Exact Privacy Guarantees for Markov Chain Implementations of the Exponential Mechanism with Artificial Atoms

1 Introduction . 1.1 Problem setup . The exponential mechanism [ 17 ] is one of the workhorses of -differential privacy ( -DP ) . Many common DP mechanisms , such as the Laplace Mechanism [ 7 ] , K-norm and K-norm gradient mechanisms [ 22 , 4 ] , pMSE mechanism [ 24 ] , and even posterior sampling under certain regularity conditions [ 26 ] , can all be viewed as instances of the exponential mechanism . In fact , any mechanism can be equivalently expressed as an instance of the exponential mechanism depending on the choice of loss function and base measure [ 2 ] . However , the output of the exponential mechanism often has an intractable distribution , making it difficult to sample from in practice . This necessitates using a sampling algorithm such as Markov chain Monte Carlo ( MCMC ) to computationally generate an approximate sample from the distribution . However , methods like these only approximate the target distribution asymptotically , meaning that the resulting sample need not satisfy the originally prescribed privacy guarantees . In practice , analyzing the privacy cost incurred due to sampling is a messy problem . Existing approaches rely on analyzing convergence rates of distances between the approximating distribution and the target distribution . While these approaches have produced nice theoretical results , the analyses are usually asymptotic and lack closed form expressions for constants required to determine finite-sample incurred costs . However , for uniformly ergodic chains that admit atoms in their state 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . space , these sampling procedures are not only more directly quantifiable but also admit finite runtime algorithms for exact simulation from the target distribution . This suggests that modifying the target distribution of the exponential mechanism to include an artificial atom may eliminate the privacy cost of implementing the sampling algorithm ; such modifications are the focus of this paper . 1.2 Contributions . Let fX ( y ) be the output density of the exponential mechanism with confidential data X and output space y ∈ Y ( we will fully define this notation in the methods section ) . In this paper , we consider sampling from fX by first sampling from a modified target density as a mixture of the form k ∈ [ 0 , 1 ] : f̃X ( y ) = ( 1− k ) fX ( y ) + kgX ( y ) . In particular , we introduce two different methods which we will give names and briefly describe : • ConfAtomPerfect gX ( y ) is a point mass at the confidential data output , and the target distribution is f̃X ( y ) conditioned on NOT releasing the confidential data , yielding an exact draw from fX . • RandomAtomPerfect gX ( y ) is the mass function for an implementation of the discrete exponential mechanism over a finite test point space . Our contributions are as follows : 1 . We use classical methods from MCMC theory to derive exact sampling algorithms for instances of the exponential mechanism with ( , δ ) -DP guarantees . 2 . We propose an exact finite-runtime algorithm ( ConfAtomPerfect ) for implementing the exponential mechanism with -DP guarantees using atomic regeneration . 3 . We derive two modifications of the previous algorithm ( i.e. , RandomAtomPerfect and ConfAtomAndRuntimePerfect ) that satisfy -DP . The first modifies the target distribution and does not resample to sample from fX , and the second allows the implementation to be independent of runtime , offering even stronger privacy guarantees . 4 . We compare the proposed methods for a few explicit examples to demonstrate a new three way trade-off between , privacy , utility , and runtime . 1.3 Related literature . Results from MCMC theory have addressed privacy loss due to approximation by analyzing convergence rates of total variational distance [ 18 ] and Rényi divergence [ 12 ] . In the latter paper , the authors argue against characterizing the distance between the MCMC sampled distribution and the target distribution in terms of total variation because it lacks the privacy-preserving compositional properties of Rényi-DP , allowing for the derivation of convergence results with better asymptotic dependence on the dimension of the output space . Our work differs in a few key directions . First , we require weaker assumptions about the loss function . In particular , V -geometric ergodicity