{\beta}{2}\right) \log\left(m_C\left(\frac{\alpha}{6}, \frac{\beta}{2}\right)\right) + \log\left(\frac{1}{\beta}\right)\right)\right)$  private samples.