Title: User-Level Differential Privacy With Few Examples Per User
Venue: NeurIPS 2023
Accepted: yes
Keywords: differential privacy

user-level privacy

PAC learning
Abstract: Previous work on user-level differential privacy (DP) [Ghazi et al. NeurIPS 2021, Bun et al. STOC 2023] obtained generic algorithms that work for various learning tasks. However, their focus was on the *example-rich* regime, where the users have so many examples that each user could themselves solve the problem. In this work we consider the *example-scarce* regime, where each user has only a few examples, and obtain the following results:
* For approximate-DP, we give a generic transformation of any item-level DP algorithm to a user-level DP algorithm. Roughly speaking, the latter gives a (multiplicative) savings of $O_{\varepsilon,\delta}(\sqrt{m})$ in terms of the number of users required for achieving the same utility, where $m$ is the number of examples per user. This algorithm, while recovering most known bounds for specific problems, also gives new bounds, e.g., for PAC learning. 
* For pure-DP, we present a simple technique for adapting the exponential mechanism [McSherry & Talwar, FOCS 2007] to the user-level setting. This gives new bounds for a variety of tasks, such as private PAC learning, hypothesis selection, and distribution learning. For some of these problems, we show that our bounds are near-optimal.

User-Level Differential Privacy With Few Examples Per User

Abstract

Previous work on user-level differential privacy (DP) [GKM21, BGH + 23] obtained generic algorithms that work for various learning tasks. However, their focus was on the example -rich regime, where the users have so many examples that each user could themselves solve the problem. In this work we consider the examplescarce regime, where each user has only a few examples, and obtain the following results:

For approximate-DP, we give a generic transformation of any item-level DP algorithm to a user-level DP algorithm. Roughly speaking, the latter gives a (multiplicative) savings of O ε,δ ( √ m ) in terms of the number of users required for achieving the same utility, where m is the number of examples per user. This algorithm, while recovering most known bounds for specific problems, also gives new bounds, e.g., for PAC learning.

For pure-DP, we present a simple technique for adapting the exponential mechanism [MT07] to the user-level setting. This gives new bounds for a variety of tasks, such as private PAC learning, hypothesis selection, and distribution learning. For some of these problems, we show that our bounds are near-optimal.

1 Introduction

Differential privacy (DP) [DMNS06, DKM + 06] has become a widely popular notion of privacy quantifying a model's leakage of personal user information. It has seen a variety of industrial and governmental deployments including [Gre16, App17, DKY17, Abo18, RE19, TM20]. Many fundamental private machine learning algorithms in literature have been devised under the (implicit) assumption that each user only contributes a single example to the training dataset, which we will refer to as item-level DP . In practice, each user often provides multiple examples to the training data. In this user-level DP setting, the output of the algorithm is required to remain (approximately) statistically indistinguishable even when all the items belonging to a single user are substituted (formal definitions below). Given such a strong (and preferable) privacy requirement, it is highly non-trivial for the algorithm to take advantage of the increased number of examples. Several recent studies have explored this question and showed-for a wide variety of tasks-that, while challenging, this is possible [LSY + 20, LSA + 21, GKM21, ILPS22, BGH + 23].

To discuss further, let us define some notation. We use n to denote the number of users and m to denote the number of examples per user. We use Z to denote the universe of possible samples. We write x = ( x 1 , 1 , . . . , x 1 ,m , x 2 , 1 , . . . , x n,m ) ∈ Z nm to denote the input to our algorithm, and

Ravi Kumar

x i := ( x i, 1 , . . . , x i,m ) for i ∈ [ n ] to denote the i th user's examples. Furthermore, we write x -i to denote the input with the i th user's data x i removed. Similarly, for S ⊆ [ n ] , we write x -S to denote the input with all the examples of users in S removed.

Definition 1 (User-Level Neighbors) . Two inputs x , x ′ are user-level neighbors , denoted by x ≍ x ′ , iff x -i = x ′ -i for some i ∈ [ n ] .

Definition 2 (User-Level and Item-Level DP) . For ε, δ > 0 , we say that a randomized algorithm 1 A : Z → O is ( ε, δ ) -user-level DP iff, for any x ≍ x ′ and any S ⊆ O , we have Pr[ A ( x ) ∈ S ] ≤ e ε Pr[ A ( x ′ ) ∈ S ] + δ . When m = 1 , we say that A is ( ε, δ ) -item-level DP .

The case δ = 0 is referred to as pure-DP , whereas the case δ > 0 is referred to as approximate-DP .

To formulate statistical tasks studied in our work, we consider the setting where there is an unknown distribution D over Z and the input x ∼ D nm consists of nm i.i.d. samples drawn from D . A task T (including the desired accuracy) is defined by Ψ T ( D ) , which is the set of 'correct' answers. For a parameter γ , we say that the algorithm A is γ -useful if Pr x ∼D nm [ A ( x ) ∈ Ψ T ( D ) ] ≥ γ for all valid D . Furthermore, we say that nm is the sample complexity of the algorithm, whereas n is its user complexity . For m ∈ N and ε, δ > 0 , let n T m ( ε, δ ; γ ) denote the smallest user complexity of any ( ε, δ ) -user-level DP algorithm that is γ -useful for T . When γ is not stated, it is assumed to be 2 / 3 .

Generic Algorithms Based on Stability. So far, there have been two main themes of research on user-level DP learning. The first aims to provide generic algorithms that work with many tasks. Ghazi et al. [GKM21] observed that any pseudo-globally stable (aka reproducible [ILPS22]) algorithm can be turned into a user-level DP algorithm. Roughly speaking, pseudo-global stability requires that the algorithm, given a random input dataset and a random string, returns a canonical output-which may depend on the random string-with a large probability (e.g., 0 . 5 ). They then show that the current best generic PAC learning item-level DP algorithms from [GGKM21] (which are based on yet another notion of stability) can be made into pseudo-globally stable algorithms. This transforms the aforementioned item-level DP algorithms into user-level DP algorithms.

In a recent breakthrough, Bun et al. [BGH + 23] significantly expanded this transformation by showing that any item-level DP algorithm can be compiled into a pseudo-globally stable algorithm-albeit with some overhead in the sample complexity. Combining with [GKM21], they then get a generic transformation of any item-level DP algorithm to a user-level DP algorithm. Such results are of (roughly) the following form: If there is an item-level DP algorithm for some task with sample complexity n , then there is a user-level DP algorithm with user complexity O (log(1 /δ ) /ε ) as long as m ≥ ˜ Ω ε,δ ( n 2 ) . In other words, if each user has sufficiently many samples, the algorithm needs very few users to learn under the user-level DP constraint. However, the requirement on the number of examples per user can be prohibitive: due to the nature of the reduction, it requires each user to have enough samples to learn by themselves. This leads to the following natural question: 2

Is there a generic transformation from item-level to user-level DP algorithms for small m ?

Algorithms for Specific Tasks & the √ m Savings. Meanwhile, borrowing a page from its item-level DP counterpart, another active research theme has been to study specific tasks and provide (tight) upper and lower bounds on their sample complexity for user-level DP. Problems such as mean estimation, stochastic convex optimization (SCO), and discrete distribution learning are well-understood under user-level DP (for approximate-DP); see, e.g., [LSY + 20, LSA + 21, NME22, GKK + 23]. A pattern has emerged through this line of studies: (the privacy-dependent part of) the user complexity in the user-level DP setting is often roughly 1 / √ m smaller than that of the item-level DP setting. For example, for the task of discrete distribution learning on domain [ k ] up to total variation distance of α > 0 (denoted by DD k ( α ) ), the user complexity for the user-level DP is [DHS15, ASZ21, NME22]

We can see that the first privacy-dependent term decreases by a factor of √ m whereas the latter privacy-independent term decreases by a factor of m . A similar phenomenon also occurs in the other problems discussed above. As such, it is intriguing to understand this question further:

Is there a common explanation for these √ m saving factors for the privacy-dependent term?

1.1 Our Contributions

Approximate-DP. We answer both questions by showing a generic way to transform any item-level DP algorithm into a user-level DP algorithm such that the latter saves roughly √ m in terms of the number of users required. Since the formal expression is quite involved, we state below a simplified version, which assumes that the sample complexity can be written as the sum of two terms, the privacy-independent term (i.e., n T stat ) and the privacy-dependent term that grows linearly in 1 /ε and polylogarithmically in 1 /δ (i.e., ( log(1 /δ ) O (1) ε ) · n T priv ). This is the most common form of sample complexity of DP learning discovered so far in the literature-in particular, this covers all the tasks we have discussed previously. The corollary below shows that the privacy-dependent term decreases by a factor of roughly √ m whereas the privacy-independent term decreases by a factor of m . The full version of the statement can be found in Theorem 10.

Corollary 3 (Main Theorem-Simplified) . Let T be any task and γ > 0 be a parameter. Suppose that for any sufficiently small ε, δ > 0 , there is an ( ε, δ ) -item-level DP algorithm that is γ -useful for T with sample complexity ˜ O ( log(1 /δ ) c ε · n T priv + n T stat ) for some constant c . Then, for any sufficiently small ε, δ > 0 , there exists an ( ε, δ ) -user-level DP algorithm that is ( γ -o (1)) -useful for T and has user complexity

Our result provides a powerful and generic tool in learning with user-level DP, as it can translate any item-level DP bound to user-level DP bound. Specifically, up to polylogarithmic terms and the dependency on ε , the corollary above recovers all the aforementioned user complexity bounds for mean estimation, SCO, and discrete distribution learning. In addition, it also presents new sample complexity bounds for the moderate m regime for PAC learning.

While our result is very general, it-perhaps inevitably-comes at a cost: the algorithm is computationally inefficient and the dependence on ε (and δ ) is not tight. We discuss this-along with other open questions-in more detail in Section 5.

Pure-DP. Surprisingly, the pure-DP setting is less explored compared to approximate-DP in the context of learning with user-level DP; the sample complexity of several of the problems mentioned above (e.g., discrete distribution learning and SCO) is well-understood under approximate-DP but not so under pure-DP. While we do not provide a generic transformation from item-level DP algorithms to user-level DP algorithms for pure-DP, we give simple modifications of the popular pure-DP exponential mechanism [MT07] that allow it to be used in the user-level DP setting. Consequently, we obtain improved bounds for several problems. Due to space constraints, in the main body of the paper, we will only discuss PAC learning. Results for other problems, such as hypothesis testing and distribution learning can be found in Appendix E.

̸

In PAC learning, Z = X × { 0 , 1 } and there is a concept class C ⊆ { 0 , 1 } X . An error of c : Z → { 0 , 1 } w.r.t. D is defined as err D ( c ) := Pr ( x,y ) ∼D [ c ( x ) = y ] . The task PAC( C ; α ) is to, for any distribution D that has zero error on some concept c ∗ ∈ C (aka realizable by C ), output c : Z → { 0 , 1 } such that err D ( c ) ≤ α . We give a tight characterization of the user complexity for PAC learning 3 :

Theorem 4. Let C be any concept class with probabilistic representation dimension d (i.e. PRDim( C ) = d ). Then, for any sufficiently small α, ε > 0 and for all m ∈ N , we have

Previous work [GKM21, BGH + 23] achieves the tight sample complexity only for large m ( ≫ d 2 ).

1.1.1 Technical Overview

In this section, we give a rough overview of our proofs. We will be intentionally vague; all definitions and results will be formalized later in the paper.

