Title: Counting Distinct Elements Under Person-Level Differential Privacy
Venue: NeurIPS 2023
Accepted: yes
Keywords: differential privacy

user-level privacy

person-level privacy

sensitivity
Abstract: We study the problem of counting the number of distinct elements in a dataset subject to the constraint of differential privacy. 
We consider the challenging setting of person-level DP (a.k.a. user-level DP) where each person may contribute an unbounded number of items and hence the sensitivity is unbounded.

Our approach is to compute a bounded-sensitivity version of this query, which reduces to solving a max-flow problem. 
The sensitivity bound is optimized to balance the noise we must add to privatize the answer against the error of the approximation of the bounded-sensitivity query to the true number of unique elements.

Counting Distinct Elements Under Person-Level Differential Privacy

Abstract

We study the problem of counting the number of distinct elements in a dataset subject to the constraint of differential privacy. We consider the challenging setting of person-level DP (a.k.a. user-level DP) where each person may contribute an unbounded number of items and hence the sensitivity is unbounded.

Our approach is to compute a bounded-sensitivity version of this query, which reduces to solving a max-flow problem. The sensitivity bound is optimized to balance the noise we must add to privatize the answer against the error of the approximation of the bounded-sensitivity query to the true number of unique elements.

1 Introduction

An elementary data analysis task is to count the number of distinct elements occurring in a dataset. The dataset may contain private data and even simple statistics can be combined to leak sensitive information about people [DN03]. Our goal is to release (an approximation to) this count in a way that ensures the privacy of the people who contributed their data. As a motivating example, consider a collection of internet browsing histories, in which case the goal is to compute the total number of websites that have been visited by at least one person.

Differential privacy (DP) [DMNS06] is a formal privacy standard. The simplest method for ensuring DPis to add noise (from either a Laplace or Gaussian distribution) to the true answer, where the scale of the noise corresponds to the sensitivity of the true answer - i.e., how much one person's data can change the true value.

If each person contributes a single element to the dataset, then the sensitivity of the number of unique elements is one. However, a person may contribute multiple elements to the dataset and our goal is to ensure privacy for all of these contributions simultaneously. That is, we seek to provide person-level DP (a.k.a. user-level DP 2 ).

This is the problem we study: We have a dataset D = ( u 1 , u 2 , · · · , u n ) of person records. Each person i ∈ [ n ] contributes a finite dataset u i ∈ Ω ∗ , where Ω is some (possibly infinite) universe of potential elements (e.g., all finite-length binary strings) and Ω ∗ := ⋃ glyph[lscript] ∈ N Ω glyph[lscript] denotes all subsets of Ω of finite size. Informally, our goal is to compute the number of unique elements

Thomas Steinke ∗

in a way that preserves differential privacy. A priori, the sensitivity of this quantity is infinite, as a single person can contribute an unbounded number of unique elements.

In particular, it is not possible to output a meaningful upper bound on the number of distinct elements subject to differential privacy. This is because a single person could increase the number of distinct elements arbitrarily and differential privacy requires us to hide this contribution. It follows that we cannot output a differentially private unbiased estimate of the number of distinct elements with finite variance. However, it is possible to output a lower bound. Thus our formal goal is to compute a high-confidence lower bound on the number of distinct elements that is as large as possible and which is computed in a differentially private manner.

1.1 Our Contributions

Given a dataset D = ( u 1 , · · · , u n ) ∈ (Ω ∗ ) n and an integer glyph[lscript] ≥ 1 , we define

That is, DC( D ; glyph[lscript] ) is the number of distinct elements if we restrict each person's contribution to glyph[lscript] elements. We take the maximum over all possible restrictions.

It is immediate that DC( D ; glyph[lscript] ) ≤ DC( D ) for all glyph[lscript] ≥ 1 . Thus we obtain a lower bound on the true number of unique elements. The advantage of DC( D ; glyph[lscript] ) is that its sensitivity is bounded by glyph[lscript] (see Lemma A.1 for a precise statement) and, hence, we can estimate it in a differentially private manner. Specifically,

defines an ε -DP algorithm M glyph[lscript],ε : (Ω ∗ ) n → R , where Lap( b ) denotes Laplace noise scaled to have mean 0 and variance 2 b 2 . This forms the basis of our algorithm. Two challenges remain: Setting the sensitivity parameter glyph[lscript] and computing DC( D ; glyph[lscript] ) efficiently.

To obtain a high-confidence lower bound on the true distinct count, we must compensate for the Laplace noise, which may inflate the reported value. We can obtain such a lower bound from M glyph[lscript] ( D ) using the cumulative distribution function (CDF) of the Laplace distribution: That is, ∀ b > 0 ∀ β ∈

Choosing the sensitivity parameter glyph[lscript] . Any choice of glyph[lscript] ≥ 1 gives us a lower bound: DC( D ; glyph[lscript] ) ≤ DC( D ) . Since ∀ D lim glyph[lscript] →∞ DC( D ; glyph[lscript] ) = DC( D ) , this lower bound can be arbitrarily tight. However, the larger glyph[lscript] is, the larger the sensitivity of DC( D ; glyph[lscript] ) is. That is, the noise we add scales linearly with glyph[lscript] .

Thus there is a bias-variance tradeoff in the choice of glyph[lscript] . To make this precise, suppose we want a lower bound on DC( D ) with confidence 1 -β ∈ [ 1 2 , 1) , as in Equation (4). To obtain the tightest possible lower bound with confidence 1 -β , we want glyph[lscript] to maximize the expectation

We can use the exponential mechanism [MT07] to privately select glyph[lscript] that approximately maximizes q ( D ; glyph[lscript] ) . However, directly applying the exponential mechanism is problematic because each score has a different sensitivity - the sensitivity of q ( · ; glyph[lscript] ) is glyph[lscript] . Instead, we apply the Generalized Exponential Mechanism (GEM) of Raskhodnikova and Smith [RS15] (see Algorithm 3). Note that we assume some a priori maximum value of glyph[lscript] is supplied to the algorithm; this is glyph[lscript] max .

