Tight lower bounds for Differentially Private ERM

is O ( √ p log ( 1/δ ) n ) , which is believed to be tight . However , current lower bounds are off by some logarithmic terms , in particular Ω ( √ p n ) for constrained case and Ω ( √ p n log p ) for unconstrained case . We achieve tight Ω ( √ p log ( 1/δ ) n ) lower bounds for both cases by introducing a novel biased mean property for fingerprinting codes . As for pure-DP , we utilize a novel ` 2 loss function instead of linear functions considered by previous papers , and achieve the first ( tight ) Ω ( p n ) lower bound . We also introduce an auxiliary dimension to simplify the computation brought by ` 2 loss . Our results close a gap in our understanding of DP-ERM by presenting the fundamental limits . Our techniques may be of independent interest , which help enrich the tools so that it readily applies to problems that are not ( easily ) reducible from one-way marginals . 1 INTRODUCTION . Since the seminal work of Dwork et al . ( 2006 ) , differential privacy ( DP ) has become the standard and rigorous notion of privacy guarantee for machine learning algorithms , among which many fundamental ones are based on empirical risk minimization ( ERM ) . Motivated by this , private ERM becomes one of the most well-studied problem in the DP literature , e.g . Chaudhuri and Monteleoni ( 2008 ) ; Rubinstein et al . ( 2009 ) ; Chaudhuri et al . ( 2011 ) ; Kifer et al . ( 2012 ) ; Song et al . ( 2013 ) ; Jain and Thakurta ( 2014 ) ; Bassily et al . ( 2014 ) ; Talwar et al . ( 2015 ) ; Kasiviswanathan and Jin ( 2016 ) ; Fukuchi et al . ( 2017 ) ; Wu et al . ( 2017 ) ; Zhang et al . ( 2017 ) ; Wang et al . ( 2017 ) ; Iyengar et al . ( 2019 ) ; Bassily et al . ( 2020 ) ; Kulkarni et al . ( 2021 ) ; Asi et al . ( 2021 ) ; Bassily et al . ( 2021 ) ; Wang et al . ( 2021 ) . Roughly speaking , in the ERM setting , we are given a convex function family defined on a convex set C ⊆ Rp and a sample setD = { d1 , · · · , dn } drawn i.i.d from some unknown distribution P with the objective to minimize the loss function L ( θ ; D ) = 1 n n∑ i=1 ` ( θ ; di ) , and the value L ( θ ; D ) −minθ′∈C L ( θ′ ; D ) is called the excess empirical loss with respect to solution θ , measuring how it compares with the best solution in C. Private ERM in the constrained case was studied first and most of the previous literature belongs to this case . More specifically , the constrained case considers convex loss functions defined on a bounded convex set C ( Rp . Assuming the functions are 1-Lipschitz over the convex set of diameter 1 , the Ω ( √ p n ) lower bound of private ERM is given by Bassily et al . ( 2014 ) , even for ( special and simpler ) generalized linear model ( GLM ) . However , there are still several aspects that existing works don ’ t cover . First , existing upper bounds are off by at least a logarithmic term √ log ( 1/δ ) . For example in Wang et al . ( 2017 ) ; Bassily et al . ( 2019 ) they give upper bounds like O ( L||θ0−θ ∗||2 √ p log ( 1/δ ) n ) , which are believed to be tight . In Bassily et al . ( 2014 ) , they present a lower bound Ω ( √ p n ) by reducing linear loss to one-way marginal results in Hardt and Talwar ( 2010 ) ; Bun et al . ( 2018 ) . In Steinke and Ullman ( 2015 ) they achieve the tight lower bound for answering one-way marginals with respect to ` 1 norm , but it does not imply tight lower bounds for general loss functions by the methods in Bassily et al . ( 2014 ) directly . Another aspect is DP-ERM in the unconstrained case which was neglected before and gathered people ’ s attention recently , see Jain and Thakurta ( 2014 ) ; Song et al . ( 2021 ) . The unconstrained case is interesting in that we can ’ t use linear loss any more which lies at the heart of the construction in the constrained case . Moreover , previous algorithms in the constrained case suffer from the curse of dimensionality when p is large . For example , when p = Ω ( n2 ) , the lower bound is Ω ( 1 ) and any private algorithm can not get meaningful bounds on the excess empirical loss . Song et al . ( 2021 ) proves an dimension-independentO ( √ rank n ) upper bound in the unconstrained setting for the special case of GLMs , where rank denotes the rank of the feature matrix of GLM . However , it ’ s unknown if similar results can be achieved for general loss functions . As for the lower bound , Asi et al . ( 2021 ) give Ω ( √ p n log p ) lower bound by considering ` 1 loss as the objective functions and reducing the results also from one-way marginals . 