Title: Creating a Public Repository for Joining Private Data
Venue: NeurIPS 2023
Accepted: yes
Keywords: Differential privacy

machine learning

linear queries
Abstract: How can one publish a dataset with sensitive attributes in a way that both preserves privacy and enables joins with other datasets on those same sensitive attributes? This problem arises in many contexts, e.g., a hospital and an airline may want to jointly determine whether people who take long-haul flights are more likely to catch respiratory infections. If they join their data by a common keyed user identifier such as email address, they can determine the answer, though it breaks privacy.  This paper shows how the hospital can generate a private sketch and how the airline can privately join with the hospital's sketch by email address. The proposed solution satisfies pure differential privacy and gives approximate answers to linear queries and optimization problems over those joins. Whereas prior work such as secure function evaluation requires sender/receiver interaction, a distinguishing characteristic of the proposed approach is that it is non-interactive. Consequently, the sketch can be published to a repository for any organization to join with, facilitating data discovery. The accuracy of the method is demonstrated through both theoretical analysis and extensive empirical evidence.

Creating a Public Repository for Joining Private Data

Abstract

How can one publish a dataset with sensitive attributes in a way that both preserves privacy and enables joins with other datasets on those same sensitive attributes? This problem arises in many contexts, e.g., a hospital and an airline may want to jointly determine whether people who take long-haul flights are more likely to catch respiratory infections. If they join their data by a common keyed user identifier such as email address, they can determine the answer, though it breaks privacy. This paper shows how the hospital can generate a private sketch and how the airline can privately join with the hospital's sketch by email address. The proposed solution satisfies pure differential privacy and gives approximate answers to linear queries and optimization problems over those joins. Whereas prior work such as secure function evaluation requires sender/receiver interaction, a distinguishing characteristic of the proposed approach is that it is non-interactive. Consequently, the sketch can be published to a repository for any organization to join with, facilitating data discovery. The accuracy of the method is demonstrated through both theoretical analysis and extensive empirical evidence.

1 Introduction

Given a sensitive dataset keyed by individual identities (which must never be revealed), how can we publish a private version of it that can nonetheless be joined by identity to another dataset to produce approximate answers to questions about the join? Can a sender publish this private version to a repository so that receivers can both approximate joint distributions and train ML models, without any interaction between the sender and the receiver?

There are inter-organizational scenarios where answering these questions is valuable. For example, a healthcare provider may have clinical records keyed by patient email address and a private column such as 'has cancer'. A company wants to determine if employees who work near toxic waste sites have a higher incidence of cancer. We show how two companies can privately join their data in order to build such predictive models. With the rise of data marketplaces, it is more common for organizations to seek to 'decorate' their data by adding new columns from other organizations, while preserving privacy. Intra-organizational scenarios also abound. Within a large organization, it is common that data collected in one team is hidden from other teams. With a central repository, not only is data discovery possible, but more private joins can be performed to assess predictive power.

The Repository Setting. A stylized view of the problem is shown in Fig. 1. One party, the sender S, holds a dataset D S with two columns: a unique identifier to join on, and a value from a small finite domain (in this case, has cancer encoded as ± 1 ). S would like to share D S in a privacy-preserving way with many other organizations without explicitly interacting with each one. To this end, S uploads a private representation of D S to a public repository. Party R is one of many possible receivers , and holds a dataset which has a column with unique identities to join on, and any number of other columns, e.g., latitude and longitude of where their employees work. R's goal is to perform a joint

ReceiverR

Private

Count

Private to R

Name

WorkLocation

(latitude,longitude)

Sketch

SenderS

(34.93,-117.2)

2

Carol

(40.83,-80.54)

Name

Cancer?

Private to S

0

(39.73, 75.13)

-1

3

Repository

-2

+1

Join:UsingthePrivateCountSketchtoDecorateR'sData

-1

Carol

-1

Name

WorkLocation

Cancer+1

Cancer-1

2

+1

(34.93,-117.2)

0

1

0

Carol

(40.83,-80.54)

-1

2

1

PrivatetoS

2

(39.73,75.13)

3

-2

-5

Private toR

computation - red box in Fig. 1. It involves the inner join that would normally include only people in both datasets. But, for privacy, the receiver R does not know about the existence of Alice; and even though David is not in S's data, R still receives a label, which is noise. This paper studies how R can learn functions over the inner join of R and S, e.g., does work location predict cancer positivity.

