Title: Adversarially Robust Distributed Count Tracking via Partial Differential Privacy
Venue: NeurIPS 2023
Accepted: yes
Keywords: Distributed Tracking

Adaptive Robustness

Differential Privacy

Generalization
Abstract: We study the distributed tracking model, also known as distributed functional monitoring. This model involves $k$ sites each receiving a stream of items and communicating with the central server. The server's task is to track a function of all items received thus far continuously, with minimum communication cost. For count tracking, it is known that there is a $\sqrt{k}$ gap in communication between deterministic and randomized algorithms. However, existing randomized algorithms assume an "oblivious adversary" who constructs the entire input streams before the algorithm starts. Here we consider adaptive adversaries who can choose new items based on previous answers from the algorithm. Deterministic algorithms are trivially robust to adaptive adversaries, while randomized ones may not. Therefore, we investigate whether the $\sqrt{k}$ advantage of randomized algorithms is from randomness itself or the oblivious adversary assumption. We provide an affirmative answer to this question by giving a robust algorithm with optimal communication. Existing robustification techniques do not yield optimal bounds due to the inherent challenges of the distributed nature of the problem. To address this, we extend the differential privacy framework by introducing "partial differential privacy" and proving a new generalization theorem. This theorem may have broader applications beyond robust count tracking, making it of independent interest.

Adversarially Robust Distributed Count Tracking via Partial Differential Privacy

Abstract

We study the distributed tracking model, also known as distributed functional monitoring. This model involves k sites each receiving a stream of items and communicating with the central server. The server's task is to track a function of all items received thus far continuously, with minimum communication cost. For count tracking, it is known that there is a √ k gap in communication between deterministic and randomized algorithms. However, existing randomized algorithms assume an "oblivious adversary" who constructs the entire input streams before the algorithm starts. Here we consider adaptive adversaries who can choose new items based on previous answers from the algorithm. Deterministic algorithms are trivially robust to adaptive adversaries, while randomized ones may not. Therefore, we investigate whether the √ k advantage of randomized algorithms is from randomness itself or the oblivious adversary assumption. We provide an affirmative answer to this question by giving a robust algorithm with optimal communication. Existing robustification techniques do not yield optimal bounds due to the inherent challenges of the distributed nature of the problem. To address this, we extend the differential privacy framework by introducing "partial differential privacy" and proving a new generalization theorem. This theorem may have broader applications beyond robust count tracking, making it of independent interest.

1 Introduction

In the distributed tracking model there are k sites and a single central server. Each site i receives items over time in a streaming fashion and can communicate with the server. Let S i ( t ) be the stream that site i observes up to time t . The sever wants to track the value of a function f that is defined over the multiset union of { S i ( t ) | i = 1 , · · · k } at all times. The goal is to minimize the communication cost, which is defined as the total number of words communicated between the server and all sites. Due to strong motivations from distributed system applications, this model has been extensively investigated, e.g., [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. The theoretical study of communication complexity was initiated by [5]. Count tracking is the most basic problem in distributed tracking, where f is simply the total number of items received so far. Since exact tracking requires sites to communicate every time an item arrives, incurring too much communication, the objective is to track

an (1 + α ) -approximation. For this problem, there is a simple deterministic algorithm with ˜ O ( k/α ) 2 communication. Huang et al. [13] proposed a randomized algorithm that achieves ˜ O ( √ k/α ) , but the correctness is under the assumption of an oblivious adversary, i.e., input streams are constructed in advance and are just given to sites one item at a time. In particular, the analysis assumes the input is independent of the algorithm's internal randomness. In interactive applications, this assumption is often unrealistic; the adversary can generate the next item based on previous answers from the server, making the independence assumption invalid. Moreover, the break of independence may occur unintentionally. For example, the tracking algorithm may be part of a larger system; the output of the algorithm can change the environment, from which the future input to the algorithm is generated. In such cases, we can no longer assume the independence between inputs and algorithm's internal state. The main question of this paper is: Whether the √ k advantage of randomized count tracking algorithms is from randomness itself or the oblivious adversary assumption?

Designing robust randomized algorithms against adaptive adversaries has received much attention recently [14, 15, 16, 17, 18, 19, 20, 21, 22, 23]. Existing research focuses on centralized settings, and in this paper, we initiate the study of adversarial robustness for distributed tracking. We provide a new randomized algorithm with communication ˜ O ( √ k/α ) , which provably tracks the count within an α relative error at all times, even in the presence of an adaptive adversary. As in [18], we utilize differential privacy (DP) to construct robust tracking algorithms. The main idea is to use DP to protect the internal randomness, so that the adversary cannot learn enough information about it to generate bad inputs. However, due to the 'event-driven nature" of distributed tracking algorithms, we cannot protect the randomness in the usual sense of DP (which will be elaborated in more details below). Thus, the DP framework of [18] is not directly applicable.

To address this difficulty, a relaxed version of differential privacy, called partial differential privacy , is introduced. Moreover, a new generalization theorem for partial DP is proved. In partial DP we allow an arbitrary small subset of the database to be revealed, and only require the privacy of the remaining dataset is protected. The power of the new definition comes from the fact that the privacy leaked set can be chosen by the algorithm after the interaction with the adversary and the set can depend on the actual transcript. Intuitively, an interactive mechanism satisfies partial DP as long as after the interaction, we can always find a large subset whose privacy is protected. On the other hand, since the set we try to protect is not fixed in advance, it is subtle to give the right notion of 'protecting the privacy of a large part of the data". Besides this new notion of DP, our algorithm deviates from the framework of [18] in many other details. For instance, our algorithm does not treat existing oblivious algorithms as a black box; instead, we directly modify oblivious algorithms and perform a more fine-grained privacy analysis. The contributions of this paper are summarized as follows:

We initiate the study of adversarially robust distributed tracking and propose the first robust counting tracking algorithm with near optimal communication.