1.1 OUR CONTRIBUTIONS . In this paper , we fill up the two gaps together by proving an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithms . This bound is automatically applicable in the constrained case , which improves previous results and achieve a tight lower bound for both constrained and unconstrained case . We summarize our main results as follows : • We prove an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithm . This bound improves Asi et al . ( 2021 ) by a log ( p ) √ log ( 1/δ ) factor in the unconstrained case and matches the upper bound in Kairouz et al . ( 2020 ) . • We also prove an Ω ( min ( 1 , pn ) ) lower bound for the excess risk of unconstrained 1- Lipschitz convex loss functions for any pure differential privacy algorithm . Note that our main results for unconstrained case can be extended to constrained case directly , thus our lower bound for approximate private algorithm is √ log ( 1/δ ) multiplicative better than the wellknown bound in Bassily et al . ( 2014 ) with the help of group privacy technique in Steinke and Ullman ( 2015 ) . A key contribution of this paper is novel tools for private lower bound techniques . For most problems , accuracy lower bound in the private setting is established via reduction from one-way marginals . Hence the tools for lower bounds is quite limited . We contribute to refinement of such tools – in particular , we propose modifications such as the additional ” biased means ” property to fingerprinting codes , which is the key lower bound technique . Such modifications help enrich the tools so that it readily applies to problems which are not ( easily ) reducible from one-way marginals . 1.2 OUR TECHNIQUES . In general , the direct technical challenge of the unconstrained case lies in the choice of loss function and the difficulties caused by the new loss function . The loss function is required to be convex and Lipschitz-continuous at the same time . In the constrained case , the linear loss function is obviously a good choice for constructing lower bounds , because it is easy to analyze and easily reducible from one-way marginals . However , in the unconstrained case any non-trivial linear loss function can take ‘ −∞ ’ value thus not applicable anymore . We further observe that convexity plus Lipschitzcontinuity means ‘ asymptotically linear ’ : the sub-gradient along any direction must converge . This observation guides us in choosing new loss functions for unconstrained DP-ERM ( which can be extended to constrained case directly ) . We briefly introduce the new problems caused by the new loss functions and our method to overcome them for approximate-DP and pure-DP separately . 1.2.1 APPROXIMATE-DP . The construction of our lower bound for approximate-DP is based on the Fingerprinting Codes , which was first studied by Wagner ( 1983 ) and developed by Boneh and Shaw ( 1998 ) ; Tardos ( 2008 ) . From a technical perspective , we change the previously used linear loss and use an ` 1 norm function instead where ` ( θ ; d ) = ‖θ − d‖1 . ` 1 loss has been used in a concurrent work Asi et al . ( 2021 ) which proves an Ω ( √ p n log p ) lower bound of approximate DP in the constrained case by reducing the results from one-way marginals , and can be extended to unconstrained case directly . We improve this bound by logarithmic terms and achieve optimality by utilizing the group privacy technique from Steinke and Ullman ( 2015 ) . We observe a novel biased mean property in the fingerprinting code to successfully combine and adjust these techniques to fit the ` 1 loss . We briefly describe the proof based on group privacy technique first . In the group privacy we need to copy some hard instances of data-set Dk of size nk : = bn/kc according to the construction of fingerprinting codes by k times , and append n− knk data points to get a final data-set D of size n. Fix any ( , δ ) -differentially private algorithm A for D , if we remove one element i∗ from Dk , we can get Dk−i∗ and D−i∗ where D−i∗ and D can have at most k elements different . Running A on D and D−i∗ respectively , we get an ( k , δ′ ) -differential privacy algorithm for Dk and Dk−i∗ . Setting k appropriately , if A can lead to small error on the DP-ERM , it can be an adversary which contradicts the properties of the fingerprinting codes . Intuitively , the differential privacy means it is hard to find the removed element i∗ , but fingerprinting codes suggest the removed element is traceable as long as Dk satisfies the required properties and A leads to small excess empirical loss with respect to