Exact Privacy Guarantees for Markov Chain Implementations of the Exponential Mechanism with Artificial Atoms

1 Introduction . 1.1 Problem setup . The exponential mechanism [ 17 ] is one of the workhorses of -differential privacy ( -DP ) . Many common DP mechanisms , such as the Laplace Mechanism [ 7 ] , K-norm and K-norm gradient mechanisms [ 22 , 4 ] , pMSE mechanism [ 24 ] , and even posterior sampling under certain regularity conditions [ 26 ] , can all be viewed as instances of the exponential mechanism . In fact , any mechanism can be equivalently expressed as an instance of the exponential mechanism depending on the choice of loss function and base measure [ 2 ] . However , the output of the exponential mechanism often has an intractable distribution , making it difficult to sample from in practice . This necessitates using a sampling algorithm such as Markov chain Monte Carlo ( MCMC ) to computationally generate an approximate sample from the distribution . However , methods like these only approximate the target distribution asymptotically , meaning that the resulting sample need not satisfy the originally prescribed privacy guarantees . In practice , analyzing the privacy cost incurred due to sampling is a messy problem . Existing approaches rely on analyzing convergence rates of distances between the approximating distribution and the target distribution . While these approaches have produced nice theoretical results , the analyses are usually asymptotic and lack closed form expressions for constants required to determine finite-sample incurred costs . However , for uniformly ergodic chains that admit atoms in their state 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . space , these sampling procedures are not only more directly quantifiable but also admit finite runtime algorithms for exact simulation from the target distribution . This suggests that modifying the target distribution of the exponential mechanism to include an artificial atom may eliminate the privacy cost of implementing the sampling algorithm ; such modifications are the focus of this paper . 1.2 Contributions . Let fX ( y ) be the output density of the exponential mechanism with confidential data X and output space y ∈ Y ( we will fully define this notation in the methods section ) . In this paper , we consider sampling from fX by first sampling from a modified target density as a mixture of the form k ∈ [ 0 , 1 ] : f̃X ( y ) = ( 1− k ) fX ( y ) + kgX ( y ) . In particular , we introduce two different methods which we will give names and briefly describe : • ConfAtomPerfect gX ( y ) is a point mass at the confidential data output , and the target distribution is f̃X ( y ) conditioned on NOT releasing the confidential data , yielding an exact draw from fX . • RandomAtomPerfect gX ( y ) is the mass function for an implementation of the discrete exponential mechanism over a finite test point space . Our contributions are as follows : 1 . We use classical methods from MCMC theory to derive exact sampling algorithms for instances of the exponential mechanism with ( , δ ) -DP guarantees . 2 . We propose an exact finite-runtime algorithm ( ConfAtomPerfect ) for implementing the exponential mechanism with -DP guarantees using atomic regeneration . 3 . We derive two modifications of the previous algorithm ( i.e. , RandomAtomPerfect and ConfAtomAndRuntimePerfect ) that satisfy -DP . The first modifies the target distribution and does not resample to sample from fX , and the second allows the implementation to be independent of runtime , offering even stronger privacy guarantees . 4 . We compare the proposed methods for a few explicit examples to demonstrate a new three way trade-off between , privacy , utility , and runtime . 1.3 Related literature . Results from MCMC theory have addressed privacy loss due to approximation by analyzing convergence rates of total variational distance [ 18 ] and Rényi divergence [ 12 ] . In the latter paper , the authors argue against characterizing the distance between the MCMC sampled distribution and the target distribution in terms of total variation because it lacks the privacy-preserving compositional properties of Rényi-DP , allowing for the derivation of convergence results with better asymptotic dependence on the dimension of the output space . Our work differs in a few key directions . First , we require weaker assumptions about the loss function . In particular , V -geometric ergodicity