To overcome the inherent challenges that arise from the distributed nature of the problem, we introduce a relaxed (and more general) version of differential privacy and prove a new generalization theorem for this notion. We believe that this new generalization theorem can be of independent interest and may have broader applications beyond count tracking.

1.1 Problem Definitions and Previous Results

Throughout this paper, we use M to denote the tracking algorithm/mechanism and A to denote the adversary. N is used to denote the total number of items.

The model and its event-driven nature We assume there exists a point-to-point communication channel between each site and the server, and communication is instantaneous with no delay. It is convenient to assume that the time is divided into discrete time steps. In each step, the adversary picks one site and sends it a new item. The adversary is also allowed to skip the step and do nothing, and because of this, algorithms that can trigger new events based on the global time do not have an advantage over purely event-driven ones. For example, the server may have wanted to wait a random number of time steps before updating the output, but the adversary can always skip a large number of steps before sending the next item, which makes the waiting meaningless. That being said, it is not a restriction to only consider event-driven algorithms: the internal state of each site changes only when

it receives a new item or a new message from the server, and the server's state changes only if a new message from sites arrives.

Distributed count tracking The goal of a count tracking algorithm M is to output an ( α, β ) -approximation of the total number of items received by all sites. More specifically, with probability at least 1 -β , the output of M is (1 ± α )-accurate with respect to the true answer at all time steps simultaneously. We measure the complexity of the algorithm by the total communication cost between the server and all sites. Consistent with prior research, communication cost is expressed in terms of words unless otherwise stated. We assume that any integer less than N can be represented by a single word. To simplify the presentation, we assume k ≤ 1 α 2 . The case k > 1 α 2 can be solved with the same technique, with an extra additive O ( k log N ) term in the communication complexity 3 .

The adversarial model The setting can be viewed as a two-player game between the tracking algorithm M and the adversary A . At each time step t ,

A generates a pair u t = ( i, x ) , where x is the item and i is the site to send x to; and u t depends on the previous items and previous outputs of M .

M processes u t and outputs its current answer a t .

The interaction between A and M generates a transcript π = ( u 1 , a 1 , u 2 , a 2 , · · · ) . The objective of A is to cause M to output an incorrect answer at some step t .

Existing results on count tracking Previous results and their main ideas are discussed here.

Deterministic complexity. There is a simple deterministic solution to count tracking. Each site notifies the server every time their counter increases by a factor of 1 + α . Then, the server always maintains an α -approximation to each site's counter, and their sum is an α -approximation to the total count. It is easy to see the communication complexity of this algorithm is O ( k α · log N ) . We note deterministic algorithms are trivially robust to adaptive inputs. A deterministic communication lower bound of Ω( k α · log N ) was proved in [6].

√

Randomized complexity. A randomized algorithm with O ( k α · log N ) communication and constant error probability was proposed in [13], which was shown to be optimal in the same paper. The main idea of their algorithm is as follows. Let N be the current number of items. Unlike the above deterministic algorithm, in which each site notifies its local count according to deterministic thresholds, now the thresholds are set randomly. Let e i be the discrepancy between the true local count on site i and its estimation on the server, and the total error is e = ∑ k i e i . For deterministic algorithms, all e i could have the same sign in the worst case, so on average, e i has to be less than αN/k . On the other hand, in the randomized algorithm, each e i is a random variable. Suppose Var [ e i ] ≤ ( αN ) 2 /k for each i , the total variance Var [ e ] ≤ ( αN ) 2 , and it is sufficient to obtain an α -approximation with constant probability by standard concentration inequalities. Compared to deterministic estimators, now each local error e i may far exceed αN/k .

Robustness to adaptive inputs. In the randomized approach described above, the analysis crucially relies on the independence assumption on e i 's, since otherwise the variances do not add up and concentration inequalities cannot be applied. When the adversary is oblivious, the independence holds as long as each site uses independent random numbers. However, in the adaptive setting, this does not hold any more, and it becomes unclear whether the √ k improvement is still achievable.

1.2 Existing Robust Streaming Frameworks

Distributed tracking is a natural combination of streaming algorithms [24] and communication complexity [25]. Robust streaming algorithms design has become a popular topic recently and several interesting techniques have been proposed. Next, we provide a brief overview on the existing frameworks for robust streaming algorithms. Let F be the target function, for example, the number of distinct elements.

Sketch switching [14] Given a stream of length N and an accuracy parameter α , the flip number, denoted as λ α,N , is the number of times that the target function F changes by a factor of 1 + α . For insertion-only streams and a monotone function F , λ = 1 α · log N . In sketch switching, we initialize λ independent copies of an oblivious algorithm, and items in the stream are fed to all copies. The stream can be divided into O ( λ ) phases; in each phase F increases roughly by a factor of 1 + α . During the j th phase, the output remains the same, and the j th copy is used for tracking the value. When the estimate (from the j th copy) has become larger than the last released output by a factor of (1 + α ) , the output is updated and j ← j +1 . The robustness holds because each copy is utilized no more than once, and once its randomness is revealed, the algorithm switches to a new copy. The space complexity is λ times the space of the oblivious algorithm. Applying sketch switching on the algorithm of [13] results in a robust count tracking algorithm. However, the communication complexity increases by a factor of λ , which can be worse than the deterministic bound.