only requires sub-exponential tails , which relaxes strict convexity and/or Lipschitz assumptions about the loss function . For our perfect sampler , we only require uniform ergodicity of the original chain , which is often achieved by virtue of bounding the database space . Second , we consider simpler classes of base MCMC algorithms that may be sufficient for a wide class of problems where the output dimension is smaller than the input dimension . Third , our work derives algorithms with exact implementation steps and exact privacy guarantees . Previous results state their results in terms of asymptotic sample complexities for the Langevin dynamics step size and run time , neither of which are immediately helpful for practitioners who want to use these algorithms and calculate their provable guarantees . 2 Methods . 2.1 Notation . We recall some definitions and theorems here : Definition 1 ( Differential Privacy [ 7 ] ) . LetM , { µX | X ∈ Xn } be a collection of probability measures over a common measurable space ( Y , F ) indexed by elements of Xn . The mechanismM satisfies ( , δ ) -DP if , for all B ∈ F and X , X ′ ∈ Xn differing on one entry : µX ( B ) ≤ e µX′ ( B ) + δ . Definition 2 ( Exponential Mechanism [ 17 ] ) . Let LX : Xn × Y 7→ [ 0 , ∞ ] be a measurable loss function for each X ∈ Xn . Suppose , for all adjacent X , X ′ ∈ Xn and y ∈ Y : |LX ( y ) − LX′ ( y ) | ≤ ∆L < ∞ . The exponential mechanism is the ( , 0 ) -DP mechanism defined by the collection of measures each with density : fX ( y ) ∝ exp ( − LX ( y ) 2∆L ) , with respect to a common base measure ν ( y ) over ( Y , F ) . Frequently , ν is taken to be the Lebesgue measure over a subset of Rd . Throughout the paper , let { µm , X } ∞m=1 be a sequence of probability measures such that µm , X converges in distribution to µX for all X ∈ Xn . We assume the chain is defined by the transition kernel ΠX : Y × F 7→ [ 0 , 1 ] and the starting value y0 ∈ Y . Throughout the paper , we use the concept of minorization : Definition 3 ( Minorization Condition ) . Suppose there exists a function s : Y 7→ [ 0 , 1 ] and probability measure ν on ( Y , F ) such that for all A ∈ F and y ∈ Y : ΠX ( y , A ) ≥ s ( y ) ν ( A ) . We call these the minorization function and measure , respectively . Define the associated remainder kernel Rν , s : Y × F 7→ [ 0 , 1 ] such that : ΠX ( y , A ) = s ( y ) ν ( A ) + ( 1− s ( y ) ) Rν , s ( y , A ) . Our results rely on the existence of minorization functions and measures for our output distribution µX . This assumption will give us uniform ergodicity properties later on . Note that a limitation of our approach is that we can not apply these methods to exponential mechanisms with unbounded output spaces such as Rk , but it does work for compact sets of Rk . In practice , this limitation is not a major barrier to generalizability , as the the output space is often intentionally bounded to control the sensitivity of the loss function , although there are exceptions ( e.g. , [ 24 ] ) . The following result shows that MCMC sampling from the exponential mechanism induces a δα penalty as a function of the upper bound on the total variation distance α : Theorem 1 ( [ 18 ] ) . A mechanismMm , { µm , X | x ∈ X } approximating the exponential mechanism , M , at time m ≥ τ ( α ) is ( , δα ) -DP where δα , α ( 1 + e ) if τ ( α ) , sup X∈Xn inf { t ≥ 0 | ‖µt , X − µX‖TV ≤ α } . Note that the upper bound on the δ cost incurred above is specific to the sequence ’ s properties ( for example , transition probabilities and starting locations for MCMC ) . However , the upper bound is not specific to the confidential data X . Such generality is necessary to preserve ( , δ ) -DP , as the mixing time can vary based on the confidential data . This means to ensure privacy , one must find realizations of X that are “ least favorable '' to ensure privacy in the worst-case scenario . One common heuristic here is to choose δ ≤ 1/n , so that the relative privacy risk violation affects , in the worst case scenario , all information about one individual in the dataset . One common “ fastmixing '' regime for these chains is a geometric rate , where the total variation distance is O ( rm ) for some r ∈ ( 0 , 1 ) : Definition 4 ( V -geometric ergodicity [ 1 ] ) . For a Markov chain where µm , X → µX in distribution as m→∞ , we say the chain is V -geometrically ergodic if there exists constants C ∈ R+ , r ∈ ( 0 , 1 ) , and a function V : Y 7→ [ 1 , ∞ ) such