Shuffle Private Stochastic Convex Optimization

1 INTRODUCTION . In stochastic convex optimization , a learner receives a convex loss function ` : Θ×X → R mapping pairs of parameters and data points to losses , and the goal is to use data samples x1 , . . . , xn to find a parameter θ to minimize population loss Ex∼D [ ` ( θ , x ) ] over unknown data distribution D. The general applicability of this framework has motivated a long line of work studying stochastic convex optimization problems under the constraint of differential privacy ( Dwork et al. , 2006b ) , which guarantees that the solution found reveals little information about the data used during optimization . This has led to guarantees for both the central and local models of differential privacy . Users in central differential privacy must trust a central algorithm operator , while users in local differential privacy need not trust anyone outside their own machine . These different protections lead to different utility guarantees . When optimizing from n samples over a d-dimensional parameter space with privacy parameter ε , the optimal loss term due to privacy is O ( √ d/ ( εn ) ) in the central model ( Bassily et al. , 2013 ; 2019 ; Feldman et al. , 2020 ) . In the local model , the optimal private loss term is O ( √ d/ ( ε √ n ) ) for sequentially interactive protocols ( Duchi et al. , 2018 ) and a class of compositional fully interactive protocols ( Lowy and Razaviyayn , 2021 ) . A similar utility gap between central and local privacy also appears in many other problems ( Kasiviswanathan et al. , 2011 ; Chan et al. , 2012 ; Duchi et al. , 2018 ; Duchi and Rogers , 2019 ; Joseph et al. , 2019 ) . This has motivated the exploration of models achieving a finer trade-off between privacy and utility . One such notion of privacy is shuffle privacy ( Cheu et al. , 2019 ; Erlingsson et al. , 2019 ) . Here , users send randomized messages to a shuffler , which permutes the collection of messages before they are viewed by any other party . In conjunction with work on building shufflers via onion routing , multi-party computation , and secure computation enclaves , this simple model has led to a now-substantial body of work on shuffle privacy ( Bittau et al. , 2017 ; Cheu et al. , 2019 ; Erlingsson et al. , 2019 ; Balle et al. , 2019 ; Ghazi et al. , 2021 ; Balcer and Cheu , 2020 ; Feldman et al. , 2021 ; Balcer et al. , 2021 ) , including steps toward real-world deployment ( Google , 2021 ) . However , comparatively little is known about shuffle private stochastic convex optimization . 1.1 OUR CONTRIBUTIONS . 1 . We introduce sequentially interactive ( each user participates in a single protocol round ) and fully interactive ( each user participates in arbitrarily many protocol rounds ) variants of the shuffle model of differential privacy1 . This distinction is useful because , while full interactivity offers the strongest possible asymptotic guarantees , the practical obstacles to making multiple queries to a user over the duration of a protocol ( Kairouz et al. , 2021b ; 2019 ) make sequentially interactive protocols more realistic . 2 . We construct a noninteractive shuffle private protocol for privately computing a sum with bounded ` 2 sensitivity . By using multiple messages , our protocol is substantially more accurate than existing results ( see Related Work ) . 3 . We use our ` 2 summation protocol to derive several new shuffle private SCO guarantees ( Table 1 ) via techniques including acceleration , Nesterov ’ s smoothing method in the sequential interactive model , and noisy gradient descent in the fully interactive model . 