Differential Privacy of Dirichlet Posterior Sampling
Year: 2021

Abstract:
We study the inherent privacy of releasing a single sample from a Dirichlet posterior 1 distribution. As a complement to the previous study that provides general theories 2 on the differential privacy of posterior sampling from exponential families, this 3 study focuses specifically on the Dirichlet posterior sampling and its privacy 4 guarantees. With the notion of truncated concentrated differential privacy (tCDP), 5 we are able to derive a simple privacy guarantee of the Dirichlet posterior sampling, 6 which effectively allows us to analyze its utility in various settings. Specifically, 7 we provide accuracy guarantees of the Dirichlet posterior sampling in Multinomial8 Dirichlet sampling and private normalized histogram publishing. 9

We study the inherent privacy of releasing a single sample from a Dirichlet posterior1 distribution. As a complement to the previous study that provides general theories2 on the differential privacy of posterior sampling from exponential families, this3 study focuses specifically on the Dirichlet posterior sampling and its privacy4 guarantees. With the notion of truncated concentrated differential privacy (tCDP),5 we are able to derive a simple privacy guarantee of the Dirichlet posterior sampling,6 which effectively allows us to analyze its utility in various settings. Specifically,7 we provide accuracy guarantees of the Dirichlet posterior sampling in Multinomial-8 Dirichlet sampling and private normalized histogram publishing.9
1 Introduction10
The Bayesian framework provides a way to perform statistical analysis by combining prior beliefs11 with real-life evidence. At a high level, the belief and the evidence are assumed to be described12 by probabilistic models. As we receive new data, our belief is updated accordingly via the Bayes’13 theorem, resulting in the so-called posterior belief. The posterior tells us how much we are uncertain14 about the model’s parameters.15
The Dirichlet distribution is usually chosen as the prior when performing Bayesian analysis on discrete16 variables, as it is a conjugate prior to the categorical and multinomial distributions. Specifically,17 Dirichlet distributions are often used in discrete mixture models, where a Dirichlet prior is put on18 the mixture weights [LW92; MMR05]. Such models have applications in NLP [PB98], biophysical19 systems [Hin15], accident analysis [de 06], and genetics [BHW00; PM01; CWS03]. In all of these20 studies, samplings from Dirichlet posteriors arise when performing Markov chain Monte Carlo21 methods for approximate Bayesian inference.22
Dirichlet posterior sampling also appears in other learning tasks. For example, in Bayesian active23 learning, it arises in Gibbs sampling, which is used to approximate the posterior of the classifier over24 the labeled sample [NLYCC13]. In Thompson sampling for multi-armed bandits, one repeatedly25 draws a sample from the Dirichlet posterior of each arm, and picks the arm whose sample maximizes26 the reward [ZHGSY20; AAFK20; NIK20]. And in Bayesian reinforcement learning, state-transition27 probabilities are sampled from the Dirichlet posterior over past observed states [Str00; ORR13].28
Dirichlet posterior sampling can also be used for data synthesis. Suppose that we have a histogram29 (x1, . . . , xd) of actual data. An approximate discrete distribution of this histogram can be obtained by30 drawing a sample Y from Dirichlet(x1 + α1, . . . , xd + αd), where α1, . . . , αd are prior parameters.31 Then synthetic data is produced by repeatedly drawing from Multinomial(Y). There are many32 studies on data synthesis that followed this approach [AV08; MKAGV08; RWZ14; PG14; SJGLY17].33
Submitted to 35th Conference on Neural Information Processing Systems (NeurIPS 2021). Do not distribute.
In the above examples, the data that we integrate into these tasks might contain sensitive information.34 Thus it is important to ask: how much of the information is protected from the Dirichlet samplings?35 The goal of this study is to find an answer to this question.36
The mathematical framework of differential privacy (DP) [DMNS06] allows us to quantify how much37 the privacy of the Dirichlet posterior sampling is affected by the prior parameters α1, . . . , αd. In the38 definition of DP, the privacy of a randomized algorithm is measured by how much its distribution39 changes upon perturbing a single data point of the input. Nonetheless, this notion might be too40 strict for the Dirichlet distribution, as a small perturbation of a near-zero parameter can cause a large41 distribution shift. Thus, it might be more appropriate to rely on one of several relaxed notions of42 DP, such as approximate differential privacy, Rényi differential privacy, or concentrated differential43 privacy. It is natural to wonder if the Dirichlet posterior sampling satisfies any of these definitions.44
1.1 Overview of Our results45
This study focuses on the privacy and utility of Dirichlet posterior sampling. In summary, we provide46 a closed-form privacy guarantee of the Dirichlet posterior sampling, which in turn allows us to47 effectively analyze its utility in various settings.48
§3 Privacy. We study the role of the prior parameters in the privacy of the Dirichlet posterior49 sampling. Theorem 1 is our main result, where we provide a guaranteed upper bound for truncated50 concentrated differential privacy (tCDP) of the Dirichlet posterior sampling. In addition, we convert51 the tCDP guarantee into an approximate differential privacy guarantee in Corollary 2.52 §4 Utility. Using the tCDP guarantee, we investigate the utility of Dirichlet posterior sampling53 applied in two specific applications:54
• In Section 4.1, we consider one-time sampling from a Multinomial-Dirichlet distribution.55 But instead of directly sampling from this distribution, we sample from another distribution56 with larger prior parameters. The accuracy is then measured by the KL-divergence between57 the original and the private distributions.58
• In Section 4.2, we use the Dirichlet posterior sampling for a private release of a normalized59 histogram. In this case, the accuracy is measured by the mean-squared error between the60 sample and the original normalized histogram.61
In both tasks, we compute the sample size that guarantees the desired level of accuracy. In the case62 of private histogram publishing, we also compare the Dirichlet posterior sampling to the Gaussian63 mechanism.64
