Numerical Accounting in the Shuffle Model of Differential Privacy
Authors: Antti Koskela
Mikko A. Heikkilä
Antti Honkela
Venue: Accepted by TMLR ()

Abstract: Shuffle model of differential privacy is a novel distributed privacy model based on a combination of local privacy mechanisms and a secure shuffler. It has been shown that the additional randomisation provided by the shuffler improves privacy bounds compared to the purely local mechanisms. Accounting tight bounds, however, is complicated by the complexity brought by the shuffler. The recently proposed numerical techniques for evaluating $(\varepsilon,\delta)$-differential privacy guarantees have been shown to give tighter bounds than commonly used methods for compositions of various complex mechanisms. In this paper, we show how to utilise these numerical accountants for adaptive compositions of general $\varepsilon$-LDP shufflers and for shufflers of $k$-randomised response mechanisms, including their subsampled variants. This is enabled by an approximation that speeds up the evaluation of the corresponding privacy loss distribution from $\mathcal{O}(n^2)$ to $\mathcal{O}(n)$, where $n$ is the number of users, without noticeable change in the resulting $\delta(\varepsilon)$-upper bounds. We also demonstrate looseness of the existing bounds and methods found in the literature, improving previous composition results for shufflers significantly. 

Published in Transactions on Machine Learning Research (MM/YYYY)
Numerical Accounting in the Shuffle Model of Differential Privacy
Antti Koskela
anthh..kosttiaannoooobellllll
Nokia Bell Labs University of Helsinki
Mikko Heikkilä
mikko.a. wakko...hhiikkiiiiccccsiskkk
Department of Computer Science University of Helsinki
Antti Honkela
anti.hhokkeaa@hclsinkk
Department of Computer Science University of Helsinki
Reviewed on OpenReview:
Abstract
Shuflle model of differential privacy a novel distributed privacy model based on a combination local privacy mechanisms and a secure shuffler. It has been shown that the additional randomisation provided by the shuffler improves privacy bounds compared to the purely local mechanisms. Accounting tight bounds, however, is complicated by the complexity brought by the shuffler. The recently proposed numerical techniques for evaluating (s, d)-difffreat privacy guarantees have been shown to give tighter bounds than commonly used methods for compositions of various complex mechanisms. In this paper, we show how to utilise these numerical accountants for adaptive compositions of general s-LDP shufflers and for shufflers of k-randomised response mechanisms, including their subsampled variants. This enabled by an approximation that speeds up the evaluation of the corresponding privacy loss distribution from On?)) to O(n), where n the number of users, without noticeable change in the resulting 6(e)-upper bounds. We also demonstrate looseness of the existing bounds and methods found in the literature, improving previous composition results for shufflers significantly.
1 Introduction
The shuffle model of differential privacy (DP) is distributed privacy model which sits between the high trust- high utility centralised DP, and the low trust low utility local DP (LDP). In the shuffle model, the individual results from local randomisers are only released through a secure shuffler. This additional randomisation leads to "amplification by shuffling", resulting in better privacy bounds against adversaries without access the unshuffled local results.
We consider computing privacy bounds for both single and composite shuflle protocols, where by composite protocol mean a protocol, where the subsequent wise local randomisers depend the same local datasets and possibly on the previous output of the shuffler, and at each round the results from the local randomisers are independently shuffled. Moreover, using the analysis by Feldman et al. 2023), we provide bounds in the case the subsequent. local randomisers are allowed to depend adaptively on the output of the previous ones.
In this paper we show how numerical accounting (oskela al. 2020 2021 employed for privacy analysis of both single and composite shuffle DP mechanisms. We demonstrate that
Gopi al. 2021 can be

---

Published in Transactions on Machine Learning Research (MM/YYYY)
thus obtained bounds can be up to orders of magnitudes tighter than the existing bounds from the literature. We also evaluate how significantly adversaries with varying capabilities differ in terms of the resulting privacy bounds using the k-randomised response mechanism. For conciseness, most of the proofs are given in the Appendix.
1.1 Related work
DP was originally defined in the central model assuming a trusted aggregator by Dwork et al. (2006), while the fully distributed LDP was formally introduced and analysed by Kasiviswanathan al. (2011). Closely related to the shuffle model of DP, Bittau et al. (2017) proposed the Encode, Shuffle, Analyze framework for distributed learning, which uses the idea of secure shuffler for enhancing privacy. The shuffle model of DP was formally defined by Cheu et al.] (0019), who also provided the first separation result showing that the shuffle model is strictly between the central and the local models of DP. Another direction initiated by CCeu et al. 2019) and continued, e.g., by Balle et al. (2020b); Ghazi et al. [2021) has established a separation between single- and multi-message shuffle protocols.
There exists several papers on privacy amplification by shuflling, some of which are central to this paper. Erlingsson et al. (2019) showed that the introduction of secure shuffler amplifies the privacy guarantees against an adversary, who is not able to access the outputs from the local randomisers but only sees the shuffled output. [Balle et al. (2019) improved the amplification results and introduced the idea of privacy blanket, which we also utilise in our analysis of k-randomised response. Feldman et al. (2021) used related idea of hiding in the crowd to improve on the previous results, and their analysis was further improved in (Feldman al., 2023). Girgis et al. (2021) generalised shuffling amplification further to scenarios with composite protocols and parties with more than one local sample under simultaneous communication and privacy restrictions. We use the improved results of Feldman et al. (2023) in the analysis of general LDP mechanisms, and compare setting considered by Girgis et al. (2021). namely in the case where subset of users sending contributions to the shufflers are sampled randomly. This can be seen as a subsampled mechanism and we are able to combine the analysis of Feldman et al. (202), the privacy loss distribution related subsampling results of Zhu et al. h and FFT accounting to obtain lighter (s, 8bbounds than Girgis el al. (2021), as shown in Section 3.4
bounds with theirs in Section 3.3 We also calculate privacy bounds in the
2
Background: numerical privacy accounting
Before analysing the shuffled mechanisms introduce some required theory and notations. In particular, use the privacy loss distribution formalism, which is based on finding the so-called dominating pairs of distributions for the given mechanisms. For more detailed presentations of the theory, we refer to [Koskelal
et al.
2021
Gopi et al. (2021): Zhu et al. 2002
2.1
Differential privacy and privacy loss distribution
An input dataset containing n data points is denoted as X = (II, (u,,...,4y (a)) E X"" where x; E X, 1 S n. We say X'X' X are neighbours we get one by substituting one element in the other (denoted X X'). Definition 1. Let E > O and E 1]. Let P and Q be two random variables taking values in the same measurable space O. We say that and Q are (e, ii.i))iiiiittinuuhhabb.e denoted P =(,,6) Q, if for every
mensurable set C O we have
Pr(P E (AREEE SeP E)
Pr(Q E E) E +6
Definition 2. Let E > 0 and E [0. Mechanism M x + 0 is (E, if for every X X': M(X) (c,5) M(X'). We call M tightly (e, (D,,, if there does not exist. 8' < such that M is (e,8')-DP
When the data are distributed among several partics, and the local datasets are only accessed via purely local DP mechanisms, we say that the mechanisms guarantee local DP (LDP) and call the local DP mechanisms local randomisers (Kasiviswanathan et al. )
2

