Title: Optimal Unbiased Randomizers for Regression with Label Differential Privacy
Venue: NeurIPS 2023
Accepted: yes
Keywords: label differential privacy
Abstract: We propose a new family of label randomizers for  training _regression_ models under the constraint of label differential privacy (DP). In particular, we leverage the trade-offs between bias and variance to construct better label randomizers depending on a privately estimated prior distribution over the labels. We demonstrate that these randomizers achieve state-of-the-art privacy-utility trade-offs on several datasets, highlighting the importance of reducing bias when training neural networks with label DP. We also provide theoretical results shedding light on the structural properties of the optimal unbiased randomizers.

Optimal Unbiased Randomizers for Regression with Label Differential Privacy

Abstract

We propose a new family of label randomizers for training regression models under the constraint of label differential privacy (DP). In particular, we leverage the tradeoffs between bias and variance to construct better label randomizers depending on a privately estimated prior distribution over the labels. We demonstrate that these randomizers achieve state-of-the-art privacy-utility trade-offs on several datasets, highlighting the importance of reducing bias when training neural networks with label DP. We also provide theoretical results shedding light on the structural properties of the optimal unbiased randomizers.

1 Introduction

Differential privacy (DP) [DMNS06] has gained significant importance in recent years as a mathematically sound metric for rigorously quantifying the potential disclosure of personal user information through ML models [ACG + 16, RE19, TM20]. DP guarantees that the model generated by the training process remains statistically indistinguishable, even if the data contributed by any individual user to the training dataset is modified arbitrarily.

In certain scenarios, the training features of a specific example are already accessible to potential adversaries, while only the training label is considered sensitive. For instance, within the context of digital advertising, it is typical to train conversion models that aim to predict whether a user, who interacts with an advertisement on a publisher's website, will ultimately make a purchase of the advertised item on the advertiser's website. The conversion label, which indicates whether the user completed the purchase or not, is not initially known to the publisher website and is considered sensitive information that spans multiple websites. 1 This particular setting, referred to as label DP, was initially studied in the work of [CH11]. Subsequently, it has garnered attention in various recent works, such as [GGK + 21, MEMP + 21, EMSV22] 2 .

For regression objectives (such as the squared loss and the Poisson log loss), the state-of-the-art is given by the prior work of [GKK + 23]. Their algorithm works in the so-called features-oblivious setting (Figure 1), which consists of a features party that has access to all the features, and a labels party that has access to all the labels. The labels party applies a mechanism that is DP with respect to the labels in order to produce the message M ( · ) that it sends to the features party, who then uses the

{

y

1

, . . . , y

n

}

{

x

1

, . . . , x

n

}

Trained

ε

-

LabelDP

model

M

(

y

1

, . . . , y

n

)

ε

-

DP

features along with the incoming message in order to train the model (which as a consequence would also satisfy label DP). It proceeds by using part of the privacy budget in order to estimate a prior over the labels, and then constructs a randomizer optimizing the 'noisy label loss' (see Definition 4) with respect to this prior.

In this work, we introduce a novel mechanism with bias-limiting constraints, motivated by the theory of bias-variance trade-offs. We show that while these constraints lead to significantly higher noisy label loss, the models trained on the privatized labels performs surprisingly well, achieving the state-of-the-art utility-privacy trade-off on multiple real world datasets.

Organization. Section 2 provides some background definitions related to (label-)DP and learning. In Section 3, we present the new label DP randomizers obtained by imposing unbiasedness constraints. Section 4 provides an experimental evaluation demonstrating that our method achieves state-of-the-art privacy-utility trade-offs across multiple datasets. We provide some related work in Section 5. We conclude with some future directions in Section 6. All missing proofs along with additional related work, as well as details on the experimental evaluation are provided in the Appendix.

2 Preliminaries

Let D be an unknown distribution on X × Y . We consider the regression setting where Y ⊆ R ; let P denote the marginal distribution of D on Y . In supervised learning, we have a set { ( x, y ) } of examples drawn from D . The goal is to learn a predictor f θ to minimize the expected loss L D ( f θ ) := E ( x,y ) ∼D ℓ ( f θ ( x ) , y ) , for some loss function ℓ : R ×Y → R . Some commonly-used loss functions used in regression tasks are the Poisson log loss ℓ Poi (˜ y, y ) := ˜ y -y · log(˜ y ) and the squared loss ℓ sq (˜ y, y ) := 1 2 (˜ y -y ) 2 .

We recall the definition of DP; for more background, see the book of Dwork and Roth [DR14].

Definition 1 (DP; [DMNS06]) . Let ε ∈ R > 0 . Arandomized algorithm A is said to be ε -differentially private (denoted ε -DP ) if for any two 'adjacent' input datasets X and X ′ , and any measurable subset S of outputs of A , it holds that Pr[ A ( X ) ∈ S ] ≤ e ε · Pr[ A ( X ′ ) ∈ S ] .

In the context of supervised learning, an algorithm produces a model as its output, while the labeled training set serves as the input. Two inputs are considered 'adjacent' if they differ on a single training example. This concept of adjacency is intended to safeguard both the features and the label of any individual example. However, in certain scenarios, protecting the features may either be unnecessary or infeasible, and the focus is solely on protecting the labels. This leads to the following definition:

Definition 2 (Label DP; [CH11]) . A randomized training algorithm A is said to be ε -label differentially private (denoted ε -LabelDP ) if it is ε -DP when two input datasets are 'adjacent' if they differ on the label of a single training example.

We recall the notion of feature-oblivious label DP [GKK + 23]. In this scenario, there are two parties: the features party and the labels party . The features party has the sequence ( x i ) n i =1 of all feature vectors across the n users; the labels party has the sequence ( y i ) n i =1 of the corresponding labels. The labels party sends a single (possibly randomized) message M ( y 1 , . . . , y n ) to the features party. Based on its input and the received message, the features party generates an ML model as its output.

Definition 3 (Feature-Oblivious Label DP [GKK + 23]) . In the above scenario, the output of the features party satisfies feature-oblivious ε -LabelDP if the message M ( y 1 , . . . , y n ) is ε -DP where two inputs are considered 'adjacent' if they differ on a single y i .

3 Label-DP Randomizers

A standard recipe for learning with label DP is to: (i) compute noisy labels using a local DP randomizer M and (ii) use a learning algorithm on the dataset with noisy labels. Many of the baseline algorithms that we consider follow this recipe, through different ways of generating noisy labels, such as, (a) (continuous/discrete) Laplace mechanism, (b) (continuous/discrete) staircase mechanism, etc. (see Appendix F for formal definitions). Prior work by [GKK + 23] argues that intuitively such a learning algorithm will be most effective when the noisy label 'mostly agrees' with the true label. This was formalized in the goal of minimizing the noisy label loss , which is the expected loss between the true label and the noisy label, for the true label drawn from a prior distribution, for some loss function ℓ .

Definition 4 (Noisy label loss) . For a loss function g : R × Y → R , the noisy label loss of a randomizer M with respect to prior P is G ( M ; P ) := E y ∼P , ˆ y ∼M ( y ) g (ˆ y, y ) , where ˆ y is the noisy label generated by M on input y .

This was motivated by the triangle inequality [GKK + 23, Eq. (1)], namely,

The work of [GKK + 23] focused on optimizing noisy label loss; they showed that the optimal randomizer takes the form of 'Randomized-Response on Bins' (see Appendix F for more details). However, if we notice carefully, the noisy label loss does not depend on the number of examples, so the RHS of (1) does not go to zero as the number of examples goes to infinity, even though we would like the excess population loss of the learnt predictor to asymptotically go to zero. In this paper, we provide an alternative insight into the goal of minimizing the noisy label loss.

For any distribution D over X × Y , and any label randomizer M mapping Y to ˆ Y ⊆ R , let D M be the distribution over X × ˆ Y sampled as ( x, M ( y )) for ( x, y ) ∼ D . The Bayes optimal predictor for any distribution D over X ×Y w.r.t. loss ℓ , is a predictor f ∗ D : X → R that minimizes L D ( f ) , which roughly corresponds to the best predictor we could hope to learn with unbounded number of samples from D . We show that, when training with a loss from a broad family that includes ℓ sq and ℓ Poi , the Bayes optimal predictor is preserved after applying the label randomizer iff E [ M ( y )] = y holds for all y ∈ Y (i.e., the randomizer is unbiased ).

Theorem 5. Suppose ℓ is a loss function such that for all distributions P over Y , the minimizer ˆ y ∗ := min ˆ y ∈ R E y ∼P ℓ (ˆ y, y ) exists and is given as ˆ y ∗ = E y ∼P [ y ] . Then the following are equivalent:

▷ E [ M ( y )] = y holds for all y ∈ Y ,

▷ For all distributions D over X × Y , it holds that f ∗ D = f ∗ D M .

The main observation is that f ∗ D ( x 0 ) = E [ y | x = x 0 ] with probability 1 over x 0 , and similarly, f ∗ D M ( x 0 ) = E [ M ( y ) | x = x 0 ] with probability 1 over x 0 . We defer the full proof to Appendix A, but for now we demonstrate a simple example where a predictor learned using noisy labels produced by the optimal RR -on -Bins randomizer can in fact be suboptimal. Let X = { a , b } and Y = { 0 , 1 , 2 } and the distribution D be defined in Table 1.