Our main algorithm attains the following guarantees.

Theorem 1.1 (Theoretical Guarantees of Our Algorithm) . Let ε > 0 and β ∈ (0 , 1 2 ) and glyph[lscript] max ∈ N . Define M : (Ω ∗ ) ∗ → N × R to be M ( D ) = DPDISTINCTCOUNT ( D ; glyph[lscript] max , ε, β ) from Algorithm 1. Then M satisfies all of the following properties.

Privacy: M is ε -differentially private.

Lower bound: For all D ∈ (Ω ∗ ) n ,

Upper bound: For all D ∈ (Ω ∗ ) n ,

Computational efficiency: M ( D ) has running time O ( | D | 1 . 5 · glyph[lscript] 2 max ) , where | D | := ∑ i | u i | .

The upper bound guarantee (7) is somewhat difficult to interpret. However, if the number of items per person is bounded by glyph[lscript] ∗ , then we can offer a clean guarantee: If D = ( u 1 , · · · , u n ) ∈ (Ω ∗ ) n satisfies max i ∈ [ n ] | u i | ≤ glyph[lscript] ∗ ≤ glyph[lscript] max , then combining the upper and lower bounds of Theorem 1.1 gives

Note that glyph[lscript] ∗ is not assumed to be known to the algorithm, but the accuracy guarantee is able to adapt. We only assume glyph[lscript] ∗ ≤ glyph[lscript] max , where glyph[lscript] max is the maximal sensitivity considered by the algorithm.

In addition to proving the above theoretical guarantees, we perform an experimental evaluation of our algorithm.

Algorithm 1 Distinct Count Algorithm

Efficient computation. The main computational task for our algorithm is to compute DC( D ; glyph[lscript] ) . By definition (2), this is an optimization problem. For each person i ∈ [ n ] , we must select a subset v i of that person's data u i of size at most glyph[lscript] so as to maximize the size of the union of the subsets ∣ ∣ ∣ ⋃ i ∈ [ n ] v i ∣ ∣ ∣ .

We can view the dataset D = ( u 1 , · · · , u n ) ∈ (Ω ∗ ) n as a bipartite graph. On one side we have the n people and on the other side we have the elements of the data universe Ω . 3 There is an edge between i ∈ [ n ] and x ∈ Ω if and only if x ∈ u i .

We can reduce computing DC( D ; glyph[lscript] ) to a max-flow problem: Each edge in the bipartite graph has capacity one. We add a source vertex s which is connected to each person i ∈ [ n ] by an edge with capacity glyph[lscript] . Finally we add a sink t that is connected to each x ∈ Ω by an edge with capacity 1 . The max flow through this graph is precisely DC( D ; glyph[lscript] ) .

Alternatively, we can reduce computing DC( D ; glyph[lscript] ) to bipartite maximum matching. For glyph[lscript] = 1 , DC( D ; 1) is exactly the maximum cardinality of a matching in the bipartite graph described above. For glyph[lscript] ≥ 2 , we simply create glyph[lscript] copies of each person vertex i ∈ [ n ] and then DC( D ; glyph[lscript] ) is the maximum cardinality of a matching in this new bipartite graph. 4

Using this reduction, standard algorithms for bipartite maximum matching [HK73; Kar73] allow us to compute DC( D ; glyph[lscript] ) with O ( | D | 1 . 5 · glyph[lscript] ) operations. We must repeat this computation for each glyph[lscript] ∈ [ glyph[lscript] max ] .

glyph[negationslash]

Linear-time algorithm. Our algorithm above is polynomial-time. However, for many applications the dataset size | D | is enormous. Thus we also propose a linear-time variant of our algorithm. However, we must trade accuracy for efficiency.

There are two key ideas that differentiate our linear-time algorithm (Algorithm 2) from our first algorithm (Algorithm 1) above: First, we compute a maxim al bipartite matching instead of a maxim um bipartite matching. 5 This can be done using a linear-time greedy algorithm and gives a 2-approximation to the maximum matching. (Experimentally we find that the approximation is better than a factor of 2.) Second, rather than repeating the computation from scratch for each glyph[lscript] ∈ [ glyph[lscript] max ] , we incrementally update our a maximal matching while increasing glyph[lscript] . The main challenge here is ensuring that the approximation to DC( D ; glyph[lscript] ) has low sensitivity - i.e., we must ensure that our approximation algorithm doesn't inflate the sensitivity. Note that DC( D ; glyph[lscript] ) having low sensitivity does not automatically ensure that the approximation to it has low sensitivity.

DPAPPROXDISTINCTCOUNT ( D ; glyph[lscript] max , ε, β ) from Algorithm 2. Then ̂ M satisfies all of the following properties.

Privacy: ̂ M is ε -differentially private.

Lower bound: For all D ∈ (Ω ∗ ) n ,

Upper bound: If D = ( u 1 , · · · , u n ) ∈ (Ω ∗ ) n satisfies max i ∈ [ n ] | u i | ≤ glyph[lscript] ∗ ≤ glyph[lscript] max , then

Computational efficiency: M ( D ) has running time O ( | D | + glyph[lscript] max log glyph[lscript] max ) , where | D | := ∑ i | u i | .

The factor 1 2 in the upper bound guarantee (10) is the main loss compared to Theorem 1.1. (The win is O ( | D | ) runtime.) This is a worst-case bound and our experimental result show that for realistic data the performance gap is not so bad.

The proofs of Theorems 1.1 and 1.2 are in Appendix A.

2 Related Work

Counting the number of distinct elements in a collection is one of the most fundamental database computations. This is supported as the COUNT(DISTINCT ...) operation in SQL. Hence, unsurprisingly, the problem of computing the number of unique elements in a differentially private way has been extensively investigated.