1.2 Related work65
There are several studies on the differential privacy of posterior sampling. Wang, Fienberg, and66 Smola [WFS15] showed that any posterior sampling with the log-likelihood bounded by B is 4B-67 differentially private. However, the likelihoods that we study are not bounded away from zero; they68 have the form ∏ i p xi i which becomes small when one of the pi’s is close to zero. Dimitrakakis, Nelson,69 Zhang, Mitrokotsa, and Rubinstein [DNZMR17] showed that if the condition on the log-likelihood is70 relaxed to the Lipschitz continuity with high probability, then one can obtain the approximate DP.71 Nonetheless, with the Dirichlet density, it is difficult to compute the probability of events in which72 the Lipschitz condition is satisfied.73
In the case that the sufficient statistics x has finite `1-sensitivity, Foulds, Geumlek, Welling and74 Chaudhuri [FGWC16] suggested adding Laplace noises to x. Suppose that y is the output; they75 showed that sampling from p(θ|y) is differentially private and as asymptotically efficient as sampling76 from p(θ|x). However, for a small sample size, the posterior over the noisy statistics might be too77 far away from the actual posterior. Bernstein and Sheldon [BS18] thus proposed to approximate the78 joint distribution p(θ,x,y) using Gibbs sampling, which is then integrated over x to obtain a more79 accurate posterior over y.80
Geumlek, Song, and Chaudhuri [GSC17] were the first to study the posterior sampling with the81 RDP. Even though they provided a general framework to find (λ, )-RDP guarantees for exponential82 families, explicit forms of and the upper bound of λwere not given. In contrast, our tCDP guarantees83 of the Dirichlet posterior sampling imply an explicit expression for , and also an upper bound for λ.84
The privacy of data synthesis via sampling from Multinomial(Y), where Y is a discrete distri-85 bution drawn from the Dirichlet posterior, was first studied by Machanavajjhala, Kifer, Abowd,86 Gehrke, and Vilhuber [MKAGV08]. They showed that the data synthesis is (ε,δ)-probabilistic DP,87 which implies (ε,δ)-approximate DP. However, as their privacy analysis includes the sampling from88 Multinomial(Y), their privacy guarantee depends on the number of synthetic samples. In contrast,89 we show that the one-time sampling from the Dirichlet posterior is approximate DP, which by the90 post-processing property allows us to sample from Multinomial(Y) as many times as we want while91 retaining the same privacy guarantee.92
The Dirichlet mechanism was first introduced by Gohari, Wu, Hawkins, Hale, and Topcu [GWHHT21].93 Originally, the Dirichlet mechanism takes a discrete distribution p := (p1, . . . , pd) and draws one94 sample Y ∼ Dirichlet(rp1, . . . , rpd). Note the absence of the prior parameters, which makes Y an95 unbiased estimator of p. But this comes with a cost, as the worst case of privacy violation occurs96 when almost all of the parameters are close to zero. The authors avoided this issue by restricting97 the input space to a subset of the unit simplex, with some of the pi’s bounded below by a fixed98 positive constant. This results in complicated expressions for the privacy guarantees as they involve99 a minimization problem over the restricted domain. In this study, we take a different approach by100 adding prior parameters to the Dirichlet mechanism. As a result, we obtain a biased algorithm that101 requires no assumption on the input space and has simpler forms of privacy guarantees.102
1.3 Notations103
We let Rd≥0 be the set of d-tuples of non-negative real numbers and Rd>0 be the set of d-tuples of104 positive real numbers. We assume that all vectors are d-dimensional where d ≥ 2. The notations for105 all vectors are always in bold. Specifically, x := (x1, . . . , xd) ∈ Rd≥0 consists of sample statistics of106 the data and α := (α1, . . . , αd) ∈ Rd>0 consists of the prior parameters. The vector p := (p1, . . . , pd)107 always satisfies ∑ i pi = 1. The number of observations is always N . We also denote x0 := ∑ i xi108
and α0 := ∑ i αi. For any vectors x,x ′ and scalar r > 0, we write x+x′ := (x1 +x′1, . . . , xd +x ′ d)109 and rx := (rx1, . . . , rxd). For any positive reals x and x′, the notation x ∝ x′ means x = Cx′ for110 some constant C > 0, x ≈ x′ means cx′ ≤ x ≤ Cx′ for some c, C > 0, and x . x′ means x ≤ Cx′111 for some C > 0. Lastly, ‖x‖∞ := maxi|xi| is the `∞ norm of x.112
2 Background113
2.1 Privacy models114
Definition 2.1 (Pure and Approximate DP [DMNS06]). A randomized mechanism M : Xn → Y115 is (ε, δ)-differentially private ((ε, δ)-DP) if for any datasets x, x′ differing on a single entry, and all116 events E ⊂ Y ,117 P[M(x) ∈ E] ≤ eεP[M(x′) ∈ E] + δ. If M is (ε, 0)-DP, then we say that it is ε-differential privacy (ε-DP).118
The term pure differential privacy (pure DP) refers to -differential privacy, while approximate119 differential privacy (approximate DP) refers to (ε, δ)-DP when δ > 0.120
In contrast to pure and approximate DP, the next definitions of differential privacy are defined in121 terms of the Rényi divergence between M(x) and M(x′):122 Definition 2.2 (Rényi Divergence [Rén61]). Let P andQ be probability distributions. For λ ∈ (1,∞)123 the Rényi divergence of order λ between P and Q is defined as124
Dλ(P‖Q) := 1
λ− 1 log
∫ P (y)λQ(y)1−λ dy = 1
λ− 1 log ( E y∼P [ P (y)λ−1 Q(y)λ−1 ] . )
Definition 2.3 (tCDP and zCDP [BDRS18; BS16]). A randomized mechanism M : Xn → Y is125 ω-truncated ρ-concentrated differentially private ((ρ, ω)-tCDP) if for any datasets x, x′ differing on a126 single entry and for all λ ∈ (1, ω),127
Dλ(M(x)‖M(x′)) ≤ λρ. If M is (ρ,∞)-tCDP, then we say that it is ρ-zero-concentrated differential privacy (ρ-zCDP).128
Note that both tCDP and zCDP have the composition and post-processing properties. Intuitively, ρ con-129 trols the expectation and standard deviation of the privacy loss random variable: Z = log P [M(x)=Y ]P [M(x′)=Y ] ,130 where Y has density M(x), and ω controls the number of standard deviations for which Z concen-131 trates like a Gaussian. A smaller ρ and larger ω correspond to a stronger privacy guarantee. It turns132 out that tCDP implies approximate DP:133 Lemma 1 (From tCDP to Approximate DP [BDRS18]). Let δ > 0. IfM is a (ρ, ω)-tCDP mechanism,134 then it also satisfies (ε, δ)-DP with135
ε =
{ ρ+ 2 √ ρ log(1/δ) if log(1/δ) ≤ (ω − 1)2ρ
ρω + log(1/δ)ω−1 if log(1/δ) > (ω − 1) 2ρ .