Thus, preserving the Bayes optimal predictor is a desirable property of a label randomizer, as any learning algorithm that converges to the optimal predictor can also be trained on the noisy labels and will approach the predictor for the original distribution.

The Bayes optimal predictor for D w.r.t. ℓ sq (or even ℓ Poi ) is given as f ∗ D ( a ) = 0 . 4 and f ∗ D ( b ) = 0 . 7 . On the other hand, the optimal M = RR -on -Bins Φ ε randomizer for ε = 0 . 5 (see Appendix F for notation), corresponds to the map Φ(0) ≈ 0 . 396 and Φ(1) = Φ(2) ≈ 0 . 720 . The Bayes optimal predictor for D M is given as f ∗ D M ( a ) = 0 . 542 and f ∗ D M ( b ) = 0 . 558 . The squared loss of these predictors are given as L D ( f ∗ D ) = 2 . 625 and L D ( f ∗ D M ) = 2 . 726 , the latter being sub-optimal.

Additionally, we can relate the property E [ M ( y )] = y to the unbiasedness of the gradients obtained in SGD. First, we observe that the gradient with respect to the parameters for ℓ sq and ℓ Poi are affine in y , namely,

Thus, the error in the gradient estimate when using the noisy label ˆ y instead of y is given as

Let S = { ( x 1 , y 1 ) , . . . , ( x b , y b ) } be a mini-batch of examples and let ˆ S = { ( x 1 , ˆ y 1 ) , . . . , ( x b , ˆ y b ) } be the mini-batch with noisy labels as returned by the randomizer M . Also consider the dataset with expected noisy labels ˜ S = { ( x 1 , ˜ y 1 ) , . . . , ( x b , ˜ y b ) } , where ˜ y i = E ˆ y ∼M ( y ) ˆ y . The difference between a mini-batch gradient w.r.t. noisy labels and the gradient of the population loss decomposes for ℓ sq as follows (similar decomposition holds for ℓ Poi ):

The term ( a ) is the difference between the mini-batch gradient and the population gradient, the inherent stochasticity in mini-batch SGD, which has zero bias. The terms ( b ) and ( c ) form precisely the bias-variance decomposition for the additional stochasticity in the gradient introduced by the label noise, with the term ( c ) having zero bias. In the case of stochastic convex optimization, it is well known that with access to biased gradients, it is impossible to achieve vanishingly small excess loss; whereas, with access to gradients with zero bias and any finite variance, it is possible to achieve an arbitrarily small excess loss using sufficient number of steps of stochastic gradient descent (see Appendix D for more details). Motivated by this reasoning, our approach is to use a randomizer that has the smallest variance possible while ensuring zero bias , namely the term ( b ) is zero.

3.1 Computing Optimal Unbiased Randomizers

We consider a label randomizer that minimizes the noisy label loss, while being unbiased. Namely, we say that an ε -DP randomizer M that maps the label set Y ⊆ R to R is unbiased if it satisfies E ˆ y ∼M ( y ) ˆ y = y for all input labels y ∈ Y . We use a linear programming (LP) based algorithm (Algorithm 1) to compute an unbiased randomizer that minimizes the noisy label loss. In order to keep this approach computationally tractable we require that both Y and ˆ Y are finite; as we discuss shortly, it is possible to handle general Y by discretization using randomized rounding, and moreover the excess noisy label loss due to consideration of a discrete ˆ Y can be bounded as well. Even though Algorithm 1 is general, we will only consider g = ℓ sq henceforth (irrespective of the training loss ℓ ).

Algorithm 1 ComputeOptUnbiasedRand ε

Parameters: Privacy parameter ε ≥ 0 .

Input: P = ( p y ) y ∈Y -prior over input labels Y ,

ˆ Y = (ˆ y i ) i ∈I -a finite sequence of potential output labels.

Output: An ε - DP label randomizer.

Solve the following LP in variables M = ( M y → i ) y ∈Y ,i ∈I :

̸

return Label randomizer M mapping Y to ˆ Y given by Pr[ M ( y ) = ˆ y i ] = M y → i .

In Figure 2, we illustrate a prior P over Y = { 0 , 1 , 2 } , using the example in Table 1, and the corresponding unbiased randomizer returned by ComputeOptUnbiasedRand ε =0 . 5 ( P , ˆ Y ) for a certain

0

1

2

0

0.1

0.2

0.3

0.4

0.5

0.6

input label

probability mass

(a)

0

1

2

0

0.05

0.1

0.15

0.2

0.25

0.3

output label

-3.3077138284373926

-3.2700918736038784

-2.8562503704352205

4.818628415601706

5.345335783270906

5.382957738104421

input label

probability mass

(b)

fine-grained choice of ˆ Y . It is worth noting that this randomizer is quite unlike 'randomized response' or any additive noise mechanism! Additionally, the output labels are all outside [0 , 2] , which is the convex hull of Y . We have observed the same in our experiments in Section 4 as well. One may find it surprising that these 'out of domain' noisy labels in fact yield better trained models! This could be attributed to the Bayes optimal predictor for this randomizer being precisely f ∗ D , since E [ M ( y )] = y for all y ∈ Y (Theorem 5).

There are however a couple of challenges to be addressed. First, it is unclear if the optimal unbiased randomizer has only finitely many labels, and even if so, what is the number of distinct output labels. Secondly, one needs to fix the choice of ˆ Y before hand, and it is unclear how one can choose it in a way that the LP is feasible and moreover, the solution is close to the optimal unbiased randomizer. We address these challenges as follows.

Structure of optimal unbiased randomizers. Addressing the first challenge, we show that there is an optimal unbiased randomizer that has a small number of distinct output labels.

Theorem 6. For any convex loss g , all distributions P over R with finite support, and ε > 0 , there exists an ε -DP unbiased randomizer M ∗ ∈ inf ε -DP unbiased M G ( M ; P ) with at most 2 |Y| output labels.

The main ideas in the proof are as follows: we use the convexity of g to show that an optimal ε -DP unbiased randomizer M must be of a certain form; if not we can use Jensen's inequality to construct another randomizer M ′ with that form such that G ( M ′ ; P ) ≤ G ( M ; P ) . In particular, we show that the randomizer must be a staircase mechanism as defined in [KOV16], a mechanism that maximally satisfies the DP constraints. This already implies that the number of output labels is at most 2 |Y| . We use the ordering of the labels, along with similar reductions using convexity of g , to show that the optimal ε -DP unbiased randomizer further lies within a special subset of staircase mechanisms with 2 |Y| output labels. The detailed proof is provided in Appendix B.

Choosing ˆ Y to ensure feasibility and good coverage. To address the second challenge, we use a finite set of output labels. We show an upper bound on the excess noisy label loss due to discretization.

We use a heuristic (Algorithm 2) for setting ˆ Y to be a grid, in a way that ensures that the LP in Algorithm 1 has a feasible solution while keeping ˆ Y small enough to be able to efficiently solve the LP. To compute the endpoints of the grid, we use an unbiased randomizer with a finite and bounded support: the ε -DP debiased randomized response ( ε -dbRR ) on the set of labels, which operates by mapping the inputs to a unique set of values such that under randomized response the randomizer is unbiased (see Appendix F for a definition). We choose the endpoints of our grid to be precisely the minimum and maximum among the possible outputs of ε -dbRR (see Algorithm 2 for details). With those two endpoints defined, we create the grid by evenly spacing output labels along this interval. The number of output labels we generate is as large as possible while maintaining that the LP solver terminates in a reasonable amount of time. We show that having these endpoints suffices to ensure feasibility of the LP in Algorithm 1.

Proposition 7. If ˆ Y contains just the smallest and largest values among the outputs of ε -dbRR , the LP in ComputeOptUnbiasedRand ε ( P, ˆ Y ) is feasible.

Algorithm 2 FeasibleOutputSet ε

We defer the proof to Appendix F; the main idea is that these endpoints create an interval that contains the interval one would obtain from the debiased randomized response on the two label set of the minimum label and maximum label. Because the ˆ Y we choose has labels less than this minimum and larger than this maximum, all labels in between can be generated by interpolation.

Additionally, we show that using the randomizer optimized on the grid ˆ Y gives bounded excess noisy label loss compared to optimizing over a continuous set of labels for Lipschitz loss functions.

Lemma 8. Let M be the optimal unbiased randomizer with ˆ Y = [ L, U ] , and let M ∆ be the optimal unbiased randomizer with ˆ Y = { L, L + ∆ , . . . , U -∆ , U } . If g (ˆ y, y ) is K -Lipschitz in ˆ y , then G ( M ∆ ; P ) ≤ G ( M ; P ) + K ∆ .

In the case of g (ˆ y, y ) = 1 2 (ˆ y -y ) 2 , we have K = ( U -L ) . Therefore, as the grid gets finer, the excess noisy label loss of M ∆ obtained from 1 over the noisy label loss of M scales linearly in the discretization parameter ∆ . We present the proof in Appendix E.

For large ε values, we experimentally observe that the optimal unbiased randomizer appears to approach ε -dbRR . For small ε values, we also experimentally observe that the optimal unbiased randomizer appears to be supported on the labels of the debiased randomized response on the two label set of the minimum label and the maximum label. This justifies our choice of endpoints for grid.