---

Published in Transactions on Machine Learning Research (MM/YYX)
We rely the results of Zhu et al. (002 and characterise (c, 6)-DP bounds using the hockey-stick divergence, which for a 2 0 is defined as
Ha(PIQQ) = [P(() f
Q(t))+ dt,
where for x E RR, 2 max (0, Using the hockey-stick divergence, by (Lemma 5, Zhu et al. 2022 tight (s, (PPP) bounds can also be characterised
8(e) = max Ho (M(((())))M(())) X-X
We can generally find (e, bounds by analysing dominating pairs of distributions:
Definition (Zhu et al. 2022. A pair of distributions (P, Q) is a dominating pair of distributions for mechanism M if for all 0,
Ha(M(())IM(())) & (.(I))).. X~X
Using dominating pairs of distributions, we can obtain d(s)-upper bounds for adaptive compositions: Theorem (Zhu et al. 2022). If (P,Q) dominates M and (P', ,²) dominates M', then (P x P'Qxx)) dominates the adaptive composition M M'.
Having dominating pairs of distributions for each individual mechanism in a composition, the hockey-stick divergence can be transformed into a more easily computable form by using the privacy loss random variables (PRVs). PRV for pair of distributions (P,Q) is defined as follows.
Definition 5. Let P(t) and Q(t) be probability density functions. We define the PRV wp/Q as
P(t) t~ P(t),
WP/Q = log
Q(t)*
where P(t) means that is distributed according P(t).
With a slight abuse of notation, we denote the probability density function of the random variable wp/Q by Wp)q(t), and call it the privacy loss distribution (PI.D).
The 8(s)-bounds can be stated using the following representation that involves the PRV.
Theorem (Gopi et al. 2021 We have:
He- (PI())
= Eurjo -1-e e--e-=PPa)
(2.1)
Moreover, if w/pp is a PRV for the pair of distributionss (P, Q) and wpd PRV for the pair of distribultons (P',))) then the PRV for the pair of distrübutions (P x P', Q x Q¹) given by wp/Q + wpr'
composition and by formulating the intogral of the form given in Equation 2.1 the numerical PLD accountants [Koskela et al. 2021 Gopi et al. 2021 can be utilised for computing accurate d(s)-bourdss.
By identifying dominating pairs of distributions for each mechanism ((c)-bound via hockey-stick divergence
We will also use the following subsampling amplification result (Proposition 30, Zhuu et al. 2022), which leads to a privacy profile for the compasod mechanism M SSudsets whore Ssubeet denotes subsampling procedure where, from an input n entries, a fixed sized subset of q n1 < S 1, entries is sampled without replacement.
Lemma (Zhu et al. 2022). Denote the subsampled mecharism M := M Ssubset. Suppose pair of distributions (P,Q) Q) is dominating pair of distributions for mechanism. M for all datasets of size q n under the m-neighhourrng relation (i.e., the substitute relation), where is the subsampling ratio (size of the subset divided by n). Then, for all neighbouring datasels (under the --neighbouring relation) X and Y of size n,
H. (M(()))))() & Ha(q P (1 QQ1Q), for 2 1,
(2.2)
H. (M(X)))M(() & H. (Pllq Q - -) P), for 1.
3

---

Published in Transactions on Machine Learning Research (MM/YYY)
Considering the assumptions of Lemma 7 if we define a function h R22 - R
h(a) max P (1 H Q (1-q) -)}
(2.3)
we see that h(a) clearly defines a privacy profile: it is convex and has all the other required properties of privacy profile. Thus we can use an existing numerical method (Doroshenko et al. 2022 Algorithm 1) with the function h to obtain discrete-valued distributions P and Q, that are dominating pair for M Me Subsett
We remark that by (Theorem 10, Zhu al.) 2022), the pairs of distributions on the right-hand side of Equation 2.2 give dominating pairs for remove and add neighbouring relations of datasets in case the pair (P)Q) is a dominating pair of distributions for M under remove and add neighbouring relations, respectively, and can therefore be used to compute (s, 6)-uppe bounds in case of add/remove neighbouring relations of datasets. Then, the computation is more straightforward since one can simply take the maximum of the ((e)-values obtained under the remove and add neighbouring relations and therefore using the tochniques of Doroshenko et al.] (2022) is not necessary. We focus on using the --relation as the dominating pair (P, Q) obtained using both the post-processing results of (Feldman et al., 2023) and using our analysis for the k-RR. local randomiscr is dominating pair under the --relation. The relation is also behind the baseline bounds by Girgis et al. (2021). We illustrate in Fig. | the accuracy of the numerical construction of (Doroshenko)
et al. 2022 Algorithm 1) applied to the privacy profile given in Equation 2.3
2.2
Numerical PLD accounting using FFT
In order to evaluate integrals of the form given in Equation 2.1 we use the Fast Fourier Transform (FFT)- based method by Koskela et al. (2021) called the Fourier Accountant (FA). This means that cach PLD is truncated and placed on an equidistant numerical grid over an interval [-L, L], L > O. The distributions for the sums of the PRVs are given by convolutions of the individual PLDs and are evaluated using the FFT algorithm. By a careful error analysis the error incurred by the numerical method can be bounded and an upper ((E)-bound obtained. We note that alternatively, for accurately computing the integrals we could also use the FFT-baased method proposed by Gopi al. 2021
3 General shuffled LD-LDP mechanisms
Feldman al. (2023) consider general Lo-LDP local randomisers combined with a shuffler. The analysis allows also sequential adaptíve compositions of the user contributions before shuffling. The analysis is based decomposing individual LDP contributions to mixtures of dala dependent part and noise, which leads to
finding (c, 5bbbund for the pair of 2-dimensional random variables (see Thm. 3.1 of Feldman et al. 2023
P (A + AI, -
Q = (A A2, C A+ A1)
(3.1)
where for n E N,
O~ Bin(nnn-- - 1,2p), A~ Bin (C, A ~~~ Bern (eoup) and A2 ~ Bin (1 AI. (1))): (3.2)
and p . Intuitively, C' denotes the number of other users whose mechanism outputs are indistinguishable "clones" of the two differing users, with A denoting random split between these. Using the following lemma, we can use the FFT-based numerical accountants to obtain accurate bounds also for adaptive compositions of general LDD shuffling mechanisms:
Lemma 8. Let X and X' be neighbouring datasets and denote by Ax(X) and Ax(')) outputs of the shufflers of adaptive LDDL local randomisers (for a detailed description of As, see Thm. 3.1 by Feldman et al. 2023 which uses the same nolation). Then, for all a O,
H.(AA(X)) < (Pl()))),
where P and Q are given in Equation 3.1
4

