Robust and differentially private mean estimation

1 Introduction . When releasing database statistics on a collection of entries from individuals , we would ideally like to make it impossible to reverse-engineer each individual ’ s potentially sensitive information . Privacy-preserving techniques add just enough randomness tailored to the statistical task to guarantee protection . At the same time , it is becoming increasingly common to apply such techniques to databases collected from multiple sources , not all of which can be trusted . Emerging data access frameworks , such as federated analyses across users ’ devices or data silos [ 50 ] , make it easier to temper with such collected datasets , leaving private statistical analyses vulnerable to a malicious corruption of a fraction of the data . Differential privacy has emerged as a widely accepted de facto measure of privacy , which is now a standard in releasing the statistics of the U.S. Census data [ 2 ] statistics and also deployed in real-world commercial systems [ 74 , 40 , 41 ] . A statistical analysis is said to be differentially private ( DP ) if the likelihood of the ( randomized ) outcome does not change significantly when a single arbitrary entry is added/removed ( formally defined in §1.2 ) . This provides a strong privacy guarantee : even a powerful adversary who knows all the other entries in the database can not confidently identify whether a particular individual is participating in the database based on the outcome of the analysis . This ensures plausible deniability , central to protecting an individual ’ s privacy . In this paper , we focus on one of the most canonical problems in statistics : estimating the mean of a distribution from i.i.d . samples . For distributions with unbounded support , such as sub-Gaussian and heavy-tailed distributions , fundamental trade-offs between accuracy , sample size , and privacy have only recently been identified [ 58 , 52 , 54 , 3 ] and efficient private estimators proposed . However , these approaches are brittle when a fraction of the data is corrupted , posing a real threat , referred to as data poisoning attacks [ 19 , 79 ] . In defense of such attacks , robust ( but not necessarily private ) statistics has emerged as a popular setting of recent algorithmic and mathematical breakthroughs [ 73 , 30 ] . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . One might be misled into thinking that privacy ensures robustness since DP guarantees that a single outlier can not change the estimation too much . This intuition is true only in a low dimension ; each sample has to be an obvious outlier to significantly change the mean . However , in a high dimension , each corrupted data point can look perfectly uncorrupted but still shift the mean significant when colluding together ( e.g. , see Fig . 1 ) . Focusing on the canonical problem of mean estimation , we introduce novel algorithms that achieve robustness and privacy simultaneously even when a fraction of data is corrupted arbitrarily . For such algorithms , there is a fundamental question of interest : do we need more samples to make private mean estimation also robust against adversarial corruption ? Sub-Gaussian distributions . If we can afford exponential run-time in the dimension , robustness can be achieved without extra cost in sample complexity . We introduce a novel estimator that ( i ) satisfies ( ε , δ ) -DP , ( ii ) achieves near-optimal robustness under α-fraction of corrupted data , achieving accuracy of O ( α √ log ( 1/α ) ) nearly matching the fundamental lower bound of Ω ( α ) that holds even for a ( non-private ) robust mean estimation with infinite samples , and ( iii ) achieves near-optimal sample complexity matching that of a fundamental lower bound for a ( non-robust ) private mean estimation as shown in Table 1 . Theorem 1 ( Informal Theorem 7 , exponential time ) . Algorithm 2 is ( ε , δ ) -DP . When α fraction of the data is arbitrarily corrupted from n samples from