Splitting budget between prior and label. So far, we have assumed a known prior P over input labels Y . However, this is typically not the case, and so we use the standard Laplace mechanism to privately estimate the prior. Given n samples drawn from P , M Lap ε constructs a histogram over Y and adds Laplace noise with scale 2 /ε to each entry, followed by clipping (to ensure that entries are non-negative) and normalization. For completeness, we include a formal description of M Lap ε in Appendix C.

Our randomizer for the unknown prior case, described in Algorithm 3, thus operates by splitting

Algorithm 3 LabelRandomizer ε 1 ,ε 2 .

the privacy budget into ε 1 , ε 2 , using M Lap ε 1 to get an approximate prior distribution P ′ , and using the randomizer returned by ComputeOptUnbiasedRand ε 2 ( P ′ , ˆ Y ) to randomize the labels. It follows that the entire algorithm is ( ε 1 + ε 2 ) -DP .

Handling continuous Y . While we focused on the case of finite sets Y , the approach can be extended to the case where Y is a continuous set, say Y = [ L, U ] . In this case, we can first choose a finite discrete subset ˜ Y ⊆ Y that contains both L and U , e.g., ˜ Y = { L, L +∆ , . . . , U } , and then apply unbiased randomized rounding URR ˜ Y ( · ) to all labels before applying any mechanism M .

Namely, for any label y ∈ [ L, U ] such that y 1 ≤ y ≤ y 2 for y 1 , y 2 being consecutive elements of ˜ Y , URR ˜ Y ( y ) returns ˜ y drawn as y 1 with probability y 2 -y y 2 -y 1 and y 2 with probability y -y 1 y 2 -y 1 . This ensures that E [ ˜ y ] = y and hence, for any unbiased mechanism M that acts on inputs in ˜ Y , it holds for all

400

0.000

0.005

0.010

300

200

100

0

0

300

Original Labels

MSE=2629.87

RR-on-Bins

400

0.0

0.02

100

200

Laplace

Mechanism

-200

-100

0

100

0

100

200

300

400

0.0

0.002

200

300

400

500

0.000

0.005

0.010

Original Labels

MSE=20003.27

400

0.000

0.005

0.010

300

200

100

0

0

100

200

Original Labels

MSE=9849.99

300

400

0.0

0.002

Clipped

Laplace

Mechanism

Optimal

Unbiased

400

400

0.000

0.0

0.01

0.005

0.010

300

300

MSE=4208.08

200

200

100

100

0

0

Original Labels

y ∈ Y that E [ M ( URR ˜ Y ( y ))] = E [ URR ˜ Y ( y )] = y . Furthermore, as the gap between consecutive points of ˜ Y decreases, the variance introduced by URR ˜ Y also decreases.

4 Experimental Evaluation

We evaluate our randomizer on three datasets, and compare with the Laplace mechanism [DMNS06], the additive staircase mechanism [GV14], and the RR -on -Bins method [GKK + 23]. The Laplace mechanism and the additive staircase mechanism both have a discrete and a continuous variant. Following [GKK + 23], we use the continuous variants for real-valued labels (the Criteo Sponsored Search Conversion dataset), and the discrete variants for integer-valued labels (the US Census dataset and the App Ads Conversion Count dataset). Note that in the experiments from [GKK + 23], the noised labels from both the Laplace mechanism and the additive staircase mechanism were clipped to be in the valid label value range, as for small ε 's, the magnitude of the noised labels could be orders of magnitudes larger than the original label values, potentially causing numerical instability in model training. However, in our study, we found that with more careful hyperparameter tuning and early stopping (see Appendix G), the learning could be stabilized for sufficiently small values (e.g., ε ≥ 0 . 3 ) that is practically useful in ML, and in this case, the unclipped (therefore also unbiased) version of both the Laplace and the additive staircase mechanisms outperform their clipped counterpart. For reference, we present the results for both clipped and unclipped variants for those two mechanisms. We note that all of these mechanisms can be implemented in the feature-oblivious label DP setting (Figure 1). More details on model and training configurations are presented in Appendix G.

4.1 Criteo Sponsored Search Conversion

The Criteo Sponsored Search Conversion Log Dataset [TY18] is a collection of 15 , 995 , 634 data points derived from a sample of 90 -day logs of live traffic from Criteo Predictive Search (CPS). Each example contains information of an user action (e.g., a click on an advertisement) and a subsequent conversion (purchase of the related product) within a 30 -day attribution window. We use the setup of feature-oblivious label DP to predict the revenue in C (i.e., the SalesAmountInEuro field in the dataset) of a conversion. We apply the following preprocessing steps: filtering out examples with SalesAmountInEuro being -1 , and clipping the labels at the 95 th percentile of the value distribution ( 400 C).

In Figure 3, we visualize an example of the various label randomizers. For ε = 4 , the optimal RR -on -Bins randomizer maps the input values to one of four distinct values. On the other hand, for the optimal unbiased randomizer, the joint distribution of the sensitive labels and randomized labels maintains an overall concentration along the diagonal. The joint distribution for the Laplace mechanism is quite spread out.

In Figure 4, we compare the noisy label loss on the training set and the mean squared error on the test set for all the randomizers considered. For each randomizer, the label randomization and training was run with 10 independent random seeds, and the plots show the average and standard deviation bars. For RR -on -Bins and the optimal unbiased randomizer, we use ε 1 = 0 . 017 for privately estimating the prior using M Lap ε 1 , and ε 2 = ε -ε 1 for randomizing the label, following the guidance in Appendix C.

10 5

10 6

Laplace

Staircase

Laplace (Clip)

Staircase (Clip)

RR-on-Bins

Optimal Unbiased

0.3

0.5

0.8

1

1.5

2

4

6

0

10000

20000

30000

40000

50000

Mean Squared Error

epsilon =

(a) Noisy Label Loss

10 4

6×10 3

2×10 4

Laplace

Staircase

Laplace (Clip)

Staircase (Clip)

RR-on-Bins

Optimal Unbiased

0.3

0.5

0.8

1

1.5

2

4

6

4000

4500

5000

5500

6000

Mean Squared Error

epsilon =

(b) Test Loss

2×10 2

3×10 2

4×10 2

Laplace

Staircase

Laplace (Clip)

Staircase (Clip)

RR-on-Bins

Optimal Unbiased

0.3

0.5

0.8

1

1.5

2

3

4

6

134

136

138

140

142

Mean Squared Error

epsilon =

(a) US Census

10 1

10 2

Laplace

Staircase

Laplace (Clip)

Staircase (Clip)

RR-on-Bins

Optimal Unbiased

0.3

0.5

0.8

1

1.5

2

3

4

6

0

1

2

3

4

5

Relative Poisson Loss

epsilon =

We find that the optimal unbiased randomizer (Algorithm 3) achieves the smallest test mean squared error across a wide range of ε values. It is interesting to note that the unbiased randomizers (Laplace and additive staircase mechanisms and the optimal unbiased randomizer) vastly outperform the biased randomizers (clipped versions of Laplace and additive staircase mechanisms as well as the RR -on -Bins ) in terms of test loss, even though the noisy label loss is an order of magnitude larger for the unbiased randomizers.

4.2 US Census

The 1940 US Census dataset 3 is widely used in the evaluation of data analysis with DP [WDZ + 19, CJG21, GKM + 21]. This digitally released dataset in 2012 contains 131 , 903 , 909 examples. We follow the task studied in [GKK + 23] and evaluate label DP algorithms by learning to predict the number of weeks each respondent worked during the previous year (the WKSWORK1 field).

In Figure 5a we compare the mean squared error on the test set for all the randomizers considered. For each randomizer, the label randomization and training was run with 10 independent random seeds, and the plots show the average and standard deviation bars. For RR -on -Bins and the optimal unbiased randomizer, we use ε 1 = 0 . 002 for privately estimating the prior using M Lap ε 1 , and ε 2 = ε -ε 1 for randomizing the label, following the guidance in Appendix C. We find that the optimal unbiased randomizer achieves the smallest test mean squared error across a wide range of ε values.

4.3 App Ads Conversion Count

We also evaluate on a conversion count prediction dataset collected from a commercial mobile app store. Each example in this dataset corresponds to an ad click and the task is to predict the number of post-click conversion events in the app after a user installs the app within a certain time window.

In Figure 5b we compare the relative Poisson loss on the test set for all the randomizers considered. For each randomizer, the label randomization and training was run with 6 independent random seeds. For the optimal unbiased randomizer, Laplace and additive staircase mechanisms, at low ε 's we experience blowup in the training loss during training. The plot show the average and standard deviation bars, at the time of lowest training loss, right before blowup. We see that for all ε 's, all of the unbiased randomizers vastly outperform the others, including RR -on -Bins . Among the unbiased randomizers (optimal unbiased randomizer, Laplace and additive staircase mechanisms), the optimal unbiased randomizer performs the best at all ε 's. One caveat is that for the smaller ε 's, one can see the standard error increase. We hypothesize this is not an inherent feature of the randomizers but due to the blow up of the model training, reducing the training length and adding additional variance to the error, a behavior that seems specific to the AppAds dataset.