L ( θ ; Dk ) . The direct use of the biased mean property is in appending the n − knk points . As nearly all of previous lower bounds in DP convex optimization are based on the results from one-way marginals , we try to demonstrate the proof in the language of one-way marginals . Because for linear functions , large one-way marginal errors lead to large excess empirical loss directly , which means the lower bound of private one-way marginals can apply to DP-ERM . But it is obvious that without additional assumption , large one-way marginal errors can not mean large excess empirical loss of the ` 1 loss functions anymore . Consider the toy case when p = 1 and Dk = { di } bn/kci=1 where di ∈ { 0 , 1 } . Denote the mean of these bn/kc by Dk . Similarly let D be the mean values of D constructed from Dk by method above . For example , if Dk = 1/2 and we only append points 1/2 , then D = 1/2 and whatever the one-way marginals are , the excess empirical loss ( of the n ` 1 loss functions ) can be 0 , as L ( θ ; D ) = 1n ∑n i=1 ‖θ−di‖1 is a constant function over [ 0 , 1 ] . So we need the meanDk to be biased . More specifically , we need |Dk − 1/2| should be larger than some value depending on k , then we can append n−knk dummy points safely . For general p , we need the unbiased mean property holds for a large fraction of coordinates . For any single dimension , the biased mean property serves to ensure the prediction of the column ( dimension ) is unchanged during the group privacy mechanism , in which some number of dummy points are appended that may potentially change the prediction of unbiased column . This novel property sets more stringent conditions . Fortunately , we observe that the previous construction of fingerprinting codes in Bun et al . ( 2018 ) satisfies it .

Summary: ## Summary of Contributions  This paper studies the unconstrained empirical risk minimization (ERM) under differential privacy (DP). In this setting, there is a loss function $\ell: \mathbb{R}^p \times \mathcal{X} \to \mathbb{R}$ and we are given $x_1, \dots, x_n \in \mathcal{X}$; the goal is to output $\theta$ that minimizes the empirical loss $L(\theta; X) := \frac{1}{n} \sum_{i=1}^n \ell(\theta; x_i)$. The goal is to minimize the excess empirical loss $\mathbb{E}[L(\theta; X) - \min_{\theta^* \in \mathbb{R}^p} L(\theta^*; X)]$. We want our algorithm to satisfies $(\epsilon, \delta)$-DP. Recall that the case $\delta > 0$ is referred to as *approximate-DP* whereas the case $\delta = 0$ is referred ti as *pure-DP*. Here we assume that $\ell$ is 1-Lipchitz; the results easily extends to $C$-Lipchitz functions with an extra multiplicative factor of $C$ in the excess empirical loss.  The main contributions of the paper are: 1. In the approximate-DP setting, the authors show a lower bound of $\Omega\left(\frac{\sqrt{p \log(1/\delta)}}{\epsilon n}\right)$. This improves upon the best known bound of $\Omega\left(\frac{\sqrt{p}}{\epsilon n \log p}\right)$ in the unconstrained case from [Asi et al., 2021] and $\Omega\left(\frac{\sqrt{p}}{\epsilon n}\right)$ in the constrained case [Bassily et al., FOCS 2014]. The new lower bound also matches the known upper bound in both cases [Bassily et al., FOCS 2014]. 2. In the pure-DP setting, the authors show a lower bound of $\Omega\left(\frac{p}{\epsilon n}\right)$.  To prove 1., the authors reduce from the 1-way marginal problem (similar to previous work). Recall that in 1-way marginal, we are given $x_1, \dots, x_n \in \\{-1, 1\\}^p$ and the goal is to approximate $\frac{1}{n} \sum_{i=1}^n x_i$; a lower bound of $\Omega(\frac{\sqrt{p \log(1/\delta)}}{\epsilon n})$ is known for the problem [Bun et al., STOC 2014]. The authors use an $\\ell_1$-distance loss function, i.e., $\\ell(\\theta; x_i) = ||\\theta - x_i||\_1$. Notice that here the optimal solution is $\\theta^*\_j = sign(\sum\_{i} z\_{i, j})$. This in spirit is very similar to 1-way marginal but not exactly the same. Specifically, if $\sum_{i} z_{i, j}$ is roughly around zero, then taking $\theta_j = -1$ or $\theta_j = 1$ does *not* effect the loss too much. Therefore, a direct "blackbox" reduction from 1-way marginal does not seem to work. To overcome this, the authors observe that actually in the construction of [Bun et al., STOC 2014] most of the coordinates' means are not close to zero (formalized as "biased mean" property in the current paper) and thus the hard instance gives the desired lower bound for DP ERM.  To prove 2., the authors use a standard packing-style construction together with the $\\ell_2$-distance loss function