In the case where we assume each person contributes only one element (a.k.a. event-level privacy or item-level privacy), the number of distinct elements has sensitivity 1 and, hence, we can simply use Laplace (or Gaussian) noise addition to release. However, it may not be possible to compute the number of distinct elements exactly due to space, communication, or trust constraints (e.g. in the local model of DP [KLNRS11]).

Most efforts have been focused on creating differentially private algorithms for counting distinct elements under space constraints (and assuming each person contributes a single element). To save space, we wish to compute a small summary of the dataset (called a sketch) that allows us to estimate the number of distinct elements and which can be updated as more elements are added. Smith, Song, and Thakurta [SST20] proved that a variant of the Flajolet-Martin sketch is private and Pagh and Stausholm [PS20] analyzed a sketch over the binary finite field. Dickens, Thaler, and Ting [DTT22] proved a general privacy result for order-invariant cardinality estimators. Hehir, Ting, and Cormode [HTC23] provided a mergeable private sketch (i.e. two sketches can be combined to obtain a sketch of the union of the two datasets). In contrast, Desfontaines, Lochbihler, and Basin [DLB19] proved an impossibility result for mergeable sketches, which shows that privacy or accuracy must degrade as we merge sketches.

0

20

40

60

80

100

200

400

600

800

1

,

000

1

,

200

1

,

400

Person Contribution Bound

Distinct Count

Amazon Fashion

0

20

40

60

80

100

1

2

3

·

10

4

Person Contribution Bound

0

20

40

60

80

100

0

.

2

0

.

4

0

.

6

0

.

8

1

·

10

5

Person Contribution Bound

Distinct Count

Reddit

0

5

10

15

20

25

30

0

.

2

0

.

4

0

.

6

0

.

8

1

·

10

5

Person Contribution Bound

IMDB

true value

matching algorithm

greedy algorithm

sampling algorithm

Counting unique elements has been considered in the pan-private streaming setting [DNPRY10] (the aforementioned algorithms also work in the pan-private setting) and in the continual release streaming setting [GKNM23]. (In the continual release setting the approximate count is continually updated, while in the pan-private setting the approximate count is only revealed once, but at an unknown point in time.) Kreuter, Wright, Skvortsov, Mirisola, and Wang [KWSMW20] give private algorithms for counting distinct elements in the setting of secure multiparty computation. In the local and shuffle models, the only known results are communication complexity bounds [CGKM21].

Aclosely related problem is that of identifying as many elements as possible (rather than just counting them); this is known as 'partition selection,' 'set union,' or 'key selection' [SDH23; DVGM22; KKMN09; CWG22; RCR22; GGKSSY20; ZDKSTMAS23]. Note that, by design, DP prevents us from identifying elements that only appear once in the dataset, or only a few times. Thus we can only output items that appear frequently.

The most closely related work to ours is that of Dong, Fang, Yi, Tao, and Machanavajjhala [DFYTM22] and Fang, Dong, and Yi [FDY22]. These papers present two different algorithms for privately approximating the distinct count (and other statistics). We discuss these below and present an experimental comparison in Table 2. We also remark that both papers prove instance optimality guarantees for their algorithms.

5

10

15

20

25

30

1

,

430

1

,

440

1

,

450

1

,

460

ε

Distinct Count

Amazon Fashion

5

10

15

20

25

30

3

.

6

3

.

62

3

.

64

3

.

66

3

.

68

3

.

7

·

10

4

ε

5

10

15

20

25

30

1

.

03

1

.

03

1

.

03

1

.

03

·

10

5

ε

Distinct Count

Reddit

5

10

15

20

25

30

9

.

86

9

.

87

9

.

87

9

.

88

9

.

88

·

10

4

ε

IMDB

true value

matching algorithm

greedy algorithm

sampling algorithm

shifted inverse algorithm

Most similar to our algorithm is the Race-to-the-Top (R2T) algorithm [DFYTM22]; R2T is a generic framework and the original paper did not specifically consider counting distinct elements, but the approach can easily be applied to DC( D ; glyph[lscript] ) . While we use the generalized exponential mechanism [RS15] to select the sensitivity glyph[lscript] , R2T computes multiple lower bounds with different sensitivities glyph[lscript] and then outputs the maximum of the noisy values. This approach incurs the cost of composition across the multiple evaluations. To manage this cost, R2T only evaluates glyph[lscript] = 2 , 4 , 8 , · · · , 2 log glyph[lscript] max . Compared to our guarantee (8) with an error O ( glyph[lscript] ∗ ε log ( glyph[lscript] max β )) , R2T has a slightly worse theoretical error guarantee of O ( glyph[lscript] ∗ ε log( glyph[lscript] max ) log ( log glyph[lscript] max β )) [DFYTM22, Theorem 5.1].

The shifted inverse mechanism [FDY22] takes a different approach to the problem. Rather than relying on adding Laplace noise (as we do), it applies the exponential mechanism with an ingenious loss function (see [Ste23] for additional discussion). When applied to counting distinct elements, the shifted inverse mechanism gives an accuracy guarantee comparable to ours (8). The downside of the shifted inverse mechanism is that computing the loss function is, in general, NP-hard. Fang, Dong, and Yi [FDY22] propose polynomial-time variants for several specific tasks, including counting distinct elements. However, the algorithm is still relatively slow.

3 Technical Background on Differential Privacy

For detailed background on differential privacy, see the survey by Vadhan [Vad17] or the book by Dwork and Roth [DR14]. We briefly define pure DP and some basic mechanisms and results.

Algorithm 3 Generalized Exponential Mechanism [RS15]

Definition 3.1 (Differential Privacy (DP) [DMNS06] ) . A randomized algorithm M : X ∗ → Y satisfies ε -DP if, for all inputs D,D ′ ∈ X ∗ differing only by the addition or removal of an element and for all measurable S ⊂ Y , we have P [ M ( D ) ∈ S ] ≤ e ε · P [ M ( D ′ ) ∈ S ] .