Difference estimator Woodruff et al. [22] refined the sketch switching approach significantly and proposed the difference estimator (DE) framework. Informally, instead of using oblivious sketches as the switching unit, the DE framework divides the stream into blocks and uses sketches on each block as switching units. Consider a part of the stream, denoted by S , in which the value of F increases from F to 2 F . A technique called difference estimator (DE) was proposed to estimate the difference between values of F at current time t and some earlier time t 0 . The estimator is generated by maintaining ℓ = log 1 α levels of DEs. In level 1 , S is divided into 1 α blocks and the value of F increases by αF in each block. In the j th level, S is divided into 1 α 2 j -1 blocks, and the DEs produce estimators with additive error αF . [22] proved that for many important problems, the space complexity of such DEs is α Space( F )2 j -1 , where Space( F ) is the space complexity of F in the oblivious setting. Since there are 1 α 2 j -1 DEs on the j th level, the total space of level j is Space( F ) and the space is ℓ Space( F ) over all levels. Since blocks from all levels form a dyadic decomposition, the final estimator is the sum of ℓ DEs, one from each level. Thus, the total error is ℓαF , and by adjusting α in the beginning by a factor of ℓ , this produces the desired error. Applying the DE framework to distributed tracking, the communication bottleneck is from level 1 , where there are 1 /α DEs. It requires synchronization at the beginning of each block, so that all sites and the server are able to agree to start a new DE. A synchronization incurs k communication; thus, even ignoring other cost, the total cost is at least k α , which is no better than the deterministic bound.

Differential privacy Hassidim et al. [18] proposed a framework using tools from DP. Instead of switching to fresh sketches, this framework protects the randomness in the sketch using DP. The random bits in each copy of the oblivious sketch are viewed as a data point in the database, and the adversary generates an item (considered as a query in DP) at each time and observes the privatized output. By the generalization theorem of DP, if the interaction transcript satisfies DP w.r.t. the random bits, then the error in the output is close to the error of an oblivious algorithm in the non-adaptive setting (the closeness depends on the magnitude of the noise injected). Similar as in sketch switching, the output is updated only when it changes by a (1 + α ) factor, and thus there are only λ time steps in which the adversary observes 'useful information". Therefore, it is not surprising that the sparse vector technique [26] is applied. By the advanced composition theorem of DP [27], ˜ O ( √ λ ) independent copies of the oblivious algorithm is enough for λ outputs. Therefore, compared with sketch switching, the space increases by only a factor of √ λ . Attias et al. [23] gave an improvement by incorporating difference estimator to the DP framework.

However, there is a fundamental challenge in applying the DP framework to distributed tracking. As discussed in Section 1.1, all distributed tracking algorithms are essentially event-driven. Now let us focus on a time step t where the server updates its output. Because of the event-driven nature, this update is triggered by the event that some site i just sent a message. Similarly, site i sending the message is also triggered by another event, and so on and so forth. The start of this event chain must be that the adversary sends an item to some site j , triggering j to send the first message. This causes additional privacy leakage. For example, suppose whether to send a message is indicated by a binary function f ( n j , r j ) where r j is the random number used in the tracking algorithm and n j is the local count on site j . At time t , the adversary knows f ( n j , r j ) = 1 , which makes the algorithm have no privacy guarantee. This problem is attributed to the fact that the server can update the output only after it receives a message. So to achieve the desired level of privacy, one has to add noise to f locally on each site, but the total noise from all sites can be too large.

1.3 Our Method

Technical overview In our algorithm, each site divides its stream into continuous blocks of size ∆ = ˜ O ( αN √ k ) . For each block j , the site draws a random integer r j with uniform distribution in [∆] . The site sends a message to the server when the number of items in a block j reaches the threshold r j . The server output m ∆ , where m is the number of messages received from all sites. By a similar analysis as in [13], the estimator has αN additive error. To robustify this algorithm, we also use DP. To overcome the limitations of the existing DP framework, we make several critical changes. First, instead of running multiple independent copies of the oblivious algorithm, we run a single copy of the above oblivious algorithm. Secondly, we perform a more refined privacy analysis, in which each random number r j is treated as the privacy unit. Therefore, the analysis framework is quite different from [18]. Thirdly, and most importantly, we do not require the algorithm to have a privacy guarantee in the traditional sense; instead, we privatize the algorithm so that, at any time, we can always find a large set of random numbers whose privacy is protected. However, it is unclear how to change the original DP definition to capture the meaning of 'protecting a large subset of the dataset", since this set depends on the current transcript, and may change at each time step. Moreover, for this weaker DP, we need to prove that the generalization theorem still holds. To this end, we introduce partial DP and prove a generalization theorem for it. We believe partial DP is quite general and will have more applications beyond robust distributed tracking. The main results of this paper is summarized in the next theorem.

Theorem 1 (Main theorem) . With probability 1 -δ , our mechanism M comprised of Algorithm 1 and 2 outputs an α -approximate to the total count at all times in the adversarial setting. The

Compared to the optimal randomized bound in the oblivious setting, the cost of handling adaptive adversaries is at most an extra factor of C .

2 Preliminaries

Notation Let Π be the space of all possible transcripts of the interaction between M and A . Weuse Π to denote the transcript random variable, π ∈ Π to denote a realization of Π . The Laplace distribution with 0 mean and 2 b 2 variance is denoted by Lap ( b ) . We use the notation S ∼ P m to indicate that S is a dataset comprised of m i.i.d samples from distribution P . The conditional distribution of S given the transcript π is represented by Q π . The query function is denoted by q : X m → [0 , 1] and q t denotes the query function at time step t . If q t is a linear query, then q t ( S ) = 1 m ∑ d i =1 q t,i ( S i ) , where q t,i : X → [0 , 1] is a sub-query function on a single sample. The expectation of q over the distribution P m is denoted by q ( P m ) = E S ∼P m [ q ( S )] . And q ( Q π ) = E S ∼ Q π [ q ( S )] .

Differential privacy Let S ∈ X m be the database that M needs to protect, for example in our case, the random numbers (thresholds) in M . Denote the interaction between A and M by I ( M , A ; S ) .

