The Skellam Mechanism for Differentially Private Federated Learning

1 Introduction . The Gaussian mechanism is the workhorse for a multitude of differentially private learning algorithms [ 46 , 10 , 1 ] . While simple enough for mathematical reasoning and privacy accounting analyses , its continuous nature presents a number of challenges in practice . For example , it can not be exactly represented on finite computers , making it prone to numerical errors that can break its privacy guarantees [ 35 ] . Moreover , it can not be used in distributed learning settings with cryptographic multi-party computation primitives involving modular arithmetic , such as secure aggregation [ 12 , 11 ] . To address these shortcomings , the binomial and ( distributed ) discrete Gaussian mechanisms were recently introduced [ 19 , 2 , 15 , 25 ] . Unfortunately , both have their own drawbacks : the privacy loss for the binomial mechanism can be infinite with a non-zero probability , and the discrete Gaussian : ( a ) is not closed under summation ( i.e . sum of discrete Gaussians is not a discrete Gaussian ) , complicating analysis in distributed settings and leading to a performance worse than continuous Gaussian in the highly distributed , low-noise regime [ 25 ] ; ( b ) requires a sampling algorithm that is not shipped with mainstream machine learning or data analysis software packages , making it difficult for engineers to use it in production settings ( naïve implementations may lead to catastrophic privacy errors ) . Our contributions To overcome these limitations , we introduce and analyze the multi-dimensional Skellam mechanism , a mechanism based on adding noise distributed according to the difference of two independent Poisson random variables . The Skellam noise is closed under summation ( i.e . sums of Skellam random variables is again Skellam distributed ) and can be sampled from easily – efficient Poisson samplers are widely available in numerical software packages . Being discrete in nature also ⇤Work done while at Google Research . §Alphabetical authorship . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . means that it can mesh well cryptographic protocols and can lead to communication savings . To analyze the privacy guarantees of the Skellam mechanism and compare it with other mechanisms , we provide a numerical evaluation of the privacy loss random variable and prove a sharp bound on the Rényi divergence between two shifted Skellam distributions . Our careful analysis shows that for a multi-dimensional query function with ` 1 sensitivity 1 and ` 2 sensitivity 2 , the Skellam mechanism with variance µ achieves ( ↵ , `` ( ↵ ) ) Rényi differential privacy ( RDP ) [ 36 ] for `` ( ↵ ) ↵ 2 2µ +min ⇣ ( 2↵ 1 ) 2+6 1 4µ2 , 3 1 2µ ⌘ ( see Theorem 3.5 ) . This implies that the RDP guarantees are at most 1 +O ( 1/µ ) times worse than those of the Gaussian mechanism . To analyze the performance of the Skellam mechanism in practice , we consider a differentially private and communication constrained federated learning ( FL ) setting [ 26 ] where the noise is added locally to the d-dimensional discretized client updates that are then summed securely via a cryptographic protocol , such as secure aggregation ( SecAgg ) [ 11 , 12 ] . We provide an end-to-end algorithm that appropriately discretizes the data and applies the Skellam mechanism along with modular arithmetic to bound the range of the data and communication costs before applying SecAgg . We show on distributed mean estimation and two benchmark FL datasets , Federated EMNIST [ 14 ] and Stack Overflow [ 8 ] , that our method can match the performance of the continuous Gaussian baseline under tight privacy and communication budgets , despite using generic RDP amplification via sampling [ 51 ] for our approach and the precise RDP analysis for the subsampled Gaussian mechanism [ 37 ] . Our method is implemented in TensorFlow Privacy [ 32 ] and TensorFlow Federated [ 24 ] and will be open-sourced.2 While we mostly focus on FL applications , the Skellam