Approximate-DP. At a high-level, our proof proceeds roughly as follows. First, we show that any ( ε, δ ) -item-level DP A with high probability satisfies a local version of user-level DP for which we only compare 4 A ( x -i ) for different i , but with ε that is increased by a factor of roughly √ m (see Definition 16 and Theorem 17). If this were to hold not only for x -i but also for all user-level neighbors x ′ of x , then we would have been done since the ( ε, δ ) -item-level DP algorithm would have also yielded ( ε √ m,δ ) -user-level DP (which would then imply a result in favor of Corollary 3). However, this is not true in general and is where the second ingredient of our algorithm comes in: We use a propose-test-release style algorithm [DL09] to check whether the input is close to a 'bad' input for which the aforementioned local condition does not hold. If so, then we output ⊥ ; otherwise, we run the item-level DP algorithm. Note that the test passes w.h.p. and thus we get the desired utility.

This second step is similar to recent work of Kohli and Laskowski [KL21] and Ghazi et al. [GKK + 23], who used a similar algorithm for additive noise mechanisms (namely Laplace and Gaussian mechanisms). The main difference is that instead of testing for local sensitivity of the function as in [KL21, GKK + 23], we directly test for the privacy loss of the algorithm A .

As for the first step, we prove this via a connection to a notion of generalization called sample perfect generalization [CLN + 16] (see Definition 12). Roughly speaking, this notion measures the privacy loss when we run an ( ε, δ ) -item-level DP algorithm on two x , x ′ drawn independently from D n . We show that w.h.p. A ( x ) ≈ ε ′ ,δ ′ A ( x ′ ) for ε ′ = O ( √ n log(1 /δ ) · ε ) . Although ostensibly unrelated to the local version of user-level DP that we discussed above, it turns out that these are indeed related: if we view the algorithm that fixes examples of all but one user, then applying the sample perfect generalization bound on just the input of the last user (which consists of only m samples) shows that the privacy loss when changing the last user is O ( √ m log(1 /δ ) · ε ) w.h.p. It turns out that we can turn this argument into a formal bound for our local notion of user-level DP (see Section 3.2.1.)

We remark that our results on sample perfect generalization also resolve an open question of Cummings et al. [CLN + 16]; we defer this discussion to Appendix C.1.

Finally, we also note that, while Bun et al. [BGH + 23] also uses the sample perfect generalization notion, their conversion from item-level DP algorithms to user-level DP algorithms require constructing pseudo-globally stable algorithms with sample complexity m . This is impossible when m is small, which is the reason why their reduction works only in the example-rich setting.

Pure-DP. Recall that the exponential mechanism [MT07] works as follows. Suppose there is a set H of candidates we would like to select from, together with the scoring functions (scr H ) H ∈H , where scr H : Z n → R has sensitivity at most ∆ . The algorithm then outputs H with probability proportional to exp( -ε · scr H ( x ) / 2∆ ) . The error guarantee of the algorithm scales with the sensitivity ∆ (see Theorem 9.) It is often the case that scr H depends on the sum of individual terms involving each item. Our approach is to clip the contribution from each user so that the sensitivity is small. We show that selecting the clipping threshold appropriately is sufficient obtain new user-level pure-DP (and in some cases optimal) algorithms.

2 Preliminaries

Let [ n ] = { 1 , . . . , n } , let [ x ] + = max(0 , x ) , and let ˜ O ( f ) denote O ( f log c f ) for some constant c . Let supp( A ) denote the support of distribution A . We recall some standard tools from DP [Vad17].

For two distributions A,B , let d ε ( A ∥ B ) = ∑ x ∈ supp( A ) [ A ( x ) -e ε B ( x )] + denote the e ε -hockey stick divergence . For brevity, we write A ≈ ε,δ B to denote d ε ( A ∥ B ) ≤ δ and d ε ( B ∥ A ) ≤ δ .

Lemma 5 ('Triangle Inequality') . If A ≈ ε ′ ,δ ′ B and B ≈ ε,δ C , then A ≈ ε + ε ′ ,e ε δ ′ + e ε ′ δ C .

Lemma 6 (Group Privacy) . Let A be any ( ε, δ ) -item-level DP algorithm and x , x ′ be k -neighbors 5 , then A ( x ) ≈ ε ′ ,δ ′ A ( x ′ ) where ε ′ = kε, δ ′ = e kε -1 e ε -1 δ ≤ ke kε δ .

Theorem 7 (Amplification-by-Subsampling [BBG18]) . Let n, n ′ ∈ N be such that n ′ ≥ n . For any ( ε, δ ) -item-level DP algorithm A with sample complexity n , let A ′ denote the algorithm with sample complexity n ′ that randomly chooses n out of the n ′ input samples and then runs A on the subsample. Then A ′ is ( ε ′ , δ ′ ) -DP where ε ′ = ln (1 + η ( e ε -1)) , δ ′ = ηδ for η = n/n ′ .

We also need the definition of the shifted and truncated discrete Laplace distribution:

Definition 8 (Shifted Truncated Discrete Laplace Distribution) . For any ε, δ > 0 , let κ = κ ( ε, δ ) := 1 + ⌈ ln(1 /δ ) /ε ⌉ and let TDLap ( ε, δ ) be the distribution supported on { 0 , . . . , 2 κ } with probability mass function at x being proportional to exp( -ε · | x -κ | ) .

Exponential Mechanism (EM). In the (generalized) selection problem (SELECT), we are given a candidate set H and scoring functions scr H for all H ∈ H whose sensitivities are at most ∆ . We say that an algorithm A is ( α, β ) -accurate iff Pr H ∼ A ( x ) [scr H ( x ) ≤ min H ′ ∈H scr H ′ ( x ) + α ] ≥ 1 -β .

Theorem 9 ([MT07]) . There is an ε -DP ( O (∆ · log( |H| /β ) /ε ) , β ) -accurate algorithm for SELECT.

3 Approximate-DP

In this section, we prove our main result on approximate-DP user-level learning, which is stated in Theorem 10 below. Throughout the paper we say that a parameter is 'sufficiently small' if it is at most an implicit absolute constant.

Theorem 10 (Main Theorem) . Let T be any task and γ > 0 be a parameter. Then, for any sufficiently small ε, δ > 0 and m ∈ N , there exists ε ′ = ε 2 log(1 /δ ) √ m log( m/δ ) and δ ′ = Θ ( δ · ε m log(1 /δ ) ) such that

Note that Corollary 3 follows directly from Theorem 10 by plugging in the expression n T 1 ( ε ′ , δ ′ ; γ ) = ˜ O ( log(1 /δ ′ ) c ε ′ · n T priv + n T stat ) into the bound.

While it might be somewhat challenging to interpret the bound in Theorem 10, given that the ε values on the left and the right hand sides are not the same, a simple subsampling argument (similar to one in [BGH + 23]) allows us to make the LHS and RHS have the same ε . In this case, we have that the user complexity is reduced by a factor of roughly 1 / √ m , as stated below. We remark that the δ values are still different on the two sides; however, if we assume that the dependence on 1 /δ is only polylogarithmic, this results in at most a small gap of at most polylogarithmic factor in 1 /δ .

Theorem 11 (Main Theorem-Same ε Version) . Let T be any task and γ > 0 be a parameter. Then, for any sufficiently small ε, δ > 0 , and m ∈ N , there exists δ ′ = Θ ( δ · ε m log(1 /δ ) ) such that

Even though Theorem 11 might be easier to interpret, we note that it does not result in as sharp a bound as Theorem 10 in some scenarios. For example, if we use Theorem 11 under the assumption in Corollary 3, then the privacy-independent part would be 1 √ m · log(1 /δ ) 1 . 5 ε · n T stat , instead of 1 m · n T stat implied by Theorem 10. (On the other hand, the privacy-dependent part is the same.)

The remainder of this section is devoted to the proof of Theorem 10. The high-level structure follows the overview in Section 1.1.1: first we show in Section 3.1 that any item-level DP algorithm satisfies sample perfect generalization. Section 3.2.1 then relates this to a local version of user-level DP. We then describe the full algorithm and its guarantees in Section 3.2.2. Since we fix a task T throughout this section, we will henceforth discard the superscript T for brevity.

3.1 DP Implies Sample Perfect Generalization

We begin with the definition of sample perfect generalization algorithms.

Definition 12 ([CLN + 16]) . For β, ε, δ > 0 , an algorithm A : Z n →O is said to be ( β, ε, δ ) -sample perfectly generalizing iff, for any distribution D (over Z ), Pr x , x ′ ∼D n [ A ( x ) ≈ ε,δ A ( x ′ )] ≥ 1 -β .

The main result of this subsection is that any ( ε, δ ) -item-level DP algorithm is ( β, O ( ε √ n log( 1 / βδ )) , O ( nδ )) -sample perfectly generalizing:

Theorem 13 (DP ⇒ Sample Perfect Generalization) . Suppose that A : Z n →O is ( ε, δ ) -item-level DP, and assume that ε, δ, β, ε √ n log( 1 / βδ ) > 0 are sufficiently small. Then, A is ( β, ε ′ , δ ′ ) -sample perfectly generalizing, where ε ′ ≤ O ( ε √ n log( 1 / βδ )) and δ ′ = O ( nδ ) .

3.1.1 Bounding the Expected Divergence

As a first step, we upper bound the expectation of the hockey stick divergence d ε ′ ( A ( x ) ∥ A ( x ′ )) :

Lemma 14. Suppose that A : Z n →O is an ( ε, δ ) -item-level DP algorithm. Further, assume that ε, δ , and ε √ n log( 1 / δ ) > 0 are sufficiently small. Then, for ε ′ = O ( ε √ n log( 1 / δ )) , we have

This proof follows an idea from [CLN + 16], who prove a similar statement for pure-DP algorithms (i.e., δ = 0 ). For every output o ∈ O , they consider the function g o : Z n → R defined by g o ( x ) := ln(Pr[ A ( x ) = o ]) . The observation here is that, in the pure-DP case, this function is ε -Lipschitz (i.e., changing a single coordinate changes its value by at most ε ). They then apply McDiarmid's inequality on g o to show that the function values are well-concentrated with a variance of O ( √ n · ε ) . This suffices to prove the above statement for the case where the algorithm is pure-DP (but the final bound still contains δ ). To adapt this proof to the approximate-DP case, we prove a 'robust' version of McDiarmid's inequality that works even for the case where the Lipschitz property is violated on some pairs of neighbors (Lemma 32). This inequality is shown by arguing that we may change the function 'slightly' to make it multiplicative-Lipschitz, which then allows us to apply standard techniques. Due to space constraints, we defer the full proof, which is technically involved, to Appendix C.3.

3.1.2 Boosting the Probability: Proof of Theorem 13

While Lemma 14 bounds the expectation of the hockey stick divergence, it is insufficient to get arbitrarily high probability bound (i.e., for any β as in Theorem 13); for example, using Markov's inequality would only be able to handle β > δ ′ . However, we require very small β in a subsequent step of the proofs (in particular Theorem 17). Fortunately, we observe that it is easy to 'boost' the β to be arbitrarily small, at an additive cost of ε √ n log( 1 / β ) in the privacy loss.

To do so, we will need the following concentration result of Talagrand 6 for product measures:

Theorem 15 ([Tal95]) . For any distribution D over Z , E ⊆ Z n , and t > 0 , if Pr x ∼D n [ x ∈ E ] ≥ 1 / 2 , then Pr x ∼D n [ x ∈ E ≤ t ] ≥ 1 -0 . 5 exp ( -t 2 / 4 n ) , where E ≤ t := { x ′ ∈ Z n | ∃ x ∈ E , ∥ x ′ -x ∥ 0 ≤ t } .

