CAN STOCHASTIC GRADIENT LANGEVIN DYNAMICS PROVIDE DIFFERENTIAL PRIVACY FOR DEEP LEARNING?
Year: 2021

Abstract:
Bayesian learning via Stochastic Gradient Langevin Dynamics (SGLD) has been suggested for differentially private learning. While previous research provides differential privacy bounds for SGLD when close to convergence or at the initial steps of the algorithm, the question of what differential privacy guarantees can be made in between remains unanswered. This interim region is essential, especially for Bayesian neural networks, as it is hard to guarantee convergence to the posterior. This paper will show that using SGLD might result in unbounded privacy loss for this interim region, even when sampling from the posterior is as differentially private as desired.

1 INTRODUCTION
Machine learning and, specifically, deep learning models show state-of-the-art results in various fields such as computer vision, natural language processing, and signal processing (e.g., Carion et al. (2020); Devlin et al. (2019); Balevi & Andrews (2021)). Training these models requires data, which in some problems, e.g., healthcare, finance, can include private information that should not be made public. Unfortunately, it has been shown (Fredrikson et al. (2015); Carlini et al. (2021)) that private information from the training data can sometimes be extracted from the trained model. One common approach to handle this issue is Differential Privacy (DP). Differential Privacy is a framework that ensures that the distribution of training output would be the same, even if we switch one of the training participants, thus ensuring privacy.
As privacy is usually obtained by adding random noise, it is natural to investigate whether Bayesian inference, which uses a distribution over models, can give private predictions. Previous works have shown that sampling from the posterior is differentially private under certain mild conditions (Wang et al. (2015); Foulds et al. (2016); Dimitrakakis et al. (2017)). The main disadvantage of this method is that sampling from the posterior is generally hard. The posterior usually does not have a closedform solution, and iterative methods such as Markov Chain Monte Carlo (MCMC) are needed. While theoretical bounds on the convergence of MCMC methods for non-convex problems exist (Ma et al., 2019), they usually require an infeasible number of steps to guarantee convergence in practice.
Stochastic Gradient Langevin Dynamics (SGLD) is a popular MCMC algorithm used to approximately sample from an unnormalized distribution (Welling & Teh, 2011). The privacy guarantees of this specific sampling algorithm are interesting as it not only returns a sample from the posterior, which can be private, but the process itself of stochastic gradient descent with Gaussian noise mirrors the common Gaussian mechanism in DP. Previous work Wang et al. (2015) gives two disjoint privacy analyses: The first is for approximate sampling from the Bayesian posterior, which is only relevant when the SGLD almost converges. The second uses the standard DP analysis utilizing the Gaussian mechanism and the Advanced Composition theorem (Dwork & Roth, 2014), which only applies for a limited number of steps and is not connected to Bayesian sampling.
From these two lines of research, differential privacy bounds for SGLD are provided for its initial steps or when close to convergence. Neither of these cases is suitable for deep learning and many other problems, as one would limit the model’s accuracy, and the other is unattainable in a reasonable time. Consequently, the privacy properties of SGLD in the interim region, between these two private
sections, are of high importance. One could speculate that since the initial steps of the algorithm are private, and it converges to the posterior that is also private, then sampling at the interim region will be private as well. If so, SGLD could be considered a solution for training differentially private deep neural networks. Unfortunately, as we will show, this is not the case.
Our Contributions: This work provides a counter-example, based on a Bayesian linear regression problem, showing that approximate sampling using SGLD might result in an unbounded loss of privacy in the interim regime. Moreover, this loss of privacy can even occur under strong conditions - when sampling from the posterior is as private as desired, and the problem is complex - even stronger conditions than what we can assume for most Deep Neural Network problems. This implies that special care should be given when using SGLD for private predictions, especially for problems where it is infeasible to guarantee convergence.
2 RELATED WORK
Several previous works investigate the connection between Bayesian inference and differential privacy (Wang et al. (2015); Foulds et al. (2016); Zhang et al. (2016); Dimitrakakis et al. (2017); Geumlek et al. (2017); Ganesh & Talwar (2020)). None of these papers provide guarantees over SGLD differential privacy in the interim regime. The closest work to ours is Wang et al. (2015) that specifically investigates stochastic MCMC algorithms such as SGLD. As mentioned, its analysis only covers the initial phase and when approximate convergence is achieved.
As many of the privacy bounds require sampling from the posterior, if SGLD is to be used, it requires non-asymptotic convergence bounds. Dalalyan (2014) provided non-asymptotic bounds on the error of approximating a target smooth and log-concave distribution by Langevin Monte Carlo. Cheng & Bartlett (2018) studied the non-asymptotic bounds on the error of approximating a target density p∗ where log p∗ is smooth and strongly convex.
For the non-convex setting, Raginsky et al. (2017) showed non-asymptotic bounds on the 2- Wasserstein distance between SGLD and the invariant distribution solving Itô stochastic differential equation. However, to provide ( , δ) differential privacy, an algorithm should produce a distribution that is O(δ) close to neighbouring databases. Total Variation (for details about Total Variation see Tsybakov (2008)) is a more suitable distance for working with differential privacy. Ma et al. (2019) examined a target distribution p∗, which is strongly log-concave outside of a region of radius R, and where − ln p∗ is L-Lipschitz. They provided a bound on the number of steps needed for the Total Variation distance between the distribution at the last step and p∗ to be smaller than . This bound is proportional to O(e32LR 2 d 2 ), where d is the model dimension. This result suggests that even little non-convexity will render running until close to convergence impractical. A conclusion from this work is that basing the differential privacy of SGLD on the proximity to the posterior is impractical for non-convex settings.
3 BACKGROUND
3.1 DIFFERENTIAL PRIVACY
Differential Privacy (Dwork et al. (2006b;a); Dwork (2011); Dwork & Roth (2014)) is a definition and a framework that enables performing data analysis on a database while reducing one’s risk of exposing its personal data to the database. An algorithm is differentially private if it does not change its output distribution by much due to a single record change in its database.
Definition 1. Approximate Differential Privacy: A randomized algorithm M : D → Range(M) is ( , δ)-differentially private if ∀S ⊆ Range(M) and {∀D, D̂ ∈ D : ‖D − D̂‖ ≤ 1} eq. 1 holds. D, D̂ are called neighboring databases, and while the metric can change per application, Hamming distance is typically used.
Pr[M(D) ∈ S] ≤ exp( )Pr[M(D̂) ∈ S] + δ (1)
Mironov (2017) suggested Rényi Differential Privacy (Definition 3), a relaxation to differential privacy, and a way to translate RDP guarantees into approximate differential privacy guarantees.
Definition 2. Rényi Divergence (Rényi, 1961): For two probability distributions Z and Q over R, the Réyni divergence of order ν > 1 is
Dν(Z||Q) ∆ =
1
ν − 1 logEx∼Q
[( Z(x)
Q(x)
)ν] .
Definition 3. (ν, )-RDP: A randomized mechanism f : D → R is said to have -Rényi differential privacy of order ν, or (ν, )-RDP in short, if for any adjacent databases D, D̂ ∈ D eq. 2 holds, where Dν is Rényi divergence of order ν.
Dν(f(D)||f(D̂)) ≤ (2)
Lemma 3.1. (Mironov (2017) Proposition 3). If f is (ν, )-RDP, it also satisfies ( + log 1 δ
ν−1 , δ) Differential Privacy for any 0 < δ < 1.
3.2 STOCHASTIC GRADIENT LANGEVIN DYNAMICS
Stochastic Gradient Langevin Dynamics (SGLD) is an MCMC method that is commonly used for Bayesian Inference (Welling & Teh, 2011). The update step of SGLD is shown in eq. 3, where θj is the parameter vector at step j, ηj is the step size at step j, p(θj) is the prior distribution, p(yi|θj) is the likelihood of sample yi given model parameterized by θj , b is the batch size, and n is the database size. SGLD can be seen as a Stochastic Gradient Descent with Gaussian noise, where the variance of the noise is calibrated to the step size.
θj+1 = θj + ηj 2
[ ∇θj ln p(θj) + n
b b∑ i=1 ∇θj ln p(yij |θj) ] + √ ηjξj
ij ∼ uniform{1, ..., n} ξj ∼ N (0, 1)
(3)
A common practice in deep learning is to use cyclic Stochastic Gradient Descent. This flavour of SGD first randomly shuffles the database samples and then cyclically uses the samples in this order. For optimization, there is empirical evidence that it works as well or better than SGD with reshuffling, and it was conjectured that it converges at a faster rate (Yun et al. (2021)). Cyclic-SGLD is the analog of cyclic-SGD for SGLD, where the difference is the use of the SGLD step instead of the SGD step. For simplicity, we will consider cyclic-SGLD in this work.
4 METHOD
Our goal is to prove that even when the posterior is as private as desired, sampling using SGLD for T steps can be as non-private as desired. This requires analysing the distribution of SGLD after T steps, which is hard in the general case. However, we show that we can get the desired behaviour when looking at a simple Bayesian linear regression problem where everything is a Gaussian with closed-form expressions. Our result is summarized in theorem 1.
Theorem 1. ∀ δ < 0.5, , ′ there exists a domain and a Bayesian inference problem where a single sample from the posterior distribution is ( , δ) differentially private, but, there is a number, T , for which performing approximate sampling by running SGLD for T steps is not ( ′, δ) differentially private.
As ′ can be as big as desired, and can be as small as desired, a corollary of Theorem 1 is that we could always find a problem for which the posterior is ( , δ) differentially private, but there will be a step in which SGLD will result in unbounded loss of privacy. Therefore, SGLD alone can not provide any privacy guarantees in the interim regime, even if the posterior is private.
To prove our theorem, we consider a Bayesian regression problem for a linear model with Gaussian noise, as defined in eq. 4, on domain D defined in eq. 5.
y = θx+ ξ
ξ ∼ N (0, β−1) θ ∼ N (0, α−1)
log p(y|x, θ) = −β(y − θx)2/2− 1 2 log(2π/β)
(4)
D(n, γ1, xh, xl, c) = {xi, yi|| yi xi − c| ≤ nγ1 ; xi, yi, c, γ1 ∈ R>0; xl ≤ xi ≤ xh}ni=1 We assume that x2hβ > 3 and that γ1 < 1
2
(5)
n, c, xl, xh, γ1 are parameters of the problem (c, xl, xh, and γ1 are used, together with the database size - n, to bound the database samples to a chosen region). For every , ′ and δ, we will show there exist parameters n, c, xl, xh, γ1 that have the privacy properties required to prove Theorem 1. The restrictions on the dataset simplify the proof but are a bit unnatural as it assumes we approximately know c, the parameter we are trying to estimate. Later we show in subsection 4.3 that they can be replaced with a Propose-Test-Release phase. We will address the problem of Bayesian Linear Regression for the model described in eq. 4 on domain D as Bayesian linear regression problem on domain D. This problem has a closed-form solution for both the posterior distribution and the distribution at each SGLD step, thus enabling us to get tight bounds on the differential privacy in each case.
The heart of our proof is showing that for n big enough sampling from the posterior is ( , δ) differentially private, with ∼ O( c 2
n3 ), while for SGLD there exists a step in which releasing a sample will not be ( ′, δ) differentially private for ′ = Ω( c 2
n2 ). Therefore, by considering instances of the problem where c ∼ O(n 32 √ ) and n is big enough, sampling from the posterior will be ( , δ) differentially private, while there will be an SGLD step in which releasing a sample will not be ( ′, δ) differentially private for ′ = Ω(n ). We note that the bounds contain dependency over δ, but since we are using a fixed and equal δ for both the posterior and SGLD privacy analysis, we omit it from the bounds for simplicity.
Figure 1 depicts an indicative value of the distance between the distributions of samples from two SGLD processes running on adjacent databases for the Bayesian linear regression problem. As we
will later show, SGLD on one of these examples is a Gaussian while the other is a mixture of n Gaussians. We plot 1n ∑ i (µt−µit) 2 (σit) 2 , where µt is the mean of the single Gaussian at timestep t, µit is the mean of the i’th Gaussian component at timestep t and (σit) 2 its variance. We can see that even though the distributions are close at the initial iterations and at convergence (which implies differential privacy in those areas), in the interim region, they are significantly apart, which implies a lack of differential privacy.
4.1 POSTERIOR SAMPLING PRIVACY
To prove Theorem 1, we first need to show that ∀δ < 0.5, , there exists a domain and a Bayesian inference problem where a single sample from the posterior distribution is ( , δ) differentially private. In order to do so, this section will consider the differential privacy guarantees provided by one sample from the posterior for the Bayesian linear regression problem on domain D. We begin by using a well-known result for the closed-form-solution of the posterior distribution for a Bayesian linear regression problem (see Bishop (2006) for further details). By using the parameters of our problem, we get Lemma 4.1. Lemma 4.1. The posterior distribution for Bayesian linear regression problem on domain D is
p(θ|D) = N (θ;µ, σ2); µ = ∑n i=1 xiyiβ
α+ ∑n i=1 x 2 iβ ; σ2 = 1 α+ ∑n i=1 x 2 iβ . (6)
Using the posterior distribution, one can calculate the Renyi divergence between every two neighbouring databases, thus getting an expression for the Rényi differential privacy, as shown in Lemma 4.2. Lemma 4.2. For a Bayesian linear regression problem on domain D, such that n > max{1 + 10
x2h x2l ν β , 1 + ν x2h x2l }, one sample from the posterior is (ν, 1)-Rényi differentially private. 1 ∼ O( c 2 n3 )
for c >> n1+γ1 .
1 = x2h
2(n− 1)x2l +
1 2 (ν − 1) νx
2 h
(n− 1)x2l − νx2h + 2νβ x4h 9 10n 1−2γ1x2l +
2νβ · (x 2 hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 · (c+ n
γ1)
n2−γ1 + ν 2 · (x
2 hα+ x 4 hβ) 2
9 10x 6 l β
· (c+ n γ1)2
n3 .
We can show that for c >> n1+γ2 , each of the terms is bounded by O( c 2
n3 ). The first and second terms are bounded by O( 1n ). The third term is bounded by O(n
2γ1−1). Noticing that n2γ1−1 = n2(1+γ1)
n3 < c2 n3 , we get that the third term is bounded by O( c2 n3 ). As c >> n γ1 , the fourth term
is bounded by O( cn γ1 n2 ), and since cnγ1 n2 = cn1+γ1 n3 < c2 n3 , the term is bounded by O( c2
n3 ). Lastly, since c >> n1+γ1 , the last term is bounded by O( c 2
n3 ). For the full proof, see subsection A.1 in the appendix.
Translating the Rényi differential privacy guarantees into approximate differential privacy terms can be done according to Lemma 3.1, which gives Lemma 4.3.
Lemma 4.3. With the conditions of Lemma 4.2, one sample from the posterior is ( 1 + ln( 1δ )
ν−1 , δ) differentially private.
By choosing ν such that ln( 1 δ )
ν−1 < 2 and then choosing n big enough such that 1 < 2 , we get that
the posterior is ( , δ) differentially private.