mechanism can also be applied in other contexts of learning and analytics , including centralized settings . Related work The Skellam mechanism was first introduced in the context of computational differential privacy from lattice-based cryptography [ 49 ] and private Bayesian inference [ 45 ] . However , the privacy analyses in the prior work do not readily extend to the multi-dimensional case , and they give direct bounds for pure or approximate DP which makes only advanced composition theorems [ 28 , 22 ] directly applicable in learning settings where the mechanism is applied many times . For example , the guarantees from [ 49 ] lead to poor accuracy-privacy trade-offs as demonstrated in Fig . 1 . Moreover , we show in Section 3.1 that extending the direct privacy analysis to the multi-dimensional setting is non-trivial because the worst-case neighboring dataset pair is unknown in this case . For these reasons , our tight privacy analysis via a sharp RDP bound makes the Skellam mechanism practical for learning applications for the first time . These guarantees ( almost ) match those of the Gaussian mechanism and allow us to use generic RDP amplification via subsampling methods [ 51 ] . The closest mechanisms to Skellam are the binomial [ 2 , 19 ] and the discrete Gaussian mechanisms [ 15 , 25 ] . The binomial mechanism can ( asymptotically ) match the continuous Gaussian mechanism ( when properly scaled ) . However , it does not achieve Rényi or zero-concentrated DP [ 36 , 13 ] and has a privacy loss that can be infinite with a non-zero probability , leading to catastrophic privacy failures . The discrete Gaussian mechanism yields Rényi DP and can be applied to distributed settings [ 25 ] , but it requires a sampling algorithm that is not yet available in data analysis software packages despite being explored in the lattice-based cryptography community ( e.g. , [ 43 , 18 , 38 ] ) . The discrete Gaussian is also not closed under summation and the divergence can be large in highly distributed low-noise settings ( e.g . quantile estimation [ 6 ] and federated analytics [ 42 ] ) , which causes privacy degradation . See the end of Section 4 for more discussion . 2 Preliminaries . We begin by providing a formal definition for ( `` , ) -differential privacy ( DP ) [ 20 ] . Definition 2.1 ( Differential Privacy ) . For `` , 0 , a randomized mechanism M satisfies ( `` , ) -DP if for all neighboring datasets D , D0 and all S in the range of M , we have that P ( M ( D ) 2 S ) e '' P ( M ( D0 ) 2 S ) + , where D and D0 are neighboring pairs if they can be obtained from each other by adding or removing all the records that belong to a particular user . In our experiments we consider user-level differential privacy – i.e. , D and D0 are neighboring pairs 2https : //github.com/google-research/federated/tree/master/distributed_dp if one of them can be obtained from the other by adding or removing all the records associated with a single user [ 33 ] . This is stronger than the commonly-used notion of item level privacy where , if a user contributes multiple records , only the addition or removal of one record is protected . We also make use of Rényi differential privacy ( RDP ) [ 36 ] which allows for tight privacy accounting . Definition 2.2 ( Rényi Differential Privacy ) . A mechanism M satisfies ( ↵ , `` ) -RDP if for any two neighboring datasets D , D0 , we have that D↵ ( M ( D ) , M ( D0 ) ) `` where D↵ ( P , Q ) is the Rényi divergence between P and Q and is given by D↵ ( P , Q ) , 1 ↵ 1 log ✓ Ex⇠Q ✓ P ( x ) Q ( x ) ◆↵ ◆ = 1 ↵ 1 log Ex⇠P `` ✓ P ( x ) Q ( x ) ◆↵ 1 # ! . A closely related privacy notion is zero-concentrated DP ( zCDP ) [ 21 , 13 ] . In fact , 12 '' 2-zCDP is equivalent to simultaneously satisfying an infinite family of RDP guarantees , namely ( ↵ , 12 '' 2↵ ) - Rényi differential privacy for all ↵ 2 ( 1,1 ) . The following conversion lemma from [ 13 , 15 , 7 ] relates RDP to ( `` , ) -DP . Lemma 2.3 . If M satisfies ( ↵ , `` ) -RDP , then , for any > 0 , M satisfies ( `` DP ( ) , ) -DP , where '' DP ( ) = inf ↵ > 1 '' + log ( 1/↵ ) ↵ 1 + log ( 1 1/↵ ) . For any query function f , we define the p sensitivity as maxD , D0 kf ( D ) f ( D0 ) kp , where D and D0 are neighboring pairs differing by adding or removing all the records from a particular user . We also include the RDP guarantees of the discrete Gaussian mechanism ( same RDP guarantees as the continuous Gaussian mechanism ) to which we compare our method . Definition 2.4 ( The Discrete Gaussian Mechanism [ 15 ] ) . Given an integer-valued query f ( D ) 2 Zd and noise variance µ , the Discrete Gaussian ( DGaussian ) Mechanism is given by f ( D ) + Z , where Z ⇠ NZ ( 0 , µ ) , and NZ ( 0 , µ ) denotes the discrete Gaussian distribution defined in Equation ( 1 ) of [ 15 ] . The discrete Gaussian mechanism achieves ( ↵ , ↵ 2 2 2µ ) -Rényi DP . 3 The Skellam Mechanism . We begin by presenting the definition of the Skellam distribution , which is the basis of the Skellam Mechanism for releasing integer ranged multi-dimensional queries . Definition 3.1 ( Skellam Distribution ) . The multidimensional Skellam distribution Sk , µ over Zd with mean 2 Zd and variance µ is given with each coordinate Xi distributed independently as Xi ⇠ Sk i , µ with P ( Xi = k ) = e µIk i ( µ ) , for k 2 Z . Here , I⌫ ( x ) is the modified Bessel function of the first kind . A key property of Skellam random variables which motivates their use in DP is that they are closed under summation , i.e . let X1 ⇠ Sk 1 , µ1 and X2 ⇠ Sk 2 , µ2 then X1 + X2 ⇠ Sk 1+ 2 , µ1+µ2 . This follows from the fact that a Skellam random variable X can be obtained by taking the difference between two independent Poisson random variables with means µ.3 We are now ready to introduce the Skellam Mechanism . Definition 3.2 ( The Skellam Mechanism ) . Given an integer-valued query f ( D ) 2 Zd , we define the Skellam Mechanism as Sk0 , µ ( f ( D ) ) = f ( D ) + Z , where Z ⇠ Sk0 , µ , and the total ` 2 error of the mechanism is bounded by E ⇥ k Sk0 , µ ( f ( D ) ) f ( D ) k22 ⇤ dµ . 3We only consider the symmetric version of Skellam , but it is often more generally defined as the difference of independent Poisson random variables with different variances . The Skellam mechanism was first introduced in [ 49 ] for the scalar case . As our goal is to apply the Skellam mechanism in the learning context , we have to address the following challenges . ( 1 ) Tight privacy compositions : Learning algorithms are iterative in nature and require the application of the DP mechanism many times ( often > 1000 ) . The current direct approximate DP analysis in [ 49 ] can be combined with advanced composition ( AC ) theorems [ 28 , 22 ] but that leads to poor privacy-accuracy trade-offs ( see Fig . 1 ) . ( 2 ) Privacy analysis for multi-dimensional queries : In learning algorithms , the differentially private queries are multi-dimensional ( where the dimension equals the number of model parameters , typically 106 ) . Using composition theorems lead to poor accuracy-privacy trade-offs and a direct extension of approximate DP guarantee [ 49 ] for the multi-dimensional case leads to a strong dependence on ` 1 sensitivity which is prohibitively large in high dimensions . ( 3 ) Data discretization : The gradients are naturally continuous vectors but we would like to apply an integer based mechanism . This requires properly discretizing the data while making sure that the norm of the vectors ( sensitivity of the query ) is preserved . We will tackle challenges ( 1 ) and ( 2 ) in the remainder of this section and leave ( 3 ) for the next section .

Summary: This paper proposed a new discrete differential privacy mechanism based on the difference between two independent poisson random variables, which may be a new attractive alternative of discrete Gaussian mechanism. The authors also carefully proves a sharp privacy guarantee via privacy loss distribution, and renyi divergences. Extensive experiments results on centralized, federated learning, demonstrate that the effectiveness of proposed methods.