Proof of Theorem 13. We consider two cases based on whether β ≥ 2 -n or not. Let us start with the case that β ≥ 2 -n . From Lemma 14, for ε ′′ = O ( ε √ n log( 1 / δ )) , we have

Let E ⊆ Z n ×Z n denote the set of (˜ x , ˜ x ′ ) such that A (˜ x ) ≈ ε ′′ , 4 δ ′′ A (˜ x ′ ) . By Markov's inequality, we have that Pr x , x ′ ∼D n [ d ε ′′ ( A (˜ x ) ∥ A (˜ x ′ )) ≤ 4 δ ′′ ] ≥ 3 / 4 and Pr x , x ′ ∼D n [ d ε ′′ ( A (˜ x ′ ) ∥ A (˜ x )) ≤ 4 δ ′′ ] ≥ 3 / 4 and hence Pr x , x ′ ∼D n [( x , x ′ ) ∈ E ] ≥ 1 / 2 . By Theorem 15, for t = O ( √ n log(1 /β )) , we have

Next, consider any ( x , x ′ ) ∈ E ≤ t . Since there exists (˜ x , ˜ x ′ ) ∈ E such that ∥ x -˜ x ∥ 0 , ∥ x ′ -˜ x ′ ∥ 0 ≤ t , we may apply Lemma 6 to conclude that d εt ( A ( x ) ∥ A (˜ x )) , d εt ( A (˜ x ′ ) ∥ A ( x ′ )) ≤

O ( tδ ) . Furthermore, since d ε ′′ ( A (˜ x ) ∥ A (˜ x ′ )) ≤ 4 δ ′′ , we may apply Lemma 5 to conclude that d ε ′ ( A ( x ) ∥ A ( x ′ )) ≤ δ ′ where ε ′ = ε ′′ +2 tε = O ( ε √ n log( 1 / βδ )) and δ ′ = O ( δ ′′ + tδ ) = O ( nδ ) . Similarly, we also have d ε ′ ( A ( x ′ ∥ A ( x )) ≤ δ ′ . In other words, A ( x ) ≈ ε ′ ,δ ′ A ( x ′ ) . Combining this and the above inequality implies that A is ( β, ε ′ , δ ′ ) -sample perfectly generalizing as desired.

For the case β < 2 -n , we may immediately apply group privacy (Lemma 6). Since any x , x ′ ∼ D n satisfies ∥ x -x ′ ∥ 0 ≤ n , we have A ( x ) ≈ ε ′ ,δ ′ A ( x ′ ) for ε ′ = nε and δ ′ = O ( nδ ) . This implies that A is ( β, ε ′ , δ ′ ) -sample perfectly generalizing (in fact, (0 , ε ′ , δ ′ ) -sample perfectly generalizing), which concludes our proof.

3.2 From Sample Perfect Generalization to User-Level DP

Next, we will use the sample perfect generalization result from the previous subsection to show that our algorithm satisfies a certain definition of a local version of user-level DP. We then finally turn this intuition into an algorithm and prove Theorem 10.

3.2.1 Achieving Local-Deletion DP

We start by defining local-deletion DP (for user-level DP). As alluded to earlier, this definition only considers x -i for different i 's. We also define the multi-deletion version where we consider x -S for all subsets S of small size.

Definition 16 (Local-Deletion DP) . An algorithm A is ( ε, δ ) -local-deletion DP (abbreviated LDDP ) at input x if A ( x -i ) ≈ ε,δ A ( x -i ′ ) for all i, i ′ ∈ [ n ] . Furthermore, for r ∈ N , an algorithm A is ( r, ε, δ ) -local-deletion DP at x if A ( x -S ) ≈ ε,δ A ( x -S ′ ) for all S, S ′ ⊆ [ n ] such that | S | = | S ′ | = r .

Below we show that, with high probability (over the input x ), any item-level DP algorithm satisfies LDDP with the privacy loss increased by roughly r √ m . The proof uses the crucial observation that relates sample perfect generalization to user-level DP.

Theorem 17. Let n, r ∈ N with r ≤ n , and let A : X ( n -r ) m → O be any ( ε ′ , δ ′ ) -item-level DP algorithm. Further, assume that ε ′ , δ ′ , ε ′ r √ m log( n / βδ ′ ) > 0 are sufficiently small. Then, for any distribution D ,

where ε = O ( ε ′ r √ m log( n / βδ ′ )) and δ = O ( rmδ ′ ) .

Proof. Let β ′ = β / ( n r ) 2 . Consider any fixed S, S ′ ⊆ [ n ] such that | S | = | S ′ | = r . Let T = S ∪ S ′ , t = | T | , U = S ′ ∖ S, U ′ = S ∖ S ′ , q = | U | = | U ′ | , and let A ′ x -T denote the algorithm defined by A ′ x -T ( y ) = A ( x -T ∪ y ) .

Thus, for any fixed x -T ∈ Z ( n -t ) m , Theorem 13 implies that

where ε = O ( ε ′ √ qm log( 1 / β ′ δ ′ )) ≤ O ( ε ′ r √ m log( n / βδ ′ )) and δ = O ( rmδ ′ ) .

Notice that A ′ x -T ( x U ) = A ( x -S ) and A ′ x -T ( x U ′ ) = A ( x -S ′ ) . Thus, we have

Hence, by taking a union bound over all possible S, S ′ ⊆ [ n ] such that | S | = | S ′ | = r , we have Pr x ∼D nm [ A is not ( r, ε, δ ) -LDDP at x ] ≤ β as desired.

3.2.2 From LDDP to DP via Propose-Test-Release

Our user-level DP algorithm is present in Algorithm 1. Roughly speaking, we try to find a small subset S such that x -S is LDDP with appropriate parameters. (Throughout, we assume that n ≥ 4 κ

where κ is from Definition 8.) The target size of S is noised using the discrete Laplace distribution. As stated in Section 1.1.1, the algorithm is very similar to that of [GKK + 23], with the main difference being that (i) X R 1 stable is defined based on LDDP instead of the local deletion sensitivity and (ii) our output is A ( x -T ) , whereas their output is the function value with Gaussian noise added. It is not hard to adapt their proof to show that our algorithm is ( ε, δ ) -user-level DP, as stated below. (Full proof is deferred to Appendix C.4.)

Lemma 18 (Privacy Guarantee) . DelStab ε,δ, A is ( ε, δ ) -user-level DP.

Algorithm 1 DelStab ε,δ, A ( x ) 1: Input: Dataset x ∈ X nm 2: Parameters: Privacy parameters ε, δ , Algorithm A : X ( n -4 κ ) m →O 3: ε ← ε 3 , δ ← δ e 2 ε + e ε +2 , κ ← κ ( ε, δ ) . 4: Sample R 1 ∼ TDLap ( ε, δ ) {See Definition 8} 5: X R 1 stable ← { S ⊆ [ n ] : | S | = R 1 , A is (4 κ -R 1 , ε, δ ) -LDDP at x -S } {See Definition 16} 6: if |X R 1 stable | = ∅ then 7: return ⊥ 8: Choose S ∈ X R 1 stable uniformly at random 9: Choose T ⊇ S of size 4 κ uniformly at random 10: return A ( x -T )

Next, we prove the utility guarantee under the assumption that A is item-level DP:

Lemma19 (Utility Guarantee) . Let ε, δ > 0 be sufficiently small. Suppose that A is ( ε ′ , δ ′ ) -item-level DP such that ε ′ = Θ ( ε κ √ m log( nm/δ ) ) and δ ′ = Θ ( δ κm ) . If A is γ -useful for any task T with ( n -4 κ ) m samples, then DelStab ε,δ, A is ( γ -o (1)) -useful for T (with nm samples).

Proof. Consider another algorithm A 0 defined in the same way as DelStab ε,δ, A except that on Line 5, we simply let X R 1 stable ← ( [ n ] R 1 ) . Note that A 0 ( x ) is equivalent to randomly selecting n -4 κ users and running A on it. Therefore, we have Pr x ∼D nm [ A 0 ( x ) ∈ Ψ T ] = Pr x ∼D ( n -4 κ ) m [ A ( x ) ∈ Ψ T ] ≥ γ

Meanwhile, A 0 and DelStab ε,δ, A are exactly the same as long as X R 1 stable ( x ) = ( [ n ] R 1 ) in the latter. In other words, we have

̸

where in the last inequality we apply Theorem 17 with, e.g., β = 0 . 1 / nm .

Putting Things Together. Theorem 10 is now 'almost' an immediate consequence of Lemmas 18 and 19 (using κ = O (log(1 /δ ) /ε ) ). The only challenge here is that ε ′ required in Lemma 19 depends polylogarithmically on n . Nonetheless, we show below via a simple subsampling argument that this only adds polylogarithmic overhead to the user/sample complexity.

Proof of Theorem 10. Let ε ′ = ε ′ ( n ) , δ ′ be as in Lemma 19. Furthermore, let ε ′′ = ε 2 log(1 /δ ) √ m log( m/δ ) . Notice that ε ′ ( n ) /ε ′′ ≤ (log n ) O (1) . Let N ∈ N be the smallest number such that N is divisible by m and

Observe that N ≤ ˜ O ( mκ + n 1 ( ε ′′ , δ ′ )) .

From the definition of n 1 , there exists an ( ε ′′ , δ ′ ) -item-level DP algorithm A 0 that is γ -useful for T with sample complexity n 1 ( ε ′′ , δ ′ ) . We start by constructing an algorithm A on N samples as follows: randomly sample (without replacement) n 1 ( ε ′′ , δ ′ ) out of N items, then run A 0 on this

subsample. By amplification-by-subsampling (Theorem 7), we have that A is ( ε ′ ( n ) , δ ′ ) -item-level DP for n = N/m +4 κ . Thus, by Lemma 18 and Lemma 19, we have that DelStab ε,δ, A is ( ε, δ ) -DP and ( γ -o (1)) -useful for T . Its user complexity is

4 Pure-DP: PAC Learning

In this section we prove Theorem 4. Let z denote the input and for i ∈ [ n ] , let z i = (( x i, 1 , y i, 1 ) , . . . , ( x i,m , y i,m )) denote the input to the i th user. A concept class is a set of functions of the form X → { 0 , 1 } . For T ⊆ X × { 0 , 1 } , we say that it is realizable by c : X → { 0 , 1 } iff c ( x ) = y for all ( x, y ) ∈ T . Recall the definition of PRDim :

̸

Definition 20 ([BNS19]) . A distribution P on concept classes is an ( α, β ) -probabilistic representation (abbreviated as ( α, β ) -PR ) of a concept class C if for every c ∈ C and for every distribution D X on X , with probability 1 -β over H ∼ P , there exists h ∈ H such that Pr x ∼D X [ c ( x ) = h ( x )] ≤ α .

The ( α, β ) -PR dimension of C is defined as PRDim α,β ( C ) := min ( α,β ) -PR P of C size( P ) , where size( P ) := max H∈ supp( P ) log |H| . Furthermore, let the probabilistic representation dimension of C be PRDim( C ) := PRDim 1 / 4 , 1 / 4 ( C ) .

Lemma 21 ([BNS19]) . For any C and α ∈ (0 , 1 / 2) , PRDim α, 1 / 4 ( C ) ≤ ˜ O (PRDim( C ) · log(1 /α )) .

Proof of Theorem 4. The lower bound ˜ Ω( d/ε ) was shown in [GKM21] (for any value of m ). The lower bound ˜ Ω ( d εαm ) follows from the lower bound of ˜ Ω ( d εα ) on the sample complexity in the item-level setting by [BNS19] and the observation that any ( ε, δ ) -user-level DP algorithm is also ( ε, δ ) -item-level DP with the same sample complexity. Thus, we may focus on the upper bound.

It suffices to only prove the upper bound ˜ O ( d ε + d εαm ) assuming 7 m ≤ 1 /α . Let P denote a (0 . 01 α, 1 / 4) -PR of C ; by Lemma 21, there exists such P with size( P ) ≤ ˜ O ( d · log(1 /α )) . Assume that the number n of users is at least κ · size( P ) εαm = ˜ O ( d εαm ) , where κ is a sufficiently large constant. Our algorithm works as follows: Sample H ∼ P and then run the ε -DP EM (Theorem 9) on candidate set H with the scoring function scr h ( z ) := ∑ i ∈ [ n ] 1 [ z i is not realizable by h ] .