5 Related Work

DP learning has been the subject of considerable research spanning different settings that include empirical risk minimization [CMS11], PAC learning [BLM20], training neural networks [ACG + 16], online learning [JKT12], and regression [Wan18]. For the label DP setting, [CH11, BNS16] studied the sample complexity of classification, while [WX19] studied sparse linear regression in the local DP model [EGS03, KLN + 11]. For training deep neural networks with label DP, [GGK + 21] studied the classification setting and gave a multi-stage training procedure where the priors on the labels in the previous stage are used to define an LP that is optimized to find the randomization mechanism for the next stage. For the classification loss, they characterized the optimal solution as the so-called RRTopk . By contrast, the work of [GKK + 23] showed that for regression objectives the optimal solution to the LP is an RR -on -Bins solution. A crucial insight in our work is that the addition of an unbiasedness constraint to the LP leads to solutions that (i) are not RR -on -Bins solutions, (ii) can have substantially higher variance than RR -on -Bins , and (iii) nevertheless have a much lower train and test error due to the reduction in bias.

Kairouz et al. [KOV16] defined a family of staircase mechanisms and showed they are optimal among local DP algorithms for minimizing an objective function given a prior. We extend the notion of staircase mechanisms to include real-valued labels that affect the optimization function. The structural properties that we prove (Theorem 6) utilize the ordering of the labels and the unbiasedness condition, which we show is critical for training neural networks for regression with label DP and high accuracy. Moreover, their work shows the presence of staircase mechanisms in the context of optimizing mutual information and KL-divergence objectives, whereas we show their presence in the context of regression.

A two-party learning setting with one features party and one labels party was recently studied in the work of [LSY + 21]. They focus on the interactive setting, which is arguably less practical than the (non-interactive) feature-oblivious setting studied in [GKK + 23] that we also consider.

We also note that the label DP mechanism of [MEMP + 21], which builds on the PATE framework [PAE + 17, PSM + 18], and the works of [EMSV22, TNM + 22], which leverage unsupervised and semi-supervised learning algorithms, cannot be implemented in the feature-oblivious setting. The DP-SGD algorithm of [ACG + 16], which protects both the features and the label of each training example and which has been applied to different domains including computer vision [DBH + 22] and language models [YNB + 22] also cannot implemented in the feature-oblivious label DP setting. The same is also true for label DP algorithms for logistic regression [GR21] that are based on linear queries (where the features are assumed to be known and non-sensitive, and the linearity is with respect to the labels).

Over the past decade, there has been a significant body of research on DP ML (e.g., [CMS11, ZZX + 12, SCS13]). In particular, DP regression has been the focus of several prior papers including [ZZX + 12, KST12, Wan18, SÁZL18, AMS + 22].

The label DP setting has also been studied in several papers including [CH11, BNS16, WX19, GGK + 21, MEMP + 21, YSMN21, EMSV22, BMS22, GKK + 23]. The Randomized Response ( RR ) mechanism [War65], a basic form of label DP, was introduced several decades ago and is widely studied/used.

6 Conclusion

In this work, we show that using unbiased ε -DP label randomizers lead to better trained models, and in particular, choosing the label randomizer that minimizes the noisy label squared loss seems to perform the best in terms of test performance, by empirically demonstrating this on three datasets. We also provide theoretical results shedding light on the structure of these randomizers, as well as why they might lead to better trained models.

Discussion. While we focused entirely on ε -DP ('pure-DP'), for our specific approach, it does not seem that relaxing to ( ε, δ ) -DP ('approximate-DP') will be beneficial. For the first stage of estimating the histogram privately, one could potentially use an approximate-DP mechanism, but we believe that is unlikely to change the prior significantly. For the second stage of randomizing labels, it is known that approximate-DP may not be helpful in the local model [BNS18].

In this work, we use hyperparameter tuning to choose the best architecture, which in general has additional privacy costs, and how to tune hyperparameters privately and efficiently is an active research topic [PS22, SSS23]. Consequently, it is common in the private ML literature to separate the question of private hyperparameter tuning and private training, and focus on comparing the privacyutility trade-off under optimal hyperparameters, e.g., [MEMP + 21, HLY + 23, KCS + 22, DBH + 22]. We also follow this convention.

Limitations and future work. While LPs are somewhat efficient, it would be desirable to have a more efficient algorithm for computing the optimal unbiased randomizer. The RR -on -Bins randomizer introduced in [GKK + 23] has an important advantage that one does not need to construct the set of potential output labels ˆ Y before hand, and in fact, there is a simple dynamic programming algorithm to compute the optimal randomizer along with the output labels. Moreover, the RR -on -Bins family of randomizers has a clean structure. Understanding more structural properties of the optimal unbiased randomizers, and designing better algorithms for computing them, would be an interesting future direction to pursue.

To further improve the benefit of this optimal prior-based unbiased label randomizer, it might be possible to first partition the input examples into groups of 'related examples', purely using the input features and compute the optimal unbiased randomizer for each group, by privately estimating the prior over labels for each group. This could lead to better test performance, as the randomizer can adapt to the different priors across these groups, unlike the 'static' label randomizers such as Laplace and additive staircase mechanisms. For example, such an approach was used in the setting of image classification using self-supervised learning in [GGK + 21].

As shown in (2), there is a bias-variance trade-off when it comes to choosing a label randomizer. While RR -on -Bins minimizes the noisy label loss (corresponding to the variance), the method in our work minimizes the bias (in fact, making it zero), at the cost of greatly increasing the variance. However, it might be possible in some settings that allowing a small amount of bias might greatly reduce the variance, thereby improving performance. This might be especially relevant when ε is very small. This could be done for example by adding a regularizer to reduce the bias, without enforcing hard unbiased constraints, as currently done in Algorithm 1. We leave this investigation to future work.

References

[ACG + 16] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In CCS , pages 308-318, 2016.

[AMS + 22] Daniel Alabi, Audra McMillan, Jayshree Sarathy, Adam Smith, and Salil Vadhan. Differentially private simple linear regression. PETS , 2:184-204, 2022.

[BLM20] Mark Bun, Roi Livni, and Shay Moran. An equivalence between private classification and online prediction. In FOCS , 2020.

[BMS22] Raef Bassily, Mehryar Mohri, and Ananda Theertha Suresh. Differentially private learning with margin guarantees. In NeurIPS , 2022.

[BNS16] Amos Beimel, Kobbi Nissim, and Uri Stemmer. Private learning and sanitization: Pure vs. approximate differential privacy. ToC , 12(1):1-61, 2016.

[BNS18] Mark Bun, Jelani Nelson, and Uri Stemmer. Heavy hitters and the structure of local privacy. In PODS , pages 435-447, 2018.

[CH11] Kamalika Chaudhuri and Daniel Hsu. Sample complexity bounds for differentially private learning. In COLT , pages 155-186, 2011.

[CJG21] Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Data poisoning attacks to local differential privacy protocols. In USENIX Security , pages 947-964, 2021.

[CMS11] Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. JMLR , 12(3), 2011.

[DBH + 22] Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650 , 2022.

[DHS15] Ilias Diakonikolas, Moritz Hardt, and Ludwig Schmidt. Differentially private learning of structured discrete distributions. In NIPS , pages 2566-2574, 2015.

[DMNS06] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. Calibrating noise to sensitivity in private data analysis. In TCC , pages 265-284, 2006.

[DR14] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science , 9(3-4):211-407, 2014.

[EGS03] Alexandre Evfimievski, Johannes Gehrke, and Ramakrishnan Srikant. Limiting privacy breaches in privacy preserving data mining. In PODS , pages 211-222, 2003.

[EMSV22] Hossein Esfandiari, Vahab Mirrokni, Umar Syed, and Sergei Vassilvitskii. Label differential privacy via clustering. In AISTATS , pages 7055-7075, 2022.

[GGK + 21] Badih Ghazi, Noah Golowich, Ravi Kumar, Pasin Manurangsi, and Chiyuan Zhang. Deep learning with label differential privacy. NeurIPS , pages 27131-27145, 2021.

[GKK + 23] Badih Ghazi, Pritish Kamath, Ravi Kumar, Ethan Leeman, Pasin Manurangsi, Avinash Varadarajan, and Chiyuan Zhang. Regression with label differential privacy. In ICLR , 2023.

[GKM + 21] Badih Ghazi, Ravi Kumar, Pasin Manurangsi, Rasmus Pagh, and Amer Sinha. Differentially private aggregation in the shuffle model: Almost central accuracy in almost a single message. In ICML , pages 3692-3701, 2021.

[GR21] Alexandre Gilotte and David Rohde. Learning a logistic model from aggregated data. AdKDD Workshop , 2021.

[GV14] Quan Geng and Pramod Viswanath. The optimal mechanism in differential privacy. In ISIT , pages 2371-2375, 2014.

[Har23] Charlie Harrison. Consider a randomized-response-like privacy mechanism, April 2023. github.com/patcg-individual-drafts/ipa/issues/60 .

[Haz22] Elad Hazan. Introduction to Online Convex Optimization . MIT Press, 2022.

[HLY + 23] Jiyan He, Xuechen Li, Da Yu, Huishuai Zhang, Janardhan Kulkarni, Yin Tat Lee, Arturs Backurs, Nenghai Yu, and Jiang Bian. Exploring the limits of differentially private deep learning with group-wise clipping. In ICLR , 2023.

[JKT12] Prateek Jain, Pravesh Kothari, and Abhradeep Thakurta. Differentially private online learning. In COLT , pages 24:1-24:34, 2012.

[KCS + 22] Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward training at imagenet scale with differential privacy. CoRR , abs/2201.12328, 2022.

[KLN + 11] Shiva Prasad Kasiviswanathan, Homin K. Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam D. Smith. What can we learn privately? SIAM J. Comput. , 40(3):793-826, 2011.