2.2 Dirichlet distribution136
For α ∈ Rd>0, the Dirichlet distribution Dirichlet(α) is a continuous distribution of d-dimensional137 probability vectors i.e. vectors whose coordinate sum is equal to 1. The density function of Y ∼138 Dirichlet(α) is given by:139
p(y) = 1
B(α) d∏ i=1 yαi−1i ,
where B(α) is the beta function, which can be written in terms of the gamma function:140
B(α) =
∏ i Γ(αi)
Γ( ∑ i αi) . (1)
2.3 Dirichlet posterior sampling141
We consider the prior Dirichlet(α) and the likelihood of the form p(x|y) ∝ ∏d i=1 y xi i where142 x ∈ Rd≥0 consists of sample statistics of the dataset. The Dirichlet posterior sampling is a one-time143 sampling:144 Y ∼ Dirichlet(x + α). There is a modification of the sampling which introduces a concentration parameter r > 0, and145 instead we sample from Dirichlet(rx + α) [GSC17; GWHHT21]. Smaller values of r make the146 sampling more private, and larger values of r make Y a closer approximation of x. Even though the147 case r = 1 is the main focus of this study, our main privacy results can be easily extended to other148 values of r as we will see at the end of Section 3.1.149
Consider a special case where x = p is an empirical distribution derived from the dataset, and we150 want Y to be a private approximation of p; the sampling Y ∼ Dirichlet(rp + α) is called the151 Dirichlet mechanism [GWHHT21]. It is interesting to note that the Dirichlet mechanism is a form of152 the exponential mechanism [MT07]: let r > 0 be the privacy parameter, Dirichlet(α) be the prior,153 and the negative KL-divergence be the score function of the exponential mechanism. Then the output154 Y of this mechanism is distributed according to the following density function:155
exp(−rDKL(p,y)) ∏ i y αi−1 i∫
exp(−rDKL(p,y)) ∏ i y αi−1 i dy ∝ exp r ∑ i,pi 6=0 pi log(yi/pi) ∏ i yαi−1i
∝ ∏ i,pi 6=0 yrpii ∏ i yαi−1i = ∏ i yrpi+αi−1i ,
which is exactly the density function of Dirichlet(rp + α).156
2.4 Polygamma functions157
In most of this study, we take advantage of several nice properties of the log-gamma function and its158 derivatives. Specifically, ψ(x) := ddx log Γ(x) is concave and increasing, while its derivative ψ
′(x) is159 positive, convex, and decreasing. In addition, ψ′ can be approximated by the reciprocals:160
1 x + 1 2x2 < ψ′(x) < 1 x + 1 x2 ,
which implies that ψ′(x) ≈ 1x2 as x→ 0 and ψ ′(x) ≈ 1x as x→∞.161
3 Main privacy results162
3.1 Truncated concentrated differential privacy163
Theorem 1. Let α ∈ Rd>0 and αm := mini αi. Let γ ∈ (0, αm). Let ∆2,∆∞ > 0 be constants that164 satisfy ∑ i(xi − x′i)2 ≤ ∆22 and maxi |xi − x′i| ≤ ∆∞ whenever x,x′ ∈ R2≥0 are sample statistics165 of any two datasets differing on a single entry. The one-time sampling from Dirichlet(x + α) is166 (ρ, ω)-tCDP, where ω = γ∆∞ + 1 and167
ρ = 1
2 ∆22ψ ′(αm − γ). (2)
Note that (ρ,∞)-tCDP is not obtainable, as the ratio between two Dirichlet densities blows up as168 ω →∞. We present here a short proof that skips some calculations (see Appendix 1 for a full proof).169
proof. Consider any λ ∈ ( 1, γ∆∞ + 1 )
. Let u := x+α and u′ := x′ +α′. Let P (y) be the density170 of Dirichlet(u) and P ′(y) be the density of Dirichlet(u′). A quick calculation shows that:171
Ey∼P (y) [ P (y)λ−1
P ′(y)λ−1
] = B(u′)λ−1
B(u)λ−1 · B(u + (λ− 1)(u− u ′)) B(u) . (3)
We take the logarithm on both sides and apply the second-order Taylor expansion to the following172 G(ui, u ′ i) and H(ui, u ′ i) terms that appear on the right-hand side. As a result, there exist ξ between173 ui + (λ− 1)(ui − u′i) and ui, and ξ′ between ui and u′i such that174 G(ui, u ′ i) := (λ− 1)(log Γ(u′i)− log Γ(ui))
= −(λ− 1)(xi − x′i)ψ(ui) + 1
2 (λ− 1)(xi − x′i)2ψ′(ξ′) (4)
H(ui, u ′ i) := log Γ(ui + (λ− 1)(ui − u′i))− log Γ(ui)
= (λ− 1)(xi − x′i)ψ(ui) + 1
2 (λ− 1)2(xi − x′i)2ψ′(ξ), (5)
Note that ψ′ is increasing. If xi > x′i, then ξ and ξ ′ are bounded below by u′i ≥ αm. On the175 other hand, if xi ≤ x′i, then ξ and ξ′ are bounded below by ui − (λ − 1)|ui − u′i|. The condition176 λ < γ∆∞ + 1 guarantees that ui − (λ− 1)|ui − u ′ i| > αm − γ. All cases considered, we have177
G(ui, u ′ i) +H(ui, u ′ i) ≤
1
2
( (λ− 1) + (λ− 1)2 ) (xi − x′i)2ψ′(αm − γ)
= 1
2 λ(λ− 1)(xi − x′i)2ψ′(αm − γ). Denoting u0 := ∑ i ui and u ′ 0 := ∑ i u ′ i, the same argument shows that G(u0, u ′ 0) +H(u0, u ′ 0) > 0.178 Therefore,179
Dλ(P (y)‖P ′(y)) = 1
λ− 1 (∑ i (G(ui, u ′ i) +H(ui, u ′ i))−G(u0, u′0)−H(u0, u′0) )
< 1 λ− 1 ∑ i (G(ui, u ′ i) +H(ui, u ′ i))
≤ 1 2 λ ∑ i (xi − x′i)2ψ′(αm − γ) ≤ 1 2 λ∆22ψ ′(αm − γ).