Observe that the sensitivity of scr h is one. Indeed, this is where our 'clipping' has been applied: a standard item-level step would sum up the error across all the samples, resulting in the sensitivity as large as m , while our scoring function above 'clips' the contribution of each user to just one.

A simple concentration argument (deferred to Appendix D) gives us the following:

Lemma 22. With probability 0.9 (over the input), the following hold for all h ∈ H :

(i) If err D ( h ) ≤ 0 . 01 α , then scr h ( z ) ≤ 0 . 05 αnm .

(ii) If err D ( h ) > α , then scr h ( z ) > 0 . 1 αnm .

We now assume that the event in Lemma 22 holds and finish the proof. Since a P is a (0 . 01 α, 1 / 4) -PR of C , with probability 3 / 4 , we have that there exists h ∗ ∈ H such that err D ( h ∗ ) ≤ 0 . 01 α . From Lemma 22(i), we have scr h ∗ ( z ) ≤ 0 . 05 αnm . Thus, by Theorem 9, with probability 2 / 3 , the algorithm outputs h that satisfies scr h ( z ) ≤ 0 . 05 αnm + O (size( P ) /ε ) , which, for a sufficiently large κ , is at most 0 . 1 αnm . By Lemma 22(ii), this implies that err D ( h ) ≤ α as desired.

5 Conclusion and Open Questions

We presented generic techniques to transform item-level DP algorithms to user-level DP algorithms.

There are several open questions. Although our upper bounds are demonstrated to be tight for many tasks discussed in this work, it is not hard to see that they are not always tight 8 ; thus, an important research direction is to get a better understanding of the tight user complexity bounds for different learning tasks.

On a more technical front, our transformation for approximate-DP (Theorem 10) has an item-level privacy loss (roughly) of the form ε 2 √ m log(1 /δ ) 3 while it seems plausible that ε √ m log(1 /δ ) can be achieved; an obvious open question is to give such an improvement, or show that it is impossible. We note that the extra factor of log(1 /δ ) / ε comes from the fact that Algorithm 1 uses LDDP with distance O ( κ ) = O ( log(1 /δ ) / ε ) . It is unclear how one could avoid this, given that the propose-test-release framework requires checking input at distance O ( log(1 /δ ) / ε ) .

Another limitation of our algorithms is their computational inefficiency, as their running time grows linearly with the size of the possible outputs. In fact, the approximate-DP algorithm could even be slower than this since we need to check whether A is LDDP at a certain input x (which involves computing d ε ( A -S ∥ A -S ′ ) ). Nevertheless, given the generality of our results, it is unlikely that a generic efficient algorithm exists with matching user complexity; for example, even the algorithm for user-level DP-SCO in [GKK + 23] has a worst case running time that is not polynomial. Thus, it remains an interesting direction to devise more efficient algorithms for specific tasks.

Finally, while our work has focused on the central model of DP, where the algorithm gets the access to the raw input data, other models of DP have also been studied in the context of user-level DP, such as the local DP model [GKM21, ALS23]. Here again, [GKM21, BGH + 23] give a generic transformation that sometimes drastically reduces the user complexity in the example-rich case. Another interesting research direction is to devise a refined transformation for the example-sparse case (like one presented in our paper for the central model) but for the local model.

References

[Abo18] John M Abowd. The US Census Bureau adopts differential privacy. In KDD , pages 2867-2867, 2018.

[ALS23] Jayadev Acharya, Yuhan Liu, and Ziteng Sun. Discrete distribution estimation under user-level local differential privacy. In AISTATS , 2023.

[App17] Apple Differential Privacy Team. Learning with privacy at scale. Apple Machine Learning Journal , 2017.

[ASZ21] Jayadev Acharya, Ziteng Sun, and Huanyu Zhang. Differentially private Assouad, Fano, and Le Cam. In ALT , pages 48-78, 2021.

[BBG18] Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. In NeurIPS , pages 6280-6290, 2018.

[BF16] Raef Bassily and Yoav Freund. Typicality-based stability and privacy. CoRR , abs/1604.03336, 2016.

[BGH + 23] Mark Bun, Marco Gaboardi, Max Hopkins, Russell Impagliazzo, Rex Lei, Toniann Pitassi, Satchit Sivakumar, and Jessica Sorrell. Stability is stable: Connections between replicability, privacy, and adaptive generalization. In STOC , 2023.

[BKSW19] Mark Bun, Gautam Kamath, Thomas Steinke, and Zhiwei Steven Wu. Private hypothesis selection. In NeurIPS , pages 156-167, 2019.

[BNS19] Amos Beimel, Kobbi Nissim, and Uri Stemmer. Characterizing the sample complexity of pure private learners. JMLR , 20:146:1-146:33, 2019.

[CLN + 16] Rachel Cummings, Katrina Ligett, Kobbi Nissim, Aaron Roth, and Zhiwei Steven Wu. Adaptive learning with robust generalization guarantees. In COLT , pages 772-814, 2016.

[DHS15] Ilias Diakonikolas, Moritz Hardt, and Ludwig Schmidt. Differentially private learning of structured discrete distributions. In NIPS , pages 2566-2574, 2015.

[DKM + 06] Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In EUROCRYPT , pages 486-503, 2006.

[DKY17] Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In NeurIPS , pages 3571-3580, 2017.

[DL09] Cynthia Dwork and Jing Lei. Differential privacy and robust statistics. In STOC , pages 371-380, 2009.

[DMNS06] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. Calibrating noise to sensitivity in private data analysis. In TCC , pages 265-284, 2006.

[DMR20] Luc Devroye, Abbas Mehrabian, and Tommy Reddad. The minimax learning rates of normal and Ising undirected graphical models. Electronic Journal of Statistics , 14(1):2338 - 2361, 2020.

[GGKM21] Badih Ghazi, Noah Golowich, Ravi Kumar, and Pasin Manurangsi. Sample-efficient proper PAC learning with approximate differential privacy. In STOC , 2021.

[GKK + 23] Badih Ghazi, Pritish Kamath, Ravi Kumar, Pasin Manurangsi, Raghu Meka, and Chiyuan Zhang. On user-level private convex optimization. In ICML , 2023.

[GKM21] Badih Ghazi, Ravi Kumar, and Pasin Manurangsi. User-level differentially private learning via correlated sampling. In NeurIPS , pages 20172-20184, 2021.

[Gre16] Andy Greenberg. Apple's 'differential privacy' is about collecting your data - but not your data. Wired, June , 13, 2016.

[ILPS22] Russell Impagliazzo, Rex Lei, Toniann Pitassi, and Jessica Sorrell. Reproducibility in learning. In STOC , pages 818-831, 2022.

[KL21] Nitin Kohli and Paul Laskowski. Differential privacy for black-box statistical analyses. In TPDP , 2021.

[KLSU19] Gautam Kamath, Jerry Li, Vikrant Singhal, and Jonathan R. Ullman. Privately learning high-dimensional distributions. In COLT , pages 1853-1902, 2019.

[Kut02] Samuel Kutin. Extensions to McDiarmid's inequality when differences are bounded with high probability. Dept. Comput. Sci., Univ. Chicago, Chicago, IL, USA, Tech. Rep. TR-2002-04 , 2002.

[LSA + 21] Daniel Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mehryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy. In NeurIPS , pages 12466-12479, 2021.

[LSY + 20] Yuhan Liu, Ananda Theertha Suresh, Felix X. Yu, Sanjiv Kumar, and Michael Riley. Learning discrete distributions: user vs item-level privacy. In NeurIPS , 2020.

[MT07] Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In FOCS , pages 94-103, 2007.

[NME22] Shyam Narayanan, Vahab S. Mirrokni, and Hossein Esfandiari. Tight and robust private mean estimation with few users. In ICML , pages 16383-16412, 2022.

[RE19] Carey Radebaugh and Ulfar Erlingsson. Introducing TensorFlow Privacy: Learning with Differential Privacy for Training Data, March 2019. blog.tensorflow.org .

[Tal95] Michel Talagrand. Concentration of measure and isoperimetric inequalities in product spaces. Publications Mathématiques de l'Institut des Hautes Etudes Scientifiques , 81:73-205, 1995.

[TM20] Davide Testuggine and Ilya Mironov. PyTorch Differential Privacy Series Part 1: DPSGD Algorithm Explained, August 2020. medium.com .

[Vad17] Salil P. Vadhan. The complexity of differential privacy. In Tutorials on the Foundations of Cryptography , pages 347-450. Springer International Publishing, 2017.

[War16] Lutz Warnke. On the method of typical bounded differences. Comb. Probab. Comput. , 25(2):269-299, 2016.

A Summary of Results

Our results for pure-DP are summarized in Table 1.

For approximate-DP, our transformation (Theorem 10) is very general and can be applied to any statistical tasks. Due to this, we do not attempt to exhaustively list its corollaries. Rather, we give only a few examples of consequences of Theorem 10 in Table 2. We note that in all cases, we either improve upon previous results or match them up to log(1 /δ ) O (1) ε factor for all values of m .

B Additional Preliminaries

In this section, we list some additional material that is required for the remaining proofs.

For a, b ∈ R such that a ≤ b , let clip a,b : R → R denote the function

For two distributions A,B , we use d tv ( A,B ) := 1 2 ∑ x ∈ supp( A ) ∪ supp( B ) | A ( x ) -B ( x ) | to denote their total variation distance, d KL ( A ∥ B ) := ∑ x ∈ supp( A ) A ( x ) · log( A ( x ) /B ( x )) to denote their Kullback-Leibler divergence, and d χ 2 ( A ∥ B ) := ∑ x ∈ supp( A ) ( A ( x ) -B ( x )) 2 B ( x ) to denote the χ 2 -divergence. We use A k to denote the distribution of k independent samples drawn from A . The following three well-known facts will be useful in our proofs.

Lemma 23. For any two distributions A and B ,

We use ∥ u ∥ 0 to denote the Hamming 'norm' 9 of u , i.e., the number of non-zero coordinates of u . The following is a well-known fact (aka constant-rate constant-distance error correcting codes ), which will be useful in our lower bound proofs.

Theorem 24. For d ∈ N , there are u 1 , . . . , u W ∈ { 0 , 1 } d for W = 2 Ω( d ) such that ∥ u i -u j ∥ 0 ≥ Ω( d ) for all distinct i, j ∈ [ W ] .

B.1 Concentration Inequalities

Next, we list a few concentration inequalities in convenient forms for subsequent proofs.

Chernoff bound. We start with the standard Chernoff bound.

Lemma 25 (Chernoff Bound) . Let X 1 , . . . , X n denote i.i.d. Bernoulli random variables with success probability p . Then, for all δ > 0 , we have

McDiarmid's inequality. For a distribution D on Z , and a function g : Z n → R , let µ D n ( g ) := E x ∼D n [ g ( x )] . We say that g is a c -bounded difference function iff | g ( x ) -g ( x ′ ) | ≤ c for all x , x ′ ∈ Z n that differ on a single coordinate (i.e., ∥ x -x ′ ∥ 0 = 1 ).

Lemma 26 (McDiarmid's inequality) . Let g : Z n → R be any c -bounded difference function. Then, for all t > 0

We will also use the following consequence of Azuma's inequality.

Lemma 27. Let C 1 , . . . , C n be sequence of random variables. Suppose that | C i | ≤ α almost surely and that γ ≤ E [ C i | C 1 = c 1 , . . . , C i -1 = c i -1 ] ≤ 0 for any c 1 , . . . , c i -1 . Then, for every G > 0 , we have Pr [ nγ -α √ nG ≤ ∑ i ∈ [ n ] C i ≤ α √ nG ] ≥ 1 -2 exp ( -G/ 2) .

and,

B.2 Observations on Item-level vs User-level DP

Here we list a couple of trivial observations on the user / sample complexity in the item vs user-level DP settings.