a d-dimensional sub-Gaussian distribution with mean µ and an identity sub-Gaussian parameter , if n = Ω̃ ( d/α2 + ( d+ d1/2 log ( 1/δ ) ) / ( αε ) ) then Algorithm 2 achieves ‖µ̂− µ‖2 = O ( α √ log ( 1/α ) ) w.h.p . We introduce PRIME ( PRIvate and robust Mean Estimation ) in §2.3 with details in Algorithm 9 in Appendix E.1 , to achieve computational efficiency . It requires a run-time of only Õ ( d3 + nd2 ) , but at the cost of requiring extra d1/2 factor larger number of samples . This can not be improved upon with current techniques since efficient robust estimators rely on the top PCA directions of the covariance matrix to detect outliers . [ 78 ] showed that Ω̃ ( d3/2 ) samples are necessary to compute PCA directions while preserving ( ε , δ ) -DP when ‖xi‖2 = O ( √ d ) . It remains an open question if this Ω̃ ( d3/2/ ( αε ) ) bottleneck is fundamental ; no matching lower bound is currently known . Theorem 2 ( Informal Theorem 6 , polynomial time ) . PRIME is ( ε , δ ) -DP and under the assumption of Thm.1 , if n = Ω̃ ( d/α2 + ( d3/2 log ( 1/δ ) ) / ( αε ) ) , achieves ‖µ̂− µ‖2 = O ( α √ log ( 1/α ) ) w.h.p . Heavy-tailed distributions . When samples are drawn from a distribution with a bounded covariance , parameters of Algorithm 2 can be modified to nearly match the optimal sample complexity of ( nonrobust ) private mean estimation in Table 2 . This algorithm also matches the fundamental limit on the accuracy of ( non-private ) robust estimation , which in this case is Ω ( α1/2 ) . Theorem 3 ( Informal Theorem 8 , exponential time ) . From a distribution with mean µ ∈ Rd and covariance Σ I , n samples are drawn and α-fraction is corrupted . Algorithm 2 is ( ε , δ ) -DP and if n = Ω̃ ( ( d+ d1/2 log ( 1/δ ) ) / ( αε ) + d1/2 log3/2 ( 1/δ ) /ε ) achieves ‖µ̂− µ‖2 = O ( α1/2 ) w.h.p . The proposed PRIME-HT for covariance bounded distributions achieve computational efficiency at the cost of an extra factor of d1/2 in sample size . This bottleneck is also due to DP PCA , and it remains open whether this gap can be closed by an efficient estimator . Theorem 4 ( Informal Theorem 9 , polynomial time ) . PRIME-HT is ( ε , δ ) -DP and if n = Ω̃ ( ( d3/2 log ( 1/δ ) ) / ( αε ) ) achieves ‖µ̂− µ‖2 = O ( α1/2 ) w.h.p . under the assumptions of Thm . 3 . 1.1 Technical contributions . We introduce PRIME which simultaneously achieves ( ε , δ ) -DP and robustness against α-fraction of corruption . A major challenge in making a standard filter-based robust estimation algorithm ( e.g. , [ 30 ] ) private is the high sensitivity of the filtered set that we pass from one iteration to the next . We propose a new framework which makes private only the statistics of the set , hence significantly reducing the sensitivity . Our major innovation is a tight analysis of the end-to-end sensitivity of this multiple interactive accesses to the database . This is critical in achieving robustness while preserving privacy and is also of independent interest in making general iterative filtering algorithms private . The classical filter approach ( see , e.g . [ 30 ] ) needs to access the database O ( d ) times , which brings an extra O ( √ d ) factor in the sample complexity due to DP composition . In order to reduce the iteration complexity , following the approach in [ 36 ] , we propose filtering multiple directions simultaneously using a new score based on the matrix multiplicative weights ( MMW ) . In order to privatize the MMW filter , our major innovation is a novel adaptive filtering algorithm DPTHRESHOLD ( · ) that outputs a single private threshold which guarantees sufficient progress at every iteration . This brings the number of database accesses from O ( d ) to O ( ( log d ) 2 ) . One downside of PRIME is that it requires an extra d1/2 factor in the sample complexity , compared to known lower bounds for ( non-robust ) DP mean estimation . To investigate whether this is also necessary , we propose a sample optimal exponential time robust mean estimation algorithm in §4 and prove that there is no extra statistical cost to jointly requiring privacy and robustness . Our major technical innovations is in using resilience property of the dataset to not only find robust mean ( which is the typical use case of resilience ) but also bound sensitivity of that robust mean . 