Tight lower bounds for Differentially Private ERM

is O ( √ p log ( 1/δ ) n ) , which is believed to be tight . However , current lower bounds are off by some logarithmic terms , in particular Ω ( √ p n ) for constrained case and Ω ( √ p n log p ) for unconstrained case . We achieve tight Ω ( √ p log ( 1/δ ) n ) lower bounds for both cases by introducing a novel biased mean property for fingerprinting codes . As for pure-DP , we utilize a novel ` 2 loss function instead of linear functions considered by previous papers , and achieve the first ( tight ) Ω ( p n ) lower bound . We also introduce an auxiliary dimension to simplify the computation brought by ` 2 loss . Our results close a gap in our understanding of DP-ERM by presenting the fundamental limits . Our techniques may be of independent interest , which help enrich the tools so that it readily applies to problems that are not ( easily ) reducible from one-way marginals . 1 INTRODUCTION . Since the seminal work of Dwork et al . ( 2006 ) , differential privacy ( DP ) has become the standard and rigorous notion of privacy guarantee for machine learning algorithms , among which many fundamental ones are based on empirical risk minimization ( ERM ) . Motivated by this , private ERM becomes one of the most well-studied problem in the DP literature , e.g . Chaudhuri and Monteleoni ( 2008 ) ; Rubinstein et al . ( 2009 ) ; Chaudhuri et al . ( 2011 ) ; Kifer et al . ( 2012 ) ; Song et al . ( 2013 ) ; Jain and Thakurta ( 2014 ) ; Bassily et al . ( 2014 ) ; Talwar et al . ( 2015 ) ; Kasiviswanathan and Jin ( 2016 ) ; Fukuchi et al . ( 2017 ) ; Wu et al . ( 2017 ) ; Zhang et al . ( 2017 ) ; Wang et al . ( 2017 ) ; Iyengar et al . ( 2019 ) ; Bassily et al . ( 2020 ) ; Kulkarni et al . ( 2021 ) ; Asi et al . ( 2021 ) ; Bassily et al . ( 2021 ) ; Wang et al . ( 2021 ) . Roughly speaking , in the ERM setting , we are given a convex function family defined on a convex set C ⊆ Rp and a sample setD = { d1 , · · · , dn } drawn i.i.d from some unknown distribution P with the objective to minimize the loss function L ( θ ; D ) = 1 n n∑ i=1 ` ( θ ; di ) , and the value L ( θ ; D ) −minθ′∈C L ( θ′ ; D ) is called the excess empirical loss with respect to solution θ , measuring how it compares with the best solution in C. Private ERM in the constrained case was studied first and most of the previous literature belongs to this case . More specifically , the constrained case considers convex loss functions defined on a bounded convex set C ( Rp . Assuming the functions are 1-Lipschitz over the convex set of diameter 1 , the Ω ( √ p n ) lower bound of private ERM is given by Bassily et al . ( 2014 ) , even for ( special and simpler ) generalized linear model ( GLM ) . However , there are still several aspects that existing works don ’ t cover . First , existing upper bounds are off by at least a logarithmic term √ log ( 1/δ ) . For example in Wang et al . ( 2017 ) ; Bassily et al . ( 2019 ) they give upper bounds like O ( L||θ0−θ ∗||2 √ p log ( 1/δ ) n ) , which are believed to be tight . In Bassily et al . ( 2014 ) , they present a lower bound Ω ( √ p n ) by reducing linear loss to one-way marginal results in Hardt and Talwar ( 2010 ) ; Bun et al . ( 2018 ) . In Steinke and Ullman ( 2015 ) they achieve the tight lower bound for answering one-way marginals with respect to ` 1 norm , but it does not imply tight lower bounds for general loss functions by the methods in Bassily et al . ( 2014 ) directly . Another aspect is DP-ERM in the unconstrained case which was neglected before and gathered people ’ s attention recently , see Jain and Thakurta ( 2014 ) ; Song et al . ( 2021 ) . The unconstrained case is interesting in that we can ’ t use linear loss any more which lies at the heart of the construction in the constrained case . Moreover , previous algorithms in the constrained case suffer from the curse of dimensionality when p is large . For example , when p = Ω ( n2 ) , the lower bound is Ω ( 1 ) and any private algorithm can not get meaningful bounds on the excess empirical loss . Song et al . ( 2021 ) proves an dimension-independentO ( √ rank n ) upper bound in the unconstrained setting for the special case of GLMs , where rank denotes the rank of the feature matrix of GLM . However , it ’ s unknown if similar results can be achieved for general loss functions . As for the lower bound , Asi et al . ( 2021 ) give Ω ( √ p n log p ) lower bound by considering ` 1 loss as the objective functions and reducing the results also from one-way marginals . 1.1 OUR CONTRIBUTIONS . In this paper , we fill up the two gaps together by proving an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithms . This bound is automatically applicable in the constrained case , which improves previous results and achieve a tight lower bound for both constrained and unconstrained case . We summarize our main results as follows : • We prove an Ω ( min ( 1 , √ p log ( 1/δ ) n ) ) tight lower bound for the excess risk of unconstrained 1-Lipschitz convex loss functions for approximate differentially private algorithm . This bound improves Asi et al . ( 2021 ) by a log ( p ) √ log ( 1/δ ) factor in the unconstrained case and matches the upper bound in Kairouz et al . ( 2020 ) . • We also prove an Ω ( min ( 1 , pn ) ) lower bound for the excess risk of unconstrained 1- Lipschitz convex loss functions for any pure differential privacy algorithm . Note that our main results for unconstrained case can be extended to constrained case directly , thus our lower bound for approximate private algorithm is √ log ( 1/δ ) multiplicative better than the wellknown bound in Bassily et al . ( 2014 ) with the help of group privacy technique in Steinke and Ullman ( 2015 ) . A key contribution of this paper is novel tools for private lower bound techniques . For most problems , accuracy lower bound in the private setting is established via reduction from one-way marginals . Hence the tools for lower bounds is quite limited . We contribute to refinement of such tools – in particular , we propose modifications such as the additional ” biased means ” property to fingerprinting codes , which is the key lower bound technique . Such modifications help enrich the tools so that it readily applies to problems which are not ( easily ) reducible from one-way marginals . 