Observation 28. Let T be any task and γ > 0 be a parameter. Then, for any ε, δ ≥ 0 , and m ∈ N , it holds that

n T m ( ε, δ ; γ ) ≤ n T 1 ( ε, δ ; γ ) , and

n T m ( ε, δ ; γ ) ≥ ⌈ n T 1 ( ε, δ ; γ ) /m ⌉ .

Proof. Both parts follow by simple reductions as given below.

Let A be an ( ε, δ ) -item-level DP γ -useful algorithm for T . Then, in the user-level DP algorithm, each user can simply throw away all-but-one example and run A . Clearly, this algorithm is ( ε, δ ) -user-level DP and is γ -useful for T . The user complexity remains the same.

Let A be an ( ε, δ ) -user-level DP γ -useful algorithm for T with user complexity n T m ( ε, δ ; γ ) . Then, in the item-level DP algorithm, if there are N = m · n T m ( ε, δ ; γ ) users, we can just run A by grouping each m examples together into a 'super-user'. Clearly, this algorithm is also ( ε, δ ) -itemlevel DP and has user complexity m · n T m ( ε, δ ; γ ) . Thus, we have m · n T m ( ε, δ ; γ ) ≤ n T 1 ( ε, δ ; γ ) .

C Missing Details from Section 3

C.1 DP Implies Perfect Generalization

We start by recalling the definition of perfectly generalizing algorithms.

Definition 29 (Perfect generalization [CLN + 16, BF16]) . For β, ε, δ > 0 , an algorithm A : Z n →O is said to be ( β, ε, δ ) -perfectly generalizing iff, for any distribution D (over Z ), there exists a distribution SIM D such that

It is known that perfect generalization and sample perfect generalization (Definition 12) are equivalent:

Lemma 30 ([CLN + 16, BGH + 23]) . Any ( β, ε, δ ) -perfectly generalizing algorithm is also ( β, 2 ε, 3 δ ) -sample perfectly generalizing. Any ( β, ε, δ ) -sample perfectly generalizing algorithm is also ( √ β, ε, δ + √ β ) -perfectly generalizing; furthermore, this holds even when we set SIM D to be the distribution of A ( x ) where x ∼ D m .

Thus, by plugging the above into Theorem 13, we immediately arrive at the following theorem, which shows that any ( ε, δ ) -DP algorithm is ( β, ˜ O ( ε √ n ) , O ( nδ )) -perfectly generalizing. This resolves an open question of [CLN + 16].

Theorem 31 (DP implies perfect generalization) . Suppose that A is an ( ε, δ ) -item-level DP algorithm. Further, assume that ε, δ, β , and ε √ n log( 1 / βδ ) are sufficiently small. Then, A is ( β, ε ′ , δ ′ ) -perfectly generalizing, where ε ′ ≤ O ( ε √ n log( 1 / βδ )) and δ ′ = O ( nδ ) .

Furthermore, this holds even when we set SIM D to be the distribution of A ( x ) where x ∼ D n .

We remark that Bun et al. [BGH + 23] showed that any ( ε, δ ) -DP algorithm can be 'repackaged' to an ( β, ε ′ , δ ′ ) -perfectly generalizing algorithm with similar parameters as our theorem above. However, unlike our result, their proof does not show that the original algorithm is perfectly generalizing.

C.2 Achieving the Same ε via Subsampling: Proof of Theorem 11

Proof of Theorem 11. Let ε ′′ = ε 2 log(1 /δ ) √ m log( m/δ ) . We claim that n 1 ( ε ′′ , δ ′ ) ≤ n 1 ( ε, δ ′ ) · O ( ε/ε ′′ ) ; the lemma follows from this claim by simply plugging this bound into Theorem 10.

To see that this claim holds, by definition of n 1 , there exists an ( ε, δ ′ ) -item-level DP algorithm A 0 that is γ -useful for T with sample complexity n 1 ( ε, δ ′ ) . Let N ∈ N be a smallest number such that

Notice that we have N ≤ n 1 ( ε, δ ′ ) · O ( ε/ε ′′ ) . Let A be an algorithm on N samples defined as follows: randomly sample (without replacement) n 1 ( ε, δ ′ ) out of N samples, then run A 0 on this subsample. By the amplification-by-subsampling theorem (Theorem 7), we have that A is ( ε ′′ , δ ′ ) -item-level DP. It is also obvious that the output distribution of this algorithm is the same as that of A 0 on n 1 ( ε, δ ′ ) examples, and this algorithm is thus also γ -useful for T . Thus, we have n 1 ( ε ′′ , δ ′ ) ≤ N ≤ n 1 ( ε, δ ′ ) · O ( ε/ε ′′ ) as desired.

C.3 Proof of Lemma 14

C.3.1 'Robust' McDiarmid Inequality for Almost-Multiplicative-Lipschitz function

We derive the following concentration inequality, which may be viewed as a strengthened McDiarmid's inequality (Lemma 26) for the multiplicative-Lipschitz case. To state this, let us define an additional notation: for x ∈ Z n , ˜ x i ∈ Z , we write ˜ x ( i ) to denote x but with x i replaced by ˜ x i .

Lemma 32. Let f : Z n → R ≥ 0 be any function and D any distribution on Z . Assume that ε, δ > 0 , and ε √ n log( 1 / δ ) > 0 are sufficiently small. Then, for ε ′ = O ( ε √ n log( 1 / δ )) , we have

When the second term in the RHS (i.e., O ( ∑ n i =1 E x , ˜ x ∼D n [ f ( x ) -e ε · f (˜ x ( i ) ) ] + ) ) is zero, our lemma is (essentially) the same as McDiarmid's inequality for multiplicative-Lipschitz functions, as proved, e.g., in [CLN + 16]. However, our bound is more robust, in the sense that it can handle the case where the multiplicative-Lipschitzness condition fails sometimes; this is crucial for the proof of Lemma 14 as we only assume approximate-DP.

We note that, while there are (additive) McDiarmid's inequalities that does not require Lipschitzness everywhere [Kut02, War16], we are not aware of any version that works for us due to the regime of parameters we are in and the assumptions we have. This is why we prove Lemma 32 from first principles. The remainder of this subsection is devoted to the proof of Lemma 32.

Scalar Random Variable Adjustment for Bounded Ratio. For the rest of this section, we write z ≈ ε z ′ where z, z ′ ∈ R ≥ 0 to indicate that z ∈ [ e -ε z ′ , e ε z ′ ] . We extend the notion similarly to R ≥ 0 -valued random variables: for a R ≥ 0 -valued random variable Z and z ∈ R ≥ 0 , we write Z ≈ ε z ′ if z ≈ ε z ′ for each z ∈ supp( Z ) . Furthermore, for (possibly dependent) R ≥ 0 -valued random variables Z, Z ′ , we write Z ≈ ε Z ′ to denote z ≈ ε z ′ for all ( z, z ′ ) ∈ supp(( Z, Z ′ )) .

Suppose Z is a R ≥ 0 -valued random variable such that any two values z, ˜ z ∈ supp( Z ) satisfies z ≈ ε ˜ z . Then, we also immediately have that their mean µ is in this range and thus Z ≈ ε µ . We start by showing a 'robust' version of this statement, which asserts that, even if the former condition fails sometimes, we can still 'move' the random variable a little bit so that the second condition holds (albeit with weaker 2 ε bound). The exact statement is presented below.

Lemma 33. Let ε, µ ∗ ≥ 0 . Let Z be any R ≥ 0 -valued random variable and µ := E [ Z ] . Then, there exists a random variable Z ′ , which is a post-processing of Z , such that

(i) Z ′ ≈ 2 ε µ ∗ .

(ii) E [ Z ′ ] = µ ∗ .

Proof. Let ℓ = e -ε · µ, r = e ε · µ . We start by defining ˆ Z := clip ℓ,r ( Z ) . This also gives a canonical coupling between ˆ Z and Z , which then yields

where the inequality follows from the convexity of [ · ] + .

Define ˆ µ := E ˆ Z [ ˆ Z ] . Note that we have

Next, consider two cases based on µ, µ ∗ .

Case I: µ > e ε · µ ∗ or µ < e -ε · µ ∗ . We assume w.l.o.g. that µ > e ε · µ ∗ ; the case µ < e -ε · µ ∗ can be argued similarly. In this case, simply set Z ′ = µ ∗ always. Obviously, items (i) and (ii) hold. Moreover, we have

where ( ⋆ ) follows from ˆ Z ≥ e -ε µ ≥ µ ∗ . Combining the above inequality with (2) yields the desired bound in item (iii).

Case II: µ ∗ ≈ ε µ . In this case, we already have supp( ˆ Z ) ⊆ [ e -ε · µ, e ε · µ ] ⊆ [ e -2 ε µ ∗ , e 2 ε µ ∗ ] . We assume w.l.o.g. that ˆ µ ≥ µ ∗ ; the case ˆ µ ≤ µ ∗ can be handled similarly. In this case, let f : [ ℓ, r ] → R be defined by f ( τ ) := E ˆ Z [clip ℓ,τ ( ˆ Z )] . Notice that f is continuous, f ( ℓ ) = ℓ ≤ µ ∗ and f ( r ) = ˆ µ ≥ µ ∗ . Thus, there exists τ ∗ such that f ( τ ∗ ) = µ ∗ . We then define Z ′ by Z ′ := clip ℓ,τ ∗ ( ˆ Z ) . This immediately satisfies items (i) and (ii). Furthermore, this gives a natural coupling between Z ′ , ˆ Z (and also Z ) such that

Concentration for Bounded-Ratio Martingales. Since we will be applying Lemma 27 on the logarithm of the ratios of random variables, it is crucial to bound its expectation. We present a bound below. Note that similar statements have been used before in DP literature; we present the (simple) proof here for completeness.

Lemma 34. Let Z be any R > 0 -valued random variable such that E [ Z ] = 1 . For any sufficiently small ε > 0 , if Z ≈ ε 1 , then -8 ε 2 ≤ E [ln Z ] ≤ 0 .

Proof. By the concavity of ln( · ) , we get E [ln Z ] ≤ ln E [ Z ] = 0 .

. This implies that

We are now ready to give a concentration inequality for martingales with bounded ratios. Note that the lemma below is stated in an 'expected deviation from [ e -ε ′ · µ, e ε ′ · µ ] ' form since it will be more convenient to use in a subsequent step.

Lemma 35. Assume that ε, δ > 0 , and ε √ n log( 1 / δ ) > 0 are sufficiently small. Let Y 1 , . . . , Y n be a R ≥ 0 -valued martingale such that Y i ≈ ε Y i -1 almost surely, and µ := E [ Y 1 ] . Then, we have

where ε ′ = O ( ε √ n log(1 /δ ))

Proof. Let τ = 100log(1 /δ ) . Consider C 1 , . . . , C n defined by C i := ln( Y i /Y i -1 ) , where we use the convention Y 0 := µ . By our assumption, we have | C i | ≤ ε . Furthermore, Lemma 34 implies that -8 ε 2 ≤ E [ Y i | Y i -1 = y i -1 , . . . , Y 1 = y 1 ] ≤ 0 for all y i -1 , . . . , y 1 . Let γ := -8 ε 2 . Applying Lemma 27, the following holds for all G > 0 :

This is equivalent to

Thus, we have

where the second inequality follows from the assumption that ε √ n log( 1 / δ ) is sufficiently small. Furthermore, we have

where the second and third inequalities are from our choice of τ .

Combining the previous two inequalities yields the desired bound for ε ′ = ε nτ .

√

Putting Things Together: Proof of Lemma 32. Our overall strategy is similar to the proof for the always-bounded case, which is to set up a martingale from suffix averages and then apply Lemma 35. The main modification is that, instead of using this argument directly on f (and its suffix averages), we use it on a different function, which is the result of applying Lemma 33 to f .

