The Skellam Mechanism for Differentially Private Federated Learning

1 Introduction . The Gaussian mechanism is the workhorse for a multitude of differentially private learning algorithms [ 46 , 10 , 1 ] . While simple enough for mathematical reasoning and privacy accounting analyses , its continuous nature presents a number of challenges in practice . For example , it can not be exactly represented on finite computers , making it prone to numerical errors that can break its privacy guarantees [ 35 ] . Moreover , it can not be used in distributed learning settings with cryptographic multi-party computation primitives involving modular arithmetic , such as secure aggregation [ 12 , 11 ] . To address these shortcomings , the binomial and ( distributed ) discrete Gaussian mechanisms were recently introduced [ 19 , 2 , 15 , 25 ] . Unfortunately , both have their own drawbacks : the privacy loss for the binomial mechanism can be infinite with a non-zero probability , and the discrete Gaussian : ( a ) is not closed under summation ( i.e . sum of discrete Gaussians is not a discrete Gaussian ) , complicating analysis in distributed settings and leading to a performance worse than continuous Gaussian in the highly distributed , low-noise regime [ 25 ] ; ( b ) requires a sampling algorithm that is not shipped with mainstream machine learning or data analysis software packages , making it difficult for engineers to use it in production settings ( naïve implementations may lead to catastrophic privacy errors ) . Our contributions To overcome these limitations , we introduce and analyze the multi-dimensional Skellam mechanism , a mechanism based on adding noise distributed according to the difference of two independent Poisson random variables . The Skellam noise is closed under summation ( i.e . sums of Skellam random variables is again Skellam distributed ) and can be sampled from easily – efficient Poisson samplers are widely available in numerical software packages . Being discrete in nature also ⇤Work done while at Google Research . §Alphabetical authorship . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . means that it can mesh well cryptographic protocols and can lead to communication savings . To analyze the privacy guarantees of the Skellam mechanism and compare it with other mechanisms , we provide a numerical evaluation of the privacy loss random variable and prove a sharp bound on the Rényi divergence between two shifted Skellam distributions . Our careful analysis shows that for a multi-dimensional query function with ` 1 sensitivity 1 and ` 2 sensitivity 2 , the Skellam mechanism with variance µ achieves ( ↵ , `` ( ↵ ) ) Rényi differential privacy ( RDP ) [ 36 ] for `` ( ↵ ) ↵ 2 2µ +min ⇣ ( 2↵ 1 ) 2+6 1 4µ2 , 3 1 2µ ⌘ ( see Theorem 3.5 ) . This implies that the RDP guarantees are at most 1 +O ( 1/µ ) times worse than those of the Gaussian mechanism . To analyze the performance of the Skellam mechanism in practice , we consider a differentially private and communication constrained federated learning ( FL ) setting [ 26 ] where the noise is added locally to the d-dimensional discretized client updates that are then summed securely via a cryptographic protocol , such as secure aggregation ( SecAgg ) [ 11 , 12 ] . We provide an end-to-end algorithm that appropriately discretizes the data and applies the Skellam mechanism along with modular arithmetic to bound the range of the data and communication costs before applying SecAgg . We show on distributed mean estimation and two benchmark FL datasets , Federated EMNIST [ 14 ] and Stack Overflow [ 8 ] , that our method can match the performance of the continuous Gaussian baseline under tight privacy and communication budgets , despite using generic RDP amplification via sampling [ 51 ] for our approach and the precise RDP analysis for the subsampled Gaussian mechanism [ 37 ] . Our method is implemented in TensorFlow Privacy [ 32 ] and TensorFlow Federated [ 24 ] and will be open-sourced.2 While we mostly focus on FL applications , the Skellam mechanism can also be