The guaranteed upper bound (2) is independent of the sample statistics. As a result, the bound applies180 even in worst settings i.e., when xi = 0 and x′i = ∆∞, or vice versa, for some i. As we can see in181 Figure 1, the upper bound is a close approximation to the actual value of ρ when x6 = 0 and x′6 = 1.182 However, being a sample independent bound, the difference becomes substantial when all xi’s are183 large. There is one way to get around this issue: if there is no privacy violation in assuming that184 the sample statistics are always bounded below by some threshold τ , then we can incorporate the185 threshold into the prior (thus ψ′(αm − γ) in (2) is replaced by ψ′(αm + τ − γ)).186
The parameter γ allows us to adjust the moment bound ω as desired. Even though a higher ω usually187 leads to a better privacy guarantee, there are two downsides to picking γ close to αm in this case.188 First, note that ρ contains ψ′(αm− γ); as γ → αm, the value of ρ diverges to∞, leading to a weaker189 privacy guarantee instead. Second, as the Taylor approximation (5) is accurate when ui is close to190 ui + (λ− 1)(ui − u′i), having a large value of λ would push the guaranteed upper bound away from191 the actual privacy loss. Thus it is recommended to pick γ so that γ/∆∞ ≥ 1 and αm − γ 0.192 Alternatively, we can choose the value of γ that minimizes ε when converting from tCDP to (ε, δ)-DP193 using Lemma 1—this method will be explored in the next subsection.194
Theorem 1 can be easily applied to sampling from Dirichlet(rx+α). Replacing x with rx, we have195 ∆2 replaced by r∆2 and ∆∞ replaced by r∆∞. Consequently, the sampling is ( ρ, γr∆∞ + 1 ) -tCDP,196
where ρ = 12r 2∆22ψ ′(αm − γ). In Appendix 4, we analyze the scaling of r in conjunction with αm197 at a fixed privacy budget ρ.198
3.2 Approximate differential privacy199
We now convert the tCDP guarantee to an approximate DP guarantee. Let δ ∈ (0, 1). Using Lemma 1,200 the Dirichlet posterior sampling with Dirichlet(α) as the prior is (ε, δ)-DP with201
ε =
{ ρ(γ) + 2 √ ρ(γ) log(1/δ) if log(1/δ) ≤ γ2ρ(γ)/∆2∞
ρ(γ) (
γ ∆∞
+ 1 )
+ log(1/δ)∆∞γ if log(1/δ) > γ 2ρ(γ)/∆2∞
, (6)
where ρ(γ) = 12∆ 2 2ψ ′(αm − γ).202
We try to minimize by adjusting the value of γ. First, we consider the case log(1/δ) ≤ γ2ρ(γ)/∆2∞.203 Since ρ(γ) is a strictly increasing function of γ, both ρ(γ) + 2 √ ρ(γ) log(1/δ) and γ2ρ(γ)/∆2∞204 are both strictly increasing function of γ. Therefore, ε is minimized at the minimum possible205 value of γ in this case, that is, at the unique γM that satisfies log(1/δ) = γ2Mρ(γM )/∆ 2 ∞ =206
1 2γ 2 M∆ 2 2ψ ′(αm − γM )/∆2∞.207
Now we consider the second case, when γ < γM . As ρ(γ) is an increasing positive convex function208 of γ, the function209
f(γ) := 1
2 ∆22ψ
′(αm − γ) ( γ
∆∞ + 1
) +
log(1/δ)∆∞ γ ; γ ∈ (0, γM ], (7)
is also convex in γ, and thus has a unique minimizer γm ∈ (0, γM ]. Comparing to the first case, we210 have f(γm) ≤ f(γM ) = ρ(γM ) + 2 √ ρ(γM ) log(1/δ). We then conclude that ε = f(γm).211 Theorem 2. Let α ∈ R2>0 and denote αm = mini αi. Let ∆2,∆∞ > 0 be constants that satisfy212 ∑ i(xi − x′i)2 ≤ ∆22 and maxi |xi − x′i| ≤ ∆∞ whenever x,x′ ∈ Rd≥0 are sample statistics of any213 two datasets differing on a single entry. For any δ ∈ (0, 1), let γM be the solution to the equation214 log(1/δ) = 12γ 2∆22ψ ′(αm − γ)/∆2∞. The one-time sampling from Dirichlet(x + α) is (ε, δ)-DP,215 where216 ε = min
γ∈(0,γM ] f(γ). (8)
Figure 1 shows how δ decays as a function of ε at three different values of αm.217
4 Utility218
Using the results from the previous section, we analyze the Dirichlet posterior sampling’s utility in219 two specific tasks.220
4.1 Multinomial-Dirichlet sampling221
Suppose that we are observing N trials, each of which has d possible outcomes. For each i ∈222 {1, . . . , d}, let xi be the number of times the i-th outcome was observed. Then we have the223 multinomial likelihood p(x|y) ∝ ∏ i y xi i . From this, we sample from the Dirichlet posterior:224
Y ∼ Dirichlet(x + α). (9)
Suppose that we want to sample from a true distribution PX ∼ Dirichlet(x + α), but for privacy225 reasons, we instead sample from Qx ∼ Dirichlet(x + α′) where α′i > αi for all i. The utility of the226 privacy scheme is then measured by the KL-divergence between Px and Qx. Assuming that x is an227 observation of Multinomial(p), the following Theorem tells us that, on average, the KL-divergence228 is small when the sample size is large, and the pi’s are evenly distributed.229 Theorem 3. Let p := (p1, . . . , pd) where pi > 0 for all i and ∑ i pi = 1. Define a random230 variable X ∼ Multinomial(p). Let PX ∼ Dirichlet(X + α) and QX ∼ Dirichlet(X + α′) where231 α′i ≥ αi ≥ 1 for all i. The following estimate holds:232
EX[DKL(PX‖QX)] ≤ 1
N + 1 ∑ i (α′i − αi)2 · 1 pi . (10)
The proof is given in Appendix 2. Let us consider a simple privacy scheme where we fix s > 0 and233 let α′i = αi + s for all i. Thus (10) becomes:234
EX[DKL(PX‖QX)] ≤ G(p)s2
