Adapting to function difficulty and growth conditions in private optimization

√ d/nε privacy rate to the faster ( √ d/nε ) κ κ−1 . Crucially , they achieve these rates without knowledge of the growth constant κ of the function . Our algorithms build upon the inverse sensitivity mechanism , which adapts to instance difficulty [ 2 ] , and recent localization techniques in private optimization [ 25 ] . We complement our algorithms with matching lower bounds for these function classes and demonstrate that our adaptive algorithm is simultaneously ( minimax ) optimal over all κ ≥ 1 + c whenever c = Θ ( 1 ) . 1 Introduction . Stochastic convex optimization ( SCO ) is a central problem in machine learning and statistics , where for a sample space S , parameter space X ⊂ Rd , and a collection of convex losses { F ( · ; s ) : s ∈ S } , one wishes to solve minimize x∈X f ( x ) : = ES∼P [ F ( x ; S ) ] = ∫ S F ( x ; s ) dP ( s ) ( 1 ) using an observed dataset S = Sn1 iid∼ P . While as formulated , the problem is by now fairly well-understood [ 12 , 38 , 29 , 10 , 37 ] , it is becoming clear that , because of considerations beyond pure statistical accuracy—memory or communication costs [ 45 , 26 , 13 ] , fairness [ 23 , 28 ] , personalization or distributed learning [ 35 ] —problem ( 1 ) is simply insufficient to address modern learning problems . To that end , researchers have revisited SCO under the additional constraint that the solution preserves the privacy of the provided sample [ 22 , 21 , 1 , 16 , 19 ] . A waypoint is Bassily et al . [ 7 ] , who provide a private method with optimal convergence rates for the related empirical risk minimization problem , with recent papers focus on SCO providing ( worst-case ) optimal rates in various settings : smooth convex functions [ 8 , 25 ] , non-smooth functions [ 9 ] , non-Euclidean geometry [ 5 , 4 ] and under more stringent privacy constraints [ 34 ] . Yet these works ground their analyses in worst-case scenarios and provide guarantees for the hardest instance of the class of problems they consider . Conversely , they argue that their algorithms are optimal in a minimax sense : for any algorithm , there exists a hard instance on which the error achieved by the algorithm is equal to the upper bound . While valuable , these results are pessimistic—the exhibited hard instances are typically pathological—and fail to reflect achievable performance . ∗Equal contribution . Author order determined by coin toss . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . In this work , we consider the problem of adaptivity when solving ( 1 ) under privacy constraints . Importantly , we wish to provide private algorithms that adapt to the hardness of the objective f . A loss function f may belong to multiple problem classes , each exhibiting different achievable rates , so a natural desideratum is to attain the error rate of the easiest sub-class . As a simple vignette , if one gets an arbitrary 1-Lipschitz convex loss function f , the worst-case guarantee of any ε-DP algorithm is Θ ( 1/ √ n+d/ ( nε ) ) . However , if one learns that f exhibits some growth property—say f is 1-strongly convex—the regret guarantee improves to the faster Θ ( 1/n + ( d/ ( nε ) ) 2 ) rate with the appropriate algorithm . It is thus important to provide algorithms that achieves the rates of the “ easiest ” class to which the function belongs [ 32 , 46 , 18 ] . To that end , consider the nested classes of functions Fκ for κ ∈ [ 1 , ∞ ] such that , if f ∈ Fκ then there exists λ > 0 such that for all x ∈ X , f ( x ) − inf x′∈X f ( x′ ) ≥ λ κ ‖x− x ? ‖κ2 . For example , strong convexity implies growth with parameter κ = 2 . This growth assumption closely relates to uniform convexity [ 32 ] and the Polyak-Kurdyka-Łojasiewicz inequality [ 11 ] , and we make these connections precise in Section 2 . Intuitively , smaller κ makes the function much easier to optimize : the error