Proof of Lemma 32. For convenience, let µ := µ D n ( f ) . Let us first extend the function f to include prefixes (i.e., f : Z ≤ n → R ≥ 0 ) naturally as follows:

Next, we construct a function g : Z ≤ n → R ≥ 0 as follows:

g ( ∅ ) = f ( ∅ ) (which is equal to µ )

For i = 1 , . . . , n :

-For all ( x 1 , . . . , x i -1 ) ∈ Z i -1 :

The coupling between ( Z, Z ′ ) is naturally also a coupling between ( x i , Z ′ ) for x i ∈ Z . Let g ( x 1 , . . . , x i ) = Z ′ based on this coupling for all x i ∈ Z .

Apply Lemma 33 with µ ∗ := g ( x 1 , . . . , x i -1 ) and Z = f ( x 1 , . . . , x i -1 , X i ) , where X i ∼ D to get a random variable Z ′ .

For brevity, let ρ = 2(1 + e -ε ) . We have

where the inequality is from Lemma 33(iii).

By repeatedly applying the above argument (to the first term), we arrive at

Recall from the definition that f ( x ≤ i -1 , x i ) = E x >i ∼D n -i [ f ( x ≤ i -1 , x i , x >i )] and f ( x ≤ i -1 , x ′ i ) = E x >i ∼D n -i [ f ( x ≤ i -1 , x ′ i , x >i )] . Thus, by the convexity of [ · ] + , we further have

Next, let Y 0 , Y 1 , . . . , Y n be a sequence of random variables defined by sampling x 1 , . . . , x n ∼ D n and letting Y i := g ( x 1 , . . . , x i ) . By Lemma 33(ii), we have that Y 1 , . . . , Y n is a martingale. Lemma 33(i) further implies that Y i -1 ≈ 2 ε Y i . Thus, we may apply Lemma 35 to arrive at

for ε ′ = O ( ε √ n log(1 /δ )) . Note that this is equivalent to

We can now derive the bound on the desired quantity as follows:

C.3.2 Putting Things Together: Proof of Lemma 14

Lemma 14 is now a simple consequence of Lemma 32.

Proof of Lemma 14. For every o ∈ O and x ∈ Z n , let f o ( x ) := Pr[ A ( x ) = o ] . Applying Lemma 32 to f o , we get

where ε ′ = O ( ε √ n log(1 /δ )) .

Summing this up over all o ∈ O , we get

where the second inequality follows from the assumption that A is ( ε, δ ) -item-level DP, which implies d ε ( A ( x ) ∥ A (˜ x ( i ) )) ≤ δ .

C.4 Privacy Analysis of Algorithm 1

Here we prove the privacy guarantee (Lemma 18) of Algorithm 1. This mostly follows the proof for the analogous algorithm in [GKK + 23].

We start with the following observation.

̸

Observation 36. For user-level neighboring datasets x , x ′ , and all r 1 ∈ { 0 , . . . , n -1 } , if X r 1 stable ( x ′ ) = ∅ , then X r 1 +1 stable ( x ) = ∅ .

̸

Proof. Let i ∈ [ n ] be such that x -i = x ′ -i , and let x ′ -S ′ be an element of X r 1 stable ( x ′ ) . Select S such that | S | = r 1 +1 and S ⊇ S ′ ∪ { i } . It is obvious from definition that x S ∈ X r 1 +1 stable ( x ) .

Proof of Lemma 18. Let x , x ′ be user-level neighboring datasets, and let A be a shorthand for DelStab ε,δ, A . First, we follow the proof of [GKK + 23, Theorem 3.3]:

and for any U 0 ⊆ O , we have

̸

To bound the term Pr[ A ( x ) ∈ U 0 | R 1 = r 1 ] for r 1 < 2 κ , observe that if it is non-zero, then it must be that A ( x ) = ⊥ or equivalently that X r 1 stable ( x ) = ∅ . In this case, we have 10

̸

̸

Since X r 1 stable ( x ) = ∅ , Observation 36 also implies that 11 X r 1 +1 stable ( x ′ ) = ∅ . Thus, we have

̸

Consider an arbitrary pair S ∈ X r 1 stable ( x ) , S ′ ∈ X r 1 +1 stable ( x ′ ) . Let i ∈ [ n ] be such that x -i = x ′ -i . Note that | ( S ∩ S ′ ) ∖ { i }| ≥ n -4 κ . Let J ∗ be any subset of ( S ∩ S ′ ) of size n -4 κ . From S ∈ X r 1 stable ( x ) , we have

for all J ∈ ( S n -4 κ ) , and, from S ′ ∈ X r 1 +1 stable ( x ′ ) , we have

for all J ′ ∈ ( S ′ n -4 κ ) .

Therefore, by arbitrary coupling of S, S ′ , we can conclude that

Plugging this back to (8), we get

Now, consider any set U ⊆ O ∪ {⊥} of outcomes. Let U O = U ∩O and U ⊥ = U ∩{⊥} . Then, we have

Therefore, the algorithm is ( ε, δ ) -user-level DP as desired.

D Missing Details from Section 4

Below we give the proof of Lemma 22.

Proof of Lemma 22. Consider any h ∈ { 0 , 1 } X . Since z i 's are drawn independently from D , we have that 1 [ z i is not realizable by h ] 's are independent Bernoulli random variables with success probability

Consider the two cases:

If err D ( h ) ≤ 0 . 01 α , then we have

Thus, applying Lemma 25, we can conclude that

Thus, when we select κ to be sufficiently large, we have

If err D ( h ) > α , then we have

where in the second inequality we use the fact that αm ≤ 1 . Again, applying Lemma 25, we can conclude that

Thus, when we select κ to be sufficiently large, we have

Finally, taking a union bound over all h ∈ H yields the desired result.

It is also worth noting that the scoring function can be written in the form:

̸

which is similar to what we present below for other tasks.

Finally, we remark that the standard techniques can boost the success probability from 2/3 to an arbitrary probability 1 -β , with a multiplicative factor of log(1 /β ) cost.

E Additional Results for Pure-DP

E.1 Algorithm: Pairwise Score Exponential Mechanism

In this section, we give a user-level DP version of pairwise score exponential mechanism (EM) [BKSW19]. In the proceeding subsections, we will show how to apply this in multiple settings, including agnostic learning, private hypothesis selection, and distribution learning.

Suppose there is a candidate set H . Furthermore, for every pair H,H ′ ∈ H of candidates, there is a 'comparison' function ψ H,H ′ : Z → [ -1 , 1] . For every pair H,H ′ of candidates and any x ∈ Z ∗ , let

We then define scr ψ for each candidate H as

Traditionally, the item-level DP algorithm for pairwise scoring function is to use EM on the above scoring function scr ψ H (where x denote the entire input) [BKSW19]; it is not hard to see that the scr ψ H has (item-level) sensitivity of at most 2 .

User-Level DP Algorithm. We now describe our user-level DP algorithm ClippedPairwiseEM . The algorithm computes:

Then, it simply runs EM using the score scr ψ,τ H with sensitivity ∆ = 2 τ .

To state the guarantee of the algorithm, we need several additional distributional-based definitions of the score:

Note that these distributional scores are normalized, so they are in [ -1 , 1] .

The guarantee of our algorithm can now be stated as follows:

Theorem 37. Let ε, α, β ∈ (0 , 1 / 2] . Assume further that there exists H ∗ such that scr ψ H ∗ ( D ) ≤ 0 . 1 α . There exists an ε -DP algorithm that with probability 1 -β (over the randomness of the algorithm and the input x ∼ ( D m ) n ) outputs H ∈ H such that scr ψ H ( D ) ≤ 0 . 5 α as long as

Proof. We use ClippedPairwiseEM with parameter τ = C ( αm + √ m log (1 /α ) ) and assume that n ≥ C ′ ( τ · log( |H| /β ) εαm + log( |H| /β ) α 2 m ) = ˜ Θ ( log( |H| /β ) ε + log( |H| /β ) αε √ m + log( |H| /β ) α 2 m ) , where C, C ′ are sufficiently large constants. The privacy guarantee follows directly from that of EM, since the (user-level) sensitivity is at most ∆ (due to clipping).

To analyze the utility, we will consider following three events:

E 1 : scr ψ,τ H ( x ) ≤ scr ψ,τ H ∗ ( x ) + 0 . 1 αnm .

E 2 : for all H,H ′ ∈ H : if pscr ψ H,H ′ ( D ) ≤ 0 . 1 α , then pscr ψ H,H ′ ( x ) ≤ 0 . 2 αnm .

E 3 : for all H,H ′ ∈ H : if pscr ψ H,H ′ ( D ) ≥ 0 . 5 α , then pscr ψ H,H ′ ( x ) ≥ 0 . 4 αnm .

When all events hold, E 1 implies that scr ψ,τ H ( x ) ≤ scr ψ,τ H ∗ ( x ) + 0 . 1 αnm . Observe that E 2 implies that scr ψ,τ H ∗ ( x ) ≤ 0 . 2 αnm . Combining these two inequalities, we get scr ψ,τ H ( x ) ≤ 0 . 3 αnm ; then, E 3 implies that pscr ψ H,H ′ ( D ) ≤ 0 . 5 α for all H ′ ∈ D . In turn, this means that scr ψ H ( D ) ≤ 0 . 5 α .

Therefore, it suffices to show that each of Pr[ E 1 ] , Pr[ E 2 ] , Pr[ E 3 ] is at least 1 -β/ 3 .

Bounding Pr[ E 1 ] . To bound the probability of E 1 , recall from Theorem 9 that, with probability 1 -β/ 3 , the guarantee of EM ensures that

From our assumption on n , when C ′ is sufficiently large, then we have O ( log( |H| /β ) ε ) · ∆ = O ( log( |H| /β ) ε · τ ) ≤ 0 . 1 αnm as desired.

Bounding Pr[ E 2 ] and Pr[ E 3 ] . Since the proofs for both cases are analogous, we only show the full argument for Pr[ E 3 ] . Let us fix H,H ′ ∈ H such that pscr ψ H,H ′ ( D ) ≥ 0 . 5 α . We may assume w.l.o.g. that 12 pscr ψ H,H ′ ( D ) = 0 . 5 α := µ .

Notice that pscr ψ,τ H,H ′ ( x ) is a 2 -bounded difference function. As a result, McDiarmid's inequality (Lemma 26) implies that

where the second inequality is due to our choice of n when C ′ is sufficiently large.

To compute µ D nm (pscr ψ,τ H,H ′ ) , observe further that

Now observe once again that pscr ψ H,H ′ : Z m → R is also a 2 -bounded difference function and µ D m (pscr ψ H,H ′ ) = µm . Therefore, McDiarmid's inequality (Lemma 26) yields

where the second inequality is due to our choice of τ when C is sufficiently large. Finally, note that

where the third-to-last inequality follows from Cauchy-Schwarz.

Combining (10), (11), and (13), we can conclude that

′ as desired.

Taking a union bound over H,H ∈ H yields Pr[ E 3 ] ≥ 1 -β/ 3

E.2 Lower Bound: User-level DP Fano's Inequality

As we often demonstrate below that our bounds are (nearly) tight, it will be useful to have a generic method for providing such a lower bound. Here we observe that it is simple to extend the DP Fano's inequality of Acharya et al. [ASZ21] to the user-level DP setting. We start by recalling Acharya et al.'s (item-level) DP Fano's inequality 13 :

Theorem 38 (Item-Level DP Fano's Inequality [ASZ21]) . Let T be any task. Suppose that there exist D 1 , . . . , D W such that, for all distinct i, j ∈ [ W ] ,

Ψ T ( D i ) ∩ Ψ T ( D j ) = ∅ ,

d KL ( D i , D j ) ≤ β , and

d tv ( D i , D j ) ≤ γ .