Problem statement Joint computation of linear queries and optimization are described in Subproblems 1.2 and 1.3. The dataset representations should be compatible with both problems simultaneously.

Problem 1.1. Given a dataset D S with a unique identity column and one value column with a small finite domain, publish to a repository a single differentially private representation of D S which can be combined with any other dataset D R (so long as D R has a column of unique identities for joining) to solve Subproblems 1.2 and 1.3.

A linear query involves applying some function f to each element in the join and outputting the sum. Subproblem 1.2 (Linear Queries) . Let f be a real-valued function. Define

where ids( D ) is the set of identities that appear in D and D [ id ] is the value associated with id in D . Given access to D R and a differentially private representation of D S , find an estimate ˆ ℓ so that

In an optimization query, the goal is to find a function f in a class of functions F that approximately minimizes SumOverJoin D R ,D S ( f ) . Supervised learning with a loss function is a special case.

Subproblem 1.3 (Optimization Queries) . Given a class F of real-valued functions, let f opt = arg min f ∈F SumOverJoin D R ,D S ( f ) . Given access to D R and a differentially private representation of D S , find a function ˆ f such that

Contributions. Problem 1.1 is solved by building upon work on private count sketches. This paper makes the following contributions. (1) Method. We show how to apply the private count sketch to enable a sender to share their data privately, enabling a receiver to approximately join it with their own dataset on individual identifiers to estimate linear queries and learn functions.The identities of the individuals in the sender's data are not revealed. A distinguishing characteristic of the method is that the algorithms are non-interactive, and hence are repository ready. (2) Analysis. A non-trivial mathematical analysis in the form of theorems bounding the error. For linear queries, Problem 1.2,

our main result is Thm. 5.1. For optimization queries, Problem 1.3, our main result is Thm. 6.4, proved using a careful combination of tail bounds. (3) Experiments. (a) We conduct three sets of experiments on public data to compare our solutions to exact answers obtained by joining the data directly, with no privacy. With a reasonable privacy parameter ( ε = 1 ) we acheive over 92% accuracy on the EMNIST dataset, and applying logistic regression on the UCI Adult dataset, we lose less than 1% accuracy compared to training on the original data with no privacy. (b) We compare to related methods. We adapt the protocol of Zhao et al. [39] to allow for joins and show that our approach is more accurate. We also compare with the LabelDP [21] method on an already-joined dataset, and show that our method performs competitively despite having the harder task of performing a private non-interactive join.

2 Related Work

Privacy. Differential privacy [19, 18] is a widely used definition that intuitively guarantees that the outcome of a mechanism is essentially unchanged whether an individual is or is not in the dataset. One of the most commonly studied models of privacy in the literature is the curator model where a trusted centralized repository holds all personal information. The role of the curator is to answer questions about the data in a differentially private way. In the function release problem, the curator must release a single piece of data which can be used to answer an unlimited number of queries [24, 2, 14].

In our case, party S plays the role of curator. The private representation they upload to the public repository can be viewed as an example of function release. It does not depend on the structure of R's dataset or the particular function R aims to compute - S has no knowledge of the parties R who might later download it. Therefore, we can view the sketch as a function accepting as 'query' an entire dataset D R together with the function to apply to the join.

Private Sketches. Sketching is a common technique used to summarize a dataset. The technique most relevant to this paper is the Count Sketch [10] which we describe in more detail below. Other influential sketching techniques include count min [16], tug of war [4], locality sensitive hashing [25] and AMS [3]. Private variants of sketching have also been considered wherein, for example, the usual sketch is computed and noise is added. Two examples include the private count sketch [6, 39] and the private count min sketch [39]. Count sketch has been used to solve a wide variety of problems, e.g., estimate histograms, frequencies, quantiles or heavy hitters. We add to this list of uses the ability to support data joins. Other examples of private sketch work include the Johnson-Lindenstrauss transform [7] and the loglog sketch [12] - neither require additional noise for privacy. Private locality sensitive hashing [15] has been considered in the context of private function release.