N + 1 , (11) where G(p) := ∑ i 1/pi. Now we take into account the privacy parameters. Let ρ = ∆ 2 2ψ ′(αm − γ)235
and ρ′ = ∆22ψ ′(α′m−γ), where αm = mini αi, α′m = mini α′i, and γ < αm. Here, we approximate236 the values of ψ′(αm − γ) and ψ′(α′m − γ) under two regimes:237
High-privacy regime: α′m − γ > 1. We have ψ′(α′m − γ) ≈ 1/(α′m − γ), which implies238 α′m−γ ≈ ∆22/ρ′. We also have αm−γ ≈ ∆22/ρ for αm−γ ≥ 1 and αm−γ > (αm−γ)2 ≈ ∆22/ρ239 for α− γ < 1. Thus we have the following bound for the right-hand side of (11):240
G(p)s2 N + 1 = G(p)(α′m − αm)2 N + 1 . ∆42G(p) N + 1
( 1
ρ′ − 1 ρ
)2 < ∆42G(p)
ρ′2(N + 1) . (12) Consequently, we have DKL(P‖Q) < for N = Ω ( ∆42G(p) ρ′2 ) .241
Low-privacy regime: 1 > α′m − γ > 0. This is similar as above, except we have α′m − γ ≈242 ∆2/ρ
′1/2 and αm − γ ≈ ∆2/ρ1/2. Similar computation as (12) shows that DKL(P‖Q) < when243 N = Ω ( ∆22G(p) ρ′ ) .244
We observe that, in both regimes, the sample size scales faster with respect to with a higher value of245 G(p), which is associated with a higher number of outcomes d, and more concentrated multinomial246 parameter p; this agrees with the result of our simulation in Appendix 3. Moreover, for small ρ′ the247 sample size scales as 1/ρ′2, while for large ρ′ the sample size scales as 1/ρ′.248
4.2 Private normalized histograms249
Let x = (x1, . . . , xd) be a histogram of N observations and p := x/N . We can privatize p by250 sampling a probability vector: Y ∼ Dirichlet(x + α). Note that Y is a biased estimator of p.251 Denoting α0 := ∑ i αi, the bias of each component of Y is given by E[Y]− pi. Hence,252
|Bias(Yi)| = ∣∣∣∣ xi + αiN + α0 − pi ∣∣∣∣ = |xiα0 −Nαi|N(N + α0) ≤ Nα0N(N + α0) = α0N + α0 . Since Yi ∼ Beta(xi + αi, N + α0 − xi − αi) is 14(N+α0+1) -sub-Gaussian [MA17], we have,253
P[|Yi − pi| > t+ |Bias(Yi)|] ≤ P[|Yi − E[Yi]|+ |Bias(Yi)| > t+ |Bias(Yi)|] = P[|Yi − E[Yi]| > t]
≤ 2e−2t 2(N+α0+1). With the union bound, we plug in t = √
log(2d/β) 2(N+α0+1) , for any β ∈ (0, 1), to obtain the following254 accuracy guarantee of the private normalized histogram:255 Theorem 4. Let Y ∼ Dirichlet(x + α), where x ∈ Rd≥0 and α ∈ Rd>0, and p := x/N . For any256 β ∈ (0, 1), with probability at least 1− β, the following inequality holds:257
‖Y − p‖∞ ≤
√ log(2d/β)
2(N + α0 + 1) + α0 N + α0 . (13)
Given > 0, we use (13) to find a lower bound for N that gives ‖Y − p‖∞ < w.p. 1− β when258 Y is sampled with ρ-tCDP. For simplicity, we consider a uniform prior: αi = α > 0 for all i.259 Thus, ρ = 12∆ 2 2ψ ′(α− γ), where γ might be chosen according to Corollary 2. We consider the two260 following regimes:261
High-privacy regime: α−γ > 1. In this case, ψ′(α−γ) ≈ 1/(α−γ). From ρ = 12∆ 2 2ψ ′(α−γ),262 we have α ≈ ∆22/2ρ+ γ. Replacing α0 by dα in (13) yields the sample size:263
N = Ω
( log(2d/β)
2 + d ( ∆22 2ρ + γ )) , (14)
for the desired accuracy.264
Low-privacy regime: α − γ < 1. This is the same as above, except now we have ψ′(α − γ) ≈265 1/(α − γ)2, which implies α ≈ ∆2/(2ρ)1/2 + γ. The sample size that guarantees the desired266 accuracy is:267
N = Ω
( log(2d/β)
2 + d ( ∆2√ 2ρ + γ )) . (15)
Let us compare this result to the Gaussian mechanism, which adds a noise Z ∼ N(0, σ2Id) to the268 normalized histogram p directly. Thus the `2-sensitivity in this case is ∆2/N . We have that the269 Gaussian mechanism is ρ-zCDP where ρ = ∆ 2
2N2σ2 [BS16]. Using the same argument as above, with270 probability at least 1− β, the following inequality holds for all i:271
‖Z‖∞ ≤
√ log(2d/β)∆22
N2ρ . (16)
Hence, the sample size of N = Ω
(√
log(2d/β)∆22/ρ 2
)
guarantees the desired accuracy. Compar-272 ing this to (14), if we assume < 1, the AM-GM inequality tells us that273
log(2d/β) 2 + d∆22 ρ > log(2d/β) 2 + ∆22 ρ ≥ 2
√ log(2d/β)∆22
ρ 2 . (17)
The inequality (17) implies that the Gaussian mechanism requires less sample than the Dirichlet274 mechanism in order to guarantee the same level of accuracy. The Gaussian mechanism is also better275 in the low-privacy regime as the ρ in (15) satisfies √ ρ < ρ and ∆2 ≈ ∆22, leading to the same276 inequality (17). Nonetheless, the decay in (16) is linear in d, while that in (13) has α0 = dα in277 the denominators. This observation suggests that, when x is a sparse histogram i.e. when N ≤ d,278 the `∞-accuracy of the Dirichlet mechanism is smaller than that of the Gaussian mechanism. This279 conclusion is supported by our simulation in Figure 2. We see that the `∞-accuracy of the Dirichlet280 mechanism is smaller than that of the Gaussian mechanism for small N when d = 1000. The code281 for all experiments in this study can be found in the supplemental material.282
Potential negative societal impacts283
It is important to note that, when ρ becomes unacceptably large (e.g., ρ = 104), the sampling is far284 away from being private. Thus any organization that deploys the posterior sampling on sensitive data285 must not vacuously refer to this study and claim that its algorithm is private. It is the organization’s286 responsibility to fully publish the prior parameters, and educate its users/customers on differential287 privacy and how the privacy guarantees are calculated.288