---

Published in Transactions on Machine Learning Research (MM/YYYY)
Proof. By Thm. 3.1 of Feldman al. (2023) there exists post-processing algorithm & such that (X) is distributed identically to (PP) and (x"))) identically to ((Q). The claim follows then from the data- processing inequality which holds for the hockey-stick divergence (Balle et al. 2020a).
Corollary 9. The pair of distributions (P, Q) given in Equation 3.1 is a dominating pair of distributions for the shuffting mechanism Ax()).
Furthermore, using Thm. 4 we can bound the ô(e) of no-wise adaptive composition of the shuffler A, using product distributions of Ps and Qs:
Corollary 10. Denole Age (X,z0) = A,(X,,(X (xx,x.....A.xx for some inilial state z0- For all neighbouring datasets and X' and for all a 2 0,
(A (X)) S Ha(Px.... x PIQQ x x Q),
(3.3)
We remark that the case of heterogeneous adaptive compositions (e.g. varying n and Eq) can be handled analogously using Thm.
Thus, using the bound of Equation 3.3 for e get upper bounds for adaptive compositions of general shuffled Eg-LDP mechanisms with the Fourier accountant by finding the PLD for the distributions P, P,Q (given in Equation 3.1). Note that even though the resulting (e, 6)-bound is tight for P's and Q's, it need not be tight for a specific mechanism like the shuffled k-RR. The bound simply gives an upper bound for any shuffled LDP mochanisms.
3.1 PLD for shuffled Ep- LDP mechanisms
To analyse compositions of general shuffled Ep-LDP mechanisms, we need to form the PLD wpyq determined by P and Q of Equation 3.1 Denoting q = = and q = -- p e and writing out the randomness of A and A₂ as mixtures, we see that the random variables and Q given in Equation 3.1 can be expressod as
() - P P 100--99--1 P1 ( -
7) P2, Q= (1- Po (1 9)(1 - 7 P2.
where
Po ~ (A+1,C A), ~ (A,C A+1), P== (A,C C A)
and A and C are as given in Equation 3.2 In the Appendix, we give the required expressions to determine the discrete-valued PL.D
wp) = =E., a.b
P(P= b)) (a) (s 8(a = log
[(P=(o.))
(3.4)
((Q=(a,)))
where 8,(.,, s E I, denotes the Dirac delta function centred at s, and similarly also for wo/r(s).
3.2 Lowering PLD computational complexity using Hoeffding's inequality
The PLD of Equation 3.4 has O(n²) terms, which makes its naive evaluation overly expensive for a large number of users n. Using an appropriate tail bound (Hoeffding) for the binomial distribution, we can truncate part of the probability mass and add it directly to ó. More specifically, if each PLD wi, 1 1 S ney in an n.-- wise composition is approximated by a truncated distribution Wi such that the truncated probability masses are T; 2 O, respectively, then 5(E) = ô(e) + 5(00), where 8(E) the value of the integral in Equation 2.1 obtained with the truncated PLDs and 8(0o) 1 II, 7x) S Σg Ti, gives an upper bound for the composition without truncations. Using the Hoeffding's 's inequality obtain an accurate approximation of WP/Q with only O(n) terms. We formalise this approximation follows:
Lemma 11. Let the PLD wpyQ be defined in Equation 3.4 (Equation
3.1 gives P and Q which include
C Bin(n- 1, 2p) and A Bin (C, 2)) and let T > 0. Consider the sel
S, |max (0, (2p cn)(n 1)) min (n 1, (2p + ca)(n 1))]
5

---

Published in Transactions on Machine Learning Research (MM/YYY)
l//) 2(-
where Cn
and the set
S. = [max (0, ( ci)
c)) -d) min (n 1 + (.)-))]
where c V
log(4/7) 2
Then, ZpiQ defined by
xp/q(0)= = Σ
Σ
P(P (j +1, (2)))88,00 ) 8a.b log
P(P=(a.01) P(Q==l.b))
(3.5)
SES JES;
has O(n log(4/T)) terms and differs from wriq at most by mass T.
Proof. As A is conditioned on C, we first use tail bound on C and then on A to reduce the number of terms. Using Hoeffding's inequality for C ~ Bin(n - 1,2p) states that for e e>> O,
(C S (2p- (n 1)) z exp (-2(n - 1)c2);
2(n
PPC 2 (2p + c)(n 1)) & exp 2( - 1)c²).
Requiring that 2 exp (-2(n - 1)e²) s r/2 gives the condition c 2 V 2( and the expressions for and S.. Similarly, we use Hoeffding's inequality for A ~ Bin(C, 2) and get expressions for G and S The total neglected mass is at most 7 7/2 + T/2 т. For the nunber of terms, we see that Sn contains at most (n - 1) -n--ne Vn- log(4/T) terms and for each i, and S, contains at most 2cpi = 2ii22-log44/)) S Vn- 2 log(4/r) terms. Thus pp/Q has at most O(n log(4/r)) terms. We get the form of Equation 3.5 by an appropriate change of variables.
/og(1/T)
When evaluating Wp/q, we require that the neglected mass is smaller than some prescribed tolerance т (e.g. T = 10 10-12). When computing guarantees for compositions, the cost of FFT for evaluating the convolutions dominates the rest the computation.
3.3 Experimental comparison to RDP
Figure shows a comparison between the PLD and RDP applied to the pair of distributions P and Q given in Equation 3.1 RDP bounds for composition are computed using standard composition results (Mironov 2012 and the RDP bounds are converted DP bounds using the conversion formula given by Canonne al. 2200 Naive evaluation of RDP-values is O(n2) computation. We heuristically speed up RDP evaluation using the Hoeffding inequality (Lemma I1 and check that increasing the accuracy does not change the results.
3.4 Experimental comparison to the subsampled RDP bounds of Girgis et al. (2021)
Girgis et al. (2021) consider protocol where randomly sampled, fixed sized subset of users sends contributions to the shuffler on each round, and the local randomisers are assumed to be integer-valued So-LDP mechanisms. This can be seen as a composition of a shuffler and a subsampling mechanism. We can generalise our analysis to this case via Lemma 7 and use Algorithm of Dorashenko et al. (2022 on the function h(a) defined Equation 2.3 obtain the dominating pair of distributions for the subsampled (on,1....n.t1 where
shuffler. To this end, we need to define a grid for a: (ao,..., +n.+11, On co. We consider logarithmically equidistant grid between ai and O'... Thus, in practice this means that we need to determine a₁ and on, and the value no. Figure 2 illustrates the convergence of the obtained approximation as we refine the a-grid, for a subsampled shuffler, where the dominating pair of distributions P and Q for the non-subsampled shuffler are obtained from (Thm. 3.1 Feldman et al. 2023
ag < 01 < ... On, <
As we see from Figure this approach leads to considerably lower b66)-bounds than the approach by Girgis et al. (2021). Notice that the tightness of the PLD-based bound is mostly determined by the analysis of Feldman et al. (2023) which gives the dominating pair (P, Q) of Equation 3.1 and that the RDP-based analysis of Girgis et al. (2011 fundamentally different.

---

Published in Transactions on Machine Learning Research (M//YYYY
10-1
10-3
10 10-5
RDP, n 4
RDP, n 3
10-7
RDP, N 2
RDP, Ne 1
10
PLD, Ne 4
PLD, nr = 3
10 11
PLD, The 2
PLD, n2
10 13
0.2
0.4
0.6
0.8
1.0
Figure 1: Evaluation of 8()) for general single and composite shullle LD-LDP mechanisms using RDP accounting and FFT-based numerical accounting (PLD) applied to the pair of distributions P and Q given by the post-processing result of Feldman et al. (2023). Number of users 10 and the LDP parameter ED = 4.0.
10-1
10 10-3. 3
10-5
10-7_
10
Doroshenko et al., na 500
Doroshenko et al., no = 3000
10 11
Ha(q P (1
q) Q1)))
0.2
0.4
0.6
0.8
1.0
Figure 2: We apply FFT-based method the dominating pair of distributions given by Algorithm 1 of Doroshenko et al. (2022) applied on the function h(a) that obtain from Lemma 7 for different sizes of a-grids. Here, the underlying P and Q are obtained from the analysis of Feldman et al. (0023), and we set Eo = 3.0, = 10a, n. 2000, subsampling ratio = 0.01,
exp(-0.255 an, = (0.25) and take a logarithmically equidistant a-grid. We also plot He P (1 - q) QlIQ) for comparison.