We refer to pairs of inputs that differ only by the addition or removal of one person's data as neighboring . Note that it is common to also consider replacement of one person's data; for simplicity, we

do not do this. We remark that there are also variants of DP such as approximate DP [DKMMN06] and concentrated DP [DR16; BS16], which quantitatively relax the definition, but these are not relevant in our application. A key property of DP is that it composes and is invariant under postprocessing.

Lemma 3.2 (Composition & Postprocessing) . Let M 1 : X ∗ →Y be ε 1 -DP. Let M 2 : X ∗ ×Y → Z be such that, for all y ∈ Y , the restriction M ( · , y ) : X ∗ →Z is ε 2 -DP. Define M 12 : X ∗ →Z by M 12 ( D ) = M 2 ( D,M 1 ( D )) . Then M 12 is ( ε 1 + ε 2 ) -DP.

A basic DP tool is the Laplace mechanism [DMNS06]. Note that we could also use the discrete Laplace mechanism [GRS09; CKS20].

Lemma 3.3 (Laplace Mechanism) . Let q : X ∗ → R . We say q has sensitivity ∆ if | q ( D ) -q ( D ′ ) | ≤ ∆ for all neighboring D,D ′ ∈ X ∗ . Define M : X ∗ → R by M ( D ) = q ( D ) + Lap (∆ /ε ) , where Lap( b ) denotes laplace noise with mean 0 and variance 2 b 2 - i.e., P ξ ← Lap( b ) [ ξ > t ] =

Another fundamental tool for DP is the exponential mechanism [MT07]. It selects the approximately best option from among a set of options, where each option i has a quality function q i with sensitivity ∆ . The following result generalizes the exponential mechanism by allowing each of the quality functions to have a different sensitivity.

Theorem 3.4 (Generalized Exponential Mechanism [RS15, Theorem 1.4]) . For each i ∈ [ m ] , let q i : X ∗ → R be a query with sensitivity ∆ i . Let ε, β > 0 . The generalized exponential mechanism ( GEM ( · ; { q i } i ∈ [ m ] , { ∆ i } i ∈ [ m ] , ε, β ) in Algorithm 3) is ε -DP and has the following utility guarantee. For all D ∈ X ∗ , we have

4 Experimental Results

We empirically validate the performance of our algorithms using data sets of various sizes from different text domains. We focus on the problem of computing vocabulary size with person-level DP. Section 4.1 describes the data sets and Section 4.2 discusses the algorithms we compare.

4.1 Datasets

We used four publicly available datasets to assess the accuracy of our algorithms compared to baselines. Two small datasets were used: Amazon Fashion 5-core [NLM19] (reviews of fashion products on Amazon) and Amazon Industrial and Scientific 5-core [NLM19] (reviews of industrial and scientific products on Amazon). Two large data sets were also used: Reddit [She20] (a data set of posts collected from r/AskReddit) and IMDb [N20; MDPHNP11] (a set of movie reviews scraped from IMDb). See details of the datasets in Table 3.

4.2 Comparisons

Computing the number of distinct elements using a differentially private mechanism involves two steps: selecting a contribution bound ( glyph[lscript] in our algorithms) and counting the number of distinct elements in a way that restricts each person to only contribute the given number of elements.

Selection: We examine four algorithms for determining the contribution limit:

Choosing the true maximum person contribution (due to computational restrictions this was only computed for Amazon Fashion data set).

Choosing the 90th percentile of person contributions.

Choosing the person contribution that exactly maximizes the utility function q glyph[lscript] ( D ) = DC( D ; glyph[lscript] ) -glyph[lscript] ε log( 1 2 β ) , where ε = 1 , and β = 0 . 001 .

Choosing the person contribution that approximately maximizes the utility function using the generalized exponential mechanism with glyph[epsilon1] = 1 .

Note that only the last option is differentially private, but we consider the other comparison points nonetheless.

Counting: We also consider three algorithms for estimating the number of distinct elements for a given sensitivity bound glyph[lscript] :

For each person, we uniformly sample glyph[lscript] elements without replacement and count the number of distinct elements in the union of the samples.

The linear-time greedy algorithm (Algorithm 2) with ε = 1 and β = 0 . 001 .

The matching-based algorithm (Algorithm 1) with ε = 1 and β = 0 . 001 .

All of these can be converted into DP algorithms by adding Laplace noise to the result.

In all our datasets 'true maximum person contribution' and '90th percentile of person contributions' output bounds that are much larger than necessary to obtain true distinct count; hence, we only consider DP versions of the estimation algorithm for these selection algorithms.

4.3 Results

Figure 1 shows the dependency of the result on the contribution bound for each of the algorithms for computing the number of distinct elements with fixed person contribution. It is clear that matching and greedy algorithms vastly outperform the sampling approach that is currently used in practice.

Tables 4 to 7 show the performance of algorithms for selecting optimal person contribution bounds on different data sets. For all bound selection algorithms and all data sets, the sampling approach to estimating the distinct count performs much worse than the greedy and matching-based approaches. The greedy approach performs worse than the matching-based approach, but the difference is about 10% for Amazon Fashion and is almost negligible for other data sets since they are much larger. As for the matching-based algorithm, it performs as follows on all the data sets:

The algorithm that uses the bound equal to the maximal person contribution overestimates the actual necessary bound. Therefore, we only consider the DP algorithms for counts estimation. It is easy to see that while the median of the estimation is close to the actual distinct count, the amount of noise is somewhat large.

The algorithm that uses the bound equal to the 99th percentile of person contributions also overestimates the necessary bound and behaves similarly to the one we just described (though the spread of the noise is a bit smaller).

The algorithms that optimize the utility function are considered: one non-private and one private. The non-private algorithm with non-private estimation gives the answer that is very close to the true number of distinct elements. The private algorithm with non-private estimation gives the answer that is worse, but not too much. Finally, the private algorithm with the private estimation gives answers very similar to the results of the non-private estimation.