It is desirable that differentially private algorithms are accurate for the task at hand, especially when289 the data is used for important decision-making. Thus, one needs to make sure that there is enough290 sample to achieve the desired level of accuracy. For a large differentially private system, privacy291 budgets need to be allocated to the parts that require accurate outputs.292
Lastly, one must be careful with the choice of prior parameters; if a uniform prior is used, smaller293 groups will suffer a relatively larger statistical bias. As a result, private statistics of small populations294 (such as ethnic or racial minorities) will be relatively less accurate. One way to get around this issue295 is to (privately) impose larger prior parameters on larger populations.296
References297 [AAFK20] I. Aykin, B. Akgun, M. Feng, and M. Krunz. “MAMBA: A Multi-armed Bandit Framework for298 Beam Tracking in Millimeter-wave Systems”. In: 39th IEEE Conference on Computer Com-299 munications, INFOCOM 2020, Toronto, ON, Canada, July 6-9, 2020. IEEE, 2020, pp. 1469–300 1478.301
[AV08] J. M. Abowd and L. Vilhuber. “How Protective Are Synthetic Data?” In: Privacy in Statistical302 Databases, UNESCO Chair in Data Privacy International Conference, PSD 2008, Istan-303 bul, Turkey, September 24-26, 2008. Proceedings. Ed. by J. Domingo-Ferrer and Y. Saygin.304 Vol. 5262. Lecture Notes in Computer Science. Springer, 2008, pp. 239–246.305
[BDRS18] M. Bun, C. Dwork, G. N. Rothblum, and T. Steinke. “Composable and versatile privacy via306 truncated CDP”. In: Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of307 Computing, STOC 2018, Los Angeles, CA, USA, June 25-29, 2018. Ed. by I. Diakonikolas,308 D. Kempe, and M. Henzinger. ACM, 2018, pp. 74–86.309
[BHW00] R. J. Boys, D. A. Henderson, and D. J. Wilkinson. “Detecting Homogeneous Segments in DNA310 Sequences by Using Hidden Markov Models”. In: Journal of the Royal Statistical Society.311 Series C (Applied Statistics) 49.2 (2000), pp. 269–285. ISSN: 00359254, 14679876.312
[BS16] M. Bun and T. Steinke. “Concentrated Differential Privacy: Simplifications, Extensions, and313 Lower Bounds”. In: Theory of Cryptography. Ed. by M. Hirt and A. Smith. Berlin, Heidelberg:314 Springer Berlin Heidelberg, 2016, pp. 635–658.315
[BS18] G. Bernstein and D. R. Sheldon. “Differentially Private Bayesian Inference for Exponential316 Families”. In: Advances in Neural Information Processing Systems 31: Annual Conference on317 Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal,318 Canada. Ed. by S. Bengio, H. M. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and319 R. Garnett. 2018, pp. 2924–2934.320
[CWS03] J. Corander, P. Waldmann, and M. J. Sillanpää. “Bayesian Analysis of Genetic Differentiation321 Between Populations”. In: Genetics 163.1 (Jan. 2003), pp. 367–374. ISSN: 1943-2631.322
[de 06] M. de Lapparent. “Empirical Bayesian analysis of accident severity for motorcyclists in large323 French urban areas”. In: Accident Analysis & Prevention 38.2 (2006), pp. 260–268. ISSN:324 0001-4575.325
[DMNS06] C. Dwork, F. Mcsherry, K. Nissim, and A. Smith. “Calibrating noise to sensitivity in private326 data analysis”. In: TCC. 2006.327
[DNZMR17] C. Dimitrakakis, B. Nelson, Z. Zhang, A. Mitrokotsa, and B. I. P. Rubinstein. “Differential328 Privacy for Bayesian Inference through Posterior Sampling”. In: J. Mach. Learn. Res. 18329 (2017), 11:1–11:39.330
[FGWC16] J. R. Foulds, J. Geumlek, M. Welling, and K. Chaudhuri. “On the Theory and Practice of331 Privacy-Preserving Bayesian Data Analysis”. In: Proceedings of the Thirty-Second Conference332 on Uncertainty in Artificial Intelligence, UAI 2016, June 25-29, 2016, New York City, NY, USA.333 Ed. by A. T. Ihler and D. Janzing. AUAI Press, 2016.334
[GSC17] J. Geumlek, S. Song, and K. Chaudhuri. “Renyi Differential Privacy Mechanisms for Posterior335 Sampling”. In: Advances in Neural Information Processing Systems 30: Annual Conference336 on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA.337 Ed. by I. Guyon, U. von Luxburg, S. Bengio, H. M. Wallach, R. Fergus, S. V. N. Vishwanathan,338 and R. Garnett. 2017, pp. 5289–5298.339
[GWHHT21] P. Gohari, B. Wu, C. Hawkins, M. T. Hale, and U. Topcu. “Differential Privacy on the Unit340 Simplex via the Dirichlet Mechanism”. In: IEEE Trans. Inf. Forensics Secur. 16 (2021),341 pp. 2326–2340.342
[Hin15] K. Hines. “A Primer on Bayesian Inference for Biophysical Systems”. In: Biophysical Journal343 108.9 (2015), pp. 2103–2113. ISSN: 0006-3495.344
[LW92] M. Lavine and M. West. “A Bayesian method for classification and discrimination”. In:345 Canadian Journal of Statistics 20.4 (1992), pp. 451–461.346
[MA17] O. Marchal and J. Arbel. “On the sub-Gaussianity of the Beta and Dirichlet distributions”. In:347 Electronic Communications in Probability 22.none (2017), pp. 1 –14.348