---

Published in Transactions on Machine Learning Research (MM/YYYY)
Eo = 3.0, n = 10,, q = 0.01, = 1/n
10
10"
DP E
10
10
e from RDP upper bound (Girgis et al., 2021)
from PLD FFT accountant
10
102
10a
10a
Number of compositions ne
Figure 3: Evaluation of =(0) for compositions of subsampled shufflers of lo-lo randomisers. We compare the bounds obtained using the FFFT-ccountiing and the PLD determined by the numerical method of Doroshenko et al.) 2022 Algorithm 1) applied to the dominating pair of Equation 3.1 33.1ation3.1aamm and the RDP-bounds given in Thm. of (Grgis et al. 2021) that are mapped to {(0)-bounds using Lemma 1 of (Girgis et al. 2021 Here the number of compositions ne varies and n is fixed. Here q denotes the subsampling ratio.
4 Shuffled k-randomised response
Balle (2019) give a protocol for n parties to compute a private histogram over the domain [k] in the single-message shuffle model. The randomiser is parameterised by a probability 7, and consists of k-ary randomised response mechanism (k-RR) that returns the true value with probability 1 1-7 and uniformly random value with probability 7. Denote this k-RR randomiscr by RPH and the shuffling operation by S. Thus, we are studying the privacy of the shuffled randomiser M = R.R.
Consider first the proof of Balle al. (2019 Thm. 3.1). Assuming without loss of generality that the differing data element between X and X', X, X' E [k]", is In, the (strong) adversary A, used by Balle et al. (011 Thm. 3.1) is defined as follows.
Definition 12. Let M
PH be the shuffled k-RR mechanism, and w.l.og. let the differing element be In. We define adversary A, as an adversary with the view
= S RPH
View = ((#1,..., In-11) B (0,1)", (U+(I)...., VWn()))
where y are the outputs from the shuffter, B is binary vector identifying which parties answered randomly, and n is uniformly random permatation applied by the shuffler.
Assuming w.lo.g. that the differing element H, and x', 2, the proof then shows that for any possible view V of the adversary Agr
PP(View M (X)= V) N +1
(4.1)
F(View M (X') =V
N₂
where N₂ denotes the number of messages received by the server with value after removing from the output Y any truthful answers submitted by the first 1 users. The (s, 8)-analysis of Balle et al. (2019) is based
8

---

Published in Transactions on Machine Learning Research (MM/YYYY)
showing that for all neighbouring X and X', View (X) (c,5) Viowlr(X))
(X)
(4.2)
for
Ni N ( 2 0t
6(=) =
(4.3)
N2
where the randommess of (N1,NN) is determined by View M (X). Instead of being mutually independent
binomially distributed random variables as argued in the proof of Balle et al. (2019 Thm. 3.1), we claim that N1 and N2 are distributed as follows.
Lemma 13. Let the Viewfa (X) be defined as in Def. 12 N1 and N2 denole the number of oulcomes of the first - local mandomisers that are results of randomisatoon and equal and 2, respectively. Then the counts N1 and N2 are distributed as
N2) ~ (A,C),
where A ~ Bin(n - 1, 1) and C ~ Bin(n - 1 A, 2
Proof. First, more generally, consider n 1 independent trials and random variables for the numbers of observations for three classes: N1, N2 and a remainder class, with corresponding probabilities Pt, Pa and P1 P2. Then, the multinomial probability gives
(((N1, = (n1. 12))
(n - 1)!
R1|ng!(n - 12 122) P1 P' (1 P1 P2) n-)
(n - 1)!
P2 221 (1 - -p1) -p:)
(n 1 - n2
D2
22 (1 P1 12)"-11m 111-112
an!(n - n2
12 n - - 12 122
(1 - Pi )1)"" n-11-m
(n 1)!
111 (1 --pi)
(n 1 - n1
P2
- P1 P2
n- n-1--j-
an:(n n2
n2!(n - - 11 - 112)!
Pl
pl
an!(n- (1 p1) p1)n-1-m
n!
(n - 1-1n-11 n1)!
P2
a
[
P2
T1 121 B2
n2!(n - n1 n2)!
I
- pl
pl
We recognise the probabilities of binomial distributions, and see that
(N2 (A,C),
where A ~ Bin(n P1) and C Bin(n 1 A, ). When V ~ View)a(X), think of N₁ and N₂ as numbers of outcomes of n independent. trials where both classes have probabilities 7/k. Substituting Pı = P2 7 in the above formula shows the claim.
Using the reasoning of Balle et al. (2019 Thm. 3.1) (Equation 4.1
explicitly write the PLD which
gives us tight (e, (b.unds. Recall from Def. that the privacy loss random variable for View M is given by
IP PPView A. (X) ( P(View (1x)=V)
A X/X
log
V~ Viewga
(4.4)
Using this definition of PRV, Equation
4.1 and Lemma
13 we get the following,
Theorem 14. Consider the adversary As as given Def PRV for Viewa is given by
12 For all neighbouring datasets X and X', the
Ni +1+
4 -log
N2
where
(N1, N2) ~ (A,
and A Bin(n 1, 7) and C Bin(n- 4, -,,)
9

---

and Published in Transactions on Machine Learning Research (MM/YYYY)
Notice that this expression for A is independent of any imput to the local randomisers and holds for any neighbouring datasets X and X'. Therefore it allows computing tight d(e)-bounds for adaptive compositions of the k-RR shuffler in case we assume the adversary of Def. I2
4.1 Tight bounds for weaker adversaries
Following the reasoning used for analysing the bounds against the adversary A, of Def. 12 tight 8(e)-bounds also for adversary that has less information about the local randomisers. Having light bounds also enables us to evaluate exactly how much different assumptions on the adversary cost us in teriss of privacy. Instead of the adversary A, we analyse a weaker adversary Aw: who has extra information only on the first n parties. We formalise this as follows.
compute
Definition 15. Let = R.K.K
PH be the shuffled k-RR mechanism, and w.L.ogg let the differing element In. Adversary Aw is an adversary with the view
S
Viewly (X) = ((II,...,IIII) In- BE 10,11" (((())....,M((())))
where y are the outputs from the shuffler, 3 is a binery vector identifying which of the first parties answered randomly, and at is uniformly random permalation applied by the shuffler.
Note that compared to the stronger adversary A, formalised in Def. 12 the difference is only in the vector B. We write = E; Si, and B for the corresponding random variable in the following, The next theorem gives the random variables we need to calculate privacy bounds for adversary Aw.
Theorem 16. Consider the adversary Aw as given in Def 15 PRV for ViewMr is given by
For all neighbouring dalasets X and X', the
P
A = log
Q
where
P = P1 P2,
Qu = =Q Q2,
(4.5)
Pi (1 (1) N1IB, P2 7 (B+1). +1,,
k
Q2 2 (B+1)
Q 7)) N1 B,
k
Bin(n 1,7),
1
B Bin B, k:
N1 ~ N B + Ray
R2 ~ Bern(1 - 7 + 7/k),
N1 B ~ Bin + 1-1-80 Ni k -1)
1
As direct corollary this result, and analogously the case of the adversary A,, since the PLD w is independent of any input to the local randomisers, obtain tight 5(E)-bounds against the adversary A.. for adaptive compositions using An
4.2 Experimental comparison between specialized analysis of k-RR (Balle et al. 2019 and specialized Clones analysis (Feldman et al., 2023)
In Figure we compare the tight bounds obtained using the PRVs の. and - with numerical FFT- basod accounting, and the PLD obtained from the k-RR specific analysis of Feldman et al. (0023 Thm 5.2) combined with numerical accounting. We tune the parameters of the FFT-basel numerical accounting so that the discretisation error is negligible. Notice that the underlying analysis of k-RR with the adversaries
10