We are not aware of past work that uses the count sketch to privately join. Nevertheless, it is possible to adapt prior private sketching work to our framework. However, since these solutions were not designed with our application in mind, they do not perform as well - see the experiments in §7.2.

Local DP. [6] describes an approach in the local model, where each individual publishes their own noisy data. If individual identities are discarded it precludes joins. If the central server in the local model records individual identities, the identities cannnot be published without compromising privacy. While our techniques are similar to past work in local differential privacy, there are important differences: we apply them in the repository setting rather than a local DP setting (see Appendix H for a comparison), the frequencies sketched are always 0 or 1 because unique identifiers are being sketched, and our technique enables joins on those private identifiers. We optimize our use of count sketches for this setting (especially in §6) and provide a novel experimental and theoretical analysis.

Vertically Partitioned Data. [17] study a scenario where a user interactively queries multiple independent databases holding vertical partitions of a dataset. Other results include [30, 31, 33, 36]. Note that in our case, the protocol is non-interactive; each database has an identity column which must be used to join the tables; the identities are private; and some identities may be present in one database and not the other.

Secure Function Evaluation. In the cryptography community, there is extensive work showing how two parties A,B holding data x A , x B can jointly compute f ( x A , x B ) without leaking any information beyond f ( x A , x B ) [37, 23]. For interactive, multi-party computation, cryptographic techniques are a superior solution. However, this paper is on non-interactive solutions for the repository setting. More comparison can be found in Appendix J.

3 Preliminaries

Notation Z , N and R denote the sets of integers, nonnegative integers and reals. We let U be some set of unique identifiers for people - e.g. strings representing name and address. For datasets D,D ′ , the join D ▷◁ D ′ is defined in Definition 3.1, and | D | ∈ N is the number of rows in D .

Datasets A dataset D ⊆ U × X is a set of pairs ( id ∈ U , x ∈ X ) ; we call X its value domain and its elements rows . In our problem there are two datasets: the sender's ( D S ) and the receiver's ( D R ). The value domain of D S will always be X = { 1 ..k } for some small k ∈ N , but there is no restriction on the value domain of D R : X could be numbers, text, images, etc. We do not allow any id ∈ U to appear more than once in the same dataset, so in particular there are no duplicate rows.

Joins When the same identity appears in two datasets, we want to combine the associated values.

Definition 3.1. The join of D ⊆ U × X and D ′ ⊆ U × Y is a dataset D ▷◁ D ′ ⊆ U × X × Y defined by

This an example of a natural join [13], using the identity column D and D ′ have in common. Given a function f : X × Y → R , we define the sum over the join :

Definition 3.2.

(This is equivalent to the definition in Subproblem 1.2, but written in terms of D ▷◁ D ′ .)

Differential Privacy Let ε and δ be positive real numbers and M be a randomized algorithm. We say that M is ( ε, δ ) -differentially private [19] if for all S ⊆ Range( M ) and for all pairs of datasets D 1 and D 2 that differ in the addition or removal of one row, Pr( M ( D 1 ) ∈ S ) ≤ e ε Pr( M ( D 2 ) ∈ S )+ δ , where the probability is taken over the coin flips of M . In this work we will always set δ = 0 ; in this case we say M is ε -differentially private; this is called pure differential privacy .

The two-sided geometric distribution The noise we add to ensure privacy will follow the two-sided geometric distribution [22] (see notes in Appendix B.1):

Definition 3.3. The two-sided geometric distribution with parameter α , denoted TGeom( α ) , is a distribution over Z with probability mass function Pr[ Z = z ] = 1 -α 1+ α α | z | .

Private Count Sketches We use a simplified version of the count sketch [10] as a way to encode a dataset D ⊆ U × { 1 ..k } . It is parameterized by a number of buckets b and two hash functions h : U × { 1 ..k } → { 1 ..b } , s : U × { 1 ..k } → {-1 , +1 } .