only requires sub-exponential tails , which relaxes strict convexity and/or Lipschitz assumptions about the loss function . For our perfect sampler , we only require uniform ergodicity of the original chain , which is often achieved by virtue of bounding the database space . Second , we consider simpler classes of base MCMC algorithms that may be sufficient for a wide class of problems where the output dimension is smaller than the input dimension . Third , our work derives algorithms with exact implementation steps and exact privacy guarantees . Previous results state their results in terms of asymptotic sample complexities for the Langevin dynamics step size and run time , neither of which are immediately helpful for practitioners who want to use these algorithms and calculate their provable guarantees . 2 Methods . 2.1 Notation . We recall some definitions and theorems here : Definition 1 ( Differential Privacy [ 7 ] ) . LetM , { µX | X ∈ Xn } be a collection of probability measures over a common measurable space ( Y , F ) indexed by elements of Xn . The mechanismM satisfies ( , δ ) -DP if , for all B ∈ F and X , X ′ ∈ Xn differing on one entry : µX ( B ) ≤ e µX′ ( B ) + δ . Definition 2 ( Exponential Mechanism [ 17 ] ) . Let LX : Xn × Y 7→ [ 0 , ∞ ] be a measurable loss function for each X ∈ Xn . Suppose , for all adjacent X , X ′ ∈ Xn and y ∈ Y : |LX ( y ) − LX′ ( y ) | ≤ ∆L < ∞ . The exponential mechanism is the ( , 0 ) -DP mechanism defined by the collection of measures each with density : fX ( y ) ∝ exp ( − LX ( y ) 2∆L ) , with respect to a common base measure ν ( y ) over ( Y , F ) . Frequently , ν is taken to be the Lebesgue measure over a subset of Rd . Throughout the paper , let { µm , X } ∞m=1 be a sequence of probability measures such that µm , X converges in distribution to µX for all X ∈ Xn . We assume the chain is defined by the transition kernel ΠX : Y × F 7→ [ 0 , 1 ] and the starting value y0 ∈ Y . Throughout the paper , we use the concept of minorization : Definition 3 ( Minorization Condition ) . Suppose there exists a function s : Y 7→ [ 0 , 1 ] and probability measure ν on ( Y , F ) such that for all A ∈ F and y ∈ Y : ΠX ( y , A ) ≥ s ( y ) ν ( A ) . We call these the minorization function and measure , respectively . Define the associated remainder kernel Rν , s : Y × F 7→ [ 0 , 1 ] such that : ΠX ( y , A ) = s ( y ) ν ( A ) + ( 1− s ( y ) ) Rν , s ( y , A ) . Our results rely on the existence of minorization functions and measures for our output distribution µX . This assumption will give us uniform ergodicity properties later on . Note that a limitation of our approach is that we can not apply these methods to exponential mechanisms with unbounded output spaces such as Rk , but it does work for compact sets of Rk . In practice , this limitation is not a major barrier to generalizability , as the the output space is often intentionally bounded to control the sensitivity of the loss function , although there are exceptions ( e.g. , [ 24 ] ) . The following result shows that MCMC sampling from the exponential mechanism induces a δα penalty as a function of the upper bound on the total variation distance α : Theorem 1 ( [ 18 ] ) . A mechanismMm , { µm , X | x ∈ X } approximating the exponential mechanism , M , at time m ≥ τ ( α ) is ( , δα ) -DP where δα , α ( 1 + e ) if τ ( α ) , sup X∈Xn inf { t ≥ 0 | ‖µt , X − µX‖TV ≤ α } . Note that the upper bound on the δ cost incurred above is specific to the sequence ’ s properties ( for example , transition probabilities and starting locations for MCMC ) . However , the upper bound is not specific to the confidential data X . Such generality is necessary to preserve ( , δ ) -DP , as the mixing time can vary based on the confidential data . This means to ensure privacy , one must find realizations of X that are “ least favorable '' to ensure privacy in the worst-case scenario . One common heuristic here is to choose δ ≤ 1/n , so that the relative privacy risk violation affects , in the worst case scenario , all information about one individual in the dataset . One common “ fastmixing '' regime for these chains is a geometric rate , where the total variation distance is O ( rm ) for some r ∈ ( 0 , 1 ) : Definition 4 ( V -geometric ergodicity [ 1 ] ) . For a Markov chain where µm , X → µX in distribution as m→∞ , we say the chain is V -geometrically ergodic if there exists constants C ∈ R+ , r ∈ ( 0 , 1 ) , and a function V : Y 7→ [ 1 , ∞ ) such that for all m ∈ N and starting points y0 ∈ Y : ‖µm , X − µX‖TV ≤ ‖µm , X − µX‖V ≤ CV ( y0 ) r −m . ( 1 ) When V is a constant function , we say the chain is uniformly ergodic . Many common algorithms , such as Metropolis-Hastings [ 1 ] and common variants such as Hybrid Monte Carlo [ 23 ] and Hamiltonian Monte Carlo [ 16 ] , are geometrically ergodic under mild regularity conditions . For these algorithms , it immediately follows that for any specific realization X ∈ Xn , if we choose m = Ω ( log ( n ) ) : ‖µm , X − µX‖TV ≤ CV ( y0 ) r log ( n ) =⇒ δα = O ( 1/n ) . ( 2 ) Therefore , up to a constant , for a fast mixing sampling algorithm we require at least order log ( n ) samples to achieve a negligible δ for an empirical privacy guarantee . However , there are two complications to formalizing this idea . First , the constant of proportionality for the rate depends on , r , V , and C. Second , the mixing time depends on X , and the privacy guarantee depends on fast mixing for all possible X ∈ Xn . 2.2 Properties of Markov chains whose state spaces admit atoms . The complications above can be alleviated when the target distribution admits an atom , specifically a proper accessible atom with respect to the transition kernel ΠX : Definition 5 ( Proper Accessible Atom ) . A set γ ∈ F is a proper accessible atom if : 1 . ( Regeneration measure ) There exists a measure µregen on ( Y , F ) such that : ΠX ( y , A ) = µregen ( A ) ∀y ∈ γ , A ∈ F . 2 . ( Accessibility criteria ) ΠX ( y , γ ) > 0 ∀y ∈ Y . 3 . ( Recurrence criteria ) the chain returns infinitely often to γ with probability 1 . When the state space admits an atom , the constants in Equation 1 have closed form expressions ( see [ 1 , Theorem 4.1 ] for an example ) . Furthermore , Markov chains that admit atoms have a special split chain representation [ 20 ] , where the state space is extended with a binary indicator indicating presence in the atom ( i.e. , Y × { 0 , 1 } ) . For this split chain , let τ be the time it takes for the split Markov chain to return to said proper accessible atom after leaving it . Hobert et al . [ 13 ] show that the stationary distribution admits an infinite mixture form : µX ( A ) = ∞∑ m=1 P ( τ ≥ m ) E [ τ ] P ( Ym ∈ A | τ ≥ m ) . If one can sample from the mixture components as well as the conditional distributions feasibly ( i.e. , in finite expected time ) , then one can sample from µX . Following [ 15 ] , the authors focus on the singleton case when γ = { a } for some a ∈ Y . Define : p ( y ) , ΠX ( y , { a } ) . If there exists β > 0 such that infy∈Y p ( y ) > β > 0 , then wen can use Algorithm 1 to produce an exact sample from the target distribution . Because many target distributions do not admit the atom required , Brockwell [ 6 ] proposes a way to introduce an artificial atom into a new stationary density f̃X . In our setting , we propose introducing an atom at the confidential response mixed with the -DP stationary distribution with proportions k and 1− k , respectively , for some k ∈ ( 0 , 1 ) : f̃X ( y ) , ( 1− k ) fX ( y ) + k1 { y=a } , with respect to a new base measure : ν̃ , ( 1− k ) ν + kξa , where ν is the original base measure and ξa is the Dirac delta function representing a point mass at the confidential data . In particular , if the Metropolis-Hastings kernel has symmetric proposal density qX ( y , y ′ ) , then one can construct a new Metropolis-Hastings transition kernel Π̃ with symmetric proposal density : q̃ ( y , y′ ) = 1 2 [ qX ( y , y ′ ) + 1 { y′=a } ] . Algorithm 1 : Exact implementation for sampling from a singleton atom mixture [ 15 ] Result : Y ∼ µ̃X Input : Transition kernel ΠX , singleton atom a ∈ Y , minorization β > 0 Sample M ∼ Geometric ( β ) , set Y1 = a ; for m = 2 to M do Using the Bernoulli factory algorithm [ 14 ] , sample : Zm ∼ Bernoulli ( 1− Π̃X ( Ym−1 , { a } ) 1− β ) if Zm = 1 then Sample Ym ∼ Rξa , Π̃X ( · , { a } ) ( Ym−1 , · ) using rejection : 1 . Propose Y ∗m ∼ Π̃X ( Ym−1 , · ) . 2 . Accept if Y ∗m 6= a , else go back to 1. else Ym = a end Release YM . end

Summary: This paper explores the use of finite runtime samplers applied on exponential mechanism (EM). The paper presents two main contributions: (1) an algorithm to produce exact samples from EM under certain conditions, (2) an algorithm to alleviate computational cost of contribution (1) with a loss in utility. There are also experiments that demonstrates the utility tradeoff between (1) and (2).