Acknowledgments and Disclosure of Funding

We would like to thank Badih Ghazi, Andreas Terzis, and four anonymous reviewers for their constructive feedback and valuable suggestions. We thank Markus Hasen¨ ohrl for helpful discussions, which helped us identify the problem. In addition, we are grateful to Ke Yi, Wei Dong, and Juanru Fang for bringing their related work [DFYTM22; FDY22] to our attention.

References

[SDH23] M. Swanberg, D. Desfontaines, and S. Haney. 'DP-SIPS: A simpler, more scalable mechanism for differentially private partition selection'. In: CoRR abs/2301.01998 (2023). arXiv: 2301.01998 . URL: https://doi.org/10. 48550/arXiv.2301.01998 (cit. on p. 6).

[She20] J. H. Shen. Ask Reddit . English. 2020. URL: https : / / github . com / heyyjudes / differentially - private - set - union / tree / ea7b39285dace35cc9e9029692802759f3e1c8e8/data (cit. on p. 9).

[SST20] A. D. Smith, S. Song, and A. Thakurta. 'The Flajolet-Martin Sketch Itself Preserves Differential Privacy: Private Counting with Minimal Space'. In: Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual . Ed. by H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin. 2020. URL: https://proceedings.neurips.cc/paper/2020/ hash/e3019767b1b23f82883c9850356b71d6- Abstract.html (cit. on p. 5).

[Ste23] T. Steinke. Beyond Local Sensitivity via Down Sensitivity . DifferentialPrivacy.org. https://differentialprivacy.org/down-sensitivity/ . Sept. 2023 (cit. on p. 8).

[Vad17] S. Vadhan. 'The complexity of differential privacy'. In: Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich (2017), pp. 347450. URL: https : / / privacytools . seas . harvard . edu / files / privacytools/files/manuscript_2016.pdf (cit. on p. 8).

[ZDKSTMAS23] B. Zhang, V. Doroshenko, P. Kairouz, T. Steinke, A. Thakurta, Z. Ma, H. Apte, and J. Spacek. 'Differentially Private Stream Processing at Scale'. In: arXiv preprint arXiv:2303.18086 (2023). URL: https://arxiv.org/abs/2303. 18086 (cit. on p. 6).

A Proofs

Lemma A.1 (Sensitivity of DC( D ; glyph[lscript] ) ) . As in Equation (2) , for D ∈ (Ω ∗ ) n and glyph[lscript] ∈ N , define

Let D,D ′ ∈ (Ω ∗ ) ∗ be neighboring. That is, D and D ′ differ only by the addition or removal of one entry. Then | DC( D ; glyph[lscript] ) -DC( D ′ ; glyph[lscript] ) | ≤ glyph[lscript] for all glyph[lscript] ∈ N .

Proof. Without loss of generality D = ( u 1 , · · · , u n ) ∈ (Ω ∗ ) n and D ′ = ( u 1 , · · · , u n -1 ) ∈ (Ω ∗ ) n -1 . I.e., D ′ is D with person n removed. Let glyph[lscript] ∈ N .

and

We can convert the 'witness' v ′ 1 , · · · , v ′ n -1 for D ′ into a 'witness' for D simply by adding the empty set. Define v ′ n = ∅ , which satisfies v ′ n ⊆ u n and | v ′ n | ≤ glyph[lscript] . Then

Similarly, we can convert the 'witness' v 1 , · · · , v n for D into a 'witness' for D ′ simply by discarding v n :

Thus | DC( D ; glyph[lscript] ) -DC( D ; glyph[lscript] ) | ≤ glyph[lscript]

Proof of Theorem 1.1. Privacy: First note that q glyph[lscript] ( D ) = DC( D ; glyph[lscript] ) -2 glyph[lscript] ε log(1 / 2 β ) has sensitivity glyph[lscript] . Algorithm 1 accesses the dataset via q glyph[lscript] ( D ) in two ways: First it runs the generalized exponential mechanism to select ˆ glyph[lscript] and second it computes ˆ ν ← q ˆ glyph[lscript] ( D ) + Lap ( 2 ˆ glyph[lscript]/ε ) . Since the generalized exponential mechanism is ε/ 2 -DP and adding Laplace noise is also ε/ 2 -DP, the overall algorithm is ε -DP by composition.

Lower bound: Since ˆ ν ← q ˆ glyph[lscript] ( D ) + Lap ( 2 ˆ glyph[lscript]/ε ) , we have

Since DC( D ; ˆ glyph[lscript] ) ≤ DC( D ) and q glyph[lscript] ( D ) = DC( D ; glyph[lscript] ) -2 glyph[lscript] ε log(1 / 2 β ) , Equation (11) gives

This is the guarantee of Equation (6); ˆ ν is a lower bound on DC( D ) with probability ≥ 1 -β .

Upper bound:

The accuracy guarantee of the generalized exponential mechanism (Theorem 3.4) is

Combining Equations (11) and (12) with a union bound yields

To interpret Equation (13) we need a high-probability upper bound on ˆ glyph[lscript] . Let A > 0 be determined later and define

Assume the event in Equation (12) happens. We have

Combining inequalities yields

which simplifies to

Now we set A = log ( 1 2 β ) to obtain

Substituting Equation (17) into Equation (13) gives

We simplify Equation (18) using log ( 1 2 β ) ≤ log ( glyph[lscript] max β ) to obtain Equation (7).

Computational efficiency: Finally, the runtime of DPDISTINCTCOUNT ( D ) is dominated by glyph[lscript] max calls to the SENSITIVEDISTINCTCOUNT ( D ) subroutine, which computes the maximum size of a bipartite matching on a graph with | E | = ∑ i ∈ [ n ] | u i | · min { glyph[lscript], | u i |} ≤ | D | · glyph[lscript] max edges and | V | + | U | = DC( D ) + ∑ i ∈ [ n ] min { glyph[lscript], | u i |} ≤ 2 | D | vertices. The Hopcroft-Karp-Karzanov algorithm runs in time O ( | E | · √ | V | + | U | ) ≤ O ( | D | 1 . 5 · glyph[lscript] max ) time.