Definition 3.4. Given b , h and s as above, the count sketch of a dataset D ⊆ U × { 1 ..k } is a vector CountSketch b,h,s ( D ) = ( c 1 , . . . , c b ) ∈ Z b , where c j = ∑ ( id ,y ) ∈ D : h ( id ,y )= j s ( id , y ) .

Adding noise makes a count sketch differentially private:

Definition 3.5. Given D , b , h and s as in Definition 3.4, and a privacy parameter ε > 0 , the private count sketch of D is a random vector PrivCountSketch b,h,s,ε ( D ) = CountSketch b,h,s ( D ) + Z ε ∈ Z b where Z ε is a vector of b independent samples from TGeom( e -ε ) (Definition 3.3).

Since adding or removing a row from D causes CountSketch b,h,s ( D ) to move a distance of 1 in the ℓ 1 metric, we have [6, 39]:

Proposition 3.6. PrivCountSketch b,h,s,ε ( D ) is ε -differentially private.

It is common to repeat the count sketch with multiple independent hash functions to mitigate error caused by hash collisions when there are fewer buckets than items ( b < n ). This is important when the goal is to recover frequencies of repeated items while storing the sketch in as few bits as possible. In contrast, our frequences are all 1 or 0 (present or not), and our goal is to estimate aggregates of many such frequencies. We are not trying to compress a stream, so we take b ≈ n , at which point

we find the error added by Z ε dominates the error from hash collisions. We do not repeat the count sketch because it would improve error only slightly (if at all), and because it would complicate our analysis. In §7.2 we compare to a private sketching method that uses multiple hash functions and Gaussian noise, and find it performs worse than Definition 3.5 for our purposes.

4 Method Overview

We begin with intuitive motivation for the method and then a provide an overview of the steps S and R take to solve Problem 1.1. In §§5 and 6 we explain R's computation in detail.

4.1 Intuition and alternative approaches

Here is a simplified version of our problem. Suppose parties S and R each have a set of individuals' names D S , D R ⊆ U = { A .. Z } ∗ . R wishes to estimate the number of names in common: | D S ∩ D R | . The names are sensitive and cannot be shared directly. Instead, S must publish a differentially private representation C = Private( D S ) without consulting R, and then R must compute their estimate based on C and D R . This is a special case of Subproblem 1.2. Here are some possible approaches.

Secure function evaluation. In cryptography, this problem is called private set intersection cardinality [20, 26, 32]. Cryptographic solutions are well-studied, but require multiple rounds of interaction. In our repository setting , party S publishes a single value Private( D S ) and may not interact further. See Appendix J for a discussion on this comparison.

Send the hashes. One might try choosing a secure hash function h : U → { 0 , 1 } ∗ and sending Private( D S ) = { h ( x ) : x ∈ D S } . The problem is that R would need to know h to compute | D R ∩ D S | . Knowing h would let them test individuals' membership in D S , compromising privacy.

Dot product of noisy vectors. We can view the sets as vectors D S , D R ∈ { 0 , 1 } U , with one bit for every possible id ∈ U . Then D T S D R = | D S ∩ D R | . Party S can make their vector ε -differentially private by adding noise: Private( D S ) = D S + Z ε , where Z ε ∈ Z U is a vector of independent samples from TGeom( e -ε ) . Party R can estimate | D R ∩ D S | ≈ Private( D S ) T D R . The problem is that U is too big - if identities are r -bit strings, then Private( D S ) takes more than 2 r bits to store.

Solution: Private count sketch. The solution we use is a modification of the previous one: S sends a vector with noise added, but first reduces the dimension using a private count sketch.

4.2 Protocol

Our solution to Problem 1.1 has two steps: (1) S publishes a sketch and some parameters (Algorithm 1; figure in Appendix A); (2) R downloads the sketch and runs Algorithm 2 (Subproblem 1.2, linear queries) or Algorithm 3 (Subproblem 1.3, choosing the optimal function from a class).