[MKAGV08] A. Machanavajjhala, D. Kifer, J. M. Abowd, J. Gehrke, and L. Vilhuber. “Privacy: Theory349 meets Practice on the Map”. In: Proceedings of the 24th International Conference on Data350 Engineering, ICDE 2008, April 7-12, 2008, Cancún, Mexico. Ed. by G. Alonso, J. A. Blakeley,351 and A. L. P. Chen. IEEE Computer Society, 2008, pp. 277–286.352
[MMR05] J.-M. Marin, K. Mengersen, and C. P. Robert. “Bayesian Modelling and Inference on Mixtures353 of Distributions”. In: Bayesian Thinking. Ed. by D. Dey and C. Rao. Vol. 25. Handbook of354 Statistics. Elsevier, 2005, pp. 459–507.355
[MT07] F. McSherry and K. Talwar. “Mechanism Design via Differential Privacy”. In: 48th Annual356 IEEE Symposium on Foundations of Computer Science (FOCS 2007), October 20-23, 2007,357 Providence, RI, USA, Proceedings. IEEE Computer Society, 2007, pp. 94–103.358
[NIK20] I. Nasim, A. S. Ibrahim, and S. Kim. “Learning-Based Beamforming for Multi-User Vehicular359 Communications: A Combinatorial Multi-Armed Bandit Approach”. In: IEEE Access 8 (2020),360 pp. 219891–219902.361
[NLYCC13] V. C. Nguyen, W. S. Lee, N. Ye, K. M. A. Chai, and H. L. Chieu. “Active Learning for362 Probabilistic Hypotheses Using the Maximum Gibbs Error Criterion”. In: Advances in Neural363 Information Processing Systems 26: 27th Annual Conference on Neural Information Processing364 Systems 2013. Proceedings of a meeting held December 5-8, 2013, Lake Tahoe, Nevada,365 United States. Ed. by C. J. C. Burges, L. Bottou, Z. Ghahramani, and K. Q. Weinberger. 2013,366 pp. 1457–1465.367
[ORR13] I. Osband, D. Russo, and B. V. Roy. “(More) Efficient Reinforcement Learning via Poste-368 rior Sampling”. In: Advances in Neural Information Processing Systems 26: 27th Annual369 Conference on Neural Information Processing Systems 2013. Proceedings of a meeting held370 December 5-8, 2013, Lake Tahoe, Nevada, United States. Ed. by C. J. C. Burges, L. Bottou,371 Z. Ghahramani, and K. Q. Weinberger. 2013, pp. 3003–3011.372
[PB98] T. Pedersen and R. F. Bruce. “Knowledge Lean Word-Sense Disambiguation”. In: Proceedings373 of the Fifteenth National Conference on Artificial Intelligence and Tenth Innovative Appli-374 cations of Artificial Intelligence Conference, AAAI 98, IAAI 98, July 26-30, 1998, Madison,375 Wisconsin, USA. Ed. by J. Mostow and C. Rich. AAAI Press / The MIT Press, 1998, pp. 800–376 805.377
[PG14] Y. Park and J. Ghosh. “PeGS: Perturbed Gibbs Samplers that Generate Privacy-Compliant378 Synthetic Data”. In: Trans. Data Priv. 7.3 (2014), pp. 253–282.379
[PM01] J. Pella and M. Masuda. “Bayesian methods for analysis of stock mixtures from genetic380 characters”. English. In: Fishery Bulletin 99 (Jan. 2001). 1, p. 151. ISSN: 00900656.381
[Rén61] A. Rényi. “On measures of entropy and information”. In: Proceedings of the Fourth Berkeley382 Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory383 of Statistics. The Regents of the University of California. 1961.384
[RWZ14] J. P. Reiter, Q. Wang, and B. Zhang. “Bayesian Estimation of Disclosure Risks for Multiply385 Imputed, Synthetic Data”. In: J. Priv. Confidentiality 6.1 (2014).386
[SJGLY17] M. J. Schneider, S. Jagpal, S. Gupta, S. Li, and Y. Yu. “Protecting customer privacy when387 marketing with second-party data”. In: International Journal of Research in Marketing 34.3388 (2017), pp. 593–603. ISSN: 0167-8116.389
[Str00] M. J. A. Strens. “A Bayesian Framework for Reinforcement Learning”. In: Proceedings of the390 Seventeenth International Conference on Machine Learning (ICML 2000), Stanford University,391 Stanford, CA, USA, June 29 - July 2, 2000. Ed. by P. Langley. Morgan Kaufmann, 2000,392 pp. 943–950.393
[WFS15] Y. Wang, S. E. Fienberg, and A. J. Smola. “Privacy for Free: Posterior Sampling and Stochastic394 Gradient Monte Carlo”. In: Proceedings of the 32nd International Conference on Machine395 Learning, ICML 2015, Lille, France, 6-11 July 2015. Ed. by F. R. Bach and D. M. Blei. Vol. 37.396 JMLR Workshop and Conference Proceedings. JMLR.org, 2015, pp. 2493–2502.397
[ZHGSY20] J. Zhu, X. Huang, X. Gao, Z. Shao, and Y. Yang. “Multi-Interface Channel Allocation in Fog398 Computing Systems using Thompson Sampling”. In: 2020 IEEE International Conference on399 Communications, ICC 2020, Dublin, Ireland, June 7-11, 2020. IEEE, 2020, pp. 1–6.400
Checklist401
1. For all authors...402
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s403 contributions and scope? [Yes] We gave a simple guaranteed upper bound of tCDP (2)404 for the Dirichlet posterior sampling and illustrated how it can be used to derive accuracy405 guarantees in Section 4.406
(b) Did you describe the limitations of your work? [Yes] We discussed a limitation of407 the guaranteed upper bound of tCDP in the paragraph following Theorem 1. We also408 described a situation under which the Gaussian mechanism is preferable to the Dirichlet409 posterior sampling at the end of Section 4.2.410