Proof of Theorem 1.2. Privacy: For convenience we analyze Algorithm 4, which produces the same result as Algorithm 2. (The difference is that Algorithm 4 is written to be efficient, while Algorithm 2 is written in a redundant manner to make the subroutine we are analyzing clear.) The privacy of the algorithm follows by composing the privacy guarantees of the generalized exponential mechanism and Laplace noise addition. The only missing part is to prove that SENSITIVEAPPROXDISTINCTCOUNT ( · , glyph[lscript] ) has sensitivity glyph[lscript] .

Note that

therefore, it is enough to prove that SENSITIVEAPPROXDISTINCTCOUNT ( · , 1) has sensitivity 1 .

Algorithm 4 Approximate Distinct Count Algorithm

glyph[negationslash]

we run APPROXSENSITIVEDISTINCTCOUNT ( D, 1) . Similarly, let S ′ 1 , · · · , S ′ j -1 , S ′ j +1 , · · · , S ′ n , v ′ 1 , · · · , v ′ j -1 , v ′ j +1 , · · · , v ′ n be the states of S and v ( v ′ i = ⊥ if u i \ S ′ i -1 = ∅ ), 6 respectively, when we run APPROXSENSITIVEDISTINCTCOUNT ( D ′ , 1) . Our goal is to show that || S n | - | S ′ n || ≤ 1 . Define S ′ j = S ′ j -1 and v ′ j = ⊥ . Clearly S ′ i = S i and v ′ i = v i for all i < j . For i ≥ j , we claim that S ′ i ⊆ S i and | S i | ≤ | S ′ i | +1 . This is true for i = j , since S ′ j = S ′ j -1 = S j -1 and S j = S j -1 ∪{ v j } . We prove the claim for i > j by induction. I.e., assume S i -1 = S ′ i -1 ∪{ v ∗ i -1 } for some v ∗ i -1 (possibly v ∗ i -1 = ⊥ , whence S i -1 = S ′ i -1 ). Now v i is the lexicographically first element of u i \ S i -1 and v ′ i is the lexicographically first element of u i \ S ′ i -1 (or ⊥ if these sets are empty). By the induction assumption, u i \ S i -1 ⊆ u i \ S ′ i -1 ⊆ ( u i \ S i -1 ) ∪ { v ∗ i -1 } . Thus either v ′ i = v i or v ′ i = v ∗ i -1 . If v ′ i = v i , then S ′ i = S ′ i -1 ∪ { v ′ i } ⊂ S i -1 ∪ { v i } = S i and S ′ i ∪ { v ∗ i -1 } = S ′ i -1 ∪ { v ′ i , v ∗ i -1 } ⊃ S i -1 ∪ { v i } = S i . If v ′ i = v ∗ i -1 , then S ′ i = S ′ i -1 ∪ { v ∗ i -1 } ⊂ S i -1 ∪ { v ∗ i -1 } = S i -1 ⊂ S i and S ′ i ∪ { v i } = S ′ i -1 ∪ { v i , v ∗ i -1 } ⊃ S i -1 ∪ { v i } = S i , so the claim holds with v ∗ i = v i .

The sensitivity bound implies that q glyph[lscript] ( D ) = | S | -2 glyph[lscript] ε log(1 / 2 β ) has sensitivity glyph[lscript] . Since the generalized exponential mechanism is ε/ 2 -DP and adding Laplace noise is also ε/ 2 -DP, the overall algorithm is ε -DP by composition.

Lower bound: Let us denote by ̂ DC( D ; glyph[lscript] ) = SENSITIVEAPPROXDISTINCTCOUNT ( · , glyph[lscript] ) the value of | S | we obtain on Line 8 in Algorithm 2. Note that ̂ DC( D ; glyph[lscript] ) is the size of a maximal matching in G glyph[lscript] , where G glyph[lscript] is the bipartite graph corresponding to the input D with glyph[lscript] copies of each person (see Algorithm 1 for a formal description of the graph). Since a maximal matching is a 2-approximation to a maximum matching [God], we have

Since ˆ ν ← q ˆ glyph[lscript] ( D ) + Lap ( 2 ˆ glyph[lscript]/ε ) , we have

Substituting q glyph[lscript] ( D ) = ̂ DC( D ; glyph[lscript] ) -2 glyph[lscript] ε log(1 / 2 β ) into Equations (19) and (20) gives Equation (9)

Upper bound: The accuracy guarantee of the generalized exponential mechanism (Theorem 3.4) is

Combining Equations (20) and (21) and the definition of q glyph[lscript] ( D ) with a union bound yields

Now we assume max i ∈ [ n ] | u i | ≤ glyph[lscript] ∗ ≤ glyph[lscript] max for some glyph[lscript] ∗ . This implies DC( D ) = DC( D ; glyph[lscript] ) . We have

As in the proof of Theorem 1.1, if the event in Equation (21) happens, we can show that

where

Note that glyph[lscript] ∗ A ≤ glyph[lscript] ∗ , since ̂ DC( D ; glyph[lscript] ) ≤ ̂ DC( D ; glyph[lscript] ∗ ) for all glyph[lscript] ∈ [ glyph[lscript] max ] . (That is simply to say that the size of the maximal matching cannot be increased by making more copies of a vertex once there is one copy for each neighbor.) Combining bounds yields

Since log ( 1 2 β ) ≤ log ( glyph[lscript] max β ) , this implies Equation (10).