Definition 1 (Differential Privacy) . M is ( ε, δ ) -differentially private if for any A , any two neighboring database S ∼ S ′ ∈ X m differing only in one position, and any event E ⊆ Π , we have

Lemma 1 (Laplace Mechanism [28]) . Let x, x ′ ∈ R and | x -x ′ | ≤ l . Let σ ∼ Lap ( l/ε ) be a Laplace random variable. For any measurable subset E ⊆ R , Pr[ x + σ ∈ E ] ≤ e ε · Pr[ x ′ + σ ∈ E ] .

Private continual counting Consider the continual counting problem : Given an input stream consists of { 0 , 1 } , continual counting requires to output an approximate count of the number of 1 's seen so far at every time step. Different techniques have been proposed to achieve differential privacy under continual observation [29, 30]. In this paper, we make use of the Binary Mechanism (BM) [30] (see appendix for its pseudo code).

Theorem 2. ( [30]) BM is ( ε, 0) -differentially private with respect to the input stream. With probability at least 1 -δ , the additive error is O ( 1 ε · (log T ) 1 . 5 · log( T δ )) at all time steps t ∈ [ T ] .

Remark. Note that although the input of BM is bits, it can directly extend to real numbers without any modification. The same privacy and utility guarantees hold.

Generalization by differential privacy The generalization guarantee of differential privacy arises from adaptive data analysis. Existing research [28, 31, 32] has shown that any mechanism for answering adaptively chosen queries that is differentially private and sample-accurate is also accurate out-of-sample.

Definition 2 (Accuracy) . M satisfies ( α, β ) -sample accuracy for adversary A and distribution P iff

where a t is the output of M and q t is the query given by A at time t . M satisfies ( α, β ) -distributional accuracy iff

Recently, Jung et al. [32] discovered a simplified analysis of the generalization theorem by introducing the posterior data distribution Q π as the key object of interest. Through a natural resampling lemma, they showed that a sample-accurate mechanism is also accurate with respect to Q π .

Lemma 2 ([32]) . Suppose that M is ( α, β ) -sample accurate. Then for every c > 0 it also satisfies:

Thus, to achieve distributional accuracy, it suffices to prove the closeness between Q π and P m . Then they showed that this can be guaranteed by differential privacy.

Lemma 3 ([32]) . If M is ( ε, δ ) -differentially private, then for any data distribution P , any analyst A , and any constant c > 0 :

3 Partial Differential Privacy and Its Generalization Property

In the definition of partial DP, we specify the set of data whose privacy is leaked via a mapping f L : Π → 2 [ m ] . Given a transcript π , partial DP guarantees privacy only on S \ f L ( π ) . Intuitively, this means that the transcripts on two database S, S ′ that differs only on a position i ∈ S \ f L ( π ) have similar distributions. However, π is not known in advance, which causes trouble to this direct definition. We remedy this by first fixing i ; then we only consider S, S ′ that differs only on i and only those events E whose elements do not contain i in their privacy leaked set.

Definition 3 (Partial Differential Privacy) . M is ( ε, δ, κ ) -partial differentially private, if there exists a privacy leak mapping f L : Π → 2 [ m ] with max π | f L ( π ) | ≤ κ , the following holds: for any A , any i , any S, S ′ ∈ X m that differs only on the i th position, and any E ⊆ Π such that i / ∈ ⋃ π ∈ E f L ( π ) ,

A generalization theorem for partial DP is presented below. Generalization for linear queries suffices for our application, but this can be extended to general low-sensitivity queries.

Theorem 3. For linear queries, if M satisfies ( ε, δ, κ ) partial differential privacy and M is ( α, β ) -sample accurate, then for any data distribution P , any adversary A , and any constant c, d > 0 :

Compared with existing results, it has an extra term κ m in the error. This is intuitive, as the privacy leaked set contributes at most κ m error in the worst case. Following [32], it suffices to establish the low discrepancy between Q π and P m . To this end, we prove the following key lemma in the appendix.

Lemma 4. If M satisfies ( ε, δ, κ ) partial differential privacy, then for any data distribution P , any adversary A , and any constant c > 0 :

The query function of interest in this paper only depends on ˆ m data points, with ˆ m ≪ m , at each time step. For such queries, we expect the total error to be proportional to ˆ m rather than m , which is formalized in the following refinement of Theorem 3, the proof of which requires only a slight modification and is included in the appendix.

Theorem 4. For linear queries, if M satisfies ( ε, δ, κ ) partial differential privacy and M is ( α, β ) -sample accurate. Further, if each linear query depends on at most ˆ m data points, then for any data distribution P , any adversary A , and any constant c, d > 0 :

4 Robust Distributed Count Tracking Algorithm

Our algorithm has multiple rounds. In each round, N increases roughly by a factor of 1+ √ kα . After a round ends, the true count is computed and sent to all sites, and then, the algorithm is reinitialized with fresh randomness. Thus, we only focus on one round, and let N 0 be the true count at the

The algorithm on site i is presented in Algorithm 1. The site divides its own stream into blocks of size ∆ , and exactly one bit will be sent to the server in each block. The actual time of sending the bit is determined by a random threshold r ij . Let N t,i be the number of items received on site i from the beginning of the current round until time t . Let d t,i = ⌊ N t,i / ∆ ⌋ and e t,i = N t,i mod ∆ . Thus, j = d t,i +1 is the index of the current active block, and e t,i is the offset in this block. As per Algorithm 1, the number of bits sent by site i up to time t is B t,i = d t,i + 1 [ r i,j < e t,i ] ≤ d t,i +1 . Since r i,j ∼ Uni (0 , ∆) , E [ B t,i ] = d t,i + e t,i ∆ , meaning ∆ · B t,i is an unbiased estimate of N t,i . Let D ∈ (0 , ∆) m ( m = k × k ′ ) be the database comprised of all sites' random numbers, i.e., D ij = r ij , considering the input generated by the adversary as queries, then the query at time t can be specified as:

where B t = ∑ k i =1 B t,i denotes the total number of bits received by the server at time t . The value of q t at each time step depends on k random numbers corresponding to the active blocks, which is much less than the size of D , which motivates the use of Theorem 4.