---

Published in Transactions on Machine Learning Research (MM/YYYY)
Aw has stronger assumptions about the adversary than the analysis by Feldman et al. (0223) the adversaries know which of the messages were randomised (except for the differing element in case of the weaker adversary A.). For the weaker adversary Aw; we already obtain stronger guarantees than by using the analysis of Feldman et al. 2023
5
Feldman et al. (2023, Thm. 5.1), ne 16
Feldman et al. (2023, Thm. 5.1), = 4
Feldman et al. (2023, Thm. 5.1), ng = 1
Adversary A,, n. 16
Adversary As, The =
Adversary As, T
3
Adversary Age nr
Adversary Awn Bg = 4
Adversary Awn the
2-
10
10
10
10
5
Figure k-RR with the strong adversary A, (PRV A determined by Thm 14 and the weak adversary (PRV A determined by Thm 16) and tight 8PP bounds obtained using FFF-accounting for different numbers of compositions ne- Here 1000, probability of randomising are the bounds computed using the k-RR specific result by Feldman et al. 2023 Thm 5.2).
0.25, and k = 4. Also shown
5 On the difficulty of obtaining bounds in the general case
We have provided means to compute accurate (s, bbbounds for the general LDPLDP shuffler using the results by Feldman et al. (2023) and tight bounds for the case of k-randomised responsc. Using the following example, we illustrate the computational difficulty obtaining light bounds for arbitrary local randomisers.
Consider neighbouring datasets X, X' R", where all elements of X are equal, and X' contains one element differing by 1. Without loss of generality (due to shifting and scaling invariance of DP), may consider the case where X consists of zeros and X' has 1 at some element. Considering mechanism M that consists of adding Gaussian noise with variance o² to each element and then shuffling, we see that the adversary sees the output of M(X) distributed as M(X) ~ NN0 I²),), and the output M(X') as the mixture distribution M(X') ~ LW, + .N(en. o²In,, where e, denotes the ith unit vector.
Determining the hockey-stick divergence [M-(MMX']) cannot be projected a lower-dimensional problem, unlike in the case of the (subsampled) Gaussian mechanism, for example, which is equivalent to one-dimensional problem. This means that in order to obtain tight (c, b)-buddssss need to numerically evaluate the n-dimensional hockey-stick integral H. (M(X'))JM(())
Using a numerical grid as in FFT-based accountants is unthinkable due to the curse of the dimensionality. However, we may use the fact that for any dataset X, the density function fx(t) M(X) is a permutation- invariant function, meaning that for any t E R and for any permutation a E Tay fx (x()t) = (t)... This allows reducing the number of required points on regular grid for the hockey stick integral from O(m") O(m"/ /n!), where is the number of discretisation points in each dimension. Recent research numerical
11

---

Published in Transactions on Machine Learning Research (MM/YYY)
integration of permutation-invarian functions (e.g. Nuyens et al. 2016 suggests it may be possible to significantly reduce or even eliminate the dependence using more advanced integration techniques.
In the Appendix C.2 we give results on experiments where we have computed He (M(())IM((() using Monte Carlo integration on a hypercube L|" which requires 5 10 samples for getting two correct significant figures already for 7.
6 Discussion
We have shown how numerical privacy accounting with privacy loss distributions can be used to calculate accurate upper bounds for the compositions of various (e,6)-DP mechanisms, as well for different adversaries in the shufile model. An alternative accounting approach uses Rényi differential privacy (Mironov 2017). We have carried out experimental comparisons between the RDP and the PLD approaches. As illustrated by the comparison against the results of Girgis et al. (2021) in Fig. numerical PL.D accounting can sometimes lead to considerably tighter bounds.
When comparing numerical and analytical privacy bounds, they are in many cases complementary and serve different purposes. Numerical accountants allow finding the tightest possible bounds for implementations and enable more unbiased comparison algorithms when accuracy of accounting is not factor. Analytical bounds enable tcal research and understanding of scaling properties of algorithms, but the inaccuracy of the bounds raises the risk of misleading conclusions about privacy claims.
While our results provide improvements over previous state-of- state-of-the-art, they only provide optimal accounting for k-randomised response. Developing optimal accounting for more general mechanisms as well as extending the results to (so, LDD base mechanisms are important topics for future research.
Acknowledgments
This work was supported by the Academy of Finland (Flagship programme: Finnish Center for Artificial Intelligence, FCAI; and grant 325573), the Strategic Research Council at the Academy of Finland (Grant 836032) as well as the European Union (Project 101070617). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.
The authors would also like to thank the anonymous reviewers and the action editor at TMLR for noticing potential points of confusion in an earlier version, as well as for the helpful discussions.
References
Borja Balle, James Bell, Adrià Gascón, and Kobbi Nissim. The privacy blanket of the shuffle model. In Annual International Cryptology Conference, pp. 638 667. Springer, 2019.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy profiles and amplification by subsampling. Journal of Privacy and Confidentialily, 10(1), 2020a.
Borja Balle, James Bell, Adria Gascón, and Kobbi Nissim. Private summation in the multi-messagee shuffle model. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 656. 2020b.
Andrea Bittau, Úlfar Erlingsson, Petros Maniatis, llya Mironov, Ananth Raghunathan, David Lie, Mitch Rudominer, Ushasree Kode, Julien Tinnes, and Bernhard Seefeld. Prochlo: Strong privacy for analytics in the crowd. In Proceedings of the 26th Symposium on Operating Systems Principles, pp. 441-459 2017.
Clément Canonne, Gautam Kamath, and Thomas Steinke. The discrete gaussian for differential privacy. Advances in Neural Information Processing Systems, 33:15676-15568 2020.
12