Computational efficiency: It only remains to verify that Algorithm 2 can be implemented in O ( | D | + glyph[lscript] max log glyph[lscript] max ) time. We can implement S using a hash table to ensure that we can add an element or query membership of an element in constant time. (We can easily maintain a counter for the size of S .) We assume D is presented as a linked list of linked lists representing each u i and furthermore that the linked lists u i are sorted in lexicographic order. The outer loop proceeds through the linked list for D = ( u 1 , · · · , u n ) . For each u i , we simply pop elements from the linked list and check if they are in S until either we find v ∈ u i \ S (and add v to S ) or u i becomes empty (in which case we remove it from the linked list for D .) Since each iteration decrements | D | , the runtime of the main loop is O ( | D | ) . Running the generalized exponential mechanism (Algorithm 3) takes O ( glyph[lscript] max log glyph[lscript] max ) time.

B Implementing the Generalized Exponential Mechanism

We conclude with some remarks about implementing the generalized exponential mechanism of Raskhodnikova and Smith [RS15] given in Algorithm 3. There are two parts to this; first we must compute the normalized scores and then we must run the standard exponential mechanism.

Implementing the standard exponential mechanism is well-studied [Ilv20] and can be performed in linear time (with some caveats about randomness and precision). We remark that, instead of the exponential mechanism, we can use report-noisy-max or permute-and-flip [MS20; DKSWXZ+21; DDKPWWXZ23]. These variants may be easier to implement and may provide better utility too.

The normalized scores are given by

where q i ( D ) is the value of the query on the dataset, ∆ i > 0 is the sensitivity of q i , and t is a constant. Na¨ ıvely it would take Θ( m 2 ) time to compute all the normalized scores. However, a more complex algorithm can compute the scores in O ( m log m ) time.

Observe that, for each i ∈ [ m ] , we have

That is, we can compute s i by solving the equation q i ( D ) -( s i + t )∆ i = f ( s i -t ) .

Since f ( x ) := max j ∈ [ m ] q j ( D ) + x ∆ j is the maximum of increasing linear functions, we have that f is a convex, increasing, piecewise-linear function, with at most m pieces. We can represent f by a sorted list of the points where the linear pieces connect, along with the linear function on each of the pieces. We can compute this representation of f as a pre-processing step in O ( m log m ) time; we sort the lines y ( x ) = q j ( D ) + x ∆ j by their slope ∆ j and then compute the intersection points between consecutive lines (we delete lines that never realize the max).

Given the above representation of f and the values q i ( D ) , ∆ i , t , we can compute s i in O (log m ) time. We must solve q i ( D ) -( s i + t )∆ i = f ( s i -t ) for s i . We can perform binary search on the pieces of f to identify j such that f ( s i -t ) = q j ( D ) + ( s i -t )∆ j . Once we have this we can directly compute s i = ( q i ( D ) -t ∆ i ) -( q j ( D ) -t ∆ j ) ∆ i +∆ j . The binary search takes O (log m ) time and we must compute m scores. Thus the overall runtime (including the pre-processing) is O ( m log m ) .