4.2 STOCHASTIC GRADIENT LANGEVIN DYNAMICS PRIVACY
To complete the proof of Theorem 1, we need to show that even if one sample from the posterior is ( , δ) differentially private for a Bayesian linear regression problem on domain D, it does not
provide any guarantees on the privacy of SGLD for that problem. In order to do so, this section will first consider the loss in privacy when using SGLD for the Bayesian linear regression problem on domain D, and then, together with the results of section 4.1, will prove Theorem 1. In order to show that SGLD is not differentially private after initial steps and before convergence, it is enough to find two neighbouring databases for which the loss in privacy is as big as desired in those steps. We define neighbouring databases D1 and D2 in eq. 7 and consider the Bayesian linear regression problem on D1 and D2. We set the learning rate to be η = 2(α+nx2hβ)2 .
D1 = {xi, yi : xi = xh, yi = c · xh}ni=1 D2 = {xi, yi : xi = xh, yi = c · xh}n−1i=1 ∪ {
xh 2 , c · xh 2 }
(7)
To tightly analyze the differential privacy loss when approximately sampling via SGLD at each step, we need to get a closed-form solution for the distribution for each step. For databaseD1, the solution is Normal distribution. For database D2, different shuffling of samples produces different Gaussian distributions, therefore giving a mixture of Gaussians.
We look at cyclic-SGLD with a batch size of 1 and mark by θj , θ̂j the samples on the j’th SGLD step when using databases D1 and D2 accordingly. Since D1 samples are all equal, the update step of the cyclic-SGLD is the same for every step (with different noise generated for each step). This update-step contains only multiplication by a scalar, addition of a scalar, and addition of Gaussian noise, therefore, together with a conjugate prior results in Normal distribution for θj : N (θj ;µj , σ2j ). For D2, there is only one sample different from the rest. We mark by r the index in which this sample is used in the cyclic-SGLD and call this order r-order. Note that there are only n different values for r and, as such, effectively only n different samples orders. Since every order of samples is chosen with the same probability, r is distributed uniformly in {1, .., n}. We mark by θ̂rj the sample on the j’th SGLD step when using r-order. Since, for a given order, θ̂rj is formed by a series of multiplications by a scalar, addition of scalar, and addition of Gaussian noise, and since the prior is also Gaussian, then θ̂rj is distributed Normally, N (θ̂rj ; µ̂rj , (σ̂rj )2). As r is distributed uniformly, θ̂j distribution mass is distributed evenly between all θ̂rj , resulting in a mixture of Gaussians.
Intuitively what will happen is that each Gaussian components ,θ̂j as well as θj , will move towards the similar posterior Gaussian. However, at each epoch, θ̂j will drag a bit behind because in one batch one gradient is smaller. While this gap can be quite small, for large n, the Gaussians are very peaked with very small standard deviations; thus, they separate enough that we can easily distinguish between the two distributions.
According to approximate differential privacy definition (Definition 1), it is enough to find one set S such that p(θj ∈ S) > e p(θ̂j ∈ S) + δ to show that releasing θj is not ( , δ) private. We choose S = {s|s > µj} at some step j we will define later on. It is clear from symmetry that p(θj > µj) = 1/2, and by using Chernoff bound we can bound p(θ̂j > µj).
Lemma 4.4. p(θ̂j > µj) ≤ 1n ∑n r=1 exp(− (µj−µ̂rj ) 2 2(σ̂rj ) 2 ).
Using Lemma 4.4, we can upper bound the mass of θ̂j in S, and thus lower bound the difference between θj and θ̂j distribution masses in S for some step - j. To use Lemma 4.4, we first need to lower bound (µj−µ̂rj ) 2
(σrj ) 2 for a certain step. This is done in Lemma 4.5.
Lemma 4.5. ∃k ∈ Z>0 such that (µ(k+1)n−µ̂r(k+1)n) 2
(σ̂r (k+1)n
)2 = Ω( c2 n2 ), for n big enough.
To prove Lemma 4.5, we first find closed-form solutions for θ̂r(k+1)n, θ(k+1)n distributions (Lemma A.1). Using the closed-form solutions, we find a lower bound over (µ(k+1)n − µ̂r(k+1)n)
2 as a function of k, which applies for all k (Lemma A.2). To upper bound (σ̂r(k+1)n)
2, we find an approximation to the epoch in which the data and prior effects on the variance are approximately equal,
marked k̇. We choose the step in which we will consider the privacy loss as (dk̇e+1)n and show that (σ̂r
(dk̇e+1)n) 2 is upper bounded at this step (Lemma A.4). Using the upper bound on the difference in means and the lower bound on the variance, Lemma 4.5 is proved. By using the lower bound from Lemma 4.5 in Lemma 4.4, we get Lemma 4.6.
Lemma 4.6. For the Bayesian linear regression problem over database D1, such that n is big enough, ∃T ∈ Z>0 such that approximate sampling by running SGLD for T steps will not be ( , δ) private for < Ω( c 2
n2 ), δ < 0.5.
From Lemma 4.3, we see that sampling from the posterior is ( , δ) differentially private for = O( c 2
n3 ). From Lemma 4.6, we see that for SGLD, there exists a step in which releasing a sample will not be ( ′, δ) differentially private for ′ = Ω( c 2
n2 ). Therefore, considering instances of the problem where c = O(n 32 √ ), sampling from the posterior will be ( , δ) differentially private. However, there will be an SGLD step in which releasing a sample will not be ( ′, δ) differentially private for ′ = Ω(n ). Since we can choose n to be big as desired, we can make the lower bound over ′ as big as we desire. This completes the proof of Theorem 1.
4.3 PROPOSE TEST SAMPLE
Our analysis of the posterior and SGLD is done on a restricted domain D as defined in eq. 5. These restrictions over the dataset simplify the proof but are a bit unnatural as they assume we approximately know c, the parameter we are trying to estimate. This section shows that these restrictions could be replaced with a Propose-Test-Release phase (Dwork & Lei, 2009) and common practices in deep learning.
When training a statistical model, it is common to first preprocess the data by enforcing it in a bounded region and removing outliers. After the data is cleaned, the training process is performed. This is especially important in DP, as outliers can significantly increase the algorithm’s sensitivity to a single data point and thus hamper privacy.
Informally, algorithm 1 starts by clipping the input to the accepted range. It then estimates a weighted average of the ratio yixi (line 12) and throws away outliers that deviate too much from it. The actual implementation of this notion is a bit more complicated because of the requirement to do so privately. Once the database is cleaned, algorithm 1 privately verifies that the number of samples is big enough, so the sensitivity of p(θ|W ) to a single change in the database will be small, therefore making sampling from p(θ|W ) ( , δ) differentially private. This method is regarded as Propose-Test-Release, where we first propose a bound over the sensitivity, then test if the database holds this bound, and finally release the result if so.
We define nmin in eq. 26 in the appendix to be the minimum size of W for which the algorithm will sample from p(θ|W ) with high probability. We will show later on that this limit ensures that sampling from p(θ|W ) is ( , δ) differentially private. We define p(θ|W ) to be the posterior for the Bayesian linear regression problem over database W. From Lemma 4.1, it follows that p(θ|W ) has the form of
p(θ|W ) = N (θ;µ, σ2); µ = ∑ (xi,yi)∈W xiyiβ
α+ ∑
(xi,yi)∈W x 2 iβ
; σ2 = 1 α+ ∑
(xi,yi)∈W x 2 iβ .
Claim 4.1. Algorithm 1 is (5 , 2δ) differentially private.
By claim C.9, steps 6-13 are (3 , δ) differentially private. By corollary C.3, steps 14-19 are (2 , δ) differentially private for given m̆ and n2. Therefore by the sequential composition theorem, the composition is (5 , 2δ) differentially private. The claim proved by noticing that if steps 6-19 are private with respect to the updated database (after step 5), then they are also private for the original database.
Claim 4.2. When replacing line 19 with sampling via SGLD with step size η = 1 (α+n1x2hβ) 2 , then ∃T (n1) : Z>0 → Z>0 such that the updated algorithm is not ( , δ) differentially private ∀ ∈ R>0, δ < 16 if ran for T (n1) steps.
Algorithm 1 Propose Test Sample Input: D = {xi, yi}n1i=1 Parameters: , δ < 0.5, xl > 0, xh > xl, α > 0, β ≥ 3x2h , ρ1 ∈ (1, 3 2 ), ρ2 ∈ (0, 1 2 ), γ1 ∈ (ρ2, 1 2 )
1: for i = 1, 2, . . . , N do 2: xi ← max{xi, xl} 3: xi ← min{xi, xh} 4: yi ← max{yi, 0} 5: end for 6: n̆1 ← n1 − 1 log 1 2δ + Lap( 1 ) 7: V = {xi, yi| yixi ≤ n̆ ρ1 1 } 8: n2 ← |V | − 1 log 1 2δ + Lap( 1 )
9: if n2 ≤ 1 then 10: return null 11: end if 12: m← ∑ (xi,yi)∈V
xiyi∑ (xi,yi)∈V x2i
13: m̆← m+ Lap( 1 n̆ ρ1 1
2(n2−1)x2hx 2 l+x 4 h
n2(n2−1)x4l )
14: W ← {(xi, yi) : | yixi − m̆| ≤ n ρ2 2 } 15: nW ← |W | − 1 log( 1 2δ ) + Lap( 1 ) 16: if nW < nmin then 17: return null 18: end if 19: return sample from p(θ|W )
Proof sketch (See appendix for full proof). We first note that by choosing 1+ρ2 > ρ1, the sensitivity of m̆ grows slower than the bound over the distance | yixi − m̆|. Therefore for n1 big enough, samples for which yixi = m will be included in W with high probability. Consequently, databases D3, D4 ∈ D will reach, with high probability, to step 19, which from our previous analysis over SGLD (see subsection 4.2) will cause an unbounded loss in privacy.
ρ1 > ρ3 > 1 D3 = {xi, yi : xi = xh, yi = nρ31 · xh} n1 i=1
D4 = {xi, yi : xi = xh, yi = nρ31 · xh} n−1 i=1 ∪ { xh 2 , nρ31 · xh 2 }
(8)
5 WASSERSTEIN DISTANCE AND DIFFERENTIAL PRIVACY
As we have shown in Theorem 1, one cannot give any DP guarantees for SGLD in the interim region. That means that to get private samples using SGLD, one must limit the number of iterations, thus utilizing the Gaussian mechanism, or run until approximate convergence. Therefore, it is of interest to get non-asymptotic convergence bounds for SGLD so that we guarantee privacy after a known number of steps. Previously, several works have given non-asymptotic bounds; however, some of those do so for the 2-Wasserstein metric (Raginsky et al. (2017); Cheng et al. (2018)). This is unfortunate as the 2-Wasserstein metric is unsuitable for differential privacy - it is easy to create two distributions with 2-Wasserstein distance as small as desired but with disjoint support.
It is, however, interesting to ask whether combining bounds on the 2-Wasserstein metric with Lipschitz continuous probability densities will allow us to get privacy guarantees. The intuition why this should be enough is simple: If p, q are two distributions with small 2-Wasserstein distance, then there is (under mild conditions) a mapping, f : X → X , such that the pushforward maintains f]p = q (i.e. for each measurable set S q(S) = p(f−1(S))) and that Ep[||x−f(x)||2] < . One can assume that p(x) ≈ q(f(x)) and q(x) ≈ q(f(x)) as x ≈ f(x) with high probability. Unfortunately, this intuition does not hold exactly, as the map f can change the density considerably but still be a
pushforward by changing the volume. For example, if we assume f is smooth and bijective, we get the standard change of variable formula such that p(x) = q(f(x)) |det(Jf )|, so p(x) ≈ q(f(x)) only if |det(Jf )| ≈ 1. This issue becomes more severe as the dimensionality increases.
For completeness, we will share our results connecting p(x) to q(x) when W2(p, q) is small, and both distributions are L-Lipschitz continuous. This bound scale poorly with dimension, and as such ill-suited for SGLD on deep networks, but can still be useful for Bayesian sampling in low-dimensional problems.
For distribution p, we define the density pλ(x) as the average of p(x) on a ball of radius λ centered around x - pλ(x) = 1vold(λ) ∫ Bdλ(0)
p(x + z)dz, where Bdλ(x) is the ball in Rd of radius λ centered around x, and vold(λ) is its volume. Claim 5.1. For L-Lipschitz continuous distribution p we have |p(x)− pλ(x)| ≤ λL. Theorem 2. Let P,Q be absolutely continuous w.r.t the Lebesgue measure in Rd, with finite secondmoment and L-Lipschitz continuous densities p, q. IfW2(p, q) < 2 then we have
pλ(x) ≤ vold(λ)
vold(λ− ) qλ(x) +
( vold(λ) vold(λ− ) − 1 ) 2λL+ vold(λ− ) . (9)
The proof is an extension of the proof of theorem 2.1 in Walker (2004) to dimensions larger than 1. The detailed proof is in the supplementary material. It is easy to see that as vold(λ)vold(λ− ) = ( 1 + λ− )d , the bounds usefulness quickly diminishes with dimensionality as it requires extremely small to give non-vacuous results.
This, however, can still give useful results in low-dimensional problems.
6 CONCLUSION
As shown in this work, while SGLD has interesting connections to privacy and some guarantees, caution is required if one wishes to use it to get private predictions. This is especially important for models such as deep neural networks, where it is infeasible to guarantee convergence.
REFERENCES Eren Balevi and Jeffrey G. Andrews. Wideband channel estimation with a generative adversarial
network. IEEE Transactions on Wireless Communications, 20(5):3049–3060, 2021. doi: 10. 1109/TWC.2020.3047100.
Christopher Bishop. Pattern Recognition and Machine Learning. Information Science and Statistics. Springer-Verlag New York, 2006.
Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm (eds.), Computer Vision – ECCV 2020, pp. 213– 229. Springer International Publishing, 2020. ISBN 978-3-030-58452-8.
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, D. Song, Ú. Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In USENIX Security Symposium, 2021.
X. Cheng and P. Bartlett. Convergence of langevin mcmc in kl-divergence. In ALT, 2018.
Xiang Cheng, Niladri S. Chatterji, Peter L. Bartlett, and Michael I. Jordan. Underdamped langevin MCMC: A non-asymptotic analysis. In Conference On Learning Theory COLT, 2018.
Arnak Dalalyan. Theoretical guarantees for approximate sampling from smooth and log-concave densities. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 79, 12 2014. doi: 10.1111/rssb.12183.
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pp. 4171–4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics. doi: 10.18653/v1/N19-1423. URL https: //aclanthology.org/N19-1423.
Christos Dimitrakakis, Blaine Nelson, Zuhe Zhang, Aikaterini Mitrokotsa, and Benjamin I. P. Rubinstein. Differential privacy for bayesian inference through posterior sampling. Journal of Machine Learning Research, 18(11):1–39, 2017. URL http://jmlr.org/papers/v18/ 15-257.html.
Cynthia Dwork. A firm foundation for private data analysis. Commun. ACM, 54(1):86–95, January 2011. ISSN 0001-0782. doi: 10.1145/1866739.1866758. URL https://doi.org/10. 1145/1866739.1866758.
Cynthia Dwork and Jing Lei. Differential privacy and robust statistics. In Proceedings of the FortyFirst Annual ACM Symposium on Theory of Computing, STOC ’09, pp. 371–380, New York, NY, USA, 2009. Association for Computing Machinery. ISBN 9781605585062. doi: 10.1145/ 1536414.1536466. URL https://doi.org/10.1145/1536414.1536466.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9(3–4):211–407, August 2014. ISSN 1551-305X. doi: 10.1561/0400000042. URL https://doi.org/10.1561/0400000042.