Although the elements of D S are pairs ( id , y ) ∈ U × { 1 ..k } , we treat them as opaque values for the purpose of computing PrivCountSketch b,h,s,ε ( D S ) - so the domain of the hash functions h, s is U × { 1 ..k } . The time complexity of Sender is O ( | D S | + b ) , assuming that sampling from TGeom( α ) and computing the hash functions h and s all take constant time.

Algorithm 1 Sender

Let { 1 ..k } be the range of D S 's value column, i.e. D S ⊆ U×{ 1 ..k } .

1: Choose the privacy budget ε and the number of hash buckets b .

2: h, s ← ChooseHashFunctions ( b )

3: C ← PrivCountSketch b,h,s,ε ( D S ) .

4: Publish C ∈ Z b and the parameters k, b, h, s, ε to a repository.

Choosing hash functions Building a sketch requires first choosing hash functions h, s with an algorithm ChooseHashFunctions ( b ) . This choice has no effect on privacy: even if ∀ x, h ( x ) = s ( x ) = 1 , the private count sketch is differentially private. However, higher-quality hash functions will give more accurate results. Thm. 6.4 assumes h and s are sampled uniformly from the set of all functions; in practice, cryptographically secure hash functions should give the same guarantees.

5 Linear queries

R can use Algorithm 2 to estimate SumOverJoin D R ,D S ( f ) , given access to their own dataset D R along with C = PrivCountSketch b,h,s,ε ( D S ) and the associated parameters k, b, h, s sent by S. Its time complexity is O ( k | D R | + b ) , assuming f ( x, y ) can be computed in constant time. The computation Q T C on lines 2-4 can be explained as follows. For every ( id , x ) ∈ D R and y ∈ { 1 ..k } , R multiplies q ( id , x, y ) = s ( id , y ) · f ( x, y ) by the entry at index h ( id , y ) in S's sketch. In expectation this equals f ( x, y ) if ( id , y ) ∈ D S and 0 otherwise. The sum of these values over ( id , x ) ∈ D R , y ∈ { 1 ..k } is Q T C , and equals SumOverJoin D R ,D S ( f ) in expectation. Here the expectation is taken over the output of ChooseHashFunctions and the TGeom( α ) noise.

Algorithm 2 ReceiverLinearQueries

1: Download C = PrivCountSketch b,h,s,ε ( D S ) and the parameters k, b, h, s from the repository.

2: Set q ( id , x, y ) ∈ R b to be s ( id , y ) f ( x, y ) at entry h ( id , y ) and 0 everywhere else.

3: Construct Q = ∑ ( id ,x ) ∈ D R ∑ k y =1 q ( id , x, y ) , the query vector .

4: Return Q T C .

Theorem 5.1. For any datasets D R ⊆ U × X,D S ⊆ U × { 1 ..k } , function f : X ×{ 1 ..K } → R , privacy parameter ε > 0 , number of hash buckets b , and accuracy parameter µ > 0 , if h and s are drawn from a mutually 4-way independent hash family, the following holds. Let M be an upper bound on | f ( x, y ) | , k be the range of the value column of D S , n = | D R ▷ ◁ D S | , C = PrivCountSketch b,h,s,ε ( D S ) . Then

The probability is taken over h, s and the noise added to PrivCountSketch b,h,s,ε ( D S ) .

We defer the proof to Appendix C. According to the theorem, the size of the join should be sufficiently large for it to be useful.

6 Optimization

Suppose R's dataset has an id column and several feature columns, and S's has an id column and a label column. In this section we show how R can train a model to predict S's labels from R's features. More generally, if R has a class of functions F which map X × Y → R , we show how R can select ˆ f ∈ F which is close to the optimal function f opt ,

in the sense that | SumOverJoin D R ,D S ( ˆ f ) -SumOverJoin D R ,D S ( f opt ) | is small.

For example, suppose D S has labels y ∈ { 0 , 1 } and D R has feature vectors x ∈ R d , and R would like to train a logistic regression model on D R ▷ ◁ D S . Then R can take F = { ℓ θ : θ ∈ R d } , where ℓ θ is the logistic loss ℓ θ ( x, y ) = y log(1 + e -θ T x ) + (1 -y ) log(1 + e θ T x ) .