around the optimal point grows quickly . Objectives with growth are widespread in machine learning applications : among others , the ` 1-regularized hinge loss exhibits sharp growth ( i.e . κ = 1 ) while ` 1- or ` ∞-constrained κ-norm regression —i.e . s = ( a , b ) ∈ Rd×R and F ( x ; s ) = |b − 〈a , x〉|κ—has κ-growth for any κ integer greater than 2 [ 43 ] . In this work , we provide private adaptive algorithms that adapt to the actual growth of the function at hand . We begin our analysis by examining Asi and Duchi ’ s inverse sensitivity mechanism [ 2 ] on ERM as a motivation . While not a practical algorithm , it achieves instance-optimal rates for any onedimensional function under mild assumptions , quantifying the best bound one could hope to achieve with an adaptive algorithm , and showing ( in principle ) that adaptive private algorithms can exist . We first show that for any function with κ-growth , the inverse sensitivity mechanism achieves privacy cost ( d/ ( nε ) ) κ/ ( κ−1 ) ; importantly , without knowledge of the function class Fκ , that f belongs to . This constitutes grounding and motivation for our work in three ways : ( i ) it validates our choice of sub-classes Fκ as the privacy rate is effectively controlled by the value of κ , ( ii ) it exhibits the rate we wish to achieve with efficient algorithms on Fκ and ( iii ) it showcases that for easier functions , privacy costs shrink significantly—to illustrate , for κ = 5/4 the privacy rate becomes ( d/ ( nε ) ) 5 . We continue our treatment of problem ( 1 ) under growth in Section 4 and develop practical algorithms that achieve the rates of the inverse sensitivity mechanism . Moreover , for approximate ( ε , δ ) differential privacy , our algorithms improve the rates , achieving roughly ( √ d/ ( nε ) ) κ/ ( κ−1 ) . Our algorithms hinge on a reduction to SCO : we show that by solving a sequence of increasingly constrained SCO problems , one achieves the right rate whenever the function exhibits growth at the optimum . Importantly , our algorithm only requires a lower bound κ ≤ κ ( where κ is the actual growth of f ) . We provide optimality guarantees for our algorithms in Section 5 and show that both the inverse sensitivity and the efficient algorithms of Section 4 are simultaneously minimax optimal over all classes Fκ whenever κ = 1 + Θ ( 1 ) and d = 1 for ε-DP algorithms . Finally , we prove that in arbitrary dimension , for both pure- and approximate-DP constraints , our algorithms are also simultaneously optimal for all classes Fκ with κ ≥ 2 . On the way , we provide results that may be of independent interest to the community . First , we develop optimal algorithms for SCO under pure differential privacy constraints , which , to the best of our knowledge , do not exist in the literature . Secondly , our algorithms and analysis provide high-probability bounds on the loss , whereas existing results only provide ( weaker ) bounds on the expected loss . Finally , we complete the results of Ramdas and Singh [ 40 ] on ( non-private ) optimization lower bounds for functions with κ-growth by providing information-theoretic lower bounds ( in contrast to oracle-based lower bounds that rely on observing only gradient information ) and capturing the optimal dependence on all problem parameters ( namely d , L and λ ) . 1.1 Related work . Convex optimization is one of the best studied problems in private data analysis [ 16 , 19 , 41 , 7 ] . The first papers in this line of work mainly study minimizing the empirical loss , and readily establish that the ( minimax ) optimal privacy rates are d/nε for pure ε-DP and √ d log ( 1/δ ) /nε for ( ε , δ ) -DP [ 16 , 7 ] . More recently , several works instead consider the harder problem of privately minimizing the population loss [ 8 , 25 ] . These papers introduce new algorithmic techniques to obtain the worst-case optimal rates of 1/ √ n+ √ d log ( 1/δ ) /nε for ( ε , δ ) -DP . They also show how to improve this rate to the faster 1/n + d log ( 1/δ ) / ( nε ) 2 in the case of 1-strongly convex functions . Our work subsumes both of these results as they correspond to κ = ∞ and κ = 2 respectively . To the best of our knowledge , there has been no work in private optimization that investigates the rates under general κ-growth assumptions or adaptivity to such conditions . In contrast , the optimization community has extensively studied growth assumptions [ 40 , 32 , 15 ] and show that on these problems , carefully crafted algorithms improves upon the standard 1/ √ n for convex functions to the faster ( 1/ √ n ) κ/ ( κ−1 ) . [ 32 ] derives worst-case optimal ( in the first-order oracle model ) gradient algorithms in the uniformly convex case ( i.e . κ ≥ 2 ) and provides technique to adapt to the growth κ , while [ 40 ] , drawing connections between growth conditions and active learning , provides upper and lower bounds in the first-order stochastic oracle model . We complete the results of the latter and provide information-theoretic lower bounds that have optimal dependence on d , λ and n—their lower bound only holding for λ inversely proportional to d1/2−1/κ , when κ ≥ 2 . Closest to our work is [ 15 ] who studies instance-optimality via local minimax complexity [ 14 ] . For one-dimensional functions , they develop a bisection-based instance-optimal algorithm and show that on individual functions of the form t 7→ κ−1|t|κ , the local minimax rate is ( 1/ √ n ) κ/ ( κ−1 ) . 2 Preliminaries . We first provide notation that we use throughout this paper , define useful assumptions and present key definitions in convex analysis and differential privacy . Notation . n typically denotes the sample size and d the dimension . Throughout this work , x refers to the optimization variable , X ⊂ Rd to the constraint set and s to elements ( S when random ) of the sample space S. We usually denote by F : X × S→ R the ( convex ) loss function and for a dataset S = ( s1 , . . . , sn ) ⊂ S , we define the empirical and population losses fS ( x ) : = 1 n ∑ i≤n F ( x ; si ) and f ( x ) : = ES∼P [ F ( x ; S ) ] . We omit the dependence on P as it is often clear from context . We reserve ε , δ ≥ 0 for the privacy parameters of Definition 2.1 . We always take gradients with respect to the optimization variable x . In the case that F ( · ; s ) is not differentiable at x , we override notation and define ∇F ( x ; s ) = argming∈∂F ( x ; s ) ‖g‖2 , where ∂F ( x ; s ) is the subdifferential of F ( · ; s ) at x . We use A for ( potentially random ) mechanism and Sn1 as a shorthand for ( S1 , . . . , Sn ) . For p ≥ 1 , ‖ · ‖p is the standard ` p-norm , Bdp ( R ) is the corresponding d-dimensional p-ball of radius R and p ? is the dual of p , i.e . such that 1/p ? + 1/p = 1 . Finally , we define the Hamming distance between datasets dHam ( S , S ′ ) : = infσ∈Sn 1 { si 6= s′σ ( i ) } , where Sn is the set of permutations over sets of size n. Assumptions . We first state standard assumptions for solving ( 1 ) . We assume that X is a closed , convex domain such that diam2 ( X ) = supx , y∈X ‖x − y‖2 ≤ D < ∞ . Furthermore , we assume that for any s ∈ S , F ( · ; s ) is convex and L-Lipschitz with respect to ‖ · ‖2 . Central to our work , we define the following κ-growth assumption . Assumption 1 ( κ-growth ) . Let x ? = argminx∈X f ( x ) . For a loss F and distribution P , we say that ( F , P ) has ( λ , κ ) growth for κ ∈ [ 1 , ∞ ] and λ > 0 , if the population function satisfies for all x ∈ X , f ( x ) − f ( x ? ) ≥ λ κ ‖x− x ? ‖κ2 . In the case where P̂ is the empirical distribution on a finite dataset S , we refer to ( λ , κ ) -growth of ( F , P̂ ) as κ-growth of the empirical function fS . Uniform convexity and Kurdyka-Łojasiewicz inequality . Assumption 1 is closely related to two fundamental notions in convex analysis : uniform convexity and the Kurdyka-Łojasiewicz inequality . Following [ 39 ] , we say that h : Z ⊂ Rd → R is ( σ , κ ) -uniformly convex with σ > 0 and κ ≥ 2 if for all x , y ∈ Z , h ( y ) ≥ h ( x ) + 〈∇h ( x ) , y − x〉+ σ κ ‖x− y‖κ2 . This immediately implies that ( i ) sums ( and expectations ) preserve uniform convexity ( ii ) if f is uniformly convex with λ and κ , then it has ( λ , κ ) -growth . This will be useful when constructing hard instances as it will suffice to consider ( λ , κ ) -uniformly convex functions which are generally more convenient to manipulate . Finally , we point out that , in the general case that κ ≥ 1 , the literature refers to Assumption 1 as the Kurdyka-Łojasiewicz inequality [ 11 ] with , in their notation , ϕ ( s ) = ( κ/λ ) 1/κs1/κ . Theorem 5- ( ii ) in [ 11 ] says that , under mild conditions , Assumption 1 implies the following inequality between the error and the gradient norm for all x ∈ X f ( x ) − inf x′∈X f ( x′ ) ≤ e λ 1 κ−1 ‖∇f ( x ) ‖ κ κ−1 2 , ( 2 ) This is a key result in our analysis of the inverse sensitivity mechanism of Section 3 . Differential privacy . We begin by recalling the definition of ( ε , δ ) -differential privacy . Definition 2.1 ( [ 22 , 21 ] ) . A randomized algorithm A is ( ε , δ ) -differentially private ( ( ε , δ ) -DP ) if , for all datasets S , S ′ ∈ Sn that differ in a single data element and for all events O in the output space of A , we have Pr ( A ( S ) ∈ O ) ≤ e Pr ( A ( S ′ ) ∈ O ) + δ . We use the following standard results in differential privacy . Lemma 2.1 ( Composition [ 20 , Thm . 3.16 ] ) . If A1 , . . . , Ak are randomized algorithms that each is ( ε , δ ) -DP , then their composition ( A1 ( S ) , . . . , Ak ( S ) ) is ( kε , kδ ) -DP . Next , we consider the Laplace mechanism . We will let Z ∼ Lapd ( σ ) denote a d-dimensional vector Z ∈ Rd such that Zi iid∼ Lap ( σ ) for 1 ≤ i ≤ d. Lemma 2.2 ( Laplace mechanism [ 20 , Thm . 3.6 ] ) . Let h : Sn → Rd have ` 1-sensitivity ∆ , that is , supS , S′∈Sn : dHam ( S , S′ ) ≤1 ‖h ( S ) − h ( S ′ ) ‖1 ≤ ∆ . Then the Laplace mechanism A ( S ) = h ( S ) + Lapd ( σ ) with σ = ∆/ε is ε-DP . Finally , we need the Gaussian mechanism for ( ε , δ ) -DP . Lemma 2.3 ( Gaussian mechanism [ 20 , Thm . A.1 ] ) . Let h : Sn → Rd have ` 2-sensitivity ∆ , that is , supS , S′∈Sn : dHam ( S , S′ ) ≤1 ‖h ( S ) − h ( S ′ ) ‖2 ≤ ∆ . Then the Gaussian mechanism A ( S ) = h ( S ) + N ( 0 , σ2Id ) with σ = 2∆ log ( 2/δ ) /ε is ( ε , δ ) -DP . Inverse sensitivity mechanism . Our goal is to design private optimization algorithms that adapt to the difficulty of the underlying function . As a reference point , we turn to the inverse sensitivity mechanism of [ 2 ] as it enjoys general instance-optimality guarantees . For a given function h : Sn → T ⊂ Rd that we wish to estimate privately , define the inverse sensitivity at x ∈ T lenh ( S ; x ) = inf S′ { dHam ( S ′ , S ) : h ( S ′ ) = x } , ( 3 ) that is , the inverse sensitivity of a target parameter y ∈ T at instance S is the minimal number of samples one needs to change to reach a new instance S ′ such that h ( S ′ ) = y . Having this quantity , the inverse sensitivity mechanism samples an output from the following probability density πAinv ( S ) ( x ) ∝ e −εlenh ( S ; x ) . ( 4 ) The inverse sensitivity mechanism preserves ε-DP and enjoys instance-optimality guarantees in general settings [ 2 ] . In contrast to ( worst-case ) minimax optimality guarantees which measure the performance of the algorithm on the hardest instance , these notions of instance-optimality provide stronger per-instance optimality guarantees .

Summary: This paper studies the SCO with loss function that satisfies growth conditions in the differential privacy model. Firstly, it considers the empirical risk function and provide an algorithm based on the inverse sensitivity mechanism. Then they show an efficient algorithm and the lower bounds of the problem in the both $\epsilon$ and $(\epsilon, \delta)$-DP models.