(c) Did you discuss any potential negative societal impacts of your work? [Yes] See the411 section on potential negative societal impacts at the end of the paper.412
(d) Have you read the ethics review guidelines and ensured that your paper conforms to413 them? [Yes]414
2. If you are including theoretical results...415
(a) Did you state the full set of assumptions of all theoretical results? [Yes]416 (b) Did you include complete proofs of all theoretical results? [No] The proofs of all417 theorems are given in the main paper, except that of Theorem 3 which is given in418 Appendix 2.419
3. If you ran experiments...420
(a) Did you include the code, data, and instructions needed to reproduce the main experi-421 mental results (either in the supplemental material or as a URL)? [Yes] The code and422 the instructions for our simulations are included in the supplemental material.423
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they424 were chosen)? [Yes] We specified the details of our simulations in the figures’ captions.425
(c) Did you report error bars (e.g., with respect to the random seed after running experi-426 ments multiple times)? [Yes] We reported the error bars in Figure 2427
(d) Did you include the total amount of compute and the type of resources used (e.g.,428 type of GPUs, internal cluster, or cloud provider)? [N/A] Our experiments are not429 computationally intensive.430
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...431
(a) If your work uses existing assets, did you cite the creators? [N/A]432 (b) Did you mention the license of the assets? [N/A]433 (c) Did you include any new assets either in the supplemental material or as a URL? [N/A]434
435
(d) Did you discuss whether and how consent was obtained from people whose data you’re436 using/curating? [N/A]437
(e) Did you discuss whether the data you are using/curating contains personally identifiable438 information or offensive content? [N/A]439
5. If you used crowdsourcing or conducted research with human subjects...440
(a) Did you include the full text of instructions given to participants and screenshots, if441 applicable? [N/A]442
(b) Did you describe any potential participant risks, with links to Institutional Review443 Board (IRB) approvals, if applicable? [N/A]444
(c) Did you include the estimated hourly wage paid to participants and the total amount445 spent on participant compensation? [N/A]446

Review summaries:
The paper studies releasing a single sample from a Dirichlet posterior with several variants of differential privacy in the two specific tasks of Dirichlet sampling and private normalized histogram publishing. Both privacy and utility guarantees are analyzed by the authors. The authors compare the results with Gaussian mechanism theoretically and empirically using a simple simulation.

This paper proposes a method for releasing differentially private samples from Dirichlet posterior distribution. Authors present a privacy analysis for their proposed method and demonstrate that the method out performs Gaussian mechanism under certain conditions. Besides the empirical evaluation, authors also derive analytical utility guarantees for the method.

This paper provides a posterior sampling mechanism for the Dirichlet distribution achieving tCDP and approximate DP privacy, relying on modifying the alpha parameters. It includes an application on histogram release.  The response addressed my comments.

This paper studies the privacy of releasing a sample from the Dirichlet posterior. The paper shows for the Dirichlet posterior sampling with prior set to be $\mathrm{Dirichlet}(\alpha)$, that Dirichlet posterior sampling  satisfies a version of truncated concentrated Differential Privacy(tCDP). Now, using the relationship between tCDP and approximate DP established in Bun et al. (2018), the paper derives the approximate differential privacy of the Dirichlet Posterior sampling.   Given the result, the paper studies the utility of Dirichlet posterior sampling in 2 contexts: 1. One is interested in sampling for the posterior but changing the prior from $Dirichlet (\alpha)$ to $Dirichlet (\alpha’)$, such that $\alpha_i' > \alpha_i$ so as to increase the privacy preserving properties of the the posterior sampling. In this context, the paper derives sample complexity bounds such that $D_{KL}(\mathrm{Dirichlet}(\mathbf{x} + \alpha)|| \mathrm{Dirichlet}(\mathbf{x} + \alpha') )<\varepsilon$. 2. One is interested in releasing the normalized histogram $\mathbf{p} = \mathbf{x}/N$. One can privately release it by sampling from the Dirichlet posterior $Y \sim \mathrm{Dirichlet}(\mathbf{x}+ \alpha)$. The paper derives sample complexity bounds to incur small error $\ell_\infty$ norm. Authors also point out that one can get better sample complexity with Gaussian mechanism where Dirichlet posterior sampling outperforms Gaussian mechanism in small data regime.