1.2 ADDITIONAL RELATED WORK . The vast majority of work on shuffle privacy studies the noninteractive model , but a few exceptions exist . Erlingsson et al . ( 2019 ) and Feldman et al . ( 2021 ) study a variant in which the shuffler is a layer that accepts randomizers from the analyst , assigns them randomly to users , and sends the permuted messages back to the analyzer . Feldman et al . ( 2021 ) also construct a basic protocol for SGD in this model . This model is similar to other work that achieves shuffle privacy guarantees by amplifying the local privacy guarantees of local randomizers ( Balle et al. , 2019 ) . Erlingsson et al . ( 2020 ) also studied empirical risk minimization using shuffle-amplified sequentially interactive locally private protocols . The main difference between that work and ours is that we only require that the view of the shuffled outputs across rounds satisfies differential privacy , and can therefore avoid relying on amplification . Another exception is the work of Beimel et al . ( 2020 ) , where the shuffler broadcasts the permuted messages to all parties . Users then execute key exchange protocols , and Beimel et al . show that a first round of key exchange enables the use of multi-party computation ( MPC ) to simulate any central DP algorithm in the second round . Our results depart from theirs in two ways . First , we only assume that the shuffler sends outputs to the analyzer , not to individual users . Second , the MPC approach given by Beimel et al . requires an honest majority . Without an honest majority , the differential privacy guarantees of their simulation fail . In contrast , the privacy guarantees of our shuffle protocols degrade smoothly with the fraction of honest users , which can be anything larger than an arbitrary constant ( see discussion at the end of Section 3.1 ) . Simultaneous independent work by Tenenbaum et al . ( 2021 ) also studies a sequentially interactive variant of the shuffle model in the context of multi-arm bandits . Their model of sequential interactivity is identical to ours , albeit for a different problem . Girgis et al . ( 2021 ) provide a fully interactive shuffle private protocol for empirical risk minimization ( ERM ) . In contrast , we provide both sequentially and fully interactive protocols for SCO , which optimizes population rather than empirical loss . Their ` 2 summation protocol requires one message from each user , and its second moment guarantee for the average gradient has a 1/b dependence on 1These terms are borrowed from local differential privacy ( Duchi et al. , 2018 ; Joseph et al. , 2019 ) . batch size b ( their Lemma 4 ) . In contrast , our multi-message protocol obtains a better 1/b2 dependence . This is possible because our multi-message protocol does not rely on privacy amplification , and in particular circumvents their single-message lower bound ( their Theorem 3 ) . Kairouz et al . ( 2021b ) study DP-FTRL , which uses a single pass , extends to nonconvex losses , does not rely on shuffling or amplification , and satisfies central DP . It is possible to adapt their algorithm to sequentially interactive shuffle privacy using our vector sum protocol , though their O ( d1/4/ √ n ) SCO guarantee is weaker than our O ( d1/3/n2/3 ) SCO guarantee ( Theorem 4.7 ) . Concurrent work by Lowy and Razaviyayn ( 2021 ) study fully interactive shuffle private protocols with SCO guarantees matching ours ( Section 4.2 ) . There are two key differences between their work and ours . First , they do not provide sequentially interactive protocols . Second , their fully interactive protocols assume that users can send messages consisting of real vectors . This assumption is difficult to satisfy in practice ( Canonne et al. , 2020 ; Kairouz et al. , 2021a ) . As a result , our protocols ( and most of those in the shuffle privacy literature ) rely only on discrete messages . Finally , several shuffle private protocols are known for the simpler problem of summing scalars ( Cheu et al. , 2019 ; Balle et al. , 2019 ; Ghazi et al. , 2019 ; Balcer and Cheu , 2020 ) and recent work has studied vector addition in the secure aggregation model ( Kairouz et al. , 2021a ) , which assumes the existence of a trusted aggregator that can execute modular arithmetic on messages . We expand on this work by introducing a shuffle private protocol for summing vectors with bounded ` 2 norm , with noise standard deviation proportional to the ` 2 sensitivity . 