The bound for the user-level case can be derived as follows.

Lemma 39 (User-Level DP Fano's Inequality) . Let T be any task. Suppose that there exist D 1 , . . . , D W such that, for all distinct i, j ∈ [ W ] ,

Ψ T ( D i ) ∩ Ψ T ( D j ) = ∅ , and,

d KL ( D i , D j ) ≤ β

.

Proof. Let D ′ i = ( D i ) m for all i ∈ [ W ] ; note that d KL ( D ′ i ∥ D ′ j ) ≤ mβ . By Pinsker's inequality (Lemma 23(i)), d tv ( D ′ i ∥ D ′ j ) ≤ O ( √ mβ ) ; furthermore, we also have the trivial bound d tv ( D ′ i ∥ D ′ j ) ≤ 1 . Finally, define a task T ′ by Ψ T ′ ( D ′ i ) := Ψ T ( D i ) for all i ∈ [ W ] . Now, applying Theorem 38,

Finally, observing that n T m ( ε, δ ) = n T ′ 1 ( ε, δ ) yields our final bound.

E.3 Applications

Our user-level DP EM with pairwise score given above has a wide variety of applications. We now give a few examples.

E.3.1 Agnostic PAC Learning

We start with agnostic PAC learning . The setting is exactly the same as in PAC learning (described in the introduction; see Theorem 4) except that we do not assume that D is realizable by some concept in C . Instead, the task agn( C ; α ) seeks an output c : X → { 0 , 1 } such that err D ( c ) ≤ min c ′ ∈C err D ( c ′ ) + α .

Theorem 40. Let C be any concept class with probabilistic representation dimension d (i.e., PRDim( C ) = d ) and let d VC be its VC dimension. Then, for any sufficiently small α, ε > 0 and for all m ∈ N ,

and

Observe that our bounds are (up to polylogarithmic factors) the same except for the d -vsd VC in the last two terms. We remark that the ratio d/d VC is not always bounded; e.g., for thresholds, d VC = 2 while d = Θ(log |Z| ) . A more careful argument can show that d in the last two terms in the upper bound can be replaced by the (maximum) VC dimension of the probabilistic representation (which is potentially smaller); this actually closes the gap in the particular case of thresholds. However, in the general case, the VC dimension of C and the VC dimension of its probabilistic represetation are not necessarily equal. It remains an interesting open question to close this gap.

We now prove Theorem 40. The algorithm is similar to that in the proof of Theorem 4, except that we use the pairwise scoring function to compare the errors of the two hypotheses.

Proof of Theorem 40. Algorithm. For any two hypotheses c, c ′ : X → { 0 , 1 } , let the comparison function between two concepts be ψ c,c ′ (( x, y )) = 1 [ c ( x ) = y ] -1 [ c ′ ( x ) = y ] .

Let P denote a (0 . 01 α, 1 / 4) -PR of C ; by Lemma 21, there exists such P with size( P ) ≤ ˜ O ( d · log(1 /α )) . Our algorithm works as follows: Sample H ∼ P and then run the ε -DP pairwise scoring EM (Theorem 37) on candidate set H with the comparison function ψ c,c ′ defined above. The privacy guarantee follows from that of Theorem 37.

As for the utility, first observe that

This means that, if we let h ∗ ∈ argmin h ∈H err D ( h ) , then scr ψ h ∗ ( D ) ≤ 0 . Thus, Theorem 37 ensures that, w.p. 0.99, if n ≥ ˜ Θ ( size( P ) ε + size( P ) αε √ m + size( P ) α 2 m ) = ˜ Θ ( d ε + d αε √ m + d α 2 m ) , then the output h satisfies scr ψ h ( D ) ≤ 0 . 5 α . By (14), this also means that err D ( h ) ≤ 0 . 5 α +err D ( h ∗ ) . Finally, by the guarantee of P , we have that err D ( h ∗ ) ≤ 0 . 01 α +min c ′ ∈C err D ( c ′ ) with probability 3/4. By a union bound, we can conclude that w.p. more than 2/3, we have err D ( h ) < α +min c ′ ∈C err D ( c ′ ) .

Lower Bound. The lower bound Ω( d/ε ) was shown in [GKM21] (and holds even for realizable PAC learning). To derive the lower bound Ω ( d VC αε √ m + d VC α 2 m ) , we will use DP Fano's inequality (Lemma 39). To do so, recall that C having VC dimension d VC means that there exist { x 1 , . . . , x d VC } that is shattered by Z . From Theorem 24, there exist u 1 , . . . , u W ∈ { 0 , 1 } d VC where W = 2 Ω( d VC ) such that ∥ u i -u j ∥ 0 ≥ κ · d VC for some constant κ . For any sufficiently small α < κ/ 8 , we can define the distribution D i for i ∈ [ W ] by

for all ℓ ∈ [ W ] and y ∈ { 0 , 1 } . Next, notice that, for any i ∈ [ W ] , we may select c i such that err D ( c i ) = 1 2 ( 1 -4 α κ ) .

̸

Furthermore, for any i = j ∈ [ W ] and any hypothesis h : X → { 0 , 1 } , we have

This means that err D i ( h ) > 1 2 ( 1 -4 α κ ) +2 α or err D j ( h ) > 1 2 ( 1 -4 α κ ) +2 α . In other words, we have Ψ agn( C ; α ) ( D i ) ∩ Ψ agn( C ; α ) ( D j ) = ∅ . Finally, we have

Plugging this into Lemma 39, we get that n agn( C ; α ) m ≥ Ω ( d VC εα √ m + d VC mα 2 ) as desired.

E.3.2 Private Hypothesis Selection

In Hypothesis Selection problem , we are given a set P of hypotheses, where each P ∈ P is a distribution over some domain Z . The goal is, for the underlying distribution D , to output P ∗ ∈ P that is the closest (in TV distance) to D . We state below the guarantee one can get from our approach:

Theorem 41. Let α, β ∈ (0 , 0 . 1) . Then, for any ε > 0 , there exists an ε -user-level DP algorithm for Hypothesis Selection that, when each user has m samples and min P ′ ∈ P d tv ( P ′ , D ) ≤ 0 . 1 α , with probability 1 -β , outputs P ∈ P such that d tv ( P , D ) ≤ α as long as

For m = 1 , the above theorem essentially match the item-level DP sample complexity bound from [BKSW19]. The proof also proceeds similarly as theirs, except that we use the user-level DP EM rather than the item-level DP one.

Proof Theorem 41. We use the so-called Scheffé score similar to [BKSW19]: For every P , P ′ ∈ P , we define W P , P ′ as the set { z ∈ Z | P ( z ) > P ′ ( z ) } and let

We then use the ε -user-level DP pairwise scoring EM (Theorem 37). The privacy guarantee follows immediately from the theorem.

For the utility analysis, let P ∗ ∈ argmin P∈ P d tv ( P , D ) . Recall from our assumption that d tv ( P ∗ , D ) ≤ 0 . 1 α . Furthermore, observe that

Moreover, for every P ∈ P , we have

Thus, applying the utility guarantee from Theorem 37, we can conclude that, with probability 1 -β , the algorithm outputs P such that d tv ( P , D ) ≤ 0 . 5 α +0 . 1 α < α as desired.

E.3.3 Distribution Learning

Private hypothesis selection has a number of applications, arguably the most prominent one being distribution learning . In distribution learning, there is a family P of distributions. The underlying distribution D comes from this family. The task dlearn( P ; α ) is to output a distribution Q such that d tv ( Q , D ) ≤ α , where α > 0 denotes the accuracy parameter.

For convenient, let us defined packing and covering of a family of distributions:

A family Q of distributions is an α -cover of a family P of distributions under distance measure d iff, for all P ∈ P , there exists Q ∈ Q such that d ( Q , P ) ≤ α .

A family Q of distributions is an α -packing of a family P of distributions under distance measure d iff, Q ⊆ P and for all distinct Q , Q ′ ∈ Q , we have d ( Q , Q ′ ) ≥ α .

The size of the cover / packing is defined as size( Q ) := log( | Q | ) . The diameter of Q under distance d is defined as max Q , Q ′ ∈ Q d ( Q , Q ′ ) .

The following convenient lemma directly follows from Theorem 41 and Lemma 39.

Theorem 42 (Distribution Learning-Arbitrary Family) . Let P be any familiy of distributions, and let α, β, ε > 0 be sufficiently small. If there exists an 0 . 1 α -cover of P under the TV distance of size L , then

Furthermore, if there exists a family Q of size L that is an 3 α -packing of P under the TV distance and has diameter at most β under the KL-divergence, then

In theorems below, we abuse the notations ˜ Θ , ˜ O and also use them to suppress terms that are polylogarithmic in 1 /α, d, R , and κ .

Discrete Distributions. First is for the task of discrete distribution learning on domain [ k ] (denoted by DD k ( α ) ), which has been studied before in [LSY + 20]. In this case, P consists of all distributions over the domain [ k ] . We have the following theorem:

Theorem 43 (Distribution Learning-Discrete Distributions) . For any sufficiently small α, ε > 0 and for all m ∈ N , we have

Proof. Upper bound. It is simple to see that there exists an 0 . 1 α -cover of the family of size O ( k · log( k/α )) : We simply let the cover contain all distributions whose probability mass at each point is a multiple of ⌊ 10 k/α ⌋ . Plugging this into Theorem 42 yields the desired upper bound.

Lower bound. As for the lower bound, we may use a construction similar to that of [ASZ21] (and also similar to that in the proof of Theorem 40). Assume w.l.o.g. that k is even. From Theorem 24, there exist u 1 , . . . , u W ∈ { 0 , 1 } k/ 2 where W = 2 Ω( k ) such that ∥ u i -u j ∥ 0 ≥ κ · k for some constant κ . For any sufficiently small α < κ/ 16 , we can define the distribution D i for i ∈ [ W ] by

for all ℓ ∈ [ k/ 2] . By a similar calculation as in the proof of Theorem 40, we have that it is an (3 α ) -packing under TV distance and its diameter under KL-divergence is at most O ( α 2 ) . Plugging this into Theorem 42 then gives the lower bound.

Interestingly, the user complexity matches those achieved via approximate-DP algorithms from [LSY + 20, NME22], except for the first term (i.e., k/ε ) whereas the best known ( ε, δ ) -DP algorithm of [NME22] works even with log(1 /δ ) /ε instead. In other words, when m is intermediate, the user complexity between the pure-DP and approximate-DP cases are the same. Only for large m that approximate-DP helps.

Product Distributions. In this case, P is a product distribution over the domain [ k ] d (denoted by PD( k, d ; α ) ). We have the following theorem:

Theorem 44 (Distribution Learning-Product Distributions) . For any sufficiently small α, ε > 0 and for all m ∈ N , we have

Proof. Upper Bound. Similar to before, we simply take Q to be a 0 . 1 α -cover (under TV distance) of the product distributions, which is known to have size at most O ( kd · log( kd/α )) [BKSW19, Lemma 6.2].

Lower Bound. Acharya et al. [ASZ21, Proof of Theorem 11] showed that there exists a family Q of product distributions over [ k ] d that is a (3 α ) -packing under TV distance and its diameter under KL-divergence is at most O ( α 2 ) of size Ω( kd ) . Theorem 42 then gives the lower bound.

Gaussian Distributions: Known Covariance. Next, we consider Gaussian distributions N ( µ, Σ) , where µ ∈ R d , Σ ∈ R d × d , under the assumption that ∥ µ ∥ ≤ R and Σ = I 14 . Let Gauss( R,d ; α ) denote this task, where α is again the (TV) accuracy. For this problem, we have:

Theorem 45 (Distribution Learning-Gaussian Distributions with Known Covariance) . For any sufficiently small α, ε > 0 and for all m ∈ N , we have

Proof. Upper Bound. It is known that this family of distribution admits a (0 . 1 α ) -cover (under TV distance) of size O ( d · log( dR/α )) [BKSW19, Lemma 6.7]. This, together with Theorem 42, gives the upper bound.