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Advances in Cryptology - EUROCRYPT 2006, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, volume 4004 of Lecture Notes in Computer Science, pp. 486– 503. Springer, 2006a. doi: 10.1007/11761679 29. URL https://iacr.org/archive/ eurocrypt2006/40040493/40040493.pdf.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Shai Halevi and Tal Rabin (eds.), Theory of Cryptography, pp. 265–284, Berlin, Heidelberg, 2006b. Springer Berlin Heidelberg. ISBN 978-3-540-32732-5.
James R. Foulds, Joseph Geumlek, Max Welling, and Kamalika Chaudhuri. On the theory and practice of privacy-preserving bayesian data analysis. In Uncertainty in Artificial Intelligence, UAI, 2016.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS ’15, pp. 1322–1333, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 9781450338325. doi: 10.1145/2810103. 2813677. URL https://doi.org/10.1145/2810103.2813677.
Arun Ganesh and Kunal Talwar. Faster differentially private samplers via rényi divergence analysis of discretized langevin mcmc. ArXiv, abs/2010.14658, 2020.
Joseph Geumlek, Shuang Song, and Kamalika Chaudhuri. Renyi differential privacy mechanisms for posterior sampling. In Advances in Neural Information Processing NeurIPS, 2017.
Alison L. Gibbs and Francis Edward Su. On choosing and bounding probability metrics. International Statistical Review, 70(3):419–435, 2002.
M. Gil, F. Alajaji, and T. Linder. Rényi divergence measures for commonly used univariate continuous distributions. Information Sciences, 249:124–131, 2013. ISSN 0020-0255. doi: https://doi. org/10.1016/j.ins.2013.06.018. URL https://www.sciencedirect.com/science/ article/pii/S0020025513004441.
Yi-An Ma, Yuansi Chen, Chi Jin, Nicolas Flammarion, and Michael I. Jordan. Sampling can be faster than optimization. Proceedings of the National Academy of Sciences, 116(42):20881– 20885, 2019. ISSN 0027-8424. doi: 10.1073/pnas.1820003116. URL https://www.pnas. org/content/116/42/20881.
Ilya Mironov. Renyi differential privacy. CoRR, abs/1702.07476, 2017. URL http://arxiv. org/abs/1702.07476.
Maxim Raginsky, Alexander Rakhlin, and Matus Telgarsky. Non-convex learning via stochastic gradient langevin dynamics: a nonasymptotic analysis. In Satyen Kale and Ohad Shamir (eds.), Proceedings of the 2017 Conference on Learning Theory, volume 65 of Proceedings of Machine Learning Research, pp. 1674–1703. PMLR, 07–10 Jul 2017. URL https://proceedings. mlr.press/v65/raginsky17a.html.
Alfréd Rényi. On measures of entropy and information. In Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory of Statistics, pp. 547–561. University of California Press, 1961.
Alexandre B. Tsybakov. Introduction to Nonparametric Estimation. Springer Publishing Company, Incorporated, 1st edition, 2008. ISBN 0387790519.
Martin J. Wainwright. High-Dimensional Statistics: A Non-Asymptotic Viewpoint. Cambridge Series in Statistical and Probabilistic Mathematics. Cambridge University Press, 2019.
Stephen Walker. New approaches to Bayesian consistency. The Annals of Statistics, 32, 2004.
Yu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and stochastic gradient monte carlo. In Proceedings of the 32nd International Conference on Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp. 2493–2502, Lille, France, 07–09 Jul 2015. PMLR. URL https://proceedings.mlr.press/v37/ wangg15.html.
M. Welling and Y. Teh. Bayesian learning via stochastic gradient langevin dynamics. In ICML, 2011.
Chulhee Yun, Suvrit Sra, and Ali Jadbabaie. Open problem: Can single-shuffle SGD be better than reshuffling SGD and gd? In Conference on Learning Theory, COLT, 2021.
Zuhe Zhang, Benjamin I. P. Rubinstein, and Christos Dimitrakakis. On the differential privacy of bayesian inference. In AAAI Conference on Artificial Intelligence, 2016.
A SGLD AND POSTERIOR PRIVACY
Proof Theorem 1. Define
1 2 > γ1 > 0; 3 2 > γ2 > 1 + γ1; xl = xh 2 ν1 = 2 ln(1δ ) + 1
n1 = max{ 1 2αx2hβ − 1 x2hβ , α x2hβ , α x2hβ (e
2
x2 h β − 2) + 1
2x2β }
n2 = max{1 + x2h x2l 8 , 1 + ν x2h x2l (1 + 8 (ν − 1) ), ( 16νβx4h 9 10 x 2 l ) 1 1−2γ1 ,
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(1 +
1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 1 2−γ1−γ2 ,
( 4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(1 + 1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 2 3−2γ2 }
n3 = max{1 + 10 x2h x2l ν1 β , 1 + ν x2h x2l }
np = max{n1, n2, n3, (( ′ − ln(0.5− δ))e 2 x2β (
32x2hβ
3 )2 2v1 α ) 1 2(γ2−1) }
v1 = max{6, 1 + 2e 1 x2 h β } cp = n γ2 p
.
We consider the Bayesian linear regression problem over databaseD1 (defined in eq. 7) with n = np and c = cp. Since np > n1, the problem holds the constraints of lemma A.6. Consequently, there exists a step for which one approximate sample from the posterior using SGLD is not ( ′′, δ) private for all ′′ such that ′′ ≤ e− 2 x2β α
2v1 ( 3 32x2hβ )2( cp np )2 + ln(0.5 − δ). From eq. 10, the choice of np promises that ′ ≤ e− 2 x2β α
2v1 ( 3 32x2hβ )2( cp np )2 + ln(0.5 − δ); Therefore approximate sampling from the posterior using SGLD is not ( ′, δ) differentially private.
Since np > n2 and np > n3, the problem holds the constraints of Claim D.30. Therefore one sample from the posterior is ( , δ) differentially private.
e − 2 x2 h β α
2v1 (
3
32x2hβ )2( cp np )2 + ln(0.5− δ) ≥ ′
( cp np )2 ≥ ( ′ − ln(0.5− δ))e 2 x2 h β ( 32x2hβ 3 )2 2v1 α
n2(γ2−1)p ≥ ( ′ − ln(0.5− δ))e 2 x2 h β ( 32x2hβ
3 )2 2v1 α
np ≥ (( ′ − ln(0.5− δ))e 2 x2 h β ( 32x2hβ
3 )2 2v1 α ) 1 2(γ2−1)
(10)
A.1 POSTERIOR SAMPLING PRIVACY
Proof Lemma 4.1. eq. 11 is a known result for the Bayesian inference problem for a linear model with Gaussian noise with known precision parameter (β) and a conjugate prior (Bishop (2006) - 3.49-4.51. for details). By choosing the basis function to be φ(x) = x, working in one dimension,
and choosing m0 = 0,S0 = α−1, we get the linear model defined in eq. 4 and matching posterior described in Lemma 4.1.
p(w|t) = N (w;mN ,SN ); mN = SN (S−10 m0 + βΦT t); S −1 N = S −1 0 + βΦ TΦ (11)
Proof Lemma 4.2. By definition 3, for a single sample from the posterior to be (ν, ′) RDP, the Rényi divergence of order ν between any adjacent databases needs to be bounded. We consider two adjacent databases D, D̂ ∈ D, and w.l.o.g, define that they differ in the last sample (where it is also allowed to be (0, 0) for one of them, which saves us the need to consider also a neighbouring database with a size smaller by 1). To ease the already complex and detailed calculations, we use definitions in eq .12.
D = {xi, yi}n−1i=1 ∪ {xn, yn}, D̂ = {xi, yi} n−1 i=1 ∪ {x̂n, ŷn}
z = n−1∑ i=1 x2i , q = n−1∑ i=1 yixi (12)
According to Lemma 4.1 and with definitions in eq. 12, the posterior distributions are
p(θ|D) = N (θ;µ, σ2); µ = β(q + xnyn) α+ (z + x2n)β ; σ2 = 1 α+ (z + xn)β
p(θ|D̂) = N (θ; µ̂, σ̂2); µ̂ = β(q + x̂nŷn) α+ (z + x̂2n)β ; σ̂2 = 1 α+ (z + x̂n)β
. (13)
By Gil et al. (2013), the Réyni divergence of order ν, - Dν(f1||f2) - for f1, f2, uni-variate normal distributions with means µ1, µ2 and variances σ1, σ2 accordingly, is
Dν(f1||f2) = ln σ1 σ2 + 1 2 (ν − 1) ln σ
2 2
(σ2f1,f2) ∗ ν
+ 1
2
ν(µ1 − µ2)2
(σ2)∗ν
(σ2f1,f2) ∗ ν = νσ 2 2 + (1− ν)σ21 > 0
.
Therefore, for p(θ|D) and p(θ|D̂), the Rényi divergence of order ν is as shown in eq. 14, where we omit the subscript for (σ2)∗ν since it is clear from context to which distributions it applies.
Dν(p(θ|D)||p(θ|D̂)) = ln σ
σ̂ +
1 2 (ν − 1) ln σ̂
2
(σ2)∗ν +
1
2
ν(µ− µ̂)2
(σ2)∗ν
(σ2)∗ν = νσ̂ 2 + (1− ν)σ2
(14)
According to claim D.25, (σ2)∗ν > 0. Therefore the value Dν(p(θ|D), p(θ|D̂)) exists. In order to prove Rényi differential privacy, each of the terms of Dν(p(θ|D), p(θ|D̂)) is bounded separately. The bounds on each of the terms are proved at claims D.26,D.27, and D.28.
Proof Lemma 4.3. By Lemma 4.2, sampling from the posterior is (ν, 1)-RDP, therefore by Lemma 3.1, sampling from the posterior is also ( 1 + ln( 1δ )
ν−1 , δ) differentially private.
A.2 STOCHASTIC GRADIENT LANGEVIN DYNAMICS PRIVACY
Proof Lemma 4.4.
p(θ̂j > µj |D2) = n∑ r=1 p(θ̂rj > µj |D2)p(θ̂j = θ̂rj |D2) =
n∑ r=1 p(θ̂j − µ̂rj > µj − µ̂rj |D2)p(θ̂j = θ̂rj |D2) =
1
n n∑ r=1 p(θ̂j − µ̂rj > µj − µ̂rj |D2) ≤
1
n n∑ r=1 exp(− (µj − µ̂rj)2 2(σrj ) 2 )
Where the inequality holds due to Chernoff bound (For further details, see Wainwright (2019)).
Proof Lemma 4.5. By lemma A.5, for n > max{ αx2β , α x2hβ (e 2 x2β − 2) + 12x2β , 1 2αx2hβ − 1 x2hβ } eq. 15 holds for some k̇ ∈ R>0. We can see that this lower bound is dominated by c 2
n2 , therefore proving Lemma 4.5.
(µ(dk̇e+1)n − µ̂r(dk̇e+1)n) 2
(σr (dk̇e+1)n)
2 ≥ e − 2 x2 h β α
v1 (
3
32x2hβ )2(
c n )2
v1 = max{6, 1 + 2e 1 x2 h β }
(15)
Proof Lemma 4.6. By Lemma A.6, for n > max{ α x2hβ , α x2hβ
(e 2 x2 h β −2)+ 1
2x2hβ , 1 2αx2hβ − 1 x2hβ }, there
exists T ∈ Z>0 (Marked in Lemma A.6 as dk̇e) such that running SGLD for the Bayesian linear regression problem over D1 for T steps will not be ( , δ) differentially for < ′, as defined in eq. 16, and δ < 0.5. Since ′ is dominated by c 2
n2 , this proves the lemma.
′ = e − 2 x2β
α
2v1 (
3
32x2hβ )2(
c n )2 + ln(0.5− δ)
v1 = max{6, 1 + 2e 1 x2 h β }
(16)
A.3 STOCHASTIC GRADIENT LANGEVIN DYNAMICS DETAILED ANALYSIS
In order to ease the analysis of the SGLD process, markings in eq. 17 are used. xh, α, β, c, n are as defined for the Bayesian linear regression problem, and η is defined in subsection 4.2.
λ = [1− η 2 (α+ nx2hβ)], λ̂ = [1− η 2 (α+ n( xh 2 )2β)], ρ = η 2 ncx2hβ, ρ̂ = η 2 nc( xh 2 )2β (17)
Lemma A.1. The forms of θ̂r(k+1)n are
θ̂1(k+1)n = θ0λ̂ k+1λ(n−1)(k+1) + k∑ j=0 (λ̂λn−1)j [ρ̂λn−1 + ρ n−2∑ i=0 λi + √ η n−1∑ i=0 λiξi]
θ̂r>1(k+1)n = θ0(λ̂λ n−1)k+1+
( r−1∑ i=1 (ρ+ √ ηξ)λ̂λn−i−1 + (ρ̂+ √ ηξ)λn−r + n∑ j=r+1 (ρ+ √ ξη)λn−j ) k∑ l=0 (λ̂λn−1)l.
Proof Lemma A.1. Welling & Teh (2011) define the SGLD update rule as in eq. 3. This rule can be applied to the Bayesian linear regression problem over databases D1, D2 as following
p(θj) = N(θj ; 0, α−1)⇒ ln p(θj) = ln( 1√ 2πα−1 )− 1 2 θ2jα⇒ ∇θjp(θj) = −θjα p(yi|θj) = N(yj ; θjxi, β−1)⇒ ln p(yi|θj) = ln( 1√
2πβ−1 )− 1 2 (yi − θjxi)2β ⇒
∇θjp(yi|θj) = (yi − θjxi)xiβ ⇒ θj+1 = θj + η
2 [−θjα+ n(yi − θjxj)xiβ] +
√ ηjξi =
θj [1− η
2 (α+ nx2jβ)] +
η 2 nyixiβ + √ ηξj =
θj [1− η
2 (α+ nx2jβ)] +
η 2 ncx2iβ + √ ηξj
.
By using standard tools for solving first-order non-homogeneous recurrence relations with variable coefficients, the value of θ̂1n can be found.
θ̂1n = λ̂λ n−1(
θ0λ̂+ ρ̂+ √ ηξ
λ̂ + n∑ i=2 ρ+ √ ηξ λ̂λi−1 ) =
θ0λ̂λ n−1 + (ρ̂+ √ ηξ)λn−1 + (ρ+ √ ηξ) n∑ i=2 λn−1−(i−1) =
θ0λ̂λ n−1 + (ρ̂+ √ ηξ)λn−1 + (ρ+ √ ηξ) n∑ i=2 λn−1−(i−1) =
θ0λ̂λ n−1 + (ρ̂+ √ ηξ)λn−1 + (ρ+ √ ηξ) n−2∑ i=0 λi =
θ0λ̂λ n−1 + ρ̂λn−1 + ρ n−2∑ i=0 λi + √ ηξ n−1∑ i=0 λi.
Now by defining a new series - θ̂1(k+1)n = c1θ̂ 1 kn + c2, and using the tools for solving first order non-homogeneous recurrence relations with constant coefficients, the value of θ̂1kn can be found
θ̂1kn = c k 1( θ̂1n c1 + k∑ i=2 c2 ci1 ) = θ1nc k−1 1 + k∑ i=2 c2c k−i 1 =
θ1nc k−1 1 + c2 k−2∑ i=0 ci1 = (θ0c1 + c2)c k−1 1 + c2 k−2∑ i=0 ci1 =
θ0(λ̂λ n−1)k + (ρ̂λn−1 + ρ n−2∑ i=0 λi + √ ηξ n−1∑ i=0 λi) k−1∑ j=0 (λ̂λn−1)j .