2 PRELIMINARIES . Differential Privacy . Throughout , let X be a data universe , and suppose that each of n users has one data point from X . Two datasets X , X ′ ∈ Xn are neighbors , denoted X ∼ X ′ , if they differ in the value of at most one user . Differential privacy is defined with respect to neighboring databases . Definition 2.1 ( Dwork et al . ( 2006b ) ) . An algorithm A satisfies ( ε , δ ) -differential privacy if , for every X ∼ X ′ and every event Z , PA [ A ( X ) ∈ Z ] ≤ eε · PA [ A ( X ′ ) ∈ Z ] + δ . Because Definition 2.1 assumes that the algorithm A has “ central ” access to compute on the entire raw dataset , we call this central privacy for brevity . For brevity , we will often use differential privacy and DP interchangeably . At times , it will also be useful to rephrase DP as a divergence constraint . Definition 2.2 . The δ-Approximate Max Divergence between distributions X and Y is Dδ∞ ( X||Y ) = max Z⊆supp ( X ) : Pr [ X∈Z ] ≥δ [ log Pr [ X ∈ Z ] − δ Pr [ Y ∈ Z ] ] . Fact 2.3 . Algorithm A is ( ε , δ ) -DP if and only if , for all X ∼ X ′ , Dδ∞ ( A ( X ) ||A ( X ′ ) ) ≤ ε . A key property of DP is closure under post-processing . Fact 2.4 ( Proposition 2.1 ( Dwork and Roth , 2014 ) ) . Fix any function f . If A is ( ε , δ ) -differentially private , then the composition f ◦ A is also ( ε , δ ) -differentially private . Shuffle Privacy . In the shuffle model ( Bittau et al. , 2017 ; Cheu et al. , 2019 ; Erlingsson et al. , 2019 ) , we do not require users to trust the operator of A . Instead , we make the narrower assumption that there is a trusted shuffler : users pass messages to the shuffler , the shuffler permutes them , and the algorithm A operates on the resulting shuffled output , thus decoupling messages from the users that sent them . Definition 2.5 . A one-round shuffle protocol P is specified by a local randomizerR : X → Y∗ and analyzer A : Y∗ → Z . In an execution of P on X , each user i computes R ( Xi ) —possibly using public randomness—and sends the resulting messages yi,1 , yi,2 , . . . to the shuffler S . S reports ~y to an analyzer , where ~y is a uniformly random permutation of all user messages . The final output of the protocol is A ( ~y ) . We now define our privacy objective in the shuffle model , often shorthanded as “ shuffle privacy ” . Definition 2.6 ( Cheu et al . ( 2019 ) ; Erlingsson et al . ( 2019 ) ) . P = ( R , A ) is ( ε , δ ) -shuffle differentially private if the algorithm ( S ◦ Rn ) ( X ) : = S ( R ( X1 ) , . . . , R ( Xn ) ) , i.e . the analyzer ’ s view of the shuffled messages , is ( ε , δ ) -differentially private . The privacy guarantee is only over the internal randomness of the users ’ randomizers and the shuffler . A drawback of the preceding definition of shuffle protocols is that it limits communication to one round . It is not possible , for example , to adjust the randomizer assigned to user i based on the messages reported from user i − 1 . This is an obstacle to implementing adaptive algorithms like gradient descent . We therefore extend the shuffle model with the following sequentially interactive and fully interactive variants . Sequential interactivity breaks the data into batches and runs a different shuffle protocol on each batch in ( possibly adaptive ) sequence . Definition 2.7 . Let Tr denote the universe of shuffle protocol transcripts , and let R denote the universe of randomizers . A sequentially interactive shuffle protocol P consists of initial local randomizer R0 , analyzer A , and update function U : Tr → [ n ] ×R . Let Trt denote the transcript after t rounds of the protocol . In each round t of P , the analyzer computes ( nt , Rt ) = U ( Trt−1 ) , nt new users applyRt to their data points , and S shuffles the result and relays it back to A . At the conclusion of a T -round protocol , the analyzer releases final output A ( TrT ) . This formalizes the idea that the analyzer looks at the past shuffled outputs to determine how many and what kind of randomizers to pass to the next batch of users . Note that , in a sequentially interactive protocol , each user only participates in one computation . More generally , we can further allow the analyzer to repeatedly query users . This leads us to the fully interactive model . Definition 2.8 . A fully interactive shuffle