In §§6.1 and 6.2 we show how to compute the estimate ˆ f , assuming we already have a non-private optimization algorithm that accepts weighted inputs . (For an alternative without weights, see Appendix E.) In §6.3 we analyze the loss in accuracy due to privacy.

6.1 Evaluating one function

Our optimization method is based on a score Φ D R ,C ( f ) for individual functions f ∈ F , which R computes based on their dataset D R and the sketch C sent by S. The score is a proxy for the true objective SumOverJoin D R ,D S ( f ) . It is less sensitive to noise and hash collisions than the estimate Q T C from §5. The cost is that Φ D R ,C ( f ) does not actually approximate SumOverJoin D R ,D S ( f ) .

Instead, the two have a linear relationship: Φ D R ,C ( f ) ≈ β SumOverJoin D R ,D S ( f ) for a positive number β = β ( D R , D S , b, ε ) which does not depend on f . (We prove this in the appendix in Lemma D.3, as part of the proof of Thm. 6.4.) R does not know β , but does not need to: the optimization method described in §6.2 boils down to computing arg min f ∈F Φ D R ,C ( f ) .

There are two differences between the score Φ D R ,C ( f ) and the linear estimate Q T C , developed while proving Theorem 6.4. First, we clip coordinates of the sketch C to be between -1 and 1 .

Definition 6.1. For x ∈ R , clip( x ) is 1 or -1 if x ≥ 1 or x ≤ -1 ; otherwise clip( x ) = x . The clipped version of a vector C ∈ R b is a vector with clipped entries: clip( C ) i = clip( C i ) .

(Since our sketches have integer coordinates, clip( x ) equals the sign sgn( x ) ∈ {-1 , 0 , 1 } . In §7.2 we try a sketch with non-integer coordinates.) Second, when h hashes more than one row ( id , x ) ∈ D R to the same coordinate of C , we reweight the terms corresponding to those rows.

Definition 6.2. The score of f ∈ F is defined as follows. Let N R ( a ) be the number of possible pairs ( id , y ) where id appears in D R , y is any value in { 1 ..k } , and h ( id , y ) = a :

6.2 Performing the optimization

Here we show how R can compute the estimate ˆ f ∈ F , given their own dataset D R , the parameters k, b, h, s, ε , and C = PrivCountSketch b,h,s,ε ( D S ) downloaded from the repository. In short, our method is simply to find the function f ∈ F that minimizes the score defined in the previous section:

Definition 6.3. The estimated optimal function in F is ˆ f := arg min f ∈F Φ D R ,C ( f ) .

If F is a small finite set, this definition directly leads to an algorithm: R computes Φ D R ,C ( f ) for every f ∈ F and chooses the arg min directly. For larger F s we will assume R has an algorithm WeightedOpt to find the optimal f on a weighted dataset . A weighted dataset ˜ D is a collection of ( w,x,y ) triples where w ∈ R is called the weight and ( x, y ) is a valid input to functions in F . To be precise, WeightedOpt minimizes

Many algorithms for training machine learning models admit a weight associated with each training example; such an algorithm could play the role of WeightedOpt . R can now find the optimal function by implementing Algorithm 3. The time complexity of this algorithm is O ( k | D R | ) + W ( k | D R | ) , where W ( n ) is the run-time complexity of WeightedOpt on a dataset with n elements.

By Definitions 6.2 and 6.3, the output of WeightedOpt is identical to the estimated optimal function ˆ f . The question of whether ˆ f is any good is addressed in §6.3.

Algorithm 3 ReceiverOptimize

1: Download C = PrivCountSketch b,h,s,ε ( D S ) and the parameters k, b, h, s .