The proof for θ̂rkn is done in similar manner.
Corollary A.1. θ̂r(k+1)n ∼ N(θ̂ r (k+1)n; µ̂ r (k+1)n, (σ̂ r (k+1)n) 2).
Lemma A.2. µkn+n − µ̂rkn+n ≥ λn−1 ncx2hβ α+nx2hβ λk(n−1)(λ̂k+1 − λk+1).
Proof Lemma A.2. The proof of this lemma is separated into two cases, for r = 1 and for r > 1. For r = 1, it is easy to derive eq. 18 from lemma A.1, using E[θ0] = 0 and E[ξ] = 0.
µ̂1(k+1)n = ρ n−2∑ i=0 λi k∑ j=0 (λ̂λ(n−1))j + ρ̂λn−1 k∑ j=0 (λ̂λ(n−1))j
µkn+n = ρ n−2∑ i=0 λi k∑ j=0 λjn + ρλn−1 k∑ r=0 λrn
(18)
We use the sum of a geometric sequence to get
µ̂1(k+1)n =
ρ n−2∑ i=0 λi k∑ j=0 (λ̂λ(n−1))j + ρ̂λn−1 k∑ j=0 (λ̂λ(n−1))j = (ρ( 1− λn−1 1− λ ) + ρ̂λn−1) 1− (λ̂λn−1)k+1 1− λ̂λn−1 .
Therefore the difference between the means can be lower bounded:
µkn+n − µ̂1kn+n = 1− λ(k+1)n
1− λn [ρ(
1− λn−1 1− λ ) + ρλn−1]− 1− (λ̂λ (n−1))k+1 1− λ̂λn−1 [ρ( 1− λn−1 1− λ ) + ρ̂λn−1] =∗
1− λ(k+1)n 1− λn ncx2β α+ nx2hβ (1− λn)− 1− (λ̂λ (n−1))k+1 1− λ̂λn−1 ncx2β α+ nx2hβ (1− λn−1(1 4 λ+ 3 4 )) =
(1− λ(k+1)n) ncx 2β α+ nx2hβ − 1− (λ̂λ (n−1))k+1 1− λ̂λn−1 ncx2β α+ nx2hβ (1− λn−1(1 4 λ+ 3 4 )) =
ncx2β α+ nx2hβ [(1− λ(k+1)n)− 1− (λ̂λ (n−1))k+1 1− λ̂λn−1 (1− λn−1(1 4 λ+ 3 4 ))] =∗∗
ncx2β
α+ nx2hβ (λn−1 34 η2α(1− λ̂k+1λ(k+1)(n−1)) + λ(k+1)(n−1)(λ̂k+1 − λk+1)(1− λn−1λ̂) 1− λn−1λ̂ ) ≥
ncx2β
α+ nx2hβ (λ(k+1)(n−1)(λ̂k+1 − λk+1)(1− λn−1λ̂) 1− λn−1λ̂ ) =
ncx2β
α+ nx2hβ λ(k+1)(n−1)(λ̂k+1 − λk+1) = λn−1 ncx2β
α+ nx2hβ λk(n−1)(λ̂k+1 − λk+1)
where equality * holds from claims D.1, D.2, D.3, equality ** holds from claim D.5, and the inequality holds because λ < λ̂ < 1. This proves Lemma A.2 for r = 1.
For the case of r > 1, from Lemma A.1 it is easy to see
θ̂r>1(k+1)n = [ [θ0λ r−1 + ρ r−2∑ i=0 λi + √ η r−2∑ i=0 λiξi]λ̂ kλk(n−1)+
k−1∑ j=0 (λ̂λn−1)j [ρ̂λn−1 + ρ n−2∑ i=0 λi + √ η n−1∑ i=0 λiξi] ] λ̂λn−r+
ρ̂λn−r + ρ n−r−1∑ j=0 λj + √ η n−r∑ j=0 ξλj
.
Therefore µ̂r>1kn+n follows
µ̂r>1(k+1)n =[ [ρ r−2∑ i=0 λi]λ̂kλk(n−1) + k−1∑ j=0 (λ̂λn−1)j [ρ̂λn−1 + ρ n−2∑ i=0 λi] ] λ̂λn−r + ρ̂λn−r + ρ n−r−1∑ j=0 λj .
Consequently the difference in means for r > 1 can be lower bounded:
µkn+n − µ̂rkn+n =
λn−r[λρλkλk(n−1) r−2∑ i=0 λi + λ k−1∑ j=0 (λλn−1)j(ρλn−1 + ρ n−2∑ i=0 λi)− λ̂ρλ̂kλk(n−1) r−2∑ i=0 λi − λ̂ k−1∑ j=0 (λ̂λn−1)j(ρ̂λn−1 + ρ n−2∑ i=0 λi)] + λn−r(ρ− ρ̂) = λn−rλk(n−1)ρ(λk+1 − λ̂k+1) r−2∑ i=0 λi + λn−r k−1∑ j=0 λ(n−1)j [λn−1(ρλj+1− ρ̂λ̂j+1) + (λj+1 − λ̂j+1)ρ n−2∑ i=0 λi] + λn−r(ρ− ρ̂) =∗ λn−rλk(n−1)ρ(λk+1 − λ̂k+1)1− λ r−1
1− λ + λn−r
ncx2hβ
α+ nx2hβ [λ(1− λkn)−
λ̂ 1− (λn−1λ̂)k
1− λn−1λ̂ (1− λn(3 4 λ−1 + 1 4 ))] + λn−r(ρ− ρ̂) =∗∗
λn−rλk(n−1)ρ(λk+1 − λ̂k+1)1− λ r−1
1− λ + λn−r
ncx2hβ
α+ nx2hβ
[ (λ− λ̂)+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + λk(n−1)(λ̂k+1 − λk+1)
] + λn−r(ρ− ρ̂) =∗∗∗
λn−r ncx2hβ α+ nx2hβ λk(n−1)(λk+1 − λ̂k+1)(1− λr−1) + λn−r ncx 2 hβ α+ nx2hβ
[ (λ− λ̂)
+ λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + λk(n−1)(λ̂k+1 − λk+1)
] + λn−r(ρ− ρ̂) =
λn−r ncx2hβ
α+ nx2hβ λk(n−1)(λk+1 − λ̂k+1)[1− λr−1 − 1]+
λn−r ncx2hβ
α+ nx2hβ (λ− λ̂+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) + λn−r(ρ− ρ̂) =
λn−r ncx2hβ
α+ nx2hβ λk(n−1)(λ̂k+1 − λk+1)λr−1+
λn−r ncx2hβ
α+ nx2hβ (λ− λ̂+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) + λn−r(ρ− ρ̂) =
λn−1 ncx2hβ
α+ nx2hβ λk(n−1)(λ̂k+1 − λk+1)+
λn−r ncx2hβ
α+ nx2hβ (λ− λ̂+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) + λn−r(ρ− ρ̂) >∗∗∗∗
λn−1 ncx2hβ
α+ nx2hβ λk(n−1)(λ̂k+1 − λk+1)
where equality * holds from claims D.6 and D.7, equality ** holds from claim D.10, equality *** holds from claim D.1, and equality **** holds from claim D.11 and λ̂ > λ.
Lemma A.3. For x2hβ > 3, n > 1 2αx2hβ − 1 x2hβ , ∃k̇ ∈ R+ such that upper bounds defined in eq. 19 hold for all 0 < k ≤ k̇:
(σ1(k+1)n) 2 ≤ 2(λ̂λn−1)2 1 α (λ̂λn−1)2k (σr>1(k+1)n) 2 ≤ 6(λ̂λn−r)2 1
α (λ̂λn−1)2k.
(19)
Proof Lemma A.3. The proof will be separated into two cases, r = 1 and r > 1. (σ̂1kn+n) 2 can be easily computed from lemma A.1 using the fact that both the noise and prior are distributed normally. A first general upper bound on (σ̂1kn+n) 2 is found at eq. 20.
(σ1kn+n) 2 =
1 α (λ̂λ(n−1))2(k+1) + η n−1∑ i=0 λ2i k∑ j=0 (λ̂2λ2(n−1))j =
(λ̂λ(n−1))2(k+1)[ 1
α + η n−1∑ i=0 λ2i k∑ j=0 (λ̂λ(n−1))2j (λ̂λ(n−1))2(k+1) ] =
(λ̂λ(n−1))2(k+1)[ 1
α + η n−1∑ i=0 λ2i k∑ j=0 (λ̂λ(n−1))2(j−(k+1))] ≤
(λ̂λ(n−1))2(k+1)[ 1
α + η n−1∑ i=0 λ2i k∑ j=0 λ2n(j−(k+1))] =
(λ̂λ(n−1))2(k+1)[ 1
α + η (k+1)n∑ i=1 λ−2i] =
(λ̂λ(n−1))2(k+1)[ 1
α + ηλ−2
1− λ−2(k+1)n
1− λ−2 ]
(20)
where the inequality holds because λ < λ̂
By claim D.12, this upper bound can be further bounded for k̇ ≤ 12n logλ( 1 1+ 1αη (1−λ2) ) − 1 such that eq. 21 will hold, therefore proving the bound for r = 1.
(λ̂λ(n−1))2(k̇+1)[ 1
α + ηλ−2
1− λ−2(k̇+1)n
1− λ−2 ] ≤ 2(λ̂λ(n−1))2(k̇+1) 1 α (21)
For r > 1, (σ̂r>1kn+n) 2 can be bounded as following
(σr>1kn+n) 2 =
(λ̂λn−r)2η[(λ̂kλk(n−1))2 r−2∑ i=0 λ2i + k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i]+
η n−r∑ i=0 λ2i + 1 α (λ̂λn−1)2k(λ̂λn−1)2 ≤∗
(λ̂λn−r)2η[(λ̂kλk(n−1))2 r−2∑ i=0 λ2i + k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i]+
η n−r∑ i=0 λ2i + 1 α (λ̂λn−1)2k(λ̂λn−r)2 =
(λ̂λn−r)2[ 1
α (λ̂λn−1)2k + η(λ̂λn−1)2k r−2∑ i=0 λ2i + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] + η n−r∑ i=0 λ2i ≤∗∗
(λ̂λn−r)2[ 1
α (λ̂λn−1)2k + η(λ̂λn−1)2k n−1∑ i=0 λ2i + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] + η n−r∑ i=0 λ2i ≤∗∗∗
2(λ̂λn−r)2[ 1
α (λ̂λn−1)2k̇ + η(λ̂λn−1)2k n−1∑ i=0 λ2i + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i]
(22)
where inequality * follows from λ < 1 and r > 1, inequality ** follows from r ≤ n, and inequality *** holds from claim D.15.
For k ≤ 12n logλ( 1 1+ 1αη (1−λ2) )− 1, this bound can be further developed
2(λ̂λn−r)2[ 1
α (λ̂λn−1)2k̇ + η(λ̂λn−1)2k n−1∑ i=0 λ2i + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] ≤
6(λ̂λn−r)2 1
α (λ̂λn−1)2k̇
. (23)
The inequality holds from claims D.12, D.14, which provide the bound for r > 1. All that is left is to prove that 12n logλ(
1 1+ 1αη (1−λ2) )− 1 > 0, which is done in Claim D.22.
Lemma A.4. Mark k̇ = 12n logλ( 1 1+ 1αη (1−λ2) )− 1, for the conditions of Lemma A.3
(σ1dk̇en+n) 2 ≤ (1 + 2e
1 x2β )(λ̂λn−1)2
1 α (λ̂λ(n−1))2dk̇e
(σr>1dk̇en+n) 2 ≤ 6(λ̂λn−r)2 1 α (λ̂λn−1)2dk̇e.
Proof Lemma A.4. This proof will be separated into two cases, for r > 1 and for r = 1. For r > 1, the bound found in eq. 22, has no dependence on the choice of k, therefore holds also for dk̇e. This bound was, in turn, developed for k̇ at eq. 23 using three claims. If these claims also hold for dk̇e, then the bound in eq. 23 also holds for dk̇e, and the lemma is proved for r > 1.
Claims D.14, D.12 hold for all k ≤ 12n logλ( 1 1+ 1αη (1−λ2) ), and since dk̇e ≤ k̇ + 1 =
1 2n logλ( 1 1+ 1αη (1−λ2) ), they holds for dk̇e. Claim D.15 was proved for all k, hence also holds for dk̇e.
For r = 1, the bound found at eq. 20 is applicable for all k, hence
(σ1 (dk̇e+1)n) 2 ≤ (λ̂λn−1)2(dk̇e+1)[ 1 α
+ ηλ−2 1− λ−2(dk̇e+1)n
1− λ−2 ] ≤ (λ̂λn−1)2(dk̇e+1) 1 α (1 + 2e 1 x2β )
where the last inequality holds from claim D.17.
Lemma A.5. For k̇ defined in Lemma A.4, the conditions of Lemma A.3, and n >
max{ α x2hβ , α x2hβ
(e 2 x2 h β − 2) + 1
2x2hβ }
(µdk̇en+n − µ̂rdk̇en+n) 2
(σrdk̇en+n) 2
≥ e − 2 x2 h β α
v1 (
3
32x2hβ )2(
c n )2
v1 = max{6, 1 + 2e 1 x2 h β }.
Proof Lemma A.5.
(µdk̇en+n − µ̂rdk̇en+n) 2
σrdk̇en+n ≥
( λn−1 ncx2hβ
α+nx2hβ λdk̇e(n−1)(λ̂dk̇e+1 − λdk̇e+1) )2 v1(λ̂λn−r)2 1 α (λ̂λ n−1)2dk̇e =
λ2dk̇e(n−1) ( λn−1 ncx2hβ
α+nx2hβ (λ̂dk̇e+1 − λdk̇e+1) )2 v1(λ̂λn−r)2 1 α (λ̂λ n−1)2dk̇e = ( λn−1 ncx2hβ α+nx2hβ (λ̂dk̇e+1 − λdk̇e+1) )2 v1(λ̂λn−r)2 1 α λ̂ 2dk̇e =
αλ2(r−1) v1 ( ncx2hβ α+ nx2hβ )2 (λ̂dk̇e+1 − λdk̇e+1)2 λ̂2dk̇e+1 = αλ2(r−1) v1 ( ncx2hβ α+ nx2hβ )2(1− λ dk̇e+1 λ̂dk̇e+1 )2 ≥ αλ2(r−1)
v1 ( ncx2hβ α+ nx2hβ )2(1− (1−
3 4nx 2β
(α+ nx2hβ) 2 − (α+ 14nx2β)
))2 =
αλ2(r−1) v1 ( ncx2hβ α+ nx2hβ )2(
3 4nx 2 hβ
(α+ nx2hβ) 2 − (α+ 14nx2β)
)2 ≥
αλ2(r−1) v1 ( ncx2hβ α+ nx2hβ )2( 3 4nx 2β (α+ nx2hβ) 2 )2 ≥ αλ 2(r−1) v1 ( ncx2β 2nx2hβ )2( 3 4nx 2β (2nx2β)2 )2 = αλ2(r−1)
v1 ( c 2 )2(
3 4
4nx2hβ )2 =
αλ2(r−1)
v1 (
3
32x2hβ )2(
c n )2 ≥
αλ2(n−1)
v1 (
3
32x2hβ )2(
c n )2 ≥ e − 2 x2 h β α v1 ( 3 32x2hβ )2( c n )2
where first inequality holds from A.3, A.4 and the definition of v1, the second inequality follows claim D.17 and claim D.22, fourth inequality holds under the assumption of nx2hβ > α ⇐⇒ n > α x2hβ , and last inequality holds from claim D.19.