Let ˆ B t be algorithm's estimate of B t . Algorithm 2 consists of √ k phases; ˆ B t remains constant in each phase and a new estimate ˆ b j is obtained at the end of the j th phase via the binary mechanism. The times that the phases end are denoted by H = { t 1 , t 2 , . . . , t √ k } , and for t ∈ [ t j , t j +1 ) , we have ˆ B t = ˆ b j . Therefore, the transcript generated by M and A is of the form (( ⊥ , 0) , ( ⊥ , 0) , . . . , ( ⊤ , ˆ b 1 ) , ( ⊥ , ˆ b 1 ) , . . . , ( ⊤ , ˆ b √ k )) . We note, in addition to noise in BM, the only noise added for the purpose of DP is the Laplace random variable added on T , and an independent noise is used in each phase.

4.1 Privacy Analysis

In this section, we analyze the privacy of M for a single round, demonstrating that it satisfies ( ϵ, 0 , √ k ) -partial differential privacy with respect to the random numbers D used by all sites. To achieve this, we first provide the privacy leak mapping. Note that each time the output of M updates, i.e, reporting ⊤ , A knows the site i it just accessed has sent a bit to the server. Then the active random

number r ij at this moment is exposed, which means there is no meaningful privacy guarantee 4 . Therefore, we need to relax the DP constraint. Given a transcript π , the privacy leaked set consists of those r ij that are exposed during the execution.

Definition 4 (Privacy Leaked Set) . For a given transcript π , let A be the set of time steps when output updates, i.e. A = { t | π t = ( ⊤ , · ) } where π t is the output at time t . Let i t be the site A chooses at time t . Then, f L ( π ) = { ( i t , j t ) | t ∈ A ( π ) , j t = ⌊ N t,i t / ∆ ⌋ +1 } .

√

Since there is one data point exposed in each phase, κ ≤ k . The privacy guarantee with this privacy leak mapping is presented below.

Lemma 5. For any two neighboring databases D ∼ D ′ that differ only on ( i, j ) , any transcript π satisfying ( i, j ) / ∈ f L ( π ) , our mechanism (Algorithm 1 and 2) satisfies the following inequality,

i.e., it satisfies ( ε, 0 , √ k ) -partial differential privacy.

4.2 Accuracy and Communication

Observe that the size of D is m = k × k ′ , and each query q t depends only on ˆ m = k of them. In the algorithm q t ( D ) is estimated by ˆ B t /m . Suppose it is ( α, β ) -sample accurate, then by Lemma 5 and Theorem 4, we have

Note that ε = C/ √ k . By setting c = 1 / √ k , we get the following lemma. Lemma 6. For query function q t defined in equation (1) , if our mechanism M is ( α, β ) accurate for q t , it is ( 4 C √ k m + α, √ kβ ) -distributional accurate.

By Theorem 2, with probability 1 -β 2 , for all t j ∈ H , we have that:

where the second inequality is from ε = C/ √ k and the definition of C . Denote the Laplace variables used in Algorithm 2 as { σ 1 , · · · , σ √ k } . By the union bound, with probability 1 -β 2 , | σ j | ≤ log(4 √ k/β ) ε for all j ∈ [ √ k ] . Consider the ( j +1) th phase. For every time step t ∈ ( t j , t j +1 ) , since B t -B t j ≤ T + σ j +1 ≤ 2 C √ k + log(4 √ k/β ) ε and ˆ B t = ˆ B t j , we have

Then ˆ B t /m is (4 C √ k/m,β ) -sample accurate with respect to q t ( D ) . By Lemma 6, it follows that ˆ B t /m is (8 C √ k/m, √ kβ ) -accurate w.r.t. E D ∼P m [ q t ( D )] = N t /m ∆ . We establish the following lemma of the accuracy guarantee. √

Lemma 7. With probability 1 -kβ , for all t in a round starting from N 0 , we have | ∆ · ˆ B t + N 0 -( N t + N 0 ) | ≤ 8 C √ k · ∆ = αN 0 .

For the Communication complexity, in one round, the total number of received bits by the server is c 1 + c 2 + . . . + c √ k . By analysis above, with probability 1 -β/ 2 , for all j ∈ [ √ k ] , we have

Therefore, in one round, the communication cost is upper bounded by O ( Ck ) . By (5), there are at least Ck · ∆ = αN 0 √ k/ 8 items received in this round, which means N increases by an O (1 + α √ k/ 8) factor after one round. It follows that there are at most O ( log N α √ k ) rounds. Combined this with the communication cost in one round, we can conclude the final communication complexity is O ( C √ k log N α ) . Now we are ready to prove Theorem 1.

Proof of Theorem 1. Since N 0 is the exact count at the beginning of a round, the Lemma 7 guarantees an α -relative error in the round. Since the lemma holds for any round, the correctness is established. We set the failure probability as β = δ/ ( √ k · O ( log N α √ k )) . Since there are O ( log N α √ k ) rounds, by the union bound and Lemma 7, it can be concluded that with probability 1 -δ , the output of M is an α -approximate to N at all times. The communication complexity is O ( C √ k log N α ) 5 .

-sample

5 Conclusion

In this paper, we study the robustness of distributed count tracking to adaptive inputs. We present a new randomized algorithm that employs differential privacy to achieve robustness. Our new algorithm has near optimal communication complexity. Besides, we introduce a relaxed version of differential privacy, which allows privacy leak of some data points. Based on this definition, we prove a new generalization theorem of differential privacy, which we believe can be of independent interest and have broader applications.

Acknowledgments and Disclosure of Funding

This work is supported by National Natural Science Foundation of China No. U2241212, No. 62276066.