1.2 Preliminary on differential privacy ( DP ) . DP is a formal metric for measuring privacy leakage when a dataset is accessed with a query [ 37 ] . Definition 1.1 . Given two datasets S = { xi } ni=1 and S′ = { x′i } n ′ i=1 , we say S and S ′ are neighboring if d4 ( S , S′ ) ≤ 1 where d4 ( S , S′ ) , max { |S \ S′| , |S′ \ S| } , which is denoted by S ∼ S′ . For an output of a stochastic query q on a database , we say q satisfies ( ε , δ ) -differential privacy for some ε > 0 and δ ∈ ( 0 , 1 ) if P ( q ( S ) ∈ A ) ≤ eεP ( q ( S′ ) ∈ A ) + δ for all S ∼ S′ and all subset A . Let z ∼ Lap ( b ) be a random vector with entries i.i.d . sampled from Laplace distribution with pdf ( 1/2b ) e−|z|/b . Let z ∼ N ( µ , Σ ) denote a Gaussian random vector with mean µ and covariance Σ . Definition 1.2 . The sensitivity of a query f ( S ) ∈ Rk is defined as ∆p = supS∼S′ ‖f ( S ) − f ( S′ ) ‖p for a norm ‖x‖p = ( ∑ i∈ [ k ] |xi|p ) 1/p . For p = 1 , the Laplace mechanism outputs f ( S ) + Lap ( ∆1/ε ) and achieves ( ε , 0 ) -DP [ 37 ] . For p = 2 , the Gaussian mechanism outputs f ( S ) +N ( 0 , ( ∆2 ( √ 2 log ( 1.25/δ ) ) /ε ) 2I ) and achieves ( ε , δ ) -DP [ 38 ] . We use these output perturbation mechanisms along with the exponential mechanism [ 69 ] as building blocks . Appendix A provides detailed survey of privacy and robust estimation . 1.3 Problem formulation . We are given n samples from a sub-Gaussian distribution with a known covariance but unknown mean , and α fraction of the samples are corrupted by an adversary . Our goal is to estimate the unknown mean . We follow the standard definition of adversary in [ 30 ] , which can adaptively choose which samples to corrupt and arbitrarily replace them with any points . Assumption 1 . An uncorrupted dataset Sgood consists of n i.i.d . samples from a d-dimensional sub-Gaussian distribution with mean µ ∈ Rd and covariance E [ xx > ] = Id , which is 1-sub-Gaussian , i.e. , E [ exp ( v > x ) ] ≤ exp ( ‖v‖22/2 ) for all v ∈ Rd . For some α ∈ ( 0 , 1/2 ) , we are given a corrupted dataset S = { xi ∈ Rd } ni=1 where an adversary adaptively inspects all the samples in Sgood , removes αn of them , and replaces them with Sbad which are αn arbitrary points in Rd . Similarly , we consider the same problem for heavy-tailed distributions with a bounded covariance . We present the assumption and main results for covariance bounded distributions in Appendix B . Notations . Let [ n ] = { 1 , 2 , . . . , n } . For x ∈ Rd , we use ‖x‖2 = ( ∑ i∈ [ d ] ( xi ) 2 ) 1/2 to denote the Euclidean norm . For X ∈ Rd×d , we use ‖X‖2 = max‖v‖2=1 ‖Xv‖2 to denote the spectral norm . The d× d identity matrix is Id×d . Whenever it is clear from context , we use S to denote both a set of data points and also the set of indices of those data points . Õ and Ω̃ hide poly-logarithmic factors in d , n , 1/α , and the failure probability . Outline . We present PRIME for sub-Gaussian distribution in §2 , and present theoretical analysis in §3 . We then introduce an exponential time algorithm with near optimal guarantee in §4 . Due to space constraints , analogous results for heavy-tailed distributions are presented in Appendix B .

Summary: The paper proposes an algorithm which is both DP and robust for "poisoning attacks" for mean estimation. Namely, it can deal with an adversary corrupting \alpha*n many points and still produces a mean which is fairly close to the true mean (of the remainder of the points); and do which without directly looking at the point but rather statistical properties that are randomly perturbed in order to preserve DP. In addition to the theoretical work, there was also a few experiments conducted on the output of the mechanism.