Lemma A.6. For the Bayesian linear regression problem over database D1, the conditions of Lemma A.5, and k̇, as defined in Lemma A.4, approximate sampling, by running SGLD for (dk̇e+1)n steps, will not be ( , δ) differentially private for
δ < 0.5, < e − 2 x2β
α
2v1 (
3
32x2hβ )2(
c n )2 + ln(0.5− δ)
v1 = max{6, 1 + 2e 1 x2 h β }.
Proof Lemma A.6. According to definition 1, it is enough that there is one group, S, such that p(θ(dk̇e+1)n ∈ S|D1) > e p(θ̂(dk̇e+1)n ∈ S|D2) + δ, to show that releasing θ(dk̇e+1)n is not ( , δ) private. Consider S = {s|s > µ(dk̇e+1)n}. From claim D.23 and since θ(dk̇e+1)n ∼ N(θ(dk̇e+1)n;µ(dk̇e+1)n, σ 2 (dk̇e+1)n), eq. 24 holds. The conditions for the right term to be smaller
than 0 (thus making the approximate sampling not ( , δ) private) are found in eq. 25, therefore proving the lemma.
e p(θ̂(dk̇e+1)n ∈ S|D2) + δ − p(θ̂(dk̇e+1)n ∈ S|D1) ≤ e e −e − 2 x2β α 2v1 ( 3 32x2 h β )2( cn ) 2 + δ − 0.5 (24)
e −e − 2 x2β α 2v1 ( 3 32x2 h β )2( cn ) 2 + δ − 0.5 < 0
e −e − 2 x2β α 2v1 ( 3 32x2 h β )2( cn ) 2 < 0.5− δ
− e− 2 x2β
α
2v1 (
3
32x2hβ )2(
c n )2 < ln(0.5− δ)
< e − 2 x2β
α
2v1 (
3
32x2hβ )2(
c n )2 + ln(0.5− δ)
(25)
B PROPOSE TEST SAMPLE SUPPLEMENTARY
nmin which is used in algorithm 4.3 is defined as following
ν = 2 ln( 1δ ) + 1
nb1 = max{1 + x2h x2l 8 , 1 + ν x2h x2l (1 + 8 (ν − 1) ), ( 16νβx4h 9 10 x 2 l ) 1 1−2γ1 ,
( 32νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )m̆)
1 2−γ1 ,
( 32νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 ))
1 2−2γ1 ,
( 8ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)m̆) 2 3 ,
( 8ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)) 2 3−2γ1 }
nb2 = max{1 + x2h x2l 10ν β , 1 + ν x2h x2l } nmin = max{nb1, nb2, n1 ρ2 γ1 }
. (26)
C PROPOSE TEST SAMPLE PRIVACY
Proof Claim 4.2. We set the algorithm parameters in eq. 27, and matching databasesD3, D4 defined in eq. 8. We note that we only define a lower bound over n1, which will be updated later on.
ρ3 = 1.15; ρ2 = 0.45; ρ1 = 1.25, γ1 = 0.49;
xl = xh/2
n1 > max{2 1 log 1
2δ , 4
1
log
1
2δ , 210ρ1 , 29+10ρ2}
β = 3;xh = 1
α = 1
(27)
Mark the return value of the algorithm as r, the event of the algorithm running on database D3 and W = D3 as AD3 , the event of the algorithm running on database D4 and W = D4 as AD4 , and
S = {s|s > µi}, where µi is the mean of the sample distribution at the SGLD i’th step given database D3 (Similarly to as defined in subsection 4.2). We will show that ∀ ∈ R>0, δ < 16 ,∃n1 such that eq. 28 holds.
P (r ∈ S|D3) > e P (r ∈ S|D4) + δ (28)
We first show that
P (r ∈ S ∧AcD3 |D3) = 0 P (r ∈ S ∧AcD4 |D4) = 0
(29)
Notice that the algorithm can return result in S only if it reached step 19. Consider an event where the algorithm reached step 19 and AcD3 . From A c D3 , ∃(xi, yi) ∈ D3 such that | yixi − m̆| ≥ n ρ2 2 . However, since ∀(xi, yi) ∈ D3 : yixi = n ρ3 1 then ∀(xi, yi) ∈ D3 : | yi xi − m̆| > nρ22 and therefore |W | = 0. Under the assumption that sample from p(θ|{}) returns null then in this case the algorithm also returns null and therefore P (r ∈ S ∧AcD3 |D3) = 0. Same arguments hold for D4. Following eq. 29, to prove eq. 28 it is enough to prove eq. 30.
P (r ∈ S|D3, A3)P (A3|D3) ≥∗ P (r ∈ S|D3, A3)− 5δ >∗∗ e P (r ∈ S|D4, A4) + δ ≥ e P (r ∈ S|D4, A4)P (A4|D4) + δ = e P (r ∈ S ∧A4|D4) + δ
(30)
From claim C.1 ∃nbound1 such that ∀n1 > nbound1 inequality * holds. From Lemma 4.6, for n1 big enough ∃T ∈ Z>0 such that eq. 31 hold (Where 6δ < 0.5 according to the claim conditions). Therefore, ∃k, nbound2 ∈ R>0 such that ∀n1 > nbound2 : ′ > kn 2(1−ρ3) 1 and eq. 31 hold. As ρ3 > 1, by choosing n1 > max{nbound2, ( k ) 1
2(ρ3−1) } get that ′ > . Consequently, by choosing n1 > max{nbound1 , nbound2 , ( k ) 1 2(ρ3−1) }, inequalities * and ** hold, and the claim is proved.
′ = Ω(n 2(ρ3−1) 1 )
P (r ∈ S|D3, A3) > e ′ P (r ∈ S|D4, A4) + 6δ
(31)
Claim C.1. ∃nbound1 ∈ Z>0 such that the probability for algorithm 4.3 to reach step 19 with W = D3 (marked event A) is greater or equal to 1− 5δ for all n1 > nbound1 .
Proof. Mark the event of nW > nmin ∧ m̆ ∈ [m − nρ22 ,m + n ρ2 2 ] ∧ n 1+ρ2−0.1 2 > n̆ ρ1 1 ∧ n̆1 ≤ n1 ∧ V = D as B. Since P (A|D3, B) = 1 it follows that P (A|D3) ≥ P (A ∧ B|D3) = P (A|B,D3)P (B|D3) = P (B|D3). Therefore if ∃nlb such that ∀n1 > nlb : P (B|D3) ≥ 1 − 5δ the claim is proved.
P (B|D3) = P (m̆ ∈ [m− nρ22 ,m+ n ρ2 2 ] ∧ nW > nmin|D3, V = D,n 1+ρ2−0.1 2 > n̆ ρ1 1 , n̆1 ≤ n1)· P (n1+ρ2−0.12 > n̆ ρ1 1 |V = D, n̆1 ≤ n1, D3)P (V = D, n̆1 ≤ n1|D3) ≥
P (m̆ ∈ [m− nρ22 ,m+ n ρ2 2 ] ∧ nW > nmin|D3, V = D,n 1+ρ2−0.1 2 > n̆ ρ1 1 , n̆1 ≤ n1)− 3δ = P (nW > nmin|D3, V = D,n1+ρ2−0.12 > n̆ ρ1 1 , n̆1 ≤ n1, m̆ ∈ [m− n ρ2 2 ,m+ n ρ2 2 ])
P (m̆ ∈ [m− nρ22 ,m+ n ρ2 2 ]|D3, V = D,n 1+ρ2−0.1 2 > n̆ ρ1 1 , n̆1 ≤ n1)− 3δ ≥ P (nW > nmin|D3, V = D,n1+ρ2−0.12 > n̆ ρ1 1 , n̆1 ≤ n1, m̆ ∈ [m− n ρ2 2 ,m+ n ρ2 2 ])− 4δ ≥ 1− 5δ (32)
By corollary C.1 and claim C.3 for n1 big enough first inequality holds. By claim C.4 for n1 big enough second inequality holds, and by claim C.5 for n1 big enough third inequality holds. Therefore for n1 big enough eq. 32 holds and the claim is proved.
Claim C.2. For n1 > max{ 12 −10ρ1 , 4 1 log 1 2δ}
P (n̆ρ11 ≥ n ρ3 1 ∧ n̆1 ≤ n1|D3) ≥ 1− 2δ.
Proof. Mark the noise added at step 6 as l1
P (n̆ρ11 ≥ n ρ3 1 ∧ n̆1 ≤ n1|D3) =
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ∧ n1 + l1 −
1
log
1
2δ ≤ n1|D3) =
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ∧ l1 ≤
1
log
1
2δ |D3) =
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ∧ |l1| ≤
1
log
1
2δ |D3)+
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ∧ l1 ≤ −
1
log
1
2δ |D3) ≥
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ∧ |l1| ≤
1
log
1
2δ |D3) =
P ((n1 + l1 − 1 log 1
2δ )ρ1 ≥ nρ31 ||l1| ≤
1
log
1
2δ ,D3)P (|l1| ≤
1
log
1
2δ |D3) ≥
P ((n1 − 2 1 log 1
2δ )ρ1 ≥ nρ31 |D3)− 2δ = 1− 2δ
Where last inequality holds from following equation
P (|l1| ≤ 1 log 1
2δ ) = 1− 2P (l1 ≤ −
1
log
1
2δ ) = 1− exp(−
1 log 1 2δ
1
) = 1− 2δ
Last equality holds since n1 > 12 −10ρ1 ⇒ n−11 < ( 12 ) 10ρ1 ⇒ n−0.11 < ( 12 ) ρ1 and therefore (n1 − 2 1 log 1 2δ ) ρ1 > ( 12n1) ρ1 > nρ1−0.11 = n ρ3 1
Corollary C.1.
∀n1 > max{ 1
2
−10ρ1 , 4 1 log 1
2δ } : P (V = D3 ∧ n̆1 ≤ n1) ≥ 1− 2δ.
Claim C.3. For n1 > max{ 12 −(9+10ρ2), 4 1 log 1 2δ}
P (n1+ρ2−0.12 > n̆ ρ1 1 |D3, V = D3, n̆1 ≤ n1) ≥ 1− δ.
Proof.
P (n0.9+ρ22 > n̆ ρ1 1 |D3, V = D3, n̆1 ≤ n1) ≥ P (n 0.9+ρ2 2 > n ρ1 1 |D3, V = D3) ≥
P ((n1 − 2 1 log 1
2δ )0.9+ρ2 > nρ11 |D3)p(n2 ≥ |V | − 2
1
log
1
2δ ) ≥
P ((n1 − 2 1 log 1
2δ )0.9+ρ2 > nρ11 |D3)− δ = 1− δ
where the second inequality holds since P (Lap( 1 ) < − 1 log 1 2δ ) < δ, and last equality holds since (n1 − 2 1 log 1 2δ ) 0.9+ρ2 > ( 12n1) 0.9+ρ2 > n1+ρ2−0.21 = n ρ1 1
Claim C.4. ∃nlb1 ∈ Z>0 such that
∀n1 > nlb1 : P (m̆ ∈ [m− n ρ2 2 ,m+ n ρ2 2 ]|D3, n 0.9+ρ2 2 > n̆ ρ1 1 ) ≥ 1− δ.
Proof. Mark the noise added at step 13 as l1
P (m̆ ∈ [m− nρ22 ,m+ n ρ2 2 ]|D3, n 0.9+ρ2 2 > n̆ ρ1 1 ) =
P (l1 ∈ [−nρ22 , n ρ2 2 ]|D3, n 0.9+ρ2 2 > n̆ ρ1 1 ) ≥
1− 2(1 2 exp(−nρ22 1
1 n̆ ρ1 1
2(n2−1)x2hx 2 l+x 4 h
n2(n2−1)x4l
) =
1− exp(− n 1+ρ2 2 (n2 − 1)x4l
n̆ρ11 (2(n2 − 1)x2hx2l + x4h) )
Since n0.9+ρ22 > n̆ ρ1 1 then n̆ ρ1 1 = o(n 1+ρ2 2 ) and therefore for n1 big enough the exponent is smaller than δ.
Claim C.5. ∃nlb2 ∈ Z>0 such that
∀n1 > nlb2 : p(nW > nmin||V | = D3 ∧ n 0.9+ρ2 2 > n̆ ρ1 1 ∧ m̆ ∈ [m− n ρ2 2 ,m+ n ρ2 2 ], D3) ≥ 1− δ.
Proof. For abbreviation mark eventB asB = |V | = D3∧n0.9+ρ22 > n̆ ρ1 1 ∧m̆ ∈ [m−n ρ2 2 ,m+n ρ2 2 ]. Mark the Laplace noise used in step 8 as l1 and the Laplace noise used in step 15 as l2.
P (nW > nmin|B,D3) =
P (n1 − 1 log 1
2δ + l2 > nmin|B,D3) >
P (n1 − 1 log 1 2δ − 1 log 1 δ > nmin|B,D3)P (l2 > − 1 log 1 δ )+ P (n1 − 1 log 1
2δ + l2 > nmin ∧ l2 < −
1
log
1 δ |B,D3) >
P (n1 − 2 log 1 2δ − 1 log 1 δ > nmin|B,D3)(1− δ 2 ) >
P (n1 − 2 log 1 2δ − 1 log 1 δ > nmin|B,D3)− δ 2 = P (n1 − 2 log 1
2δ − 1 log 1 δ > nmin|l1 < 1 log 1 δ ,B,D3)P (l1 < 1 log 1 δ |B,D3)+
P (n1 − 2 log 1 2δ − 1 log 1 δ > nmin ∧ l1 ≥ 1 log 1 δ |B,D3)− δ 2 ≥
P (n1 − 2 log 1 2δ − 1 log 1 δ > nmin|l1 < 1 log 1 δ ,B,D3)P (l1 < 1 log 1 δ |B,D3)− δ 2 ≥ P (n1 − 2 log 1
2δ − 1 log 1 δ > nmin|l1 < 1 log 1 δ ,B,D3)− δ
From B it holds that |m− m̆| < nρ22 and therefore m̆ < m+ n ρ2 2 , and for the case of l1 < 1 log 1 δ it holds that n2 < n1 − 1 log 1 2δ + 1 log 1 δ < n1 + 1 log 1 δ . Therefore m̆ ≤ m+ (n1 + 1 log 1 δ ) ρ2 . As nmin = O(max{m̆ 2 3 , n ρ2 γ1 1 }) then for the case of l1 < 1 log 1 δ and B, it holds that nmin = O(max{(m + nρ21 ) 2 3 , n ρ2 γ1 1 }) = O(max{n 2ρ3 3 1 , n ρ2 γ1 1 }) < o(n1), therefore ∃nlb2 such that ∀n1 > nlb2 : n1 − 2 log 1 2δ − 1 log 1 δ > nmin. Consequently, ∀n1 > nlb2 : P (n1 − 2 log 1 2δ − 1 log 1 δ > nmin|l1 < 1 log 1 δ , B,D3) = 1.