---

Published in Transactions on Machine Learning Research (MM/YYYY)
Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev. Distributed differential privacy via shuffling. In Annual International Conferencce on the Theory and Applications of Cryplographic Techniques, pp. 375 403. Springer, 2019.
Vadym Doroshenko, Badih Chazi, Pritish Kamath, Ravi Kumar, and Pasin Manurangsi. Connect the dots: Tighter discrete approximations of privacy loss distributions. Proceedings on Privacy Enhancing Technologies, -5552-570, 2022.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pp. 265 284. Springer, 2006.
Ülaar Erlingsson, Vitaly Feldman, Πlya Mironov, Ananth Raghmnathan, Kunal Talwar, and Abhradocp Thakurta. Amplification by shuflling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pp. 2468 2479. SIAM, 2019.
Vitaly Feldman, Audra McMillan, and Kunal Talwar. Hiding among the clones: A simple and nearly optimal analysis of privacy amplification by shuffling. In 2021 IEEE 62nd Annual Symposium Foundations of Computer Science. IEEE, 2021.
Vitaly Feldman, Audra McMillan, and Kunal Talwar. Stronger privacy amplification by shuffling for Rényi and approximate differential privacy. In Proceedings of the 2023 Annuull ACM-SIAM Symposium Discrete Algorithms (SODA), pp. 4966-4981. STAM, 2023.
Badih Ghazi, Noah Golowich, Ravi Kumar, Rasmus Pagh, and Ameya Velingker. On the power of multiple anonymous messages: Frequency estimation and selection in the shuffle model of differential privacy. In Anne Canteaut and François-Xavier Standaert (eds.), Advances in Cryptology EUROCRYPT 2021, pp. 463-488, Cham, 2021. Springer International Publishing. ISEN 978-3-030-77883-5.
Antonious Girgis, Deepesh Data, and Suhas Diggavi. Rényi differential privacy of the subsampled shuffle model in distributed learning. Advances in Neural Information Processing Systems, 34, 2021.
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. In Advances in Newral Information Processing Systems, 2021.
Shiva. Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. What can we learn privately? SIAM Journal on Computing, 40(3):793 826, 2011.
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight differential privacy guarantees using FFT. In International Conference on Artificial Intelligence and Statistics, pp. 2560 2569. PMLR, 2020.
Antti Koskela, Joonas Jälkö, Lukas Prediger, and Antti Honkela. Tight differential privacy for discrete- valued mechanisms and for the subsampled gaussian mechanism using FFT. In International Conference on Artificial Intelligence and Statistics, pp. 3366. PMLR, 2021.
llya Mironov. On significance of the least significant bits for differential privacy. In Proceedings of the 2012 ACM conference on Computer and communications security, pp. 650-661, 2012.
llya Mironov. Rényi differential privacy. 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263-275, Aug 2017. doi: 10.1109/CSF 1111.1
2017.11.
Dirk Nuyens, Gowri Suryanarayana, and Markus Weimar. Rank-1 lattice rules for multivariate integration in spaces of cormutation-invarian functions: Error bounds and tractability. Advances in Computational Mathematics, 42:55-84 84, 2016.
David M Sommer, Sebastian Meiser, and Esfandiar Mohammadi. Privacy loss classes: The central limit theorem in differential privacy. Proceedings on Privacy Enhancing Technologies, 2019(2):245 269, 2019.
Yuqing Zhu, Jinshuo Dong, and Yu- Yu-Xiang Wang. Optimal accounting of differential privacy via characteristic function. In International Conference on Artificial Intelligence and Statistics, pp-
PMLR, 2022.
13

---

Published in Transactions on Machine Learning Research (MM/YYYY)
A Auxiliary results for determining the PLD of general Eo shufflers
p We recall the following from Section 3.1 Denoting g = e and q = 1-p-op- p= e5041> the dominating pair
of distributions (P, Q) is determined are given by the mixtures
P= q- Po + (1 9)9 Pi + (1 () - ② P2. Q = 1)q Po + Pi+ + (1-9)(1 - -) P2.
where
Po (A+1,C - A), A),
(A
(A, -
and for n E N, A and C are as
C~ Bin(n 1, A~ Bin (c, A ~ Bern (c and
42 ~ Bin (1- A1, 1
In this section we give the expressions needed to determine the PLD wp/o(s) E., 0,b P(P (a, 6 (s): Sa.b log
(PPP (a. PPQ = (a, b))
(A.1)
and similarly also wo/p-
A.1 Determining the log ratios $a.b
To determine 80,6 8, we need the lollowing auxiliary results.
Lemma A.1. When b > 0 and a > 0, we have:
P(Po (a, b)) = PP(P (a,
Proof. We see that Po (a, if and only if A - 1 and C b - 1. Since
P(A=a-1CC=al 1) a b 1
- 1
2atb-I
+ b
20+b-1
a
PPA = a
alC C a b-1);
we see that
P(Po = (a, = P(C = a
= -
= P(C = a
P(A = a
P(P: = b),
since P1 = (a, b) if and only if A = and C = a + 1.
Lemma A.2. When b > 0 and a > 0, we have:
P(Po (a, b)) = (1-21) 2p)a
P(P2 = b)).
(n- 1a-bj b)pp
Proof. We see that P2 = (a, b) if and only if A = a and C = + b. Since
n
P(C a b)
(2p)att ab (1 --1a-
a b)
2p
1
(2p) (1 2p))n-1-a--t
1 2p
a + b)
2p
- b
1
(2p)atb-1(1 -11
1 2p
+
a
2p a b
PCC = a + b 1-11
- 2p b b
14

---

Published in Transactions on Machine Learning Research (MM/YYY)
and since
P(A=alC=a+bb 1)= (a+b-1) (a+b-1) 1))(m+b-1)
1
2b (a (a+b) 1
2b
PP(A C
a
2a
a+b a
20
a+b
we see that
P(Po ()) = P(C = a a P(A a (-
= P(C = a b- 1) P(A = c
(1 - 2p)a PCCC = a a +++) b) a
P(A C = a
(n blp
b
(1 2p)a
P(P = (a.b)).
nn b)p
As corollary of Lemmas A.1 and A.2 we get the following expressions with which can also determine the log ratios 8a,b- Corollary A.3. We have:
b + 9)(1
(n 1 a b)p
P(P = (a, = a (1- अ)
PPP = (a,
(1 12ppp
and
(n b)p)
(P(Q = (a, 6)) = q - + (1 - + 4)(1
PP(Po = ())
(1 2p)a
Probabilities for the cases a = 0 and b = 0 become extremely small already for moderate values of n. When using the Hoeffding inequality based (n)) -approximation to determine the PL.Ss, we do not need to evaluate these probabilitics so we do not consider writing them out.
Corollary A.3 gives ((P- (a, and P(Q (a, b)) in terms of PPPo (a, and that is given by the following expression which we get by change of variables. 0,
Lemma A.4. When
P(Po = ba, n (m- (1000) (11--))---- 1
2
where (a. = (1+ (i.e., C = i and A = -).
B More detailed proof of the Lemma: Lowering PLD computational complexity using Hoeffding's inequality
Using an appropriate tail bound (Hoeffding) for the binomial distribution, we can truncate part of the probability mass and add it directly to More specifically, if each PLD wi, S i Rey in an ne-oomposition is approximated by truncated distribution W; such that the truncated probability masses respectively, then
0,
8(z) = 5(E) + 6(cc),
where 0(s) is the value of the hockey-stick divergence obtained with the truncated PLDs W., 1 5 5 Ney and where
8(00) = 1 II - m (1-)) Σ To
gives an upper bound for the composition without truncations, see c.g. Thm in Sommer al. (2019) Using the Hoeffding inequality we obtain an accurate approximation of wp/Q (or wa/p) with only O(n) terms. We formalise this approximation follows.
15

---

Published in Transactions on Machine Learning Research (MM/YW) (M/YYYY)
Lemma 11. Let O. Consider the set
n max (0, (2p - cn - 1)) min (n 1, (2p + ca)(n -))]
where On
7)) 2(
and the set
S: = [max (0, ci) .t) min (n 1, -)) 1)),
where 04 V 1og(4/T)
Then, the distribution Wp/Q defined by
2:
(p/o(0)=
ΣΣ SES. JES.
(j+, 8ng 1. (6), 80, log
((P=(a.b))
((Q=
(B.1)
has On log(4/T)) terms and differs from wp/Q most mass T.
Proof. Using Hoeffding's inequality for C' ~ Bin h 1, 2p) states that for c >> 0,
2(n PP(C S (2p c) 1)) < exp 2- 1---2(nne)) 1)c2),
PPCC 2 (2p + c) 1)) S exp 2(n - 1)e²).
Requiring that 2 exp ( 1)c²) s T/2 gives the condition c V 2(n-1) and the expressions for on and S,. Similarly, we use Hoeffding's ' inequality for ~ Bin(C, ()) and get expressions for e and S.. The total neglegted mass is most. 7/2 + r/2 = т. For the number of terms, we see that Sn contains most (n - 1) = Vn-1V2 log(4/) terms and for each i, S, contains most 2cg 2 log(4/r) s Vn - T log(0//447 terms. Thus Wp/Q has at most O(n log(4/7)) terms. We get the expression of Equation B.1 by the change variables a = 1 (A = i) and = i- (C=s)).
log(4/r)
C Auxiliary results for Section
C.1 Proof of Theorem 16
Theorem C.1. Consider the adversory Aw as given in Def the PRV for Viewfr is given by
15
For all neighbouring datasets X and X
P
A = log
Q
where
Pw P2+ Qu Q1 Q2.
(C.1)
and
(1 (1-7) NiBB, P2 7 (B+1),
Q (1-7) N2/NN,, B, Q2~ 2 (B++)) 2B+1.
B~ Bin(n - 1,7),
1
N B Bin B, k
Ni ~ N B + Rn,
R2 ~ Bern(1 - 7 + 7/k),
N1 B ~ Bin B+1 - N2 B,
16