1.2 OUR TECHNIQUES . In general , the direct technical challenge of the unconstrained case lies in the choice of loss function and the difficulties caused by the new loss function . The loss function is required to be convex and Lipschitz-continuous at the same time . In the constrained case , the linear loss function is obviously a good choice for constructing lower bounds , because it is easy to analyze and easily reducible from one-way marginals . However , in the unconstrained case any non-trivial linear loss function can take ‘ −∞ ’ value thus not applicable anymore . We further observe that convexity plus Lipschitzcontinuity means ‘ asymptotically linear ’ : the sub-gradient along any direction must converge . This observation guides us in choosing new loss functions for unconstrained DP-ERM ( which can be extended to constrained case directly ) . We briefly introduce the new problems caused by the new loss functions and our method to overcome them for approximate-DP and pure-DP separately . 1.2.1 APPROXIMATE-DP . The construction of our lower bound for approximate-DP is based on the Fingerprinting Codes , which was first studied by Wagner ( 1983 ) and developed by Boneh and Shaw ( 1998 ) ; Tardos ( 2008 ) . From a technical perspective , we change the previously used linear loss and use an ` 1 norm function instead where ` ( θ ; d ) = ‖θ − d‖1 . ` 1 loss has been used in a concurrent work Asi et al . ( 2021 ) which proves an Ω ( √ p n log p ) lower bound of approximate DP in the constrained case by reducing the results from one-way marginals , and can be extended to unconstrained case directly . We improve this bound by logarithmic terms and achieve optimality by utilizing the group privacy technique from Steinke and Ullman ( 2015 ) . We observe a novel biased mean property in the fingerprinting code to successfully combine and adjust these techniques to fit the ` 1 loss . We briefly describe the proof based on group privacy technique first . In the group privacy we need to copy some hard instances of data-set Dk of size nk : = bn/kc according to the construction of fingerprinting codes by k times , and append n− knk data points to get a final data-set D of size n. Fix any ( , δ ) -differentially private algorithm A for D , if we remove one element i∗ from Dk , we can get Dk−i∗ and D−i∗ where D−i∗ and D can have at most k elements different . Running A on D and D−i∗ respectively , we get an ( k , δ′ ) -differential privacy algorithm for Dk and Dk−i∗ . Setting k appropriately , if A can lead to small error on the DP-ERM , it can be an adversary which contradicts the properties of the fingerprinting codes . Intuitively , the differential privacy means it is hard to find the removed element i∗ , but fingerprinting codes suggest the removed element is traceable as long as Dk satisfies the required properties and A leads to small excess empirical loss with respect to L ( θ ; Dk ) . The direct use of the biased mean property is in appending the n − knk points . As nearly all of previous lower bounds in DP convex optimization are based on the results from one-way marginals , we try to demonstrate the proof in the language of one-way marginals . Because for linear functions , large one-way marginal errors lead to large excess empirical loss directly , which means the lower bound of private one-way marginals can apply to DP-ERM . But it is obvious that without additional assumption , large one-way marginal errors can not mean large excess empirical loss of the ` 1 loss functions anymore . Consider the toy case when p = 1 and Dk = { di } bn/kci=1 where di ∈ { 0 , 1 } . Denote the mean of these bn/kc by Dk . Similarly let D be the mean values of D constructed from Dk by method above . For example , if Dk = 1/2 and we only append points 1/2 , then D = 1/2 and whatever the one-way marginals are , the excess empirical loss ( of the n ` 1 loss functions ) can be 0 , as L ( θ ; D ) = 1n ∑n i=1 ‖θ−di‖1 is a constant function over [ 0 , 1 ] . So we need the meanDk to be biased . More specifically , we need |Dk − 1/2| should be larger than some value depending on k , then we can append n−knk dummy points safely . For general p , we need the unbiased mean property holds for a large fraction of coordinates . For any single dimension , the biased mean property serves to ensure the prediction of the column ( dimension ) is unchanged during the group privacy mechanism , in which some number of dummy points are appended that may potentially change the prediction of unbiased column . This novel property sets more stringent conditions . Fortunately , we observe that the previous construction of fingerprinting codes in Bun et al . ( 2018 ) satisfies it .

Summary: The paper describes some lower bounds for differentially private empirical risk minimization (DP ERM). The main results are:  * An $\Omega(\sqrt{p \log(1/\delta)}/\epsilon n)$ lower bound for unconstrtained ERM under approximate differential privacy. This improves on prior work of Bassily et al. in the presence of the $\log(1/\delta)$ term, and in the optimization being unconstrained.  * An $\Omega(p/\varepsilon n)$ lower bound for pure differential privacy.  The proofs use now standard techniques from the literature: fingerprinting codes for approximate DP and a packing argument for pure DP.