Definition 4. A randomized function f(X, y) : χn1 ×Rn2 → R, is ( , δ)-differentially private with respect to X if ∀S ⊆ R, and ∀X, X̂ ∈ χn : ‖X − X̂‖ ≤ 1, eq. 33 holds.
P (f(X, y) ∈ S) ≤ exp( )P (f(X̂, y) ∈ S) + δ (33)
Claim C.6. Calculating n̆1, n2 is (2 , 0) differentially private.
Proof. Since n1 can differ by up to 1 for neighbouring databases, calculating n̆1 is protected via the Laplace mechanism. Since for a given n̆1 the value |V | can change by up to 1 for two neighbouring databases then calculating n2 is ( , 0) by the Laplace mechanism. Consequently from sequential composition theorem the sequential composition is (2 , 0) differentially private.
Claim C.7. P (n2 ≤ |V ||D, n̆1) = 1− δ.
Proof. Mark l ∼ Lap( 1 ),
P (n2 ≤ |V ||D, n̆1) = P (|V | − 1 log 1
2δ + l ≤ |V ||D, n̆1) =
P (l ≤ 1 log 1
2δ |D, n̆1) = 1−
1 2 exp(−
1 log 1 2δ
1
) = 1− δ
Claim C.8. Calculating m̆ is ( , 0) differentially private with respect to D for given n̆1, n2 and n2 < |V |.
Proof. Mark by D̂ a neighbouring database to D, and V̂ as V induced by this database. If V = V̂ then the claim follows trivially. In case the V ’s differ, assume w.l.o.g that |V | ≥ |V̂ |, and that if |V | = |V̂ | then they differ in their last sample. Define q = ∑ (xi,yi)∈V/{x|V |,y|V |} xiyi, z =∑
(xi,yi)∈V/{x|V |,y|V |} x 2 i .
| q + x|V |y|V | z + x2|V | − q + x̂|V |ŷ|V | z + x̂2|V | | =
| qx̂2|V | + x|V |y|V |x̂ 2 |V | + x|V |y|V |z − qx 2 |V | − x̂|V |ŷ|V |x 2 |V | − x̂|V |ŷ|V |z
(z + x2|V |)(z + x̂ 2 |V |)
| ≤
qx2h + n̆ ρ1 1 x 2 hz + n̆ ρ1 1 x 4 h
(z + x2l )z ≤ n̆ρ11
2zx2h + x 4 h
(z + x2l )z = n̆ρ11 ( 2x2h z + xl + x4h (z + x2l )z ) ≤
n̆ρ11 ( 2x2h |V |x2l + x4h |V |(|V | − 1)x4l ) ≤ n̆ρ11 ( 2x2h n2x2l + x4h n2(n2 − 1)x4l ) = n̆ρ11 2(n2 − 1)x2hx2l + x4h n2(n2 − 1)x4l
therefore by the Laplace mechanism calculating m̆ is ( , 0) differentially private.
Claim C.9. Steps 6-13 are (3 , δ) differentially private.
Proof. Mark D̂ as a neighbouring database,
P (m̆ ∈ S|D) =∫ r1,r2∈R>0×R>0
P (m̆ ∈ S|D, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D)dr1dr2 =∫ r1,r2∈R>0×[1,|V |]
P (m̆ ∈ S|D, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D)dr1dr2+∫ r1,r2∈R>0×(|V |,∞]
P (m̆ ∈ S|D, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D)dr1dr2 ≤∗∫ r1,r2∈R>0×[1,|V |]
P (m̆ ∈ S|D, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D)dr1dr2 + δ ≤∗∗∫ r1,r2∈R>0×[1,|V |]
e2 P (m̆ ∈ S|D̂, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D̂)dr1dr2 + δ ≤∫ r1,r2∈R>0×R>0 e2 P (m̆ ∈ S|D̂, n̆1 = r1, n2 = r2)p(n̆1 = r1, n2 = r2|D̂)dr1dr2 + δ =
e2 P (m̆ ∈ S|D̂) + δ
where inequality * follows claim C.7 and inequality ** follows claims C.8 and C.6.
Claim C.10. Steps 14-19 are ( , δ) differentially private with respect to D for |W | < nmin and given n2, m̆.
Proof. Mark l ∼ Lap( 1 ), and D̂ as a neighbouring database. Eq. 34 proves the claim.
P (S|D, |W | < nmin, m̆, n2) = P (S ∩ {null}|D, |W | < nmin, m̆, n2)+ P (S ∩ {null}c|D, |W | < nmin, m̆, n2) ≤ e P (S ∩ {null}|D̂, |W | < nmin, m̆, n2) + δ ≤ e P (S|D̂, |W | < d, m̆, n2) + δ
(34)
where first inequality is true from eq. 35 and the Laplace mechanism for nW .
P (null|D, |W | < nmin, m̆, n2) =
P (nW < nmin + 1 log( 1
2δ )|D, |W | < nmin, m̆, n2) ≥
P (l < 1 log( 1
2δ )) ≥ 1− δ
(35)
Claim C.11. Step 19 is ( , δ) differentially private with respect to D for |W | ≥ nmin and given n2, m̆.
Proof. For a given n2, m̆ and a neighbouring database, the groupW can change by up to one sample. Mark n = |W | and c = m̆. From eq. 36, it follows that W ∈ D, as defined in eq. 5.
n ≥ n ρ2 γ1 2 ⇒ n 1 2 > nγ1 ≥ nρ22
(36)
As W ∈ D, n ≥ nb1, and n ≥ nb2, the problem of sampling from p(θ|W ) for |W | ≥ nmin holds the constraints of claim D.29. Therefore one sample from p(θ|W ) is ( , δ) differentially private.
Claim C.12. Steps 14-18 are ( , 0) differentially private with respect to D for |W | > nmin and given m̆, n2.
Proof. Only data released is nW , and since the sensitivity of |W | given m̆, n2 is 1, then the Laplace mechanism ensures ( , 0) differential privacy.
Corollary C.2. Steps 14-19 are (2 , δ) differentially private with respect to D for |W | > nmin and given m̆, n2. Corollary C.3. Steps 14-19 are (2 , δ) differentially private with respect to D given m̆, n2.
D AUXILIARY CLAIMS
This subsection contains simple claims used to simplify the reading of the proofs. Claims described in this subsection uses the marking defined in eq. 17.
Claim D.1. ρ 11−λ = ncx2hβ
α+nx2hβ .
Proof Claim D.1.
ρ 1 1− λ = η 2 ncx2hβ
1
1− (1− η2 (α+ n( xh 2 )
2β)) = ncx2hβ
1
α+ nx2hβ =
ncx2hβ
α+ nx2hβ
Claim D.2. ρ 1−λ n−1 1−λ + ρλ n−1 = ncx2hβ
α+nx2hβ (1− λn).
Proof Claim D.2.
ρ 1− λn−1
1− λ + ρλn−1 = ρ(
1− λn−1 + λn−1 − λn
1− λ ) = ρ(
1− λn
1− λ ) =
ncx2hβ
α+ nx2hβ (1− λn)
where the last equality holds from Claim D.1
Claim D.3. ρ( 1−λ n−1 1−λ ) + ρ̂λ n−1 = ncx2hβ α+nx2hβ (1− λn( 34λ −1 + 14 )).
Proof Claim D.3.
ρ( 1− λn−1
1− λ ) + ρ̂λn−1 = ρ(
1− λn−1
1− λ ) + ρ
1 4 λn−1 = ρ(
1− 34λ n−1 − 14λ n
1− λ ) =
ρ( 1− λn( 34λ −1 + 14 )
1− λ ) =
ncx2hβ
α+ nx2hβ (1− λn(3 4 λ−1 + 1 4 ))
where the last equality holds from Claim D.1.
Claim D.4. 14λ+ 3 4 − λ̂ = 3 4 η 2α.
Proof Claim D.4.
1 4 λ+ 3 4 − λ̂ = 1 4 (1− η 2 (α+ nx2β)) + 3 4 − (1− η 2 (α+ 1 4 nx2β)) = η 2 [α+ 1 4 nx2β − 1 4 (α+ nx2β)] = 3 4 η 2 α
Claim D.5.
(1− λkn)(1− λ̂λn−1)− (1− (λ̂λ(n−1)))k(1− λn−1(1 4 λ+ 3 4 )) = λn−1 3
4
η 2 α(1− λ̂kλk(n−1)) + λk(n−1)(λ̂k − λk)(1− λn−1λ̂).
Proof Claim D.5.
(1− λkn)(1− λ̂λn−1)− (1− (λ̂λ(n−1)))k(1− λn−1(1 4 λ+ 3 4 )) = λn−1( 1
4 λ+
3 4 − λ̂) + λkn(λ̂λn−1 − 1) + (λ̂λn−1)k(1− λn−1(1 4 λ+ 3 4 )) =
λn−1( 1
4 λ+
3 4 − λ̂) + λk(n−1)(λk(λ̂λn−1 − 1) + λ̂k(1− λn−1(1 4 λ+ 3 4 ))) =
λn−1( 1
4 λ+
3 4 − λ̂) + λk(n−1)(λ̂k(1− λn−1(1 4 λ+ 3 4 ))− λk(1− λ̂λn−1)) =
λn−1( 1
4 λ+
3 4 − λ̂) + λk(n−1)(λ̂k(1− λn−1(1 4 λ+ 3 4 ))− λk(1− λn−1λ̂)) =∗
λn−1 η
2
3 4 α+ λk(n−1)(λ̂k(1− λn−1(1 4 λ+ 3 4 ))− λk(1− λn−1λ̂)) =∗
λn−1 η
2
3 4 α+ λk(n−1)(λ̂k(1− λn−1(λ̂+ 3 4 η 2 α)− λk(1− λn−1λ̂)) =
λn−1 η
2
3 4 α− λ̂kλn−1 3 4 η 2 α+ λk(n−1)(λ̂k(1− λn−1λ̂)− λk(1− λn−1λ̂)) =
λn−1 3
4
η 2 α(1− λ̂kλk(n−1)) + λk(n−1)(λ̂k − λk)(1− λn−1λ̂)
where equality * holds from claim D.4
Claim D.6. λ ∑k−1 j=0 λ (n−1)jλj [λn−1ρ+ ρ ∑n−2 i=0 λ i] = λ(1− λkn) ncx 2 hβ
α+nx2hβ .
Proof Claim D.6.
λ k−1∑ j=0 λ(n−1)jλj [λn−1ρ+ ρ n−2∑ i=0 λi] = ρλ kn−1∑ i=0 λi = ρλ 1− λkn 1− λ =∗ λ ncx2hβ α+ nx2hβ (1− λkn)
Where equality * follows from claim D.1.
Claim D.7. λ̂ ∑k−1 j=0 λ (n−1)j λ̂j [λn−1ρ̂+ ρ ∑n−2 i=0 λ i] = λ̂ 1−(λ n−1λ̂)k 1−λn−1λ̂ ncx2hβ α+nx2hβ (1−λn( 34λ −1 + 14 )).
Proof Claim D.7.
λ̂ k−1∑ j=0 λ(n−1)j λ̂j [λn−1ρ̂+ ρ n−2∑ i=0 λi] =
λ̂ 1− (λn−1λ̂)k
1− λn−1λ̂ [λn−1ρ̂+ ρ
1− λn−1
1− λ ] =∗ λ̂
1− (λn−1λ̂)k 1− λn−1λ̂ ncx2hβ α+ nx2hβ (1− λn(3 4 λ−1 + 1 4 ))
Where equality * follows from claims D.1, D.3.
Claim D.8. λλk − λkλnλ̂− λ̂λ̂k + λ̂λ̂kλn( 34λ −1 + 14 ) = (1− λ̂λ n−1)(λk+1 − λ̂k+1) + λ̂k+1λn−1( 34 η 2α).
Proof Claim D.8.
λλk − λkλnλ̂− λ̂λ̂k + λ̂λ̂kλn(3 4 λ−1 + 1 4 ) = λk+1(1− λ̂λn−1)− λ̂k+1(1− λn−1(1 4 λ+ 3 4 )) =∗ λk+1(1− λ̂λn−1)− λ̂k+1(1− λn−1(λ̂+ 3 4 η 2 α)) = (1− λ̂λn−1)(λk+1 − λ̂k+1) + λ̂k+1λn−1(3 4 η 2 α)
where equality * holds from claim D.4.
Claim D.9. λ(1− λkn)(1− λn−1λ̂)− λ̂(1− (λn−1λ̂)k)(1− λn( 34λ −1 + 14 )) = (λ− λ̂)(1− λ̂λn−1) + λn−1λ̂[ 34 η 2α(1− λ̂ kλk(n−1))] + λk(n−1)[(1− λ̂λn−1)(λ̂k+1 − λk+1)].
Proof Claim D.9.
λ(1− λkn)(1− λn−1λ̂)− λ̂(1− (λn−1λ̂)k)(1− λn(3 4 λ−1 + 1 4 )) = λ− λ̂− λnλ̂(1− (3 4 λ−1 + 1 4 ))− λk(n−1)[λλk − λkλnλ̂− λ̂λ̂k + λ̂λ̂kλn(3 4 λ−1 + 1 4 )] =∗ λ− λ̂− λnλ̂(1− (3 4 λ−1 + 1 4 ))− λk(n−1)[(1− λ̂λn−1)(λk+1 − λ̂k+1) + λ̂k+1λn−1(3 4 η 2 α)] = λ− λ̂− λn−1λ̂(λ− (3 4 + 1 4 λ))− λk(n−1)[(1− λ̂λn−1)(λk+1 − λ̂k+1) + λ̂k+1λn−1(3 4 η 2 α)] =∗∗ λ− λ̂− λn−1λ̂(λ− (λ̂+ 3 4 η 2 α))− λk(n−1)[(1− λ̂λn−1)(λk+1 − λ̂k+1) + λ̂k+1λn−1(3 4 η 2 α)] = (λ− λ̂)(1− λ̂λn−1) + λn−1λ̂[ 3 4 η 2 α(1− λ̂kλk(n−1))] + λk(n−1)[(1− λ̂λn−1)(λ̂k+1 − λk+1)]
Where equality * follows from claim D.8 and equality ** follows from claim D.4.
Claim D.10.
λ(1− λkn)− λ̂1− (λ n−1λ̂)k
1− λn−1λ̂ (1− λn(3 4 λ−1 + 1 4 )) =
(λ− λ̂) + λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + λk(n−1)(λ̂k+1 − λk+1).
Proof Claim D.10.
λ(1− λkn)− λ̂1− (λ n−1λ̂)k
1− λn−1λ̂ (1− λn(3 4 λ−1 + 1 4 )) =[M5.d]
(λ− λ̂)(1− λ̂λn−1) + λn−1λ̂[ 34 η 2α(1− λ̂ kλk(n−1))] + λk(n−1)[(1− λ̂λn−1)(λ̂k+1 − λk+1)] (1− λ̂λn−1) =
(λ− λ̂) + λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + λk(n−1)(λ̂k+1 − λk+1)
Claim D.11. ncx 2 hβ α+nx2hβ (λ− λ̂+ λ n−1[ 34 η 2α(1−λ̂ kλk(n−1))] 1−λ̂λn−1 ) + (ρ− ρ̂) > 0.