[KOV16] Peter Kairouz, Sewoong Oh, and Pramod Viswanath. Extremal mechanisms for local differential privacy. JMLR , 17:17:1-17:51, 2016.

[KST12] Daniel Kifer, Adam Smith, and Abhradeep Thakurta. Private convex empirical risk minimization and high-dimensional regression. In COLT , pages 25.1-25.40, 2012.

[LSY + 21] Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label leakage and protection in two-party split learning. In ICLR , 2021.

[MEMP + 21] Mani Malek Esmaeili, Ilya Mironov, Karthik Prasad, Igor Shilov, and Florian Tramer. Antipodes of label differential privacy: PATE and ALIBI. NeurIPS , 34:6934-6945, 2021.

[PAE + 17] Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In ICLR , 2017.

[PS22] Nicolas Papernot and Thomas Steinke. Hyperparameter tuning with Rényi differential privacy. In ICLR , 2022.

[PSM + 18] Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Erlingsson. Scalable private learning with PATE. In ICLR , 2018.

[RE19] Carey Radebaugh and Ulfar Erlingsson. Introducing TensorFlow Privacy: Learning with Differential Privacy for Training Data, March 2019. blog.tensorflow.org .

[SÁZL18] Michael Thomas Smith, Mauricio A. Álvarez, Max Zwiessele, and Neil Lawrence. Differentially private regression with Gaussian processes. In AISTATS , 2018.

[SCS13] Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In GlobalSIP , pages 245-248, 2013.

[SSS23] Tom Sander, Pierre Stock, and Alexandre Sablayrolles. TAN without a burn: Scaling laws of DP-SGD. In ICML , pages 29937-29949, 2023.

[TM20] Davide Testuggine and Ilya Mironov. PyTorch Differential Privacy Series Part 1: DP-SGD Algorithm Explained, August 2020. medium.com .

[TNM + 22] Xinyu Tang, Milad Nasr, Saeed Mahloujifar, Virat Shejwalkar, Liwei Song, Amir Houmansadr, and Prateek Mittal. Machine learning with differentially private labels: Mechanisms and frameworks. PETS , 4:332-350, 2022.

[TY18] Marcelo Tallis and Pranjul Yadav. Reacting to variations in product demand: An application for conversion rate (CR) prediction in sponsored search. In IEEE BigData , pages 1856-1864, 2018.

[Wan18] Yu-Xiang Wang. Revisiting differentially private linear regression: optimal and adaptive prediction & estimation in unbounded domain. In UAI , pages 93-103, 2018.

[War65] Stanley L Warner. Randomized response: A survey technique for eliminating evasive answer bias. JASA , 60(309):63-69, 1965.

[WDZ + 19] Tianhao Wang, Bolin Ding, Jingren Zhou, Cheng Hong, Zhicong Huang, Ninghui Li, and Somesh Jha. Answering multi-dimensional analytical queries under local differential privacy. In SIGMOD , pages 159-176, 2019.

[WX19] Di Wang and Jinhui Xu. On sparse linear regression in the local differential privacy model. In ICML , pages 6628-6637, 2019.

[YNB + 22] Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. In ICLR , 2022.

[YSMN21] Sen Yuan, Milan Shen, Ilya Mironov, and Anderson Nascimento. Label private deep learning training based on secure multiparty computation and differential privacy. In NeurIPS Workshop Privacy in Machine Learning , 2021.

[ZZX + 12] Jun Zhang, Zhenjie Zhang, Xiaokui Xiao, Yin Yang, and Marianne Winslett. Functional mechanism: regression analysis under differential privacy. VLDB , 5(11):1364-1375, 2012.

A Bayes Optimal Predictor Using Noisy Labels

We prove Theorem 5, restated below for convenience.

Theorem 5. Suppose ℓ is a loss function such that for all distributions P over Y , the minimizer ˆ y ∗ := min ˆ y ∈ R E y ∼P ℓ (ˆ y, y ) exists and is given as ˆ y ∗ = E y ∼P [ y ] . Then the following are equivalent:

▷ E [ M ( y )] = y holds for all y ∈ Y ,

▷ For all distributions D over X × Y , it holds that f ∗ D = f ∗ D M .

Proof. If M is unbiased, then E ˆ y ∼M ( y ) [ˆ y ] = ∑ ˆ y ∈ ˆ Y ˆ y · Pr[ M ( y ) = ˆ y ] = y for all input labels y ∈ Y . We have the following equalities (we restrict ourselves to the case of finite Y and ˆ Y , but the proof generalizes easily to measurable sets Y and ˆ Y ):

showing that the Bayes optimal predictors are equal at all values x 0 .

̸

Conversely, suppose we have a y ′ ∈ Y such that E ˆ y ∼M ( y ′ ) [ˆ y ] = y ′ . Then take any distribution D for which there is some x 0 with Pr[ y = y ′ | x = x 0 ] = 1 . Then clearly E y ∼ D ( x 0 ) [ y | x = x 0 ] = y ′ . However, E ˆ y ∼M ( y ) ,y ∼ D ( x 0 ) [ˆ y | x = x 0 ] = E ˆ y ∼M ( y ′ ) [ˆ y ] = y ′ . Hence the Bayes optimal predictors differ at x 0 .

̸

B Structural Properties of Optimal Unbiased Randomizers

We prove Theorem 6, restated below for convenience. We use the following assumption about the label loss g , which in particular, is satisfied by ℓ sq that we primarily use.

Assumption 9. The loss g : R × R → R is such that for all y , it holds that g (ˆ y, y ) is convex in ˆ y , and minimized at ˆ y = y for all y .

Theorem 6. For any convex loss g , all distributions P over R with finite support, and ε > 0 , there exists an ε -DP unbiased randomizer M ∗ ∈ inf ε -DP unbiased M G ( M ; P ) with at most 2 |Y| output labels.

We recall the definition of a signature matrix from [GKK + 23]. Consider any feasible solution M := ( M y → i ) y ∈Y ,i ∈I of the LP in Algorithm 1. Note that for reasons that will be clear shortly, we do not require the ˆ y i values to be distinct, and we will assume without loss of generality that ˆ y i ≤ ˆ y j for all i < j ∈ I . Let p min i = min y M y → i and let p max i = max y M y → i . Note that if M encodes an ε -DP randomizer, it holds that p max i ≤ e ε · p min i .

Definition 10 (Signature matrix) . For any ε -DP randomizer encoded by M , the corresponding signature matrix entry S M ( y, i ) for all y ∈ Y and i ∈ I is defined as

We show that for any ε -DP unbiased randomizer M (0) , there exists another ε -DP unbiased randomizer M , which satisfies certain nice properties, while not increasing the noisy label loss.

Claim 11. Suppose |Y| ≥ 2 . For any ε -DP unbiased randomizer M (0) mapping to a finite set of output labels, there exists an ε -DP unbiased randomizer M with output label sequence ˆ Y = (ˆ y i ) i ∈I , encoded by ( M y → i ) y,i such that the following hold:

▷ G ( M 0 ; P ) ≥ G ( M ; P ) .

▷ Each column of S M consists of only U 's and L 's, with at least one U and one L .

▷ With row indices in Y sorted in increasing order from top to bottom, every non-zero column of S M matches the regular expression L ∗ U + L ∗ . For each i ∈ I , let Φ 1 ( i ) and Φ 2 ( i ) be the smallest and the largest y respectively for which S M ( y, i ) = U .

▷ For all i < i ′ it holds that Φ 1 ( i ) ≤ Φ 1 ( i ′ ) and Φ 2 ( i ) ≤ Φ 2 ( i ′ ) , with at least one of the inequalities being strict.

Before we prove Claim 11, we prove Theorem 6 using it.

̸

Proof of Theorem 6. If |Y| = 1 , then it is immediate that the optimal unbiased randomizer simply returns the unique value in Y with probability 1 . If |Y| ≥ 2 , then for any optimal unbiased randomizer M (0) , we can apply Claim 11 to get another optimal unbiased randomizer M that satisfies the stated conditions. Let I =0 ⊆ I be the subsequence of all outputs for which M y → i = 0 (for all y ). The sequence (Φ 1 ( i ) , Φ 2 ( i )) ordered in increasing order of i ∈ I =0 is strictly increasing in the partial order Y × Y , that is, at least one of Φ 1 ( i ) or Φ 2 ( i ) strictly increases from one i to next. It is easy to see that this can happen at most 2 |Y| times, thereby concluding that |I =0 | ≤ 2 |Y| .

̸

To prove Claim 11, we perform several transformations to the given ε -DP randomizer M (0) , which is say encoded by M (0) = ( M (0) y → i ) y,i for some ˆ Y = (ˆ y i ) i ∈I , such that the randomizer obtained in each step satisfies E M ( r ) ( y ) = E M ( r +1) ( y ) for all y ∈ Y and G ( M ( r ) ; P ) ≥ G ( M ( r +1) ; P ) .

Combining columns with identical signatures. For convenience let k := |Y| . Let b j be the k -dimensional binary vector corresponding to the binary representation of j for j ≤ 2 k -1 . A matrix S ( k ) ∈ { 1 , e ε } k × (2 k -2) is called a Staircase Pattern Matrix [KOV16] if the j th column of S ( k ) is S ( k ) j = ( e ε -1) b j +1 , for j ∈ { 1 , . . . , 2 k -2 } . For example,

Since M (0) is ε -DP , we have that each column of M (0) , namely ( M (0) y → i ) y ∈Y is a conic combination of the columns of S ( k ) .