References

MDilman and D Raz. Efficient reactive monitoring. In Proceedings IEEE INFOCOM 2001. , volume 2, pages 1012-1019. IEEE, 2001.

Brian Babcock and Chris Olston. Distributed top-k monitoring. In Proceedings of the 2003 ACM SIGMOD international conference on Management of data , pages 28-39, 2003.

Graham Cormode, Minos Garofalakis, Shanmugavelayutham Muthukrishnan, and Rajeev Rastogi. Holistic aggregates in a networked world: Distributed tracking of approximate quantiles. In Proceedings of the 2005 ACM SIGMOD international conference on Management of data , pages 25-36, 2005.

Ram Keralapura, Graham Cormode, and Jeyashankher Ramamirtham. Communication-efficient distributed monitoring of thresholded counts. In Proceedings of the 2006 ACM SIGMOD international conference on Management of data , pages 289-300, 2006.

Graham Cormode, S Muthukrishnan, and Ke Yi. Algorithms for distributed functional monitoring. In 19th Annual ACM-SIAM Symposium on Discrete Algorithms , pages 1076-1085, 2008.

Ke Yi and Qin Zhang. Optimal tracking of distributed heavy hitters and quantiles. In Proceedings of the twenty-eighth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems , pages 167-174, 2009.

Chrisil Arackaparambil, Joshua Brody, and Amit Chakrabarti. Functional monitoring without monotonicity. In Automata, Languages and Programming: 36th International Colloquium, ICALP 2009, Rhodes, Greece, July 5-12, 2009, Proceedings, Part I 36 , pages 95-106. Springer, 2009.

Srikanta Tirthapura and David P Woodruff. Optimal random sampling from distributed streams revisited. In Distributed Computing: 25th International Symposium, DISC 2011, Rome, Italy, September 20-22, 2011. Proceedings 25 , pages 283-297. Springer, 2011.

Graham Cormode, Shanmugavelayutham Muthukrishnan, Ke Yi, and Qin Zhang. Continuous sampling from distributed streams. Journal of the ACM (JACM) , 59(2):1-25, 2012.

David P Woodruff and Qin Zhang. Tight bounds for distributed functional monitoring. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing , pages 941-960, 2012.

Jiecao Chen and Qin Zhang. Improved algorithms for distributed entropy monitoring. Algorithmica , 78:1041-1066, 2017.

Hao Wu, Junhao Gan, and Rui Zhang. Learning based distributed tracking. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages 2040-2050, 2020.

Zengfeng Huang, Ke Yi, and Qin Zhang. Randomized algorithms for tracking distributed count, frequencies, and ranks. In Proceedings of the 31st ACM SIGMOD-SIGACT-SIGAI symposium on Principles of Database Systems , pages 295-306, 2012.

Omri Ben-Eliezer and Eylon Yogev. The adversarial robustness of sampling. In Proceedings of the 39th ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems , pages 49-62, 2020.

Omri Ben-Eliezer, Rajesh Jayaram, David P Woodruff, and Eylon Yogev. A framework for adversarially robust streaming algorithms. ACM Journal of the ACM (JACM) , 69(2):1-33, 2022.

Omri Ben-Eliezer, Talya Eden, and Krzysztof Onak. Adversarially robust streaming via densesparse trade-offs. In Symposium on Simplicity in Algorithms (SOSA) , pages 214-227. SIAM, 2022.

Amos Beimel, Haim Kaplan, Yishay Mansour, Kobbi Nissim, Thatchaphol Saranurak, and Uri Stemmer. Dynamic algorithms against an adaptive adversary: Generic constructions and lower bounds. In Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing , pages 1671-1684, 2022.

Avinatan Hassidim, Haim Kaplan, Yishay Mansour, Yossi Matias, and Uri Stemmer. Adversarially robust streaming algorithms via differential privacy. Advances in Neural Information Processing Systems , 33:147-158, 2020.

Yeshwanth Cherapanamjeri and Jelani Nelson. On adaptive distance estimation. Advances in Neural Information Processing Systems , 33:11178-11190, 2020.

Edith Cohen, Xin Lyu, Jelani Nelson, Tamás Sarlós, Moshe Shechner, and Uri Stemmer. On the robustness of countsketch to adaptive inputs. In International Conference on Machine Learning , pages 4112-4140. PMLR, 2022.

Vladimir Braverman, Avinatan Hassidim, Yossi Matias, Mariano Schain, Sandeep Silwal, and Samson Zhou. Adversarial robustness of streaming algorithms through importance sampling. Advances in Neural Information Processing Systems , 34:3544-3557, 2021.

David P Woodruff and Samson Zhou. Tight bounds for adversarially robust streams and sliding windows via difference estimators. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS) , pages 1183-1196. IEEE, 2022.

Idan Attias, Edith Cohen, Moshe Shechner, and Uri Stemmer. A Framework for Adversarial Streaming via Differential Privacy and Difference Estimators. In Yael Tauman Kalai, editor, 14th Innovations in Theoretical Computer Science Conference (ITCS 2023) , volume 251 of Leibniz International Proceedings in Informatics (LIPIcs) , pages 8:1-8:19, Dagstuhl, Germany, 2023. Schloss Dagstuhl - Leibniz-Zentrum für Informatik.

Noga Alon, Yossi Matias, and Mario Szegedy. The space complexity of approximating the frequency moments. In Proceedings of the twenty-eighth annual ACM symposium on Theory of computing , pages 20-29, 1996.

Andrew Chi-Chih Yao. Some complexity questions related to distributive computing (preliminary report). In Proceedings of the eleventh annual ACM symposium on Theory of computing , pages 209-213, 1979.