applied in other contexts of learning and analytics , including centralized settings . Related work The Skellam mechanism was first introduced in the context of computational differential privacy from lattice-based cryptography [ 49 ] and private Bayesian inference [ 45 ] . However , the privacy analyses in the prior work do not readily extend to the multi-dimensional case , and they give direct bounds for pure or approximate DP which makes only advanced composition theorems [ 28 , 22 ] directly applicable in learning settings where the mechanism is applied many times . For example , the guarantees from [ 49 ] lead to poor accuracy-privacy trade-offs as demonstrated in Fig . 1 . Moreover , we show in Section 3.1 that extending the direct privacy analysis to the multi-dimensional setting is non-trivial because the worst-case neighboring dataset pair is unknown in this case . For these reasons , our tight privacy analysis via a sharp RDP bound makes the Skellam mechanism practical for learning applications for the first time . These guarantees ( almost ) match those of the Gaussian mechanism and allow us to use generic RDP amplification via subsampling methods [ 51 ] . The closest mechanisms to Skellam are the binomial [ 2 , 19 ] and the discrete Gaussian mechanisms [ 15 , 25 ] . The binomial mechanism can ( asymptotically ) match the continuous Gaussian mechanism ( when properly scaled ) . However , it does not achieve Rényi or zero-concentrated DP [ 36 , 13 ] and has a privacy loss that can be infinite with a non-zero probability , leading to catastrophic privacy failures . The discrete Gaussian mechanism yields Rényi DP and can be applied to distributed settings [ 25 ] , but it requires a sampling algorithm that is not yet available in data analysis software packages despite being explored in the lattice-based cryptography community ( e.g. , [ 43 , 18 , 38 ] ) . The discrete Gaussian is also not closed under summation and the divergence can be large in highly distributed low-noise settings ( e.g . quantile estimation [ 6 ] and federated analytics [ 42 ] ) , which causes privacy degradation . See the end of Section 4 for more discussion . 2 Preliminaries . We begin by providing a formal definition for ( `` , ) -differential privacy ( DP ) [ 20 ] . Definition 2.1 ( Differential Privacy ) . For `` , 0 , a randomized mechanism M satisfies ( `` , ) -DP if for all neighboring datasets D , D0 and all S in the range of M , we have that P ( M ( D ) 2 S ) e '' P ( M ( D0 ) 2 S ) + , where D and D0 are neighboring pairs if they can be obtained from each other by adding or removing all the records that belong to a particular user . In our experiments we consider user-level differential privacy – i.e. , D and D0 are neighboring pairs 2https : //github.com/google-research/federated/tree/master/distributed_dp if one of them can be obtained from the other by adding or removing all the records associated with a single user [ 33 ] . This is stronger than the commonly-used notion of item level privacy where , if a user contributes multiple records , only the addition or removal of one record is protected . We also make use of Rényi differential privacy ( RDP ) [ 36 ] which allows for tight privacy accounting . Definition 2.2 ( Rényi Differential Privacy ) . A mechanism M satisfies ( ↵ , `` ) -RDP if for any two neighboring datasets D , D0 , we have that D↵ ( M ( D ) , M ( D0 ) ) `` where D↵ ( P , Q ) is the Rényi divergence between P and Q and is given by D↵ ( P , Q ) , 1 ↵ 1 log ✓ Ex⇠Q ✓ P ( x ) Q ( x ) ◆↵ ◆ = 1 ↵ 1 log Ex⇠P `` ✓ P ( x ) Q ( x ) ◆↵ 1 # ! . A closely related privacy notion is zero-concentrated DP ( zCDP ) [ 21 , 13 ] . In fact , 12 '' 2-zCDP is equivalent to simultaneously satisfying an infinite family of RDP guarantees , namely ( ↵ , 12 '' 2↵ ) - Rényi differential privacy for all ↵ 2 ( 1,1 ) . The following conversion lemma from [ 13 , 15 , 7 ] relates RDP to ( `` , ) -DP . Lemma 2.3 . If M satisfies ( ↵ , `` ) -RDP , then , for any > 0 , M satisfies ( `` DP ( ) , ) -DP , where '' DP ( ) = inf ↵ > 1 '' + log ( 1/↵ ) ↵ 1 + log ( 1 1/↵ ) . For any query function f , we define the p sensitivity as maxD , D0 kf ( D ) f ( D0 ) kp , where D and D0 are neighboring pairs differing by adding or removing all the records from a particular user . We also include the RDP guarantees of the discrete Gaussian mechanism ( same RDP guarantees as the continuous Gaussian mechanism ) to which we compare our method . Definition 2.4 ( The Discrete Gaussian Mechanism [ 15 ] ) . Given an integer-valued query f ( D ) 2 Zd and noise variance µ , the Discrete Gaussian ( DGaussian ) Mechanism is given by f ( D ) + Z , where Z ⇠ NZ ( 0 , µ ) , and NZ ( 0 , µ ) denotes the discrete Gaussian distribution defined in Equation ( 1 ) of [ 15 ] . The discrete Gaussian mechanism achieves ( ↵ , ↵ 2 2 2µ ) -Rényi DP . 3 The Skellam Mechanism . We begin by presenting the definition of the Skellam distribution , which is the basis of the Skellam Mechanism for releasing integer ranged multi-dimensional queries . Definition 3.1 ( Skellam Distribution ) . The multidimensional Skellam distribution Sk , µ over Zd with mean 2 Zd and variance µ is given with each coordinate Xi distributed independently as Xi ⇠ Sk i , µ with P ( Xi = k ) = e µIk i ( µ ) , for k 2 Z . Here , I⌫ ( x ) is the modified Bessel function of the first kind . A key property of Skellam random variables which motivates their use in DP is that they are closed under summation , i.e . let X1 ⇠ Sk 1 , µ1 and X2 ⇠ Sk 2 , µ2 then X1 + X2 ⇠ Sk 1+ 2 , µ1+µ2 . This follows from the fact that a Skellam random variable X can be obtained by taking the difference between two independent Poisson random variables with means µ.3 We are now ready to introduce the Skellam Mechanism . Definition 3.2 ( The Skellam Mechanism ) . Given an integer-valued query f ( D ) 2 Zd , we define the Skellam Mechanism as Sk0 , µ ( f ( D ) ) = f ( D ) + Z , where Z ⇠ Sk0 , µ , and the total ` 2 error of the mechanism is bounded by E ⇥ k Sk0 , µ ( f ( D ) ) f ( D ) k22 ⇤ dµ . 3We only consider the symmetric version of Skellam , but it is often more generally defined as the difference of independent Poisson random variables with different variances . The Skellam mechanism was first introduced in [ 49 ] for the scalar case . As our goal is to apply the Skellam mechanism in the learning context , we have to address the following challenges . ( 1 ) Tight privacy compositions : Learning algorithms are iterative in nature and require the application of the DP mechanism many times ( often > 1000 ) . The current direct approximate DP analysis in [ 49 ] can be combined with advanced composition ( AC ) theorems [ 28 , 22 ] but that leads to poor privacy-accuracy trade-offs ( see Fig . 1 ) . ( 2 ) Privacy analysis for multi-dimensional queries : In learning algorithms , the differentially private queries are multi-dimensional ( where the dimension equals the number of model parameters , typically 106 ) . Using composition theorems lead to poor accuracy-privacy trade-offs and a direct extension of approximate DP guarantee [ 49 ] for the multi-dimensional case leads to a strong dependence on ` 1 sensitivity which is prohibitively large in high dimensions . ( 3 ) Data discretization : The gradients are naturally continuous vectors but we would like to apply an integer based mechanism . This requires properly discretizing the data while making sure that the norm of the vectors ( sensitivity of the query ) is preserved . We will tackle challenges ( 1 ) and ( 2 ) in the remainder of this section and leave ( 3 ) for the next section .

Summary: This paper studies a new to DP noise addition mechanism, based on the Skellem distribution.  The benefits of the Skellem distribution include closure under addition, a property lost on discrete Gaussians, and its discrete nature which makes it able to be exactly sampled from with finite machines, unlike continuous Gaussian noise.  Furthermore, this work bounds the increase in the scale of the noise compared with Gaussian noise for the same level of privacy.  Lastly, they provide experimental results of their approach.