Claim 12. Let M (0) be an ε -DP randomizer, mapping Y to a finite subset ˆ Y (0) of R . Then there exists an ε -DP randomizer M (1) mapping Y to ˆ Y (1) ⊆ R encoded by ( M y → ˆ y ) y ∈Y , ˆ y ∈ ˆ Y (1) such that:

▷ G ( M (1) ; P ) ≤ G ( M (0) ; P ) for any convex loss g .

▷ E [ M (1) ( y ) | y ] = E [ M (0) ( y ) | y ] .

▷ | ˆ Y| ≤ 2 |Y| .

▷ The vector ( M y → ˆ y ) y ∈Y is a positive multiple of a staircase column, with the staircase column being unique for each ˆ y ∈ ˆ Y (1) .

The proof idea of combining columns of staircase type to potentially decrease loss was shown in [KOV16].

Proof. By ε -DP constraint, the columns of M (0) lie in the cone made by convex combinations of the rays { c, c · e ε } |Y| where c ≥ 0 . Because positive multiples of the staircase columns are specifically these rays, except the ray { c } |Y| which is already in the convex hull, this column of M (0) is a convex combination of positive multiples of the staircase columns.

̸

̸

Let v ˆ y be the columns of M (0) indexed by ˆ Y (0) , which by the above can be written as:

Define M (1) as being supported only at ˆ y j with the vector of probabilities being C j · S ( k ) j . We now prove M (1) has all the desired properties.

▷ (Defines a Mechanism):

▷ (Does not increase loss): This follows by Jensen's inequality and the linearity of expectation:

▷ (Expectation does not change): Because M (0) is unbiased:

Define for each j :

We have showing that M (1) is unbiased.

▷ (Bounded by 2 |Y| and multiple of unique staircase columns): This is clear by construction.

While the finite case is easier to read, the above proof can be done also when the range of M (0) is R and v ˆ y is a vector of absolutely continuous probability distributions. The only change is that sums over ˆ y ∈ ˆ Y (0) become integrals. The projections of v ˆ y onto the staircase columns are continuous maps. Lastly, because a continuous function that is bounded by a function in L 1 is itself in L 1 , all the integrals become well-defined and finite. Therefore, our theorem regarding the structure of the optimal unbiased ε -DP mechanism does not depend on a finiteness condition.

Each row matches the pattern L ∗ U + L ∗ . We now use the ordering of the input and output labels as real numbers to make further deductions.

Claim 13. Suppose |Y| ≥ 2 . For any ε -DP randomizer M (1) obtained via Claim 12, there exists an ε -DP randomizer M (2) mapping Y to ˆ Y ⊆ R encoded by M := ( M y → ˆ y ) y ∈Y , ˆ y ∈ ˆ Y such that:

▷ G ( M (2) ; P ) ≤ G ( M (1) ; P ) for any convex loss g ,

▷ E [ M (2) ( y ) | y ] = E [ M (1) ( y ) | y ] ,

▷ Every row of S M matches the regular expression L ∗ U + L ∗ .

Proof. The only way a row of S M does not match the regular expression L ∗ U + L ∗ is if (i) there is no U present, or (ii) if there is an L between an two U 's. It is easy to see that (i) is not possible because ∑ ˆ y M y → i = 1 for all y ∈ Y , and if one row has no U 's, this would imply no row has any U 's, which is not possible by the uniqueness of the columns if |Y| ≥ 2 , and we know such an M exists.

If (ii) is true, then we can construct M (2) as follows. For any y and ˆ y 1 < ˆ y 2 < ˆ y 3 such that S M (1) ( y, ˆ y 1 ) = S M (1) ( y, ˆ y 3 ) = U and S M (1) ( y, ˆ y 2 ) = L , consider a perturbation (for a small enough η > 0 ), where we set

This choice ensures that M (2) remains an unbiased randomizer. By Jensen's inequality, due to convexity of g , it holds that G ( M (2) ; P ) < G ( M (1) ; P ) . We can keep repeating these steps, in addition to Claim 12 if necessary, till we arrive at M (2) such that each row of S M (2) matches the regular expression L ∗ U + L ∗ .

Set of U 's in any row cannot be a subset of the set of U 's in another, and are 'moving forward'.

̸

Claim 14. For an ε -DP unbiased randomizer M (2) obtained via Claim 13, let T ( y ) ⊆ ˆ Y be defined as T ( y ) := { ˆ y : S M ( y, ˆ y ) = U } . Then, for all y = y ′ , it holds that T ( y ) ̸⊂ T ( y ′ ) , and moreover if y < y ′ , then min T ( y ) < min T ( y ′ ) and max T ( y ) < max T ( y ′ ) .

Proof. If T ( y ) ⊂ T ( y ′ ) , then it holds that M y → ˆ y ≤ M y ′ → ˆ y with the inequality being strict for some ˆ y . Thus, we have ∑ ˆ y M y → ˆ y < ∑ ˆ y M y ′ → ˆ y = 1 , which is a contradiction.

Given that both T ( y ) and T ( y ′ ) are contiguous subsets of ˆ Y , it follows that one of following holds:

▷ min T ( y ) < min T ( y ′ ) and max T ( y ) < max T ( y ′ ) , or

▷ min T ( y ) > min T ( y ′ ) and max T ( y ) > max T ( y ′ ) .

However, if y < y ′ , the latter is not possible because in that case, we would have y ′ = E ˆ y ∼M (2) ( y ′ ) < E ˆ y ∼M (2) ( y ) = y , which is a contradiction.

Putting together the claims. Finally, we put together Claims 12 to 14 to prove Claim 11.

Proof of Claim 11. Given any ε -DP unbiased randomizer M , we apply Claims 12 and 13 to obtain the ε -DP unbiased randomizer M (2) , which satisfies the conditions in Claim 14. Consider the signature matrix S M corresponding to M (2) , with the row indices sorted in increasing order of Y .

If a column has a signature with an L between two U 's, this would contradict Claim 14, since the U 's only 'move forward'.

Additionally, for the signatures of column ˆ y 1 < ˆ y 2 , the first U of column ˆ y 2 cannot come before the first U of column ˆ y 1 , as this would also contradict the claim of the U 's moving forward. Similarly, the last U of column ˆ y 1 cannot come after the last U of column ˆ y 2 . Finally, the columns must be unique, since each column is a unique staircase matrix vector. Thus, each column of S M matches the regular expression L ∗ U + L ∗ .

C Optimal Unbiased Randomizers with Approximate Prior

We elaborate on the approach of splitting privacy budget for estimating the prior and for generating noisy labels as described in Section 3.

To privately estimate the prior, we use the Laplace mechanism. The Laplace distribution with scale parameter b , denoted by Lap( b ) , is the distribution supported on R whose probability density function is 1 2 b exp( -| x | /b ) . The Laplace mechanism is presented in Algorithm 4.

It is well-known (e.g., [DMNS06]) that this mechanism satisfies ε -DP . It is also well-known that this yields an approximation of the true distribution up to small total variation distance (e.g., [DHS15]).

In [GKK + 23], it is argued that the best choice of ( ε 1 , ε 2 ) that minimizes the excess noisy label loss achieved by randomizer computed in Algorithm 3 over the optimal unbiased randomizer computed using the true prior and privacy parameter ε , is given as ε 1 = √ k/n . (We follow the same budget splitting method in our experiments.)

Algorithm 4 Laplace Mechanism for Estimating Probability Distribution M Lap ε .

Parameters: Privacy parameter ε ≥ 0 . Input: Labels y 1 , . . . , y n ∈ Y . Output: A probability distribution P ′ over Y . for y ∈ Y do h y ← number of i such that y i = y h ′ y ← max { h y +Lap(2 /ε ) , 0 } return Distribution P ′ over Y such that p ′ y = h ′ y ∑ y ∈Y h ′ y

D Excess Loss of SGD with Biased Gradient Oracles

Consider a convex objective L ( · ) over R D , for which we have a gradient oracle, that given w , returns a stochastic estimate g ( w ) of ∇L ( w ) . We say that the gradient oracle has bias α and variance σ 2 if g ( w ) = ∇L ( w ) + ζ ( w ) such that ∥ E ζ ( w ) ∥ ≤ α and E ∥ ζ ( w ) -E ζ ( w ) ∥ 2 ≤ σ 2 holds for all w . When optimizing over a convex set K ⊆ R D , projected GD with step size η is defined as iteratively performing w t +1 ← Π K ( w t -ηg ( w t )) , where Π K ( · ) is the projection onto K . We recall the following guarantee on the expected excess loss using a standard analysis (see [Haz22]).

Lemma 15. For a L -Lipschitz loss function, and a gradient oracle with bias α and variance σ 2 , projected GD over a set K with diameter R , with step size η = R √ (( L + α ) 2 + σ 2 ) T achieves

In particular, if α = 0 , we get

The dependence on the bias is essentially tight, for any first order method. Consider the loss function L ( w ) = 1 2 αw defined over the domain K = [0 , R ] . However, if the gradient oracle is allowed to have a bias of magnitude α , it is impossible using any first order algorithm to distinguish between the gradients of L and that of L ′ ( w ) := -1 2 αw . Note that both L and L ′ are L -Lipschitz for L ≥ 1 2 α . While L is minimized at w = 0 , L ′ is minimized at w = R . For any w ∈ K , min {L ( w ) -L (0) , L ′ ( w ) -L ′ ( R ) } ≥ 1 4 αR .

