Tight lower bounds for Differentially Private ERM

is O ( √ p log ( 1/δ ) n ) , which is believed to be tight . However , current lower bounds are off by some logarithmic terms , in particular Ω ( √ p n ) for constrained case and Ω ( √ p n log p ) for unconstrained case . We achieve tight Ω ( √ p log ( 1/δ ) n ) lower bounds for both cases by introducing a novel biased mean property for fingerprinting codes . As for pure-DP , we utilize a novel ` 2 loss function instead of linear functions considered by previous papers , and achieve the first ( tight ) Ω ( p n ) lower bound . We also introduce an auxiliary dimension to simplify the computation brought by ` 2 loss . Our results close a gap in our understanding of DP-ERM by presenting the fundamental limits . Our techniques may be of independent interest , which help enrich the tools so that it readily applies to problems that are not ( easily ) reducible from one-way marginals . 1 INTRODUCTION . Since the seminal work of Dwork et al . ( 2006 ) , differential privacy ( DP ) has become the standard and rigorous notion of privacy guarantee for machine learning algorithms , among which many fundamental ones are based on empirical risk minimization ( ERM ) . Motivated by this , private ERM becomes one of the most well-studied problem in the DP literature , e.g . Chaudhuri and Monteleoni ( 2008 ) ; Rubinstein et al . ( 2009 ) ; Chaudhuri et al . ( 2011 ) ; Kifer et al . ( 2012 ) ; Song et al . ( 2013 ) ; Jain and Thakurta ( 2014 ) ; Bassily et al . ( 2014 ) ; Talwar et al . ( 2015 ) ; Kasiviswanathan and Jin ( 2016 ) ; Fukuchi et al . ( 2017 ) ; Wu et al . ( 2017 ) ; Zhang et al . ( 2017 ) ; Wang et al . ( 2017 ) ; Iyengar et al . ( 2019 ) ; Bassily et al . ( 2020 ) ; Kulkarni et al . ( 2021 ) ; Asi et al . ( 2021 ) ; Bassily et al . ( 2021 ) ; Wang et al . ( 2021 ) . Roughly speaking , in the ERM setting , we are given a convex function family defined on a convex set C ⊆ Rp and a sample setD = { d1 , · · · , dn } drawn i.i.d from some unknown distribution P with the objective to minimize the loss function L ( θ ; D ) = 1 n n∑ i=1 ` ( θ ; di ) , and the value L ( θ ; D ) −minθ′∈C L ( θ′ ; D ) is called the excess empirical loss with respect to solution θ , measuring how it compares with the best solution in C. Private ERM in the constrained case was studied first and most of the previous literature belongs to this case . More specifically , the constrained case considers convex loss functions defined on a bounded convex set C ( Rp . Assuming the functions are 1-Lipschitz over the convex set of diameter 1 , the Ω ( √ p n ) lower bound of private ERM is given by Bassily et al . ( 2014 ) , even for ( special and simpler ) generalized linear model ( GLM ) . However , there are still several aspects that existing works don ’ t cover . First , existing upper bounds are off by at least a logarithmic term √ log ( 1/δ ) . For example in Wang et al . ( 2017 ) ; Bassily et al . ( 2019 ) they give upper bounds like O ( L||θ0−θ ∗||2 √ p log ( 1/δ ) n ) , which are believed to be tight . In Bassily et al . ( 2014 ) , they present a lower bound Ω ( √ p n ) by reducing linear loss to one-way marginal results in Hardt and Talwar ( 2010 ) ; Bun et al . ( 2018 ) . In Steinke and Ullman ( 2015 ) they achieve the tight lower bound for answering one-way marginals with respect to ` 1 norm , but it does not imply tight lower bounds for general loss functions by the methods in Bassily et al . ( 2014 ) directly . Another aspect is DP-ERM in the unconstrained case which was neglected before and gathered people ’ s attention recently , see Jain and Thakurta ( 2014 ) ; Song et al . ( 2021 ) . The unconstrained case is interesting in that we can ’ t use linear loss any more which lies at the heart of the construction in the constrained case . Moreover , previous algorithms in the constrained case suffer from the curse of dimensionality when p is large . For example , when p = Ω ( n2 ) , the lower bound is Ω ( 1 ) and any private algorithm can not get meaningful bounds on the excess empirical loss . Song et al . ( 2021 ) proves an dimension-independentO ( √ rank n ) upper bound in the unconstrained setting for the special case of GLMs , where rank denotes the rank of the feature matrix of GLM . However , it ’ s unknown if similar results can be achieved for general loss functions . As for the lower bound , Asi et al . ( 2021 ) give Ω ( √ p n log p ) lower bound by considering ` 1 loss as the objective functions and reducing the results also from one-way marginals . 1.1 OUR CONTRIBUTIONS . In this paper , we fill up the two gaps together by proving an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithms . This bound is automatically applicable in the constrained case , which improves previous results and achieve a tight lower bound for both constrained and unconstrained case . We summarize our main results as follows : • We prove an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithm . This bound improves Asi et al . ( 2021 ) by a log ( p ) √ log ( 1/δ ) factor in the unconstrained case and matches the upper bound in Kairouz et al . ( 2020 ) . • We also prove an Ω ( min ( 1 , pn ) ) lower bound for the excess risk of unconstrained 1- Lipschitz convex loss functions for any pure differential privacy algorithm . Note that our main results for unconstrained case can be extended to constrained case directly , thus our lower bound for approximate private algorithm is √ log ( 1/δ ) multiplicative better than the wellknown bound in Bassily et al . ( 2014 ) with the help of group privacy technique in Steinke and Ullman ( 2015 ) . A key contribution of this paper is novel tools for private lower bound techniques . For most problems , accuracy lower bound in the private setting is established via reduction from one-way marginals . Hence the tools for lower bounds is quite limited . We contribute to refinement of such tools – in particular , we propose modifications such as the additional ” biased means ” property to fingerprinting codes , which is the key lower bound technique . Such modifications help enrich the tools so that it readily applies to problems which are not ( easily ) reducible from one-way marginals . 