Proof Claim D.11.
ncx2hβ
α+ nx2hβ (λ− λ̂+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) + (ρ− ρ̂) =
ncx2hβ
α+ nx2hβ (λ− λ̂+
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) +
η 2 ncx2hβ(1− 1 4 ) =
ncx2hβ
α+ nx2hβ (1− η 2 (α+ nx2β)− (1− η 2 (α+ 1 4 nx2β))+ λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) +
3
4
η 2 ncx2hβ =
ncx2hβ
α+ nx2hβ (−3 4 η 2 (nx2β) +
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 ) +
3
4
η 2 ncx2hβ =
ncx2hβ
α+ nx2hβ
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + ncx2hβ[
3
4
η 2 − 3 4 η 2
nx2β
α+ nx2β ] =
ncx2hβ
α+ nx2hβ
λn−1[ 34 η 2α(1− λ̂ kλk(n−1))]
1− λ̂λn−1 + ncx2hβ
3
4
η 2 [1− nx
2β
α+ nx2β ] > 0
where the last inequality holds because λ, λ̂ < 1 and α > 0
Claim D.12. 1α > λ −2η 1−λ
−2(k+1)n
1−λ−2 is true for k ≤ 1 2n logλ( 1 1+ 1αη (1−λ2) )− 1.
Proof Claim D.12.
1 α ≥ λ−2η 1− λ
−2k̇n
1− λ−2 ⇐⇒ λ2 1 α 1 η (1− λ−2) ≤ 1− λ−2k̇n ⇐⇒
λ2 1
α
1 η (λ−2 − 1) ≥ λ−2k̇n − 1 ⇐⇒ 1 + λ2 1 α 1 η (λ−2 − 1) ≥ λ−2k̇n ⇐⇒
− k̇ ≥ 1 2n logλ(1 + 1 αη (1− λ2)) ⇐⇒ k̇ ≤ 1 2n logλ(
1
1 + 1αη (1− λ2) )
Claim D.13. 1 α (λ̂λ (n−1))2k̇ > η ∑n−1 i=0 λ 2i ∑k̇−1 j=0 (λ̂ 2λ2(n−1))j is true for k̇ ≤ 12n logλ( 1
1+ 1αη (1−λ2) ).
Proof Claim D.13. First note that the inequality can also be written as 1 α > η ∑n−1 i=0 λ 2i ∑k−1 j=0 (λ̂λ (n−1))2(j−k).
Secondly, the right hand term of the inequality could be upper bound as in eq. 37. Therefore for the claim’s inequality to holds it is enough that 1α ≥ ηλ −2 1−λ−2nk 1−λ−2 , which proved by claim D.12 to be true for k̇ ≤ 12n logλ( 1
1+ 1αη (1−λ2) )
η n−1∑ i=0 λ2i k−1∑ j=0 (λ̂λ(n−1))2(j−k) = η n−1∑ i=0 λ2i k−1∑ j=0
1
(λ̂λ(n−1))2(k−j) <k>j
η n−1∑ i=0 λ2i k−1∑ j=0
1
(λλ(n−1))2(k−j) = η n−1∑ i=0 λ2i k−1∑ j=0
1
λ2n(k−j) =
η n−1∑ i=0 k−1∑ j=0
1
λ2[nk−nj−i] =r=nj+i η nk−1∑ r=0
1
λ2[nk−r] =r′=nk−r,1<r′<nk η nk∑ r′=1 1 λ2[r′] =
η nk∑ i=1 λ−2i = η λ−2 − λ−2(nk+1) 1− λ−2 = ηλ−2 1− λ−2nk 1− λ−2
(37)
Claim D.14. 1α (λ̂λ n−1)2k̇ ≥ η(λ̂λn−1)2k̇ ∑n−1 i=0 λ 2i is true for k̇ ≤ 12n logλ( 1
1+ 1αη (1−λ2) ).
Proof Claim D.14. eq. 38 holds because λ, λ̂ < 1. By multiplying both sides with ∑n−1 i=0 λ
2i get eq. 39. Then noticing that the right term equals to the right term of claim D.13, and hence smaller than the left term of the claim, the claim is proved.
(λ̂λn−1)2k < 1 < k−1∑ i=0 (λ̂λn−1)2j (38)
η(λ̂λn−1)2k̇ n−1∑ i=0 λ2i < η k̇−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i (39)
Claim D.15. The inequality
(λ̂λn−r)2[ 1
α (λ̂λn−1)2k + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] > η n−r∑ i=0 λ2i
holds for x2hβ > 3, n > 1 2αx2hβ − 1 x2hβ .
Proof Claim D.15. Left hand side can be lower bounded according to eq. 40, while right hand side can be upper bounded according to eq. 41. Therefore it’s enough to show that λ2n[ 1αλ 2kn + η 1−λ 2kn 1−λ2 ] > η 1−λ2n 1−λ2 , which according to eq. 42 is equivalent to showing that (2nx2hβ−1) 1αλ 2(k+1)n+2(2λ2n−1) > 0. Since n > 1 2αx2hβ − 1 x2hβ claim D.19 applies and therefore λ2n ≥ e − 2 x2 h β . Consequently it’s enough to show that (2nx2hβ−1) 1αλ 2(k+1)n+2(2e − 2 x2 h β −1) > 0, which is true for x2hβ > 3 by claim D.16.
(λ̂λn−r)2[ 1
α (λ̂λn−1)2k + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] >
(λ̂λn−1)2[ 1
α (λ̂λn−1)2k + η k−1∑ j=0 (λ̂λn−1)2j n−1∑ i=0 λ2i] >
λ2n[ 1
α λ2kn + η k−1∑ j=0 λ2jn n−1∑ i=0 λ2i] = λ2n[ 1 α λ2kn + η 1− λ2kn 1− λ2 ]
(40)
First inequality holds because λ < 1 and r > 1, and second inequality holds because λ < λ̂.
η n−r∑ i=0 λ2i < η n−1∑ i=0 λ2i = η 1− λ2n 1− λ2 (41)
Inequality holds because λ < λ̂ and r > 1.
λ2n[ 1
α λ2kn + η
1− λ2kn
1− λ2 ] > η
1− λ2n
1− λ2
λ2n(1− λ2) 1 α λ2kn + ηλ2n(1− λ2kn) > η(1− λ2n) (1− λ2) 1 α λ2(k+1)n + η(2λ2n − λ2(k+1)n − 1) > 0 (α+ nx2hβ) 2(1− λ2) 1
α λ2(k+1)n + 2(2λ2n − λ2(k+1)n − 1) > 0
(α+ nx2hβ) 2(1− (1− 1
α+ nx2hβ )2)
1 α λ2(k+1)n + 2(2λ2n − λ2(k+1)n − 1) > 0
(2(α+ nx2hβ)− 1) 1
α λ2(k+1)n + 2(2λ2n − λ2(k+1)n − 1) > 0
2λ2(k+1)n + (2nx2β − 1) 1 α λ2(k+1)n + 2(2λ2n − λ2(k+1)n − 1) > 0 (2nx2hβ − 1) 1
α λ2(k+1)n + 2(2λ2n − 1) > 0
(42)
Claim D.16. For x2β > 3 the inequality (2e− 2 x2β − 1) > 0 holds.
Proof Claim D.16. It’s easy to see that the inequality holds only if x2β ≥ −2 ln 12 . Since −2 ln 12 < 3 claim is proved.
Claim D.17. For k̇ as defined in lemma A.4, and the conditions of claim D.19
1 α (e
2
x2 h β + α
(e 2 x2 h β − 1)
(α+ nx2β) + 18 ) > λ−2η
1− λ−2(dk̇e+1)n
1− λ−2 .
Proof Claim D.17.
η 1− λ−2(dk̇e+1)n
λ2 − 1 ≤ ηλ −2(k̇+2)n − 1 1− λ2
= η λ −2( 12n logλ(
1
1+ 1 αη
(1−λ2) )−1+2)n
− 1 1− λ2 =
η λ − logλ( 11+ 1 αη (1−λ2) ) λ−2n − 1
1− λ2 = η
[1 + 1αη (1− λ 2)]λ−2n − 1
1− λ2 =
η (1− λ2)λ−2n 1αη
1− λ2 + η λ−2n − 1 1− λ2 = 1 α λ−2n + (λ−2n − 1) (α+ nx2β) + 18 ≤
e 2 x2β
1 α + 1 α α
(e 2 x2β − 1)
(α+ nx2β) + 18 =
1 α [e 2 x2β + α
(e 2 x2β − 1)
(α+ nx2β) + 18 ]
where the fourth equality holds from eq. 43 and the second inequality holds from D.19.
η
λ2 − 1 = η
1
(1− η2 (α+ nx2β))2 − 1 = η
1
η(α+ nx2β) + (η2 (α+ nx 2β))2
=
1
(α+ nx2β) + η4 (α+ nx 2β)2
= 1
(α+ nx2β) + 18
(43)
Claim D.18.
∀k > 0 : 1− (λ λ̂
)k ≥ 3 4nx 2β
(α+ nx2β)2 − (α+ 14nx2β) .
Proof Claim D.18.
1− (λ λ̂ )k ≥ 1− λ λ̂
= 1− 1− 1α+nx2β
1− α+ 1 4nx 2β
(α+nx2β)2
= 1− (α+ nx 2β)2 − (α+ nx2β)
(α+ nx2β)2 − (α+ 14nx2β) =
1− α 2 + 2nx2αβ + (nx2β)2 − α− nx2β
α2 + 2nx2αβ + (nx2β)2 − α− 14nx2β =
3 4nx 2β
(α+ nx2β)2 − (α+ 14nx2β)
Where first inequality holds because λ < λ̂.
Claim D.19. For the conditions of claim D.21,
(1− 1 α+ nx2β )2n ≥ e− 2 x2β .
Proof Claim D.19. The proof is easily deduced from claims D.20 and D.21
Claim D.20. lim n→∞ (1− 1 α+ nx2β )2n = e − 2 x2β .
Proof Lemma D.20. From eq. 44, it is enough to find limn→∞ ln(1− 1 α+nx2β )
1 2n
.
Since limn→∞ ln(1− 1 α+nx2β )
1 2n = 00 , and both the numerator and denominator are differentiable around∞, the use of L’Hôpital’s rule is possible as shown in eq. 45. This proves the claim.
(1− 1 α+ nx2β )2n = e ln[(1− 1 α+nx2β )2n] = e 2n ln(1− 1 α+nx2β ) = e
ln(1− 1 α+nx2β )
1 2n (44)
lim n→∞
d dn ln(1− 1 α+nx2β )
d dn 1 2n
= lim
x2β (α+nx2β−1)(α+nx2β)
− 12n2 = − lim 2n
2x2β
(nx2β)2 = − 2 x2β (45)
Claim D.21. ∀n > 1
2αx2β − 1 x2β : d dn (1− 1 α+ nx2β )2n < 0.
Proof claim D.21. First, a simplified term for the derivative is found at eq. 46. d
dn (1− 1 α+ nx2β )2n = d dn e 2n ln(1− 1 α+nx2β ) =
(1− 1 α+ nx2β )2n[2 ln(1− 1 α+ nx2β ) + 2n 1 1− 1α+nx2β · x
2β
(α+ nx2β)2 ] =
(1− 1 α+ nx2β )2n[2 ln(1− 1 α+ nx2β ) + 2nx2β (α+ nx2β − 1)(α+ nx2β) ]
(46)
A lower bound for the ln term can be found using Taylor’s theorem as shown in eq .47, where 0 ≤ ξ ≤ 1α+nx2β .
ln(1− 1 α+ nx2β ) = − 1 α+ nx2β − 1 2
1
(1− ξ)2 (
1
α+ nx2β )2 ≤
− 1 α+ nx2β − 1 2 ( 1 α+ nx2β )2
(47)
From equations 46 and 47 it is enough to find the terms for which nx 2β
(α+nx2β−1)(α+nx2β) < 1
α+nx2β + 1 2 1 (α+nx2β)2 holds. A simplified version of this inequality is found at (48), and it can be easily seen that for α > 12 ( 1 nx2β + 1) ⇐⇒ n > 1 2αx2β − 1 x2β this inequality holds.
nx2β
(α+ nx2β − 1)(α+ nx2β) <
1
α+ nx2β +
1
2
1
(α+ nx2β)2 ⇐⇒
0 < 2α2 + 2nx2βα− 2α− 2nx2β + α+ nx2β − 1 ⇐⇒ 0 < nx2β(2α− 1) + α(2α− 1)− 1
(48)
Claim D.22. For n > α x2hβ
(e 2 x2 h β − 2) + 1
2x2hβ and the conditions of claim D.19, k̇, as defined in
lemma A.4, is positive.
Proof Claim D.22. The claim’s inequality is simplified at eq. 49
k̇ > 0
1
2n logλ(
1
1 + 1αη (1− λ2) )− 1 > 0
logλ( 1
1 + 1αη (1− λ2) ) > 2n
ln( 1 1+ 1αη (1−λ2) )
lnλ > 2n
ln( 1
1 + 1αη (1− λ2) ) < 2n lnλ
ln( 1
1 + 1αη (1− λ2) ) < lnλ2n
1
1 + 1αη (1− λ2) ) < λ2n
λ−2n < 1 + 1
αη (1− λ2)
λ−2n − 1 < 1 αη (1− λ2)
(49)
By claim D.19 λ−2n−1 < e 2 x2 h β −1, therefore it is enough to find terms for e 2
x2 h β −1 < 1αη (1−λ 2), which is done at eq. 50, which proves the claim.
e 2 x2 h β − 1 < 1
αη (1− λ2)
αη(e 2 x2 h β − 1) < (1− λ2)
αη(e 2 x2 h β − 1) < 1− (1− η
2 (α+ nx2hβ)) 2
α(e 2
x2 h β − 1) < (α+ nx2hβ)−
η 4 (α+ nx2β)2
α(e 2
x2 h β − 1) < (α+ nx2hβ)−
1
2
α(e 2 x2 h β − 2) + 1
2 < nx2hβ
α
x2hβ (e
2
x2 h β − 2) + 1
2x2hβ < n
(50)
Claim D.23. For k̇ as defined in lemma A.4, and the conditions of lemma A.5
p(θ̂(dk̇e+1)n > µ(dk̇e+1)n|D̂) ≤ e −e − 2 x2β α 2v1 ( 3 32x2β )2( cn ) 2 .
Proof claim D.23.
p(θ̂(dk̇e+1)n > µ(dk̇e+1)n|D̂) ≤
1
n n∑ r=1 exp(− (µ(dk̇e+1)n − µ̂r(dk̇e+1)n) 2 2(σr (dk̇e+1)n) 2 ) ≤
1
n n∑ r=1 exp(−e− 2 x2β α 2v1 ( 3 32x2β )2( c n )2) =
exp(−e− 2 x2β
α
2v1 (
3
32x2β )2(
c n )2)
Where the first inequality holds due to lemma 4.4 and second inequality holds due to lemma A.5.
Claim D.24. for n > 1 + 10x 2 h
x2l
ν β , the inequality 1 10 (α+ (z + x 2 n)β) > ν(x̂ 2 n − x2n) holds.
Proof Claim D.24. Notice that 110 (α+(z+x 2 n)β) > 1 10zβ > 1 10 (n−1)x 2 l β and νx 2 h > ν(x̂ 2 n−x2n), Therefore a sufficient condition will be that 110 (n − 1)x 2 l β > νx 2 h, which is equivalent to n > 1 + x2h x2l 10ν β .