Thus, with access to gradients with bias α , it is impossible for any first order method to achieve an excess loss that is smaller than Ω( αR ) , whereas, with access to gradients with zero bias and variance σ 2 , it is possible to achieve an arbitrarily small excess loss using sufficient number of steps of SGD.

E Noisy Label Loss Bound from Discretization

Here we prove Lemma 8, restated below for convenience.

Lemma 8. Let M be the optimal unbiased randomizer with ˆ Y = [ L, U ] , and let M ∆ be the optimal unbiased randomizer with ˆ Y = { L, L + ∆ , . . . , U -∆ , U } . If g (ˆ y, y ) is K -Lipschitz in ˆ y , then G ( M ∆ ; P ) ≤ G ( M ; P ) + K ∆ .

Proof. Given any unbiased mechanism M , we construct a mechanism M u supported on ˆ Y ′ := { L, L +∆ , . . . , U -∆ , U ) by applying 'unbiased randomized rounding' URR ˆ Y ′ to the output of M , i.e., M u ( y ) := URR ˆ Y ′ ( M ( y )) .

For any ˆ y ∈ [ L, U ] such that ˆ y 1 ≤ ˆ y ≤ ˆ y 2 for ˆ y 1 , ˆ y 2 being consecutive elements of ˆ Y ′ , URR ˆ Y ′ ( y ) returns ˆ y ′ drawn as ˆ y 1 with probability ˆ y 2 -ˆ y ˆ y 2 -ˆ y 1 and ˆ y 2 with probability ˆ y -ˆ y 1 ˆ y 2 -ˆ y 1 . Observe that E [ URR ˆ Y ′ (ˆ y )] = ˆ y and | URR ˆ Y ′ (ˆ y ) -ˆ y | ≤ ∆ with probability 1 .

Thus, we have that E [ M u ( y )] = E [ URR ˆ Y ′ ( M ( y ))] = E [ M ( y )] = y , and hence M u is also unbiased. Moreover,

where the last line follows from K -Lipschitzness of g . Since M ∆ is the optimal unbiased randomizer with output labels ˆ Y ′ , we have that G ( M ∆ ; P ) ≤ G ( M u ; P ) ≤ G ( M ; P ) + K ∆ .

F DP Mechanisms Definitions

In this section, we recall the definition of various DP notions that we use throughout the paper.

Definition 16 (Global Sensitivity) . Let f be a function taking as input a dataset and returning as output a vector in R d . Then, the global sensitivity ∆( f ) of f is defined as the maximum, over all pairs ( X,X ′ ) of adjacent datasets, of || f ( X ) -f ( X ′ ) || 1 .

The (discrete) Laplace distribution with scale parameter b > 0 is denoted by DLap( b ) . Its probability mass function is given by p ( y ) ∝ exp( -| y | /b ) for any y ∈ Z .

Definition 17 (Discrete Laplace Mechanism) . Let f be a function taking as input a dataset X and returning as output a vector in Z d . The discrete Laplace mechanism applied to f on input X returns f ( X ) + ( Y 1 , . . . , Y d ) where each Y i is sampled i.i.d. from DLap(∆( f ) /ε ) . The output of the mechanism is ε -DP .

Next, recall that the (continuous) Laplace distribution Lap( b ) with scale parameter b > 0 has probability density function given by h ( y ) ∝ exp( -| y | /b ) for any y ∈ R .

Definition 18 (Continuous Laplace Mechanism, [DMNS06]) . Let f be a function taking as input a dataset X and returning as output a vector in R d . The continuous Laplace mechanism applied to f on input X returns f ( X ) + ( Y 1 , . . . , Y d ) where each Y i is sampled i.i.d. from Lap(∆( f ) /ε ) . The output of the mechanism is ε -DP .

We next define the discrete and continuous versions of the staircase mechanism [GV14].

Definition 19 (Discrete Staircase Distribution) . Fix ∆ ≥ 2 . The discrete staircase distribution is parameterized by an integer 1 ≤ r ≤ ∆ and has probability mass function given by:

where

Let f be a function taking as input a dataset X and returning as output a scalar in Z . The discrete staircase mechanism applied to f on input X returns f ( X ) + Y where Y is sampled from the discrete staircase distribution given in (3).

Definition 20 (Continuous Staircase Distribution) . The continuous staircase distribution is parameterized by γ ∈ (0 , 1) and has probability density function given by:

where

Let f be a function taking as input a dataset X and returning as output a scalar in R . The continuous staircase mechanism applied to f on input X returns f ( X ) + Y where Y is sampled from the continuous staircase distribution given in (4).

Definition 21 (Randomized Response, [War65]) . Let ε ≥ 0 , and q be a positive integer. The randomized response mechanism with parameters ε and q (denoted by RR ε,q ) takes as input y ∈ { 1 , . . . , q } and returns ˆ y ∼ ˆ Y , where the random variable ˆ Y is distributed as:

The output of RR ε,q is ε -DP .

Definition 22 (Randomized Response on Bins, [GKK + 23]) . Let ε > 0 , for map Φ : Y → ˆ Y , RR -on -Bins Φ ε is defined as the mechanism that on input y samples ˆ y ∼ ˆ Y , where the random variable ˆ Y is distributed as

Definition 23 (Debiased Randomized Response) . For ε > 0 , the ε -debiased randomized response ( ε -dbRR ) operates by performing randomized response on (Φ( y )) y ∈Y , where

namely, the mechanism on input y samples ˆ y ∼ ˆ Y , where the random variable ˆ Y is distributed as

Finally, we prove Proposition 7, restated below for convenience.

Proposition 7. If ˆ Y contains just the smallest and largest values among the outputs of ε -dbRR , the LP in ComputeOptUnbiasedRand ε ( P, ˆ Y ) is feasible.

Proof. Let y 0 = min( Y ) and y 1 = max( Y ) . The smallest and largest values among the outputs of ε -dbRR are given as

Consider the mechanism M such that for any input y ∈ Y it holds that

Note M is unbiased, namely E [ M ( y )] = y for all y ∈ Y . We show

̸

̸

̸

where the last step follows because ∑ y = y 0 ( y 1 -y ) ≥ 0 and for a, b, c > 0 it holds that ( a + b ) / ( a + c ) ≤ b/c . Similarly, it holds that max y Pr[ M ( y ) = ˆ y 1 ] / min y Pr[ M ( y ) = ˆ y 1 ] ≤ e ε .

G Additional Details of Experiments

All our experiments were performed using NVidia P100 GPUs.

G.1 Hyperparameter Details

Criteo Sponsored Search Conversion. We use a neural network that takes as input concatenation of floating point features, as well as categorical features using an embedding table of dimension four for each. The neural network had two hidden layers of dimensions 64 and 32 respectively. The training was performed on a random 80% of the dataset using RMSProp algorithm using the squared loss objective, with learning rate of 10 -4 , ℓ 2 -regularization of 10 -4 , batch size of 1 , 024 for 50 epochs. The remaining 20% of the dataset was used to report the test loss.

This architecture choice was chosen by performing a hyperparameter search over various choices, and this choice seemed to give the best results for all the randomizers considered.

US Census. We use a neural network that takes as input concatenation of floating point features, as well as categorical features using an embedding table of dimension eight for each. The neural network had two hidden layers of dimensions 128 and 64 respectively. The training was performed on a random 80% of the dataset using RMSProp algorithm using the squared loss objective, with ℓ 2 -regularization of 10 -4 , batch size of 8 , 192 . A varying learning rate in { 10 -2 , 10 -3 , 10 -4 } and a varying number of epochs in { 50 , 200 } were used, and the best test loss was reported for training with each randomizer. The remaining 20% of the dataset was used to report the test loss.

G.2 Early Stopping

In training on the AppAds dataset, we found that the training would often be unstable, with the training loss blowing up after several steps, especially for smaller values of ε , which corresponded to faster blow up. We used early stopping, keeping track of intermediate states, to select the best model that minimizes the training loss, and used this to report the test loss.

G.3 Complexity of Computing the Mechanisms

Even though the wall clock time for computing the optimal unbiased randomizer using an LP solver is significantly larger than that of computing the optimal RR -on -Bins randomizer (for which there is a highly efficient dynamic programming algorithm [GKK + 23]), this is still orders of magnitude smaller than that of ML model training. We note that while the noisy label loss decreases as ∆ in Algorithm 2 is made smaller, this causes the computational cost of solving the LP to increase. This trade-off is demonstrated in the following table, which shows the running time of the LP for the unbiased randomizer, the noisy label loss and the final test loss, for different mesh sizes (parameter n in Algorithm 2) for ε = 1 on the US Census dataset we study (prediction of number of weeks worked in { 1 , . . . , 52 } ).

The test loss is quite similar for various mesh sizes, even though the noisy label loss does improve slightly with finer discretization. This suggests that the unbiasedness was key to the improvements over RR -on -Bins and the discretization of the output set does not hurt performance as much.

The computation time increases considerably when the number of input labels is large, e.g., in the Criteo Search Sponsored Conversion Logs dataset, where there were 401 input labels { 0 , . . . , 400 } .