Cynthia Dwork, Moni Naor, Omer Reingold, Guy N Rothblum, and Salil Vadhan. On the complexity of differentially private data release: efficient algorithms and hardness results. In Proceedings of the forty-first annual ACM symposium on Theory of computing , pages 381-390, 2009.

Cynthia Dwork, Guy N Rothblum, and Salil Vadhan. Boosting and differential privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science , pages 51-60. IEEE, 2010.

Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science , 9(3-4):211-407, 2014.

Cynthia Dwork, Moni Naor, Toniann Pitassi, and Guy N Rothblum. Differential privacy under continual observation. In Proceedings of the forty-second ACM symposium on Theory of computing , pages 715-724, 2010.

T-H Hubert Chan, Elaine Shi, and Dawn Song. Private and continual release of statistics. ACM Transactions on Information and System Security (TISSEC) , 14(3):1-24, 2011.

Raef Bassily, Kobbi Nissim, Adam Smith, Thomas Steinke, Uri Stemmer, and Jonathan Ullman. Algorithmic stability for adaptive data analysis. In Proceedings of the forty-eighth annual ACM symposium on Theory of Computing , pages 1046-1059, 2016.

Christopher Jung and Katrina Ligett. A new analysis of differential privacy's generalization guarantees. Innovations in Theoretical Computer Science (ITCS) , 2020.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies adversarial robustness for the problem of counting on distributed streams, where the input may be adaptive based on previous outputs by a protocol across $k$ sites and the objective is for a central server to output an additive $\\alpha m$ approximation to the stream of length $m$. When the input is oblivious, there is a randomized protocol that uses $\\tilde{O}(\\sqrt{k}/\\alpha)$ communication, which improves upon a deterministic protocol using $\\tilde{O}(k/\\alpha)$ communication. However, it is not clear how the protocol behaves when the input is adaptive. This paper gives a protocol that uses $\\tilde{O}(\\sqrt{k}/\\alpha)$ communication, showing there is essentially no overhead for adversarial inputs.\n\nThe algorithm works by having each site split its input into blocks and notify the central server if its number of updates within a server block surpasses a certain randomized threshold. Whereas a previous work in adversarially robust streaming used sparse vector technique and differential privacy to protect the internal randomness of the algorithm, the challenge is that distributed streams are event based, and so sparse vector technique will not work. Instead, this paper proposes a new notion of partial differential privacy and shows that not only does it handle generalization with respect to the sample accuracy, but also the distributional accuracy. Thus the output is close to its expectation, which circumvents a complicated analysis of the estimator.\n\nSTRENGTHS:\nThere are multiple solid contributions by this paper. \n- Firstly, it introduces the problem of adversarial robustness to distributed streams. \n- Secondly, it gives an algorithm that shows there is no overhead for the counting problem, which is not clear at all a priori. \n- Thirdly, the paper introduces the concept of partial differential privacy and proves interesting generalization properties of partial differential privacy. The paper notes that partial differential privacy may be of independent interest. \n- There is a good summary of related work for adversarial robustness, the central techniques in those works, and why they do not apply in this setting. \n- Adversarial robustness on streams is a relevant topic for both the machine learning and theory communities.\n\nWEAKNESSES:\n- The communication cost is actually $O(k+\\sqrt{k}(\\log N)/\\alpha)$ rather than $O(\\sqrt{k}(\\log N)/\\alpha)$, so the regime of improvement is for $k>\\frac{1}{\\alpha^2}$, though it should be noted that this same weakness is also present in previous work [13] on oblivious distributed streams. Nevertheless this should be corrected in the formal guarantees.\n\n- While there is a good summary of related work for adversarial robustness and why they do not apply in this setting, it is not clear why natural modifications to the techniques of [13] would not work. \n\nMinor comments:\n\n- It should be noted that $\\tilde{O}$ is being used to suppress polylogarithmic terms in $N$, rather than $\\tilde{O}(f)=O(f)\\cdot\\text{polylog(f)}$, due to the notation $\\tilde{\\sqrt{k}/\\alpha}$ to mean $O(\\sqrt{k}(\\log N)/\\alpha)$. \n\n- [18] is \"Hassidim\" rather than \"Hasidim\" (note the correct spelling in [21])\n\n- Line 294: \"the the\"\n\nQUESTIONS:\nIs it possible to think of partial differential privacy to protect a certain set of elements in the manner of carefully distributing the privacy budget as in [20]?\n\nEDIT: I acknowledge receipt of the author response and am currently choosing to maintain my score.\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-15"}

comments: SUMMARY:
The paper provides an algorithm or the distributed count tracking that both enjoys the communication advantage from randomization and is robust to adaptive adversaries. Another contribution of the paper is that it introduces a new *partial differential privacy* definition and completes related generalization theorem that can have potential broader implications.

STRENGTHS:
**Originality** The proposed method is novel by creatively designing a new privacy criteria and randomizing the communication to account for adaptive adversaries.
The new definition *partial DP* and the generalization theorem will be useful for other stream data setting.

**Quality**  The theoretical analysis looks sound; the authors can verify the efficient tradeoffs among privacy, accuracy, and communication of the proposed method.

**Clarity** The problem is well-defined and clearly stated. The method and the analysis are connected smoothly.

**Significance** The problem being solved is important. The new DP definition can have broader impact for other private ML tasks.

WEAKNESSES:
**No experiments** Could you please justify why you think experiments are not needed in your paper? Because you claim your proposed method is the first robust tracking algorithm in the domain, it seems important to offer some baseline experiments to help future work.

QUESTIONS:
1. I am curious what are potential scenarios that your newly proposed partial DP may be important? It would be helpful to suggest some.

2. Do you think it would be a great idea to briefly mention how the algorithm you propose can be easily adapted for other robust distributed tracking beyond the count tracking?