Claim D.25. For the (σ2)∗ν as defined in eq. 14 (σ2)∗ν > 0.
Proof Claim D.25.
(σ2)∗ν = νσ 2 + (1− ν)σ̂2 = ν
α+ (z + x2n)β + 1− ν α+ (z + x̂2n)β =
ν(α+ (z + x̂2n)β) + (1− ν)(α+ (z + x2n)β) (α+ (z + x2n)β)(α+ (z + x̂ 2 n)β) = α+ (z + x2n)β + ν(x 2 n − x̂2n) (α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
(51)
Therefore, a sufficient condition is that α + (z + x2n)β + ν(x 2 n − x̂2n) > 0. Since the condition of Lemma 4.2 dictates n > 1 + 10x 2 h
x2l
ν β then claim D.24 holds, which satisfy this condition.
Claim D.26. For the Bayesian linear regression problem on domain D, and σ, σ̂ defined in eq. 14
ln σ σ̂ ≤ x
2 h
2(n− 1)x2l .
Proof Claim D.26. Consider c1 = x2h
(n−1)x2l ,
c1 = x2h (n− 1)x2l > x̂2n − x2n z + x2n > x̂2nβ − x2nβ α+ (z + x2n)β = α+ (z + x̂2n)β α+ (z + x2n)β − 1 (52)
Where eq. 52 holds trivially for x̂n ≤ xn, therefore it is assumed that x̂n > xn. From eq. 52, by Taylor theorem and 0 ≤ ζ ≤ c1 following inequality holds
ec1 = 1 + c1 + eζ
2 (c1)
2 > 1 + c1 > α+ (z + x̂2n)β
α+ (z + x2n)β
Consequently, because the natural logarithm is monotonically increasing the following equation also holds
1 2 c1 > 1 2 ln α+ (z + x̂n)β α+ (z + xn)β = ln σ σ̂
Therefore ln σσ̂ < 1 2 x2h (n−1)x2l
Claim D.27. For the Bayesian linear regression problem on domain D, the conditions of Lemma 4.2 and (σ2)∗ν , σ̂ defined in eq. 14
1 2 (ν − 1) ln σ̂
2
(σ2)∗ν ≤ 1 2 (ν − 1) νx
2 h
2((n− 1)x2l − νx2h) .
Proof Claim D.27. consider c1 = νx2h
((n−1)x2l−νx 2 h)
,
c1 = νx2h (n− 1)x2l − νx2h ≥∗ νβx 2 h α+ (n− 1)x2l β − νβx2h ≥∗ νβx̂2n α+ (z + x2n)β − νβx2n ≥ νβ(x̂ 2 n − x2n) α+ (z + x2n)β − νβ(x2n − x̂2n) =
α+ (z + x2n)β
α+ (z + x2n)β + νβ(x 2 n − x̂2n)
− 1 =
1 α+ (z + x̂2n)β · (α+ (z + x
2 n)β)(α+ (z + x̂ 2 n)β)
α+ (z + x2n)β + νβ(x 2 n − x̂2n)
− 1 =
σ̂2
(σ2)∗ν − 1
Where inequalities * holds under assumption that n > 1 + ν x 2 h
x2l , and last equality holds from eq. 51.
Therefore, by using Taylor theorem and 0 ≤ ζ ≤ c1 following inequality holds
ec1 = 1 + c1 + eζ
2 (c1)
2 > 1 + c1 ≥ σ̂2
(σ2)∗ν
From this inequality, and because the natural logarithm is monotonically increasing ln σ̂ 2
(σ2)∗ν ≤ c1,
therefore 1
2 (ν − 1) ln σ̂
2
(σ2)∗ν ≤ 1 2 (ν − 1)c1 = 1 2 (ν − 1) νx
2 h
((n− 1)x2l − νx2h) .
Claim D.28. For the Bayesian linear regression problem on domain D, the definitions of eq. 14, and the conditions of Lemma 4.2, the value ν2 (µ−µ̂)2 (σ2)∗ν is bounded by
2νβ( x4h
9 10n 1−2γ1x2l ) + 2νβ(
(x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 ) (c+ nγ1) n2−γ1 + ν 2 ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
) (c+ nγ1)2
n3 .
Proof Claim D.28. First bound |µ− µ̂|,
|µ− µ̂| = β| q + xnyn α+ (z + x2n)β − q + x̂nŷn α+ (z + x̂2n)β | = | (q + xnyn)(α+ (z + x̂ 2 n)β)− (q + x̂nŷn)(α+ (z + x2n)β)
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
| =
β|qx̂ 2 nβ + xnynα+ xnynzβ + xnynx̂ 2 nβ − qx2nβ − x̂nŷnα− x̂nŷnzβ − x̂nŷnx2nβ
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
| =
β| x̂2nz( q z − ŷn x̂n )β − x2nz( q z − yn xn )β + α(xnyn − x̂nŷn) + xnx̂nβ(ynx̂n − ŷnxn) (α+ (z + x2n)β)(α+ (z + x̂ 2 n)β) | < β| x̂ 2 hz(2n γ1)β + αx2h(c+ n γ1) + x4hβ(c+ n γ1)
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
| =
β|2x̂ 2 hβzn γ1 + (x2hα+ x 4 hβ)(c+ n γ1)
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
|
Therefore,
ν
2
(µ− µ̂)2
(σ2)∗ν ≤
ν 2 β2(
2x̂2hβzn γ1 + (x2hα+ x 4 hβ)(c+ n γ1)
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
)2 · ( α+ (z + x 2 n)β + ν(x 2 n − x̂2n)
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)
)−1 =
ν
2
β2(2x̂2hβzn γ1 + (x2hα+ x 4 hβ)(c+ n γ1))2
(α+ (z + x2n)β)(α+ (z + x̂ 2 n)β)(α+ (z + x 2 n)β + ν(x 2 n − x̂2n))
≤∗
ν
2
β2(2x2hβzn γ1 + (x2hα+ x 4 hβ)(c+ n γ1))2
9 10 (α+ (z + x 2 n)β)(α+ (z + x̂ 2 n)β)(α+ (z + x 2 n)β)
=
ν 2 β2(
(2x2hβ) 2z2n2γ1 + 2(2x2hβ)(x 2 hα+ x 4 hβ)zn γ1(c+ nγ1) + (x2hα+ x 4 hβ) 2(c+ nγ1)2
9 10 (α+ (z + x 2 n)β) 2(α+ (z + x̂2n)β) ) ≤
ν 2 β2(
(2x2hβ) 2z2n2γ1 + (4x2hβ)(x 2 hα+ x 4 hβ)zn γ1(c+ nγ1) + (x2hα+ x 4 hβ) 2(c+ nγ1)2
9 10 ((z + x 2 n)β) 2((z + x̂2n)β) ) ≤∗∗
ν 2 β2(
(2x2hβ) 2n2γ1
9 10nx 2 l β
3 )+
ν 2 β2(
(4x2hβ)(x 2 hα+ x 4 hβ)n γ1(c+ nγ1) 9 10 (nx 2 l ) 2β3 ) + ν 2 β2( (x2hα+ x 4 hβ) 2(c+ nγ1)2 9 10 (nx 2 l β) 3 ) =
2νβ( x4h
9 10n 1−2γ1x2l ) + 2νβ(
(x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 ) (c+ nγ1) n2−γ1 + ν 2 ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
) (c+ nγ1)2
n3
Inequality * is true because Lemma 4.2 conditions dictates that n > 1 + x 2 h
x2l
10ν β , and according
to claim D.24 this promises that 110 (α + (z + x 2 n)β) > ν(x̂ 2 n − x2n). Inequality ** follows from n >> 1⇒ (n− 1)xl ≈ nxl.
Claim D.29. For the conditions and definitions of Lemma 4.3, one sample from the posterior is ( , δ) differentially private for the following terms on n and ν.
ν = 1 + 2 ln( 1δ )
n ≥ max{1 + x 2 h
x2l
8
, 1 + ν x2h x2l (1 + 8 (ν − 1) ),
( 16νβx4h
9 10 x 2 l
) 1 1−2γ1 ,
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(c+ nγ1))
1 2−γ1 ,
( 4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(c+ nγ1)) 2 3 }
Proof Claim D.29. By Lemma 4.3, one sample from the posterior is ( 1 + ln( 1δ )
ν−1 , δ) differentially
private. For each of the 6 terms of 1 + ln( 1δ )
ν−1 , a lower bound on n and ν is found at equations 53, 54, 55, 56, 57, 58 such that the sum of terms is upper bounded by . These bounds match the claim’s guarantee over n and ν therefore proving the claim.
For term ln( 1 δ )
ν−1
ln( 1δ ) ν − 1 = 2 ⇐⇒
2 ln( 1δ )
+ 1 = ν
(53)
For term x 2 h
(n−1)x2l
x2h 2(n− 1)x2l ≤ 16 n ≥ 1 + x 2 h
x2l
8
(54)
For term 12 (ν − 1) νx2h
(n−1)x2l−νx 2 h
1 2 (ν − 1) νx
2 h
(n− 1)x2l − νx2h ≤ 16
1 2 (ν − 1)16νx
2 h
≤ (n− 1)x2l − νx2h
n ≥ 1 + 1 2 (ν − 1)16νx 2 h
x2l + ν x2h x2l = 1 + ν x2h x2l (1 + 8 (ν − 1) )
(55)
For term 2νβ( x 4 h
9 10n 1−2γ1x2l )
2νβ( x4h
9 10n 1−2γ1x2l ) ≤ 8
16
νβ x4h 9 10x 2 l ≤ n1−2γ1
n ≥ (16νβx 4 h
9 10 x 2 l
) 1 1−2γ1
(56)
For term 2νβ( (x 2 hβ)(x 2 hα+x 4 hβ)
9 10 (x 2 l β)
2 ) (c+nγ1 ) n2−γ1
2νβ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 ) (c+ nγ1) n2−γ1 ≤ 8
n2−γ1 ≥ 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(c+ nγ1)
n ≥ (16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(c+ nγ1))
1 2−γ1
(57)
For term ν2 ( (x2hα+x 4 hβ) 2
9 10x 6 l β
) (c+n γ1 )2
n3
ν 2 ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
) (c+ nγ1)2
n3 ≤ 8
n3 ≥ 4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(c+ nγ1)2
n ≥ (4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(c+ nγ1)) 2 3
(58)
Claim D.30. For c = nγ2 , γ1 < γ2 < 32 , and the conditions and definitions of Lemma 4.3, one sample from the posterior is ( , δ) differentially private for following terms on n and ν.
ν = 2 ln( 1δ ) + 1
n ≥ max{1 + x 2 h
x2l
8
, 1 + ν x2h x2l (1 + 8 (ν − 1) ),
( 16νβx4h
9 10 x 2 l
) 1 1−2γ1 ,
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(1 +
1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 1 2−γ1−γ2 ,
( 4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(1 + 1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 2 3−2γ2 }
Proof Claim D.30. Claim D.29 provides general lower bounds on n for ( , δ) differential privacy. When c = nγ2 , γ2 > γ1, these bounds can be simplified.
For condition n ≥ ( 16νβ ( (x2hβ)(x 2 hα+x 4 hβ)
9 10 (x 2 l β)
2 )(c+ n γ1))
1 2−γ1 ,
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(c+ nγ1))
1 2−γ1 =
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )nγ2(1 +
1
nγ2−γ1 ))
1 2−γ1 ≤
( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )nγ2(1 +
1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 1 2−γ1
, where the inequality holds since Lemma 4.3 dictates that n ≥ 1 + 10x 2 h
x2l
ν β . Consequently it’s
enough that
n > ( 16νβ ( (x2hβ)(x 2 hα+ x 4 hβ)
9 10 (x 2 l β)
2 )(1 +
1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 1 2−γ1−γ2 .
Following same considerations for condition n ≥ ( 4ν ( (x2hα+x 4 hβ) 2
9 10x 6 l β
)(c+ nγ1)) 2 3 , it is enough that
n > ( 4ν ( (x2hα+ x 4 hβ) 2
9 10x 6 l β
)(1 + 1
(1 + 10 x2h x2l ν β ) γ2−γ1
)) 2 3−2γ2
E WASSERSTEIN DISTANCE PROOF
Claim E.1. If p, q are distributions with 2-Wasserstein distance W2(p, q) = 2, then we have p(Br(x)) ≤ q(Br+ (x)) + .
Proof. If is the claim that d2P ≤ dw from Gibbs & Su (2002). Picking an optimal coupling and using Markov inequality we get P (d(x, y) > ) ≤ 1 E[d(x, y)] = . As {(x̃, ỹ) : x̃ ∈ Br(x)} ⊂ {(x̃, ỹ) : ỹ ∈ Br+ (y)}∪{(x̃, ỹ) : d(x̃, ỹ) > } we get p(Br(x)) ≤ q(Br+ (x)) + (special case of Strassen theorem).
Claim E.2. Let p, q be continuous distributions on Rd with Wasserstein distance W2(p, q) < 2, and let pδ ,qδ be their convolutions with uniform distribution on Bδ(0). We assume both density functions are L−Lipshitz continuous. For λ > we have
pλ(x) ≤ vold(λ)
vold(λ− ) qλ(x) + vold(λ− ) + 2
( vold(λ) vold(λ− ) − 1 ) λL. (59)
Proof. We have P (Bλ(x)) = P (Bλ− (x)) + P (A(x;λ − , λ)) where A(x; r1, r2) is the annulus around x between radius r1 and r2. From continuity there exists z ∈ P (Bλ(x)) such that p(z) = P (Bλ(x)) vold(λ) , where vold(r) is the volume of a ball of radius r in Rd. From Lipshitz continuity we have
P (A(x;λ − , λ)) ≤ (vold(λ) − vold(λ − ))(p(z) + 2λL) = ( 1− vold(λ− )vold(λ) ) P (Bλ(x)) + ∆, where ∆ = (vold(λ)− vold(λ− ))2λL. From this, we get
P (Bλ− (x)) ≥ vold(λ− ) vold(λ) P (Bλ(x))−∆. (60)
Combining this with claim E.1, we get
P (Bλ(x)) ≤ vold(λ)
vold(λ− ) (P (Bλ− (x)) + ∆) ≤
vold(λ)
vold(λ− ) (Q(Bλ(x)) + ∆ + ). (61)
We divide by vold(λ) to get the densities pλ, qλ.
pλ(x) ≤ vold(λ)
vold(λ− ) qλ(x) +
∆ +
vold(λ− ) (62)

Review summaries:
This paper shows that even when the posterior is as private as targeted in the beginning, sampling from posterior with SGLS might not be as private as targeted. The authors prove the theorem on Bayesian linear regression problem. They prove that for n big enough sampling from the posterior is (\epsilon, \delta) differentially private (DP), but there is a step in which releasing a sample will not be (\epsilon^\prime, \delta)-DP for \epsilon^\prime=\omega(n \epsilon).

This paper studies the privacy guarantee of Bayesian learning using Stochastic Gradient Langevin Dynamics (SGLD). Since the SGLD updates are stochastic, it is often thought the solution can be suitable for privacy-preserving of the data that is used to train the algorithm. Using a counter-example, this paper shows that it is not necessarily correct to assume so.