Peer reviews:
comments: SUMMARY:
This paper investigates the bias of the state-of-the-art label-differential privacy (label-DP) mechanism proposed by Ghazi et al. (2023) and proposes bias-corrected randomizers achieved through minimizing of a constrained linear programming approach. The proposed label-DP mechanisms demonstrate lower mean squared errors empirically by carefully tuning the hyperparameters in deep learning.

STRENGTHS:
1. The main result of this paper is intriguing and original. The paper provides a compelling example illustrating the bias present in the state-of-the-art label-DP mechanism and proposes a new mechanism to address this bias. Additionally, the authors thoroughly investigate the empirical performance of the proposed algorithm and show that it outperforms the state-of-the-art.

2. This paper is well-written. The authors effectively communicate their contributions and main findings in a clear and concise manner. Furthermore, the organization of the paper is well-structured.

WEAKNESSES:
1. The proposed algorithm introduces extra computational cost. In order to obtain the unbiased randomizer, a constrained linear programming (LP) problem needs to be solved, which introduces extra computational cost. Although the authors demonstrate the feasibility of the LP, the term "feasible" left me uncertain, and it would be more informative to explicitly state the computational complexity involved.

 2. The authors should consider the potential privacy implications of hyperparameter tuning. In the experimental section, they mention the careful tuning of hyperparameters. However, if the validation set used for this tuning procedure is not label DP, there is a risk of privacy leakage.

QUESTIONS:
See the weakness part.

LIMITATIONS:
Yes
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a differentially private algorithm for regression problems. The algorithm protects the privacy of the labels (\"label DP\"), in contrast to the entire example. The canonical application of this is digital advertising, where the label might be transaction data from a separate website. Furthermore, the algorithm operates in what [GKK+23] term the \"feature-oblivious\" model, where a private algorithm, operating solely on the labels, sends a message to the \"features party,\" who then uses these together to learn a model.\n\n[GKK+23] studied a label randomizer that aims to minimize the difference between the true and noisy labels. This work studies a unbiased randomizers. In addition to experiments, the paper provides some theoretical evidence that unbiased estimators, even if they have high variance, may be superior.\n\nThe private algorithm (which, again, only has access to the labels) proceeds in two steps. First, it uses a private histogram to estimate a prior over the labels. It then solves a linear program, the output of which is our label randomizer. The LP minimizes the expected difference between the true and noisy labels, subject to privacy, unbiasedness, and normalization constraints.\n\nAn important technical question is the randomizer's output space. Let $\\mathcal{Y}\\subseteq \\mathbb{R}$ be the label space and $\\hat{\\mathcal{Y}}\\subseteq \\mathbb{R}$ the set of possible outputs of the randomizer. The solution to the LP has $|\\mathcal{Y}|\\times|\\hat{\\mathcal{Y}}|$ entries, representing a probability distribution over $\\hat{\\mathcal{Y}}$ for each entry in $\\mathcal{Y}$. Thus it is clear that this approach demands both sets be finite (and of modest size, to solve the LP). What is less clear, due to the unbiasedness constraint, is what $\\hat{\\mathcal{Y}}$ should be. Note that if $\\min \\mathcal{Y} =0 $ and $\\hat{\\mathcal{Y}}=\\mathcal{Y}$, then unbiasedness demands we map $0\\to 0$ with probability 1, violating privacy. Thus the endpoints of $\\hat{\\mathcal{Y}}$ must exceed those of $\\mathcal{Y}$. The authors set the endpoints of $\\hat{\\mathcal{Y}}$ so that (provably) the LP is feasible. They \"fill in\" the rest of $\\hat{\\mathcal{Y}}$ with a grid, as finely spaced as their computational constraints allow.\n\nFor a fixed $\\hat{\\mathcal{Y}}$ and prior on $\\mathcal{Y}$, the LP finds the unbiased private randomizer with the lowest expected difference (or loss) in labels. Experiments demonstrate improvements over prior work on three data sets.\n\nI noticed that parts of the submission (introducing the label DP recipe, describing data sets, and reviewing related work) had substantial overlap with text from GKK+23. After discussion with my chair, I have not used this information in my evaluation of the paper.\n\nSTRENGTHS:\nWithout unbiasedness constraints, GKK+23 find the best randomizer is of a form they call \"RR-on-Bins.\" The authors nicely sum up their core innovation: \"the addition of an unbiasedness constraint to the linear program leads to solutions to the LP that (i) are not RR-on-Bins solutions, (ii) can have substantially higher variance than RR-on-Bins, and (iii) nevertheless have a much lower train and test error due to the reduction in bias.\" This is a clear observation that allows them to move past prior work.\n\nI buy that this is a practical problem, that the feature-oblivious model is useful.\n\nTheir approach does seem to significantly improve on that of GKK+23 on the data sets they tested. Their experimental results are complemented by their formal claims (Theorem 6 and Proposition 7) about the output label space of randomizers.\n\nWith minor exceptions, I found the presentation very clear throughout.\n\nWEAKNESSES:\nIn light of the work of GKK+23, this paper has limited novelty. Originality is also a serious weakness: GKK+23 point out that \"our noising mechanism typically introduces a bias; mitigating it, say by adding unbiasedness constraints into the LP, is an interesting direction.\"\n\nThe title says the work finds \"optimal\" unbiased randomizers, but that optimality only holds once the choice of output space is selected. Theorem 6 (there is an optimal unbiased randomizer with at most $2|\\mathcal{Y}|$ labels) and Proposition 7 (selecting endpoints to ensure feasibility) are good steps, but do not get us all the way there. As far as I can tell, it remains possible that some other scheme generates better unbiased randomizers, at least for some priors.\n\nThe paper's focus is on feature-oblivious algorithms, but I would have liked to see a comparison with other label-DP algorithms that solve this problem. How much are we giving up by moving to feature-oblivious?\n\nQUESTIONS:\nIs there evidence (even informal) that this discretization approach is close to optimal? For instance, can we rule out that the LP's objective is highly sensitive to the choice of endpoints (in the regime considered)?\n\nCan you briefly sketch out what you feel are the key innovations beyond GKK+23?\n\nEstimating the prior requires some privacy budget for each bin. Do you expect that, as $|\\mathcal{Y}|$ grows, another approach will perform better than yours?\n\nLIMITATIONS:\nThe algorithm operates in the feature-oblivious model; other label-DP algorithms might perform better in different settings.\n\nThe algorithm assumes prior knowledge of $\\mathcal{Y}$; it is not always clear where this information comes from.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies the regression problems under label differential privacy (DP). It proposes a novel randomizer that generates high-quality DP labels which can be used to train a regressor. The proposed randomized mechanism is sound and the experiments on various benchmark datasets and different privacy budgets demonstrated the improvements over the baselines. \n\nOverall I think the contribution of the paper is significant, but the proposed mechanism seems to be limited to the case where the labels are discrete (not continuous). Based on that I recommend a weak accept for this paper.\n\nSTRENGTHS:\n1. The contribution is significant and the idea is novel. The paper proposes a novel randomized mechanism that can generate unbiased DP labels which helps to train an unbiased regressor. \n\n2. The paper conducts extensive experiments on different benchmark datasets and different epsilon and shows that a noticeable reduction of mean squared error  when using the proposed mechanism over the previous works.\n\nWEAKNESSES:\n1. The paper focuses on optimal mechanism for epsilon-DP and this topic is pretty studied in some previous work such as  the stair-case mechanism. It would be great if there is any discussion about extension to (epsilon, delta)-DP. \n\n2. The settings are limited to the discrete (but not continuous) choice of labels which only applies for ordinal regression.\n\n3. The authors did not attach the codes so it might be hard to reproduce the experiments.\n\nQUESTIONS:\nCan the authors explain more why the proposed mechanism is better than the optimal stair-case mechanism for example if we look at Figure 4.a , especially even when epsilon is large? I used the staircase mechanism before and this turned out to be better than many baseline mechanisms when epsilon is large enough.\n\nLIMITATIONS:\nThe paper  discusses clearly the limitations of their proposed mechanism compared to the baselines in the Conclusion section.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

comments: SUMMARY:
This paper proposes a new family of DP label randomizers for regression models. They show that these randomizers improve the MSE of the training set at the expense of the noisy label loss, indicating an alternate bias-variance tradeoff to other similar works.

STRENGTHS:
The strength of this paper is the theoretical and empirical evidence of the randomizer. It is evident that it outperforms the unbiased randomizers by significant margins in the test error, but this comes at the cost of the noisy label loss.

WEAKNESSES:
However, it would have been helpful to include what this tradeoff means practically and its implications.

QUESTIONS:
Overall, I think the paper is well-written and has enough experiments to validate its conjectures. The novelty of the paper is in its theoretical results and improved guarantees.

Some points/comments that could be improved are: 
$\hat{y}$, the noisy label, is never defined in Section 3? 
The end of Section 3, particularly the observations for $\epsilon$ are a bit unwieldy to read -- this would probably be better presented with a table or figure
Why is the computational complexity not compared between the unbiased and biased randomizers? This would help understand what tradeoffs of this method are
It would be nice to see an analysis of why the method works better on one dataset versus the other
In Section 4.3, it is mentioned that for smaller $\epsilon$’s one can see the standard error increase -- is this only true for these types of algorithms or simpler models as well?

LIMITATIONS:
Yes
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-27