1.2 OUR TECHNIQUES . In general , the direct technical challenge of the unconstrained case lies in the choice of loss function and the difficulties caused by the new loss function . The loss function is required to be convex and Lipschitz-continuous at the same time . In the constrained case , the linear loss function is obviously a good choice for constructing lower bounds , because it is easy to analyze and easily reducible from one-way marginals . However , in the unconstrained case any non-trivial linear loss function can take ‘ −∞ ’ value thus not applicable anymore . We further observe that convexity plus Lipschitzcontinuity means ‘ asymptotically linear ’ : the sub-gradient along any direction must converge . This observation guides us in choosing new loss functions for unconstrained DP-ERM ( which can be extended to constrained case directly ) . We briefly introduce the new problems caused by the new loss functions and our method to overcome them for approximate-DP and pure-DP separately . 1.2.1 APPROXIMATE-DP . The construction of our lower bound for approximate-DP is based on the Fingerprinting Codes , which was first studied by Wagner ( 1983 ) and developed by Boneh and Shaw ( 1998 ) ; Tardos ( 2008 ) . From a technical perspective , we change the previously used linear loss and use an ` 1 norm function instead where ` ( θ ; d ) = ‖θ − d‖1 . ` 1 loss has been used in a concurrent work Asi et al . ( 2021 ) which proves an Ω ( √ p n log p ) lower bound of approximate DP in the constrained case by reducing the results from one-way marginals , and can be extended to unconstrained case directly . We improve this bound by logarithmic terms and achieve optimality by utilizing the group privacy technique from Steinke and Ullman ( 2015 ) . We observe a novel biased mean property in the fingerprinting code to successfully combine and adjust these techniques to fit the ` 1 loss . We briefly describe the proof based on group privacy technique first . In the group privacy we need to copy some hard instances of data-set Dk of size nk : = bn/kc according to the construction of fingerprinting codes by k times , and append n− knk data points to get a final data-set D of size n. Fix any ( , δ ) -differentially private algorithm A for D , if we remove one element i∗ from Dk , we can get Dk−i∗ and D−i∗ where D−i∗ and D can have at most k elements different . Running A on D and D−i∗ respectively , we get an ( k , δ′ ) -differential privacy algorithm for Dk and Dk−i∗ . Setting k appropriately , if A can lead to small error on the DP-ERM , it can be an adversary which contradicts the properties of the fingerprinting codes . Intuitively , the differential privacy means it is hard to find the removed element i∗ , but fingerprinting codes suggest the removed element is traceable as long as Dk satisfies the required properties and A leads to small excess empirical loss with respect to L ( θ ; Dk ) . The direct use of the biased mean property is in appending the n − knk points . As nearly all of previous lower bounds in DP convex optimization are based on the results from one-way marginals , we try to demonstrate the proof in the language of one-way marginals . Because for linear functions , large one-way marginal errors lead to large excess empirical loss directly , which means the lower bound of private one-way marginals can apply to DP-ERM . But it is obvious that without additional assumption , large one-way marginal errors can not mean large excess empirical loss of the ` 1 loss functions anymore . Consider the toy case when p = 1 and Dk = { di } bn/kci=1 where di ∈ { 0 , 1 } . Denote the mean of these bn/kc by Dk . Similarly let D be the mean values of D constructed from Dk by method above . For example , if Dk = 1/2 and we only append points 1/2 , then D = 1/2 and whatever the one-way marginals are , the excess empirical loss ( of the n ` 1 loss functions ) can be 0 , as L ( θ ; D ) = 1n ∑n i=1 ‖θ−di‖1 is a constant function over [ 0 , 1 ] . So we need the meanDk to be biased . More specifically , we need |Dk − 1/2| should be larger than some value depending on k , then we can append n−knk dummy points safely . For general p , we need the unbiased mean property holds for a large fraction of coordinates . For any single dimension , the biased mean property serves to ensure the prediction of the column ( dimension ) is unchanged during the group privacy mechanism , in which some number of dummy points are appended that may potentially change the prediction of unbiased column . This novel property sets more stringent conditions . Fortunately , we observe that the previous construction of fingerprinting codes in Bun et al . ( 2018 ) satisfies it .

Summary: This paper studies differentially private empirical risk minimisation (ERM) in the unconstrained setting. It gives tight lower bounds for approximate DP ERM for general loss functions, which also implies the same lower bound for the constrained case, which is an improvement over a classic lower bound by Bassily et al 2014. It also gives a lower bound for unconstrained pure DP ERM that recovers the result in the constrained case.