---

Published in Transactions on Machine Learning Research (MM/YYYY)
Proof. Assume w.l.o.g. that the differing elements are En 1, 2. Notice that for k-RR, sceing the shuffler output is equivalent to seeing the total counts for each class resulting from applying the local randomisers to X or X'. The adversary Aw can remove all truthfully reported values by client j, j E [n - 1]. Denote the observed counts after this removal by n, = 1,...,k,, k, so Σ n. = =
We now have
P(View Ar (x) = -V=
Σ i=1
P(N RI,
N₂ = - 1, N,41 mith..... N₂ = mn P(R(xx)= = -) P(( b)
(1 (1- 2)
7 - ~
1, 122
1kk
b
2 k
70 -
11y
14
1, 1.... 11
1s
b
(1 n-
n1(1 - 7 + 7)
r
Σ 1=2
?
n
11, n22 1kk
kbb
b
(1 - 7) n 1-b
T1 - + 7
+ (b + +1 m1) x1
R1. 122,
1kkk
kbb
k
b
11 7) ) n- 1-b
nn 7) + 7 (b + 11] k
11, R2,,... , m2k)
kbb
(C.2)
Noting then that P(R PH k, (2/)) = =1 -1-77 + 2) when i = 2 and I otherwise, repeating essentially the
same steps gives
P(View (X') -V) ((1)) b
V) n1, .2,...,, m ) 701 - -)""---
n2(1 7) + 2
(bb + [b]
(C.3)
kbb
Looking at the ratio of the two final probabilities given in Equation
C.2 and in Equation
C.3
we get
IPVVie M (X) V) N1 (1 7) - ]BB +1 P(View M (X')= N₂ B (1 (1 + (BBB1)
where we write, e.g., B for the random variables N₁ conditional on B. This shows that for DP bounds, the adversaries' full view is equivalent to only considering the joint distribution of (N1, N2, B), and we can therefore look at the neighbouring random variables
Pw P =u=01+00 Q2,
(C.4)
where
7 P1 ~ (1 7)) NI P2
(B + 1),
k
Q ~ (1-7) No/N1, B, Q2 22~ T (B 1).
Writing , 1,2, for the count in class resulting from the noisc sent by the n - partics, and denoting by RR a Bernoulli random variable s.i. R, = 1, if R(x,) = 1, similarly to the proof in case of the strong adversary, we have
i=
N ~ Bin B, (B+)))
B B Bin(n- - 1,7),
Rn ~ Bern - 7 7/k)).
(C.5)
As V ~ Ar (X), and
Bin(B + N1IB, Rr = 1,
N1, Rw, B ~
Bin(B N₂ B, + Bern (er if R,, = 0,
17

---

Published in Transactions on Machine Learning Research (MM/YYN
finally have
M Rm: N2 B (in +1 N₁ Ni
(C.6)
1
The distributions of Equation C.5 and Equation
determine the neighbouring distributions Par and Qu that are given in Equation C.4 This completes the proof.
C.6
C.2 Experiment for Section
Consider neighbouring datasets X, X' R², where all elements of X equal, and X' contains element differing by 1. Without loss of generality (due to shifting and scaling invariance of DP), may consider the case where X consists of zeros and X' has 1 at some element. Considering mechanism M that consists of adding Gaussian noise with variance o² to each element and then shuffling, we see that the adversary sees the output of M(X) distributed as M(X) ~ ~N(00, In), and the output M(X) as the mixture distribution M(X') ~ (eW(e,,, ()) +... o In), where e, denotes the ith unit vector. In order to oblain tight (e, 6)-bounds, we need to numerically evaluate the n-dimensional hockey-stick integral He (T((MM))])
In Figure 5
we have computed Hę (M((M)))) up
7 using Monte Carlo integration L, LJ which requires ss 5 10" samples for getting two correct significant figures for 7.
hypercube
10
10 10-3
10 10-5
10 7
10 10-9
n=
10-11
72 14
10-13 13
10
71 n=
n=
0.5
1.0
1.5
2.0
Figure 5: Approximation of tight 8(E) for shuffled outputs of Gaussian mechanisms (a 2.0) by Monte Carlo integration of the hockey-stick divergence He- (M((())))) using 5 5-10 samples (two correct significant figures).
18