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nSuppose a data set consists of (user, item) pairs. The paper provides an estimate of the count of the number of distinct items that satisfies user level differential privacy. This differs from existing work in two ways. Existing work 1) considers item streams with item, not user, level differential privacy and 2) is highly concerned about computation costs and uses data sketches which have bounded size. \n\nIt solves the problem by generating lower bounds with bounded sensitivity by converting the distinct count to a max flow problem.\n\nSTRENGTHS:\nThe paper introduces a novel user-level privacy formulation of the distinct count problem. The main ideas are presented well, and it is technically sound.\n\nWEAKNESSES:\n1. The title could better describe the key feature of the problem, providing user level privacy. Since most distinct counting papers are about approx distinct counting and streaming/distributed algorithms, I think readers have an expectation that this paper would address this given the title and it's a bit of a let down when it doesn't.\n\n2. The related work section is somewhat inaccurate in its descriptions. E.g.\n* Desfointaine et al is a universal result about any distinct counting method which is mergeable. Changing the algorithm design can't get around this. But the results only imply that you can't merge many times and preserve both privacy and accuracy, not that you can't build a private sketch.\n* Smith et al doesn’t actually analyze the Flajolet-Martin (a.k.a. PCSA) sketch but their own tweak of the LogLog sketch (by Durand and Flajolet). (Though this inaccuracy is totally understandable given their title.)\n* Dickens et al is also a universal result for any order invariant sketch. \n* Both Smith et al and Dickens et al are pan private in the streaming setting as well\n* Note neither claim to provide privacy under merges. \n\n3. There is also some related work on private multiparty computation for distinct counts. e.g. \"Privacy-Preserving Secure Cardinality and Frequency Estimation\" Kreuter et al 2020\n\n4. The empirical results for the greedy algorithm are nice, but the bound is quite bad for this application since it only gives you an estimate of the correct order of magnitude. It's also not clear what to do in large scale distributed data settings. These are fairly minor weaknesses given the paper's scope though.\n\nQUESTIONS:\n1. What is the distinction between maximal and maximum bipartite matching? A quick search seems to regard these descriptions as the same problem. Does the greedy algorithm generate the maximal matching that approximates the maximum matching? \n\n2. I'd be happy to increase the rating if the weaknesses 1 & especially 2 are addressed.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors study the fundamental problem of counting the number of distinct elements in a dataset\nin a user-level DP setting, where a user can contribute an unbounded number of items. The main\ncontribution of the paper is an approach to obtain lower bounds through a bounded sensitivity\ncount and a bias-variance perspective. The authors give interesting algorithms to compute\nit quite efficiently, and show a linear time version which trades off efficiency with accuracy.\nThe algorithms are evaluated empirically and show good performance.\n\nSTRENGTHS:\nThe problem is very natural and well motivated. The approach considered in the paper, in terms of\nbounded sensitivity, seems quite natural, and is connected to a big literature on Lipschitz extension.\nThe authors give rigorous bounds on the bounds achieved by their algorithms. The empirical results\nare also interesting, and show reasonable performance. The greedy algorithm is also shown to perform\nquite well. The presentation is quite good.\n\nWEAKNESSES:\nThe basic ideas in the paper, and the techniques used in the algorithms are fairly simple. The experiments section could be strengthened\n\nQUESTIONS:\nIn line 51, what is the motivation for considering\nM_{\\ell,\\epsilon}(D) - \\frac{\\ell}{\\epsilon}\\log(1/2\\beta)?\n\nIs it assumed that there is a fixed \\ell_{max} for all the data (line 58)? It appears as an input in\nprocedure DPDISTINCTCOUNT, and in the bounds in Theorem 1.1.  This should be clarified\nearlier in that case. The algorithm needs to know \\ell_{max} in that case. Is there a way to specify it?\n\nLine 13 of algorithm 1 and line 10 of Algorithm 2: it might be helpful to make GEM consistent with\nthe name \"Generalized Exponential Mechanism\" used in Algorithm 3\n\nThe baseline sampling algorithm mentioned in lines 131-134 is not really related work, but just a\nbaseline, and could be in the experiments section.\n\nline 176: \"three\" should be \"four\"\n\nline 191: is the sampling done with replacement?\n\nWhat is the \\epsilon value in Fig 1? Does the \"Person Contribution Bound\" refer to \\ell_{max}?\nThe plots are quite interesting. Is there an explanation for why the gap between the algorithms\nand the true counts decreases as in the figure?\n\nTables 2 and 3 are not very easy to interpret. It might be easier to compare the counts as\nfractions or visually.\n\nHow do the results vary with \\epsilon?\n\nWhat is the motivation for considering \\epsilon=1 in the person contribution for the baseline?\n\nLIMITATIONS:\nTo some extent. There are no negative social impacts", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nEdit: Overall decision recommendation changed from borderline reject to borderline accept under the expectation that limitations and future work directions as discussed in the reviewer discussion are incorporated into the manuscript.\n\nThe manuscript studies the problem of approximating the number of unique items in a multiset under (user-level) differential privacy (DP). Unlike in prior work users can contribute arbitrarily many items to the multiset.\n\nThe authors propose to select for each user a subset of contributed items that maximises the total number of unique items. The maximisation problem is solved exactly in polynomial-time via bipartite maximum matching or alternatively a 2-approximation is found in linear-time via a greedy algorithm.\n\nSTRENGTHS:\nS1) Non-trivial results: Sensitivity analysis of approximate DC(D;l) and application of generalized exponential mechanism is interesting.\n\nS2) Could be useful: Probability that noisy count is a lower bound can be calibrated and lower bound can be useful to check if certain thresholds are exceeded.\n\nS3) Improvement over naive baselines: Computing/approximating DC(D;l) seems clearly preferable to selecting l random items for each user.\n\nWEAKNESSES:\nW1) Heavily biased estimator.\n\nA DP count would seem to prohibit deterministic lower/upper bounds. While a lower bound w.h.p. could still be useful, most settings would seem to call for an unbiased estimator (see also Q1a & Q1b).\n\nW2) Quality of solution unclear.\n\nApart from the poorly presented tables that do not clearly indicate the correct count, there is also no analysis of how much more utility could potentially be possible for this problem under a given DP regime. Thus, it is difficult to appreciate the solution in terms of how practically useful it is or how much utility is potentially lost due to the method (see also Q2a & Q2b).\n\nW3) Reproducibility\n\nWhile the datasets seem to be specified, the submission does not seem to provide code for experiments (see also Q3).\n\nW4) Minor: Some parts of the paper are hard to understand. Particularly, Section 3 could focus more on explanations related to the Generalized Exponential Mechanism (GEM) rather than well-known basics.\n\nIt would be better to move the basics of DP and basic Exponential/Laplace mechanism to the appendix and instead provide more explanations/intuitions on how the GEM is used in this work, why it is needed and some intuitions how it leads to better results.\n\nW5) Minor: Sensitivity analysis of DC(D;l) is missing.\n\nIt could be stated more explicitly why if a user is added that contributes X items DC(D;l) can increase by at most X, i.e., the added user cannot improve the solution for the previous users (e.g., due to optimal solution for previous users). That would also make it clearer why the sensitivity analysis for the approximation of DC(D;l) is non-trivial where an added user could potentially improve the solution for the previous users and removing a user could lead to less optimal solutions for the rest of users.\n\nQUESTIONS:\nQ1a) Presuming number of distinct items per user cannot be arbitrarily large, is it possible to derive an unbiased estimator using the proposed method or is there some strong indication that any unbiased estimator would be inherently impossible (presuming upper limit on items per user) or could not provide good enough accuracy in this setting?\n\nQ1b) Is there some indication that the released noisy counts correlate with the correct counts sufficiently to rank multiple noisy counts somewhat accurately?\n\nQ2a) What is correct count for each table and what is the achieved count with the proposed method? \n\nQ2b) Is there any strong indication that the proposed solution could not be easily improved upon?\n\nQ3) Do the authors plan to release the code that was used for the experiments?\n\nLIMITATIONS:\nSome limitations do not seem to be mentioned (see Weaknesses W1) and there is generally no discussion of limitations in the abstract or an explicit paragraph in the main paper or appendix.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

comments: SUMMARY:
This paper proposes an algorithm to count the maximum number of unique items one can get from considering from every individual in a dataset at most l items, while preserving differential privacy.

STRENGTHS:
The paper offers an (as far as I know) original contribution, which is simple and nice.  The explanation is clear.  The result may be significant to the extent one can cast applications needing to count the number of unique items into the relaxation considered in the current paper.
The paper performs an interesting empirical evaluation, even if it doesn't fully succeed to bring up a convincing application.

WEAKNESSES:
The paper also proposes a linear time algorithm, which is very nice, but which makes a second approximation, making it even more unclear how to determine whether it is suitable for a specific application.

QUESTIONS:
--

LIMITATIONS:
The paper doesn't have a conclusions section, and doesn't mention limitations nor societal impact.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-08