Lower Bound. Again, Acharya et al. [ASZ21, Proof of Theorem 12] showed that there exists a family Q of isotropic Gaussian distributions with ∥ µ ∥ ≤ O ( √ log(1 /α )) that is a (3 α ) -packing under TV distance and its diameter under KL-divergence is at most O ( α 2 ) of size Ω( d ) . Theorem 42 then gives the lower bound.

We note that this problem has already been (implicitly) studied under user-level approximate-DP in [NME22], 15 who showed that n Gauss( R,d ; α ) m ( ε, δ > 0) ≤ ˜ O ( d αε √ m + d α 2 m ) . Again, it is perhaps surprising that our pure-DP bound nearly matches this result, except that we have the extra first term (i.e., d/ε ).

Gaussian Distributions: Unknown Bounded Covariance. Finally, we consider the case where the covariance is also unknown but is assumed to satisfied I ⪯ Σ ⪯ κI . We use Gauss( R,d, κ ; α ) to denote this task.

Theorem 46 (Distribution Learning-Gaussian Distributions with Unknown Bounded Covariance) . Let κ > 1 be a constant. For any sufficiently small α, ε > 0 and for all m ∈ N , we have

Proof. Upper Bound. This follows from Theorem 42 and a known upper bound of O ( d 2 log( dκ/α )+ d · log( dR/α )) on the size of a (0 . 1 α ) -cover (under TV distance) of the family [BKSW19, Lemma 6.8].

Lower Bound. Devroye et al. [DMR20] showed 16 that, for κ ≥ 1 + O ( α ) , there exists a 3 α -packing under TV distance whose diameter under the KL-divergence is at most O ( α 2 ) of size Ω( d 2 ) . This, together with Theorem 42, gives the lower bound.

We remark that it is simple to see that Gaussian with unbounded mean or unbounded covariance cannot be learned with pure (even user-level) DP using a finite number of examples.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work designs a generic algorithm that transforms an item-level DP algorithm into a user-level DP one with $\\sqrt{m}$ improvement in user complexity. It recovers previous user complexity bounds on various learning tasks, and the transformation works in the example sparse setting, i.e. does not require sufficient number of samples per user.\n\nSTRENGTHS:\n1. Compared to Ghazi et.al. 2021 which requires sufficient number of samples per user, the generic transformation from item-level to user-level DP in this work applies to the example scarce setting. The authors derive new bounds in the example-scarce setting for PAC learning.\n2. The authors recover the $\\sqrt{m}$ factor in many known bounds for various learning tasks through a generic algorithm. \n3. The writing is clear and easy to follow.\n\nWEAKNESSES:\n1. The proposed algorithm is not computationally efficient.\n2. Although $\\sqrt{m}$ matches the tight bounds for a variety of problems, it seems that the lower bound is not addressed in this work.\n3. In Theorem 16, it might be helpful to be specific about how sufficiently small should $\\varepsilon', \\delta'$ be. \n\nMinor issues:\n1. In Lemma 4, I feel that it should be $A\\simeq C$ instead of $B$ at the end of the line.\n2. In line 242, it appears that the $\\delta'$ inside the big O should be $\\delta''$, and there should be a factor of $(1+e^{\\varepsilon''})$ for the $\\delta''$ term according to Lemma 4 (even though it does not affect the final bound on $\\delta'$).\n\nQUESTIONS:\n1.  I wonder if it is possible show a $\\Omega(\\sqrt{m})$ lower bound as well under some non-trivial conditions?\n2.  In Theorem 16, how sufficiently small are $\\varepsilon', \\delta'$? Is it for some fixed small constant, or some expression that depends on other parameters?\n\nLIMITATIONS:\nLimitations and potential impacts are adequately addressed.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the problem of user-level differential privacy, giving a generic conversion for any item-level approx DP algorithm to a user-level approx DP algorithm, and a clipped scoring function that allows application of the exponential mechanism to obtain user-level privacy. All results are applicable in the few-samples-per-user setting, significantly extending results beyond the case in which users have enough samples to solve a task independently.\n\nSTRENGTHS:\nThis work significantly improves our understanding of when user-level privacy is achievable, though it is unfortunate the transformation from item-level to user-level privacy isn't computationally efficient. The intermediate result that approx DP => sample perfect generalization is also a meaningful contribution to our understanding of the relationships between useful algorithmic stability notions.\n\nWEAKNESSES:\nIn terms of substance, I think this work is very strong, but the clarity of presentation could maybe be improved a little. That said, I do think the authors did a good job overall of assisting the reader with interpretation of their results. \n\nNotes:\n\nThe first paragraph of the technical overview for the approximate DP result was a bit confusing.\n\nPage 4: “it is sufficient get new user-level pure-DP”\n\nPage 6: \t“For example, g is not Lipschitz everywhere anyway anymore”\n\nQUESTIONS:\nThere's a related result from BGHILPSS23 showing that approx DP implies perfect generalization, following from the connections approx DP => one-way perfect generalization, one-way perfect generalization => replicability, replicability => perfect generalization. However, my understanding is that their result is weaker than the one given in this work because it 1) requires correlated sampling and is therefore not necessarily computationally efficient and 2) the transformation from replicability to perfect generalization changes the output distribution of the DP algorithm, whereas the result in this work proves perfect generalization for the same approx DP algorithm A. Is this a correct comparison of these results, or is there any notable distinction between the resulting PG parameters obtained from both results?\n\nIt would be very interesting to understand whether the computational inefficiency is in fact necessary.\n\nLIMITATIONS:\nYes, the authors adequately address societal impact of their work.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper establishes new generic conversions from item-level DP algorithms to user-level DP algorithms, continuing a line of work initiated by Ghazi, Kumar, and Manurangsi. Previous state-of-the-art due to BGHILPSS '23 shows that any item-level $(\\varepsilon, \\delta)$-DP algorithm using N samples can be converted to a user-level DP algorithm with $n = O(\\log(1/\\delta)/\\varepsilon$ users and $m \\approx N^2$ samples per user. The present submission observes that this previous result is just one end of a spectrum of possible item-to-user-level conversions, and generalizes it to hold for the full range of $1 \\le m \\le N^2$. That is, the main result (somewhat simplifying) shows a conversion from any item-level DP algorithm to a user-level DP algorithm with $n \\approx (N/\\sqrt{m}) \\cdot \\log^{O(1)} ({1/\\delta})/\\varepsilon^2$ users and $m$ samples per user. In addition to generalizing the conversions of GKM'21 and BGHILPSS'23 to the regime of few examples per user, this result unifies previous work on specific problems such as mean estimation, stcochastic convex optimization, and discrete distribution learning for which a $n \\propto 1/\\sqrt{m}$ dependence was previously observed.\n\nAs an auxiliary result, the paper also gives a tight characterization of the sample complexity of user-level pure $(\\varepsilon, 0)$-differentially private PAC learning in terms of the probabilistic representation dimension.\n\nSTRENGTHS:\n- This is a nice contribution to the emerging general theory around user-level DP learning, in particular, building a bridge between one thread of work on general item-level vs. user-level connections and another on understanding the sample complexity of user-level DP for specific problems.\n\n- As part of their analysis, the authors more carefully investigate the connection between DP and perfect generalization, in particular giving a clean solution to an old open question of CNLRW'16 that is likely to have further applications.\n\nWEAKNESSES:\n- The main technical ideas going into the algorithms and their analysis appeared in prior work on this topic. (E.g., the passage from DP to perfect generalization appears in GKM'21/BGHILPSS'23, and a similar PTR-based argument appeared in KL'21/GKKMMZ'23). This paper's technical contribution is to carefully refine each of these steps and piece them together in the right way.\n\n- Neither of the paper's new algorithms is computationally efficient in general, even if the task admits a computationally efficient item-level DP learner. Note that this is the case for previous general item-to-user-level conversions as well.\n\n- The final main result (Theorem 9) is somewhat messy to state and potentially suboptimal in its dependence on $\\log(1/\\delta)$ and $\\varepsilon$. This is likely in part due to stacking various generic tools (DP => PG, amplification by subsampling, PTR) that could potentially be avoided with a simpler algorithm.\n\nQUESTIONS:\n- The prior work of BBGHLISS'23 also claims to have resolved the open question of CLNRW'16 on DP vs. perfect generalization, but I believe they did so in a weaker sense. Namely, they only showed that every DP algorithm admits a PG algorithm solving the same problem; whereas this submission shows that the original DP algorithm itself perfectly generalizes. This is an important distinction that I think is worth highlighting.\n\n- I wasn't really able to match the informal description of the proof of Lemma 13 (lines 214-226) to the formal proof in appendix B. In particular, the new contribution of the formal proof seems to be to apply a nice symmetrization argument to the previous results of RRST'16/BGHILPSS'23 that held for a one-sided version of the DP -> PG connection. Does the informal argument in the main body of the text reflect what's going on under the hood of these prior results? And if so, does it suggest a simpler / more direct argument that doesn't go through max-information etc.?\n\n- I'd suggest renaming \"local deletion DP\" (Definition 15) to something else due to the (unfortunate) naming collision that may suggest this definition has to do with local DP. Maybe something like \"pointwise deletion DP\"?\n\nLIMITATIONS:\nLimitations (overlapping with points identified as weaknesses) are nicely described as directions for future work in the conclusion.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work develops novel generic algorithms that convert algorithms under item-level differential privacy (DP) to user-level DP in the low user sample regime, where each user holds a small number of samples, and obtains new results for user sample complexity (aka., min # users to achieve a certain utility of the algorithm). Based on a novel observation that connects sample perfect generalization to local deletion DP, the proposed algorithm under approximate-DP leads to tight user sample complexity bound for several privacy-preserving machine learning applications. The proposed algorithm under pure-DP is based on the exponential mechanism with a new score function and it also leads to tight and improved user sample complexity bounds for several applications.\n\nSTRENGTHS:\nThe improved user sample complexity results and proposed algorithms under both approximate DP and pure DP are interesting and are widely applicable to several important privacy preserving machine learning tasks. \n\nThe paper is well presented and intriguing to read. The notations are well-defined throughout the paper. Problems and results are well defined and clearly stated. The contribution and overview of techniques are well summarized. \n\nThe paper tries hard to give the readers intuition on the techniques developed and does a good job explaining the observations.\n\nThe paper also explains well its difference from the previous works, especially why the techniques from previous works do not apply when the number of samples per user is low.\n\nWEAKNESSES:\nThe only places that might need a bit more explanation is why local deletion DP is natural to consider based on sample perfect generalization results, and how local deletion DP is then converted to user level DP?\n\nQUESTIONS:\nThis might be a stupid question. How is the randomness of the private algorithms considered in this work? Do we assume that a random seed is given?\n\nIs line 9 in Algorithm 1 for removing the polylog dependence on $n$ users in the proof?\n\nWhat are the major differences between pure DP and approximate DP in changing from item-level DP to user-level DP? What are the challenges that make the techniques to convert from item-level DP to user-level DP for approximate DP not applicable to pure DP?\n\nIn which applications/problems is the user sample complexity bound from this work not tight?\n\nMinor issues: $x_{1, n}$ in line 31 $\\Rightarrow$ $x_{1, m}$. \n\n$\\mathbf{x}_{T}$ in line 265 \n\n$\\Rightarrow$ $\\mathbf{x}_{-T}$. \n\nMight be clearer to add “for some chosen constant $\\kappa$” to the end of line 272.\n\nLIMITATIONS:\nLimitations (esp. the runtime of the proposed algorithm) are well discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-20"}