Reviews:
[{"review_id": "jiCikWp3go", "reviewer": "Reviewer_th4D", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nI think that the direction of the paper is interesting -- numerical bounds are useful in practice and can be much tighter than closed-form bounds, and the settings of adaptive composition and subsampling are also of practical interest. The paper proposes combining two state-of-the-art methods that give improved numerical bounds for privacy amplification via shuffling and for privacy accounting under composition to provide tight bounds for the both shuffled and composed mechanisms. The experimental evaluations in three different settings (composition of 2-4 mechanisms, subsampling with Renyi DP, and composition of k-RR mechanisms) all seem to show that FA (combined with the right numerical analysis in each case) gives better of the same numerical privacy bounds compared to other approaches.\n\nWeaknesses:\nThe main concern I have about this paper is that it does not seem to use or compare to the state of the art in these settings. The result on privacy amplification via shuffling by the cited paper of Feldman et al. has been improved in subsequent work: Stronger Privacy Amplification by Shuffling for Rényi and Approximate Differential Privacy (https://arxiv.org/pdf/2208.04591.pdf). This new paper has a better analysis of k-RR mechanisms which is tight numerically (for k>=3) so Balle et al might not be the best comparison in Section 4. It also has an RDP-based analysis which could be useful in the subsampling experiment. \n\nSecond, for the experiments on subsampling, it was not very clear to me what the setting was (my understanding was that it is sampling with replacement as in Girgis et al), but more importantly the result imported from Zhu et al. on the comvex combination of the dominating pair of distributions seems to refer to DP under the remove-only neighboring relation between datasets. It would be helpful to clarify this point.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper aims to give numerical bounds (that is, not closed-form theoretical bounds) on the amplified privacy parameter guaranteed by shuffle differentially private mechanisms, specifically for the settings of composition and subsampling. The authors propose using a method of numerical accounting introduced in prior work, called Fourier Accountant (FA), to calculate a bound on the divergence between two distributions, which measures the privacy loss. The choice of distributions is dictated by other prior work that gives numerical bounds for privacy amplification via shuffling for single mechanisms. This paper extends the latter with the FA method to give numerical bounds for the composition of 2 or more shuffled DP mechanisms and for the case of subsampling without replacement.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The main request is to compare and use the results from the improved analysis of Feldman et al.", "broader_impact_concerns": "There are no significant ethical implications that would require adding a Broader Impact statement.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "OG2MeBLpmu", "reviewer": "Reviewer_RsmC", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "One of the main theoretical contributions of this paper is the new method for computing the privacy guarantee of kRR (which is new even for a single round). The authors show that this method is tighter than both Balle et al. and Feldman et al. (2021), the two analysis methods available at the time of writing this paper. The authors refer to this analysis as “tight”, although I couldn’t see a formal tightness statement, is it tight for the strong adversary?\n\nIn the general numerical comparison, there is a main comparison point missing. The authors use Feldman et al. combined with strong composition as the baseline, although the Rényi amplification version of Feldman et al. (2021) combined with Rényi composition would be a more fair comparison. Feldman et al. show that this analysis beats Girgis et al. for composition over multiple rounds. Without this comparison, I am unconvinced that the FFT method is preferable to RDP composition. Even with this comparison, I'm not sure I see why this result isn't just a simple combination of Feldman et al. and Koskela et al.?\n\nOne of the contributions the authors claim in the abstract (and in 3.2) is an improvement in the efficiency of numerically evaluating the method of Feldman et al. I’m confused as to how this compares to efficiency improvements implemented by Feldman et al. in their implementation available on GitHub, and discussed in their appendix. Feldman et al. does not provide a time analysis of their algorithm, but their implementation also involves a speedup that cuts off the tails of the distribution. They also provide another speedup by noticing that when computing the divergence between binomials, the computation simply involves a few cdf computations. The authors mention a 10x speed up for n=10^4 over Feldman et al., what implementation of Feldman et al. is being used for this comparison? (The authors do not cite the GitHub of Feldman et al.)  In Figure 1, the numerical method implemented by the authors performs better than Feldman et al. I was a little confused about this since I thought they were implementations of the same thing (and I would have thought an efficient method would perform slightly worse).\n\nI want to bring the authors attention to Feldman et al.’s follow-up paper “Stronger Privacy Amplification by Shuffling for Rényi and Approximate Differential Privacy” (arxiv: August 2022). Given the timing, I assume this paper was not released when the authors wrote this paper. I think that using the new decompositions from this paper should immediately provide improvements for the results in Section 3. They also provide a numerically tight analysis of kRR, which I suspect would also provide improvements on the results of Section 4.\n\nMinor Comments:\n- In the intro, the authors mention that the shuffle model requires LDP mechanisms. This isn’t technically true, Cheu et al. give algorithms that are private in the shuffle model but not built off LDP mechanisms. Similarly, when defining LDP in definition 2, the definition is slightly more nuanced since LDP exists of databases of any size. \n- I think there is a typo in Definition 5, t~Q(t)?\n- I don’t think A_s is defined before it it is used in Lemma 8.\n- Several times the authors reference equations in the appendix. I suspect this is a duplicated labels issue in tex. \n- In eqn 4.2, I think n_1 and n_2 should be lower case. \n- I appreciated the inclusion of the comparison to Feldman et al. (2021) kRR in the appendix. I would mention the performance in the main body. \n- There are two Koskela et al. (2021)s in the appendix and the in text citations do not distinguish between them\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies privacy amplification by shuffling. The goal is to obtain tighter numerical bounds than prior work, particularly when composing multiple rounds of shuffled mechanisms. They study two main settings:\n1. The general setting, where users can use any local randomizer. In this setting, they use the method for analyzing a single round introduced by Feldman et al., and analyze multiple rounds using the FFT technique introduced by Koskela et al. \n2. Shuffling k-randomized response. They develop a new upper bound that is based on a weaker adversary than that which appears in Balle et al. Again they use the FFT to analyze the privacy guarantee over multiple rounds. \n\nThis paper is well-written and easy to follow. I did not see any technical issues with the paper. ", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Compare FFT method to performing the composition in RDP (in both the general setting and kRR).\n- Compare numerical efficiency improvements for Feldman et al. to the implementation in Feldman et al. git repo.", "broader_impact_concerns": "I don't have any broader impact concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "vKRmuMEphG", "reviewer": "Reviewer_KLwm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "This is a solid contribution, the results are convincing and the paper is easy to read. I believe the paper has great potential for practical deployments of DP. To the best of my knowledge all relevant baselines are included in the comparisons and the proposed accountant is indeed superior to existing work. I have some questions and suggestions:\n1. In my opinion, the title of the paper can be made more indicative of the content. In particular, an important aspect of the paper is the fact that the accounting is numerical rather than analytical. I would probably say \"tight numerical accounting ...\" or something like that. If the other reviewers and the authors don't think this would help situate the paper better, then please ignore the suggestion. On a related note, I didn't love seeing the word \"tight\" in the title because the accountant seems to be tight only in the k-randomized response setting; is this correct? (For example, the Hoeffding truncation is not tight.) But I can see why the word tight is justified since the analysis is almost tight.\n2. I believe you could make your analysis even tighter by replacing the Hoeffding confidence intervals in Lemma 11 by tighter confidence intervals for the binomial. In particular, you could just numerically invert an exact test for the binomial distribution or, say, use the Clopper–Pearson interval. This approach wouldn't lead to a nice analytical expression like Hoeffding's inequality but Hoeffding confidence intervals are generally quite loose and your method is numerical anyway, so you may be able to improve. I am not sure if this would lead to a visible improvement or not, but it may be worth a shot.\n3. What is p in Lemma 11? I don't remember seeing the definition.\n4. Minor: you refer to omega-til as a distribution (for example, in equation (3.5) in Lemma 11) but it's not actually a distribution since you don't renormalize it to add up to 1.\n5. Some stylistic comments:\n- In Theorem 6, why wouldn't you just write e^{eps - omega_{P/Q}}? Since you define omega_{P/Q} as a random variable anyway?\n- You repeat some equations in the Appendix (e.g., A.1, A.2) so your equations in the main text link to the equations in the Appendix rather than the corresponding equations in the main text.\n- You define what it means for (P,Q) to be tightly dominating for a mechanism but you don't use this terminology anywhere in the paper I think. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "By relying on recent theoretical characterizations, the paper adapts existing numerical methods for tight(er) privacy loss accounting to LDP shufflers and shufflers for k-randomized response mechanisms. It is shown in simulation that the proposed method is superior to existing analytical and numerical baselines.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper already looks good overall, please address the stylistic comments if they make sense to you. I have made several other suggestions that I think could improve the paper but they are not critical.", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors have already conducted a major revision and the current version is significantly improved over the initial submission. 
The reviewer feedback and the authors' prompt responses worked out quite well in the process.

I have one more clarification question that potentially requires some minor modifications. The authors wrote:

> We noticed ourselves an error that was not noticed by the reviewers. It was related to the comment of reviewer th4D about the dominating pairs for subsampling:  We were originally using Proposition 30 of Zhu et al. (2022), however we realized that the result does not give a dominating pair (i.e. a pair of distributions that would dominate the alpha divergence for all alpha \geq 0) as the pairs are different for 0 \leq alpha<1 and alpha \geq 1.

The pair is dominating for all alpha > 0 under "remove only" neighbors.  And the other pair is dominating for all alpha > 0 under "add only" neighbors.   What can be done, according to Zhu et al. (2022) is to keep two numerical accountants. One for "remove-only" neighbors the other for "add only" neighbors and take the max only after composition.  This is likely to be tighter than a relaxed bound that tries to get a privacy profile bound (and a dominating pair) for pointwise maximum.

Why is it important to have a more complicated dominating pair for "Add/Remove" together worked out when a tighter alternative with a mere 2x computation is available?
Decision: Accept (poster)