protocol P is identical to a sequentially interactive shuffle protocol , except the update function U : Tr→ 2 [ n ] ×R selects an arbitrary subset of users in each round . In particular , a user may participate in multiple rounds . The main advantage of full interactivity is that it offers the strongest formal utility guarantees ( see Section 4 ) ; the main advantage of sequential interactivity is that it is typically difficult to query a user multiple times in practice ( Kairouz et al. , 2021b ; 2019 ) . For sequentially and fully interactive shuffle protocols , the definition of privacy is identical : the view of the transcript satisfies DP . The noninteractive definition is a special case of this general definition . Definition 2.9 . Given shuffle protocol P , let MP : X ∗ → Tr denote the central algorithm that simulates P on an input database and outputs the resulting transcript . Then P is ( ε , δ ) -shuffle differentially private ifMP is ( ε , δ ) -differentially private . Stochastic Convex Optimization . Let closed convex Θ ⊂ Rd with diameter D be our parameter space . We always assume loss functions ` ( θ , x ) that are convex and L-Lipschitz in Θ . Definition 2.10 . Loss function ` : Θ×X → R is convex in Θ if , for all x ∈ X , for all t ∈ [ 0 , 1 ] and θ , θ′ ∈ Θ , ` ( tθ + ( 1 − t ) θ′ , x ) ≤ t ` ( θ , x ) + ( 1 − t ) ` ( θ′ , x ) . ` is L-Lipschitz in Θ if for all x ∈ X and θ , θ′ ∈ Θ , | ` ( θ , x ) − ` ( θ′ , x ) | ≤ L‖θ − θ′‖2 . In some cases , we also assume that our loss function ` is β-smooth and/or λ-strongly convex . Definition 2.11 . Loss function ` : Θ×X → R is β-smooth over Θ if , for every x ∈ X and for every θ , θ′ ∈ Θ , ‖∇ ` ( θ , x ) −∇ ` ( θ′ , x ) ‖2 ≤ β‖θ − θ′‖2 . ` is λ-strongly convex in Θ if , for all x ∈ X , for all t ∈ [ 0 , 1 ] and θ , θ′ ∈ Θ , ` ( tθ + ( 1− t ) θ′ , x ) ≤ t ` ( θ , x ) + ( 1− t ) ` ( θ′ , x ) − λt ( 1−t ) 2 ‖θ − θ ′‖22 . Our goal is to minimize population loss . We will view each user as a sample from D , and our protocols will learn from these samples through repeated interaction with the shuffler rather than direct access to the samples . Definition 2.12 . Let D be a distribution over X , and let ` : Θ × X → R be a loss function . Then algorithm A : X ∗ → Θ has population loss EA , D [ ` ( θ̄ , D ) ] = Eθ∼A ( Dn ) [ Ex∼D [ ` ( θ , x ) ] ] .

Summary: This papers considers stochastic convex optimization (SCO) in the shuffle-DP model. In particular, the authors consider two models for shuffle-DP: A "sequential" model where the analyzer operates in rounds, and in each round a new set of users participate in a local-DP protocol, and a new "full" model in which the analyzer can request a specific subset of users to participate in each round, which allows users' data to be queried more than once. The authors show that in the full model, one can retrieve excess population loss bounds matching the best possible bounds in the central DP setting. Furthermore, they show even the sequential model offers improved excess population bounds over the best possible bound of sqrt(d/n) in the local setting.   The key technical ingredient is a shuffle-DP randomizer for estimating the sum of vectors, each stored by a user, when the vectors have bounded $\ell_2$-sensitivity (which corresponds to a Lipschitz assumption on each loss function in SCO), in contrast with existing work which focused on $\ell_1$-sensitivity. The authors build off a scalar sum estimator and then use a composition theorem to prove privacy of the vector sum estimator as composition of scalar sum estimators, and then bound the variance of this estimator, and then use it to compute batch gradients in existing optimization algorithms such as gradient descent, stochastic gradient descent, and the accelerated stochastic approximation algorithm. For some of these results, a variance bound on the batch gradient immediately gives an excess empirical loss bound. In some other settings there is no plug-and-play error bound, so instead they need appeal to arguments/reductions similar to those appearing before in the central DP SCO literature, but with some elements specialized to their setting.