LIMITATIONS:
The authors do not discuss the limitations.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work studies adversarially robust count tracking in a distributed computation setting. In particular the work considers a setting with an adaptive adversary that can choose future inputs based on the outputs produced by the server so far. This is in contrast to prior work on distributed count tracking that considers only oblivious adversaries that must choose the entire input stream before the session begins. \n\nThis is the first work to consider robustness against active adversaries in the distributed setting. However, prior work in the central model [18] proves that a differentially private algorithm can be used to extend obliviously robust algorithms to ones that are robust against active adversaries while retaining similar accuracy guarantees. Taking inspiration from [18], this work uses a notion related to differential privacy, and a distributed algorithm that is robust against oblivious adversaries, to construct a distributed algorithm that is robust against active adversaries. Instead of a general black box reduction like in [18] (one that can be applied to any robust algorithm), this work directly modifies some oblivious algorithms to obtain algorithms that are robust against active adversaries. The work additionally argues that the communication complexity of their algorithms is near optimal.\n\nSTRENGTHS:\nLike the authors mention in their manuscript, and support with a clear discussion: it is very important to study the robustness of streaming algorithms in the presence of  active adversaries since this is a more realistic model of the settings in which these algorithms operate. \n\nThis work provides a distributed count tracking algorithm that is robust against active adversaries while also achieving near optimal communication complexity and accuracy.\n\nWEAKNESSES:\nThis work states that the event driven nature of distributed tracking algorithms prevents them from protecting randomness in the DP sense. However, they do not provide a concrete claim or any formal proof  of this fact. The only explanation of this claim is a brief paragraph on page 4 of the manuscript, making it difficult to understand what exactly the authors mean by the statement and also making it difficult to verify if their claim is true. Given that this claim is the central motivation for defining partial differential privacy, I would have hoped for a more thorough treatment of the claim. They also do not define differential privacy against adaptive attackers in the distributed setting.\n\nThis paper doesn’t provide a discussion of the privacy consequences of using their partial DP notion to provide privacy in distributed settings. Since this work defines a new notion that they call privacy, I believe it is essential to provide at least some discussion of:\n- the limitations of this new notion \n\n- whether the definition should be expected to provide real world privacy for computations\n\nMinor comments:\n- Despite switching between discussions of additive and multiplicative error throughout the manuscript, this work does not define accuracy anywhere and often uses the phrase accuracy without an ‘additive’ or ‘multiplicative’ quantifier.\n\n- This work often states that they use ‘differential privacy’ to achieve robustness against active adversaries in the distributed setting, therefore conflating differential privacy with the weaker notion defined in this work.\n\n- The way that the authors phrase the statement that their algorithm does not treat existing oblivious algorithms as a black-box is somewhat misleading. The statement seems to imply that a non black-box use of prior algorithms is generally desirable; However, while a non black-box use of algorithms is sometimes necessary to achieve optimal guarantees – a black-box use of prior algorithms often leads to a more generalizable result.\n\nQUESTIONS:\nRegarding the claim: “the event driven nature of distributed tracking algorithms prevents them from protecting randomness in the DP sense.”\n\n - [With respect to the discussion on pg 4] Why does the fact that the server can update the output only after it receives an input imply that you cannot provide privacy against active attackers in the distributed setting? Why should we expect this to be different than in the central setting? \n\n- In the above claim, are you considering adaptive differential privacy as in  https://arxiv.org/abs/2112.00828? \n\n- Could you explain,  formally, what exactly your claim is?\n\nLIMITATIONS:\nThis paper doesn’t provide a discussion of the privacy consequences of using their partial DP notion to provide privacy in distributed settings. Since this work defines a new notion that they call privacy, I believe it is essential to provide at least some discussion of:\n- the limitations of this new notion \n\n- whether the definition should be expected to provide real world privacy for computations\n\nFinally, if this notion does not indeed provide intuitive individual or group privacy in the setting the authors consider, this should be made very clear – perhaps by calling the notion something other than ’privacy’.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper considers a distributed count tracking problem introduced at PODS 2012: k parties receive (possibly adversarial) updates to a common counter, and need to communicate with a server to maintain an approximation of the total number of updates received. The goal is to minimize communication from the parties to the server. In PODS 2012 it was shown that communication proportional to $\\sqrt{k}$ is sufficient, improving on a simple deterministic algorithm for which communication is proportional to $k$. The $\\sqrt{k}$ bound was also shown optimal up to polylogarithmic factors. However, the upper bound crucially assumes an oblivious adversary, such that the inputs to the parties may not depend on the estimates reported so far. The present paper shows that this assumption can be removed. The idea is to use techniques from differential privacy, but existing techniques do not apply, so the paper proposes a new version of these techniques that is applicable in the distributed setting.\n\nUPDATE: After reading the review of MMAV and the corresponding rebuttal I am increasing my score slightly.\n\nSTRENGTHS:\n- Resolves a decade-old open problem regarding one of the most natural problems in distributed functional monitoring\n- Introduces interesting new techniques for dealing with adaptive, adversarial inputs, which should arguably be the standard model for any dynamic algorithm claiming to be robust\n\nWEAKNESSES:\n- The paper does not really try to argue for relevance to machine learning. Unless this is addressed, it would probably be of interest to only a small fraction of NeurIPS attendees.\n- Though adversarial robustness and the connection to differential privacy has been studied in NeurIPS before, this has been in the context of streaming algorithms, which are probably closer to machine learning applications. The paper feels more like a database theory paper than a NeurIPS paper.\n\nQUESTIONS:\n- Can you elaborate on why the results of the paper are of interest for a machine learning audience? Are there, for example, potential implications for federated learning?\n\nLIMITATIONS:\nI would have liked the model to be described more clearly. If my understanding is correct, only communication from sites to the server is counted, while the server is able to broadcast estimates \"for free\" to the sites. It is unclear in what settings this kind of asymmetry in accounting for communication is a good model.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-09"}