that for all m ∈ N and starting points y0 ∈ Y : ‖µm , X − µX‖TV ≤ ‖µm , X − µX‖V ≤ CV ( y0 ) r −m . ( 1 ) When V is a constant function , we say the chain is uniformly ergodic . Many common algorithms , such as Metropolis-Hastings [ 1 ] and common variants such as Hybrid Monte Carlo [ 23 ] and Hamiltonian Monte Carlo [ 16 ] , are geometrically ergodic under mild regularity conditions . For these algorithms , it immediately follows that for any specific realization X ∈ Xn , if we choose m = Ω ( log ( n ) ) : ‖µm , X − µX‖TV ≤ CV ( y0 ) r log ( n ) =⇒ δα = O ( 1/n ) . ( 2 ) Therefore , up to a constant , for a fast mixing sampling algorithm we require at least order log ( n ) samples to achieve a negligible δ for an empirical privacy guarantee . However , there are two complications to formalizing this idea . First , the constant of proportionality for the rate depends on , r , V , and C. Second , the mixing time depends on X , and the privacy guarantee depends on fast mixing for all possible X ∈ Xn . 2.2 Properties of Markov chains whose state spaces admit atoms . The complications above can be alleviated when the target distribution admits an atom , specifically a proper accessible atom with respect to the transition kernel ΠX : Definition 5 ( Proper Accessible Atom ) . A set γ ∈ F is a proper accessible atom if : 1 . ( Regeneration measure ) There exists a measure µregen on ( Y , F ) such that : ΠX ( y , A ) = µregen ( A ) ∀y ∈ γ , A ∈ F . 2 . ( Accessibility criteria ) ΠX ( y , γ ) > 0 ∀y ∈ Y . 3 . ( Recurrence criteria ) the chain returns infinitely often to γ with probability 1 . When the state space admits an atom , the constants in Equation 1 have closed form expressions ( see [ 1 , Theorem 4.1 ] for an example ) . Furthermore , Markov chains that admit atoms have a special split chain representation [ 20 ] , where the state space is extended with a binary indicator indicating presence in the atom ( i.e. , Y × { 0 , 1 } ) . For this split chain , let τ be the time it takes for the split Markov chain to return to said proper accessible atom after leaving it . Hobert et al . [ 13 ] show that the stationary distribution admits an infinite mixture form : µX ( A ) = ∞∑ m=1 P ( τ ≥ m ) E [ τ ] P ( Ym ∈ A | τ ≥ m ) . If one can sample from the mixture components as well as the conditional distributions feasibly ( i.e. , in finite expected time ) , then one can sample from µX . Following [ 15 ] , the authors focus on the singleton case when γ = { a } for some a ∈ Y . Define : p ( y ) , ΠX ( y , { a } ) . If there exists β > 0 such that infy∈Y p ( y ) > β > 0 , then wen can use Algorithm 1 to produce an exact sample from the target distribution . Because many target distributions do not admit the atom required , Brockwell [ 6 ] proposes a way to introduce an artificial atom into a new stationary density f̃X . In our setting , we propose introducing an atom at the confidential response mixed with the -DP stationary distribution with proportions k and 1− k , respectively , for some k ∈ ( 0 , 1 ) : f̃X ( y ) , ( 1− k ) fX ( y ) + k1 { y=a } , with respect to a new base measure : ν̃ , ( 1− k ) ν + kξa , where ν is the original base measure and ξa is the Dirac delta function representing a point mass at the confidential data . In particular , if the Metropolis-Hastings kernel has symmetric proposal density qX ( y , y ′ ) , then one can construct a new Metropolis-Hastings transition kernel Π̃ with symmetric proposal density : q̃ ( y , y′ ) = 1 2 [ qX ( y , y ′ ) + 1 { y′=a } ] . Algorithm 1 : Exact implementation for sampling from a singleton atom mixture [ 15 ] Result : Y ∼ µ̃X Input : Transition kernel ΠX , singleton atom a ∈ Y , minorization β > 0 Sample M ∼ Geometric ( β ) , set Y1 = a ; for m = 2 to M do Using the Bernoulli factory algorithm [ 14 ] , sample : Zm ∼ Bernoulli ( 1− Π̃X ( Ym−1 , { a } ) 1− β ) if Zm = 1 then Sample Ym ∼ Rξa , Π̃X ( · , { a } ) ( Ym−1 , · ) using rejection : 1 . Propose Y ∗m ∼ Π̃X ( Ym−1 , · ) . 2 . Accept if Y ∗m 6= a , else go back to 1. else Ym = a end Release YM . end

Summary: The paper proposes a MCMC approach to mimicking the DP Exponential Mechanism. Moreover, its main claim to fame is that it gives sufficient conditions for finite-time convergence. These conditions are based on the existence of "atoms" (Def.4), which, in this work's setting, is the optimal state. In addition, the approach is evaluated on two cases (mean estimation and Ridge Rigression on a bounded domain.