2: w id ,y ← s ( id , y ) clip( C h ( id ,y ) ) /N R ( h ( id , y ) for y = 1 , . . . , k

3: Construct ˜ D = ˜ D ( b, h, s, D R , C ) by creating ( w id ,y , x, y ) for each element ( id , x ) ∈ D R and y ∈ { 1 ..k } . //note : | ˜ D | = k | D R |

4: Return WeightedOpt ( ˜ D, F )

6.3 Analysis

Here we analyze the accuracy of our method in the context of learning a classifier. We state and prove a more general result in Appendix D, and prove the below results in Appendices D.2 and D.3.

We bound the classification error of a model trained using our method on features from D R and binary labels from D S (so k = 2 ). Let F be a set of classifiers f : X →{ 0 , 1 } , and for f ∈ F let

L f ∈ N be the number of classifications errors on D R ▷ ◁ D S . To apply Algorithm 3, we convert this to an equivalent problem: let G be the set of corresponding error functions e f ( x, y ) = | f ( x ) -y | for f ∈ F , so L f = SumOverJoin D R ,D S ( e f ) . Then we can ask Algorithm 3 to find the best e f ∈ G , which corresponds to the best classifier f .

Theorem 6.4. For any datasets D R ⊆ U × X,D S ×U×{ 1 ..k } , function class F , privacy parameter ε > 0 , number of hash buckets b and accuracy parameter µ > 0 , if h and s are drawn uniformly at random from the set of all 2 functions U × { 1 ..k } → { 1 ..b } , the following holds. Let f opt be the classifier that minimizes L f , and let ˆ f be the classifier corresponding to the function e ˆ f output by Algorithm 3. Let d be the VC dimension of F , n = | D R ▷ ◁ D S | , and

Then

For reference, we define VC dimension in Appendix B.4. Adding assumptions can simplify the bound. This corollary highlights the dependence on the privacy parameter ε :

Corollary 6.5. Assume D R and D S have the same set of identities, so the join is 'perfect' in the sense that | D R | = | D S | = | D R ▷ ◁ D S | . Let n = | D R ▷ ◁ D S | and let d be the VC dimension of F . Assume also that b = Ω( n ) . Let f opt be the classifier that minimizes L f , and let ˆ f be the classifier corresponding to the function e ˆ f output by Algorithm 3. Then for any µ > 0 ,

7 Experiments

The goal of the experiments is to evaluate the accuracy of our solutions and quantify the effect of noise and join size on downstream tasks. To simulate parties S and R, for each dataset, we add a unique id to each row, then split its columns into D R with all of the features and D S with labels. In §7.1 we learn a function that, given features x , predicts labels y ∈ { 1 ..k } using Algorithm 3 and a private count sketch. In Appendix F we estimate a joint distribution using Algorithm 2. In both cases, we find that the test error drops as we increase ε (meaning the privacy requirement is relaxed) or the sketch dimension, or as the join size increases ( D R , D S have more id s in common). In §7.2 we compare our results with the private linear queries protocol of Zhao et al. [39]. We also conduct experiments with multi-way joins and with non-unique identifiers in Appendix I.

Datasets. Two datasets are used in the experiments. (1) UC Irvine Adult dataset [1]. We predict if income is greater than 50K based on categorical features such as age , workclass and education . (2) Extended MNIST, for which we predict labels based on images of handwritten digits.

7.1 Optimization: Prediction Findings

We evaluate our method with two machine learning tasks: logistic regression on the UCI Adult dataset, and a neural net for Extended MNIST. We capped the cross-entropy loss by replacing predicted probabilities ˆ y with max { ˆ y, 10 -4 } . This is necessary since Algorithm 3 can produce negative weights, which would lead to divergence in the optimization if loss were not bounded.

In each case, we conduct several experiments varying the privacy parameter 3 ε and the sketch dimension b . All accuracy numbers are measured on the test set directly, with no simulated join. The right halves of Figs. 2 and 3 show the results, with different lines for different sketch dimensions b . A dashed line shows the test accuracy of a model trained directly on the training set, without privacy.

Adult testaccuracyvs.Joinsize.k=2,|DR×Ds|=6400.

Adulttestaccuracyvs.ε.k=2,|D×Ds|=32K.

0.84

0.82

0.80

2

accura

0.80

ccura

0.75

0.78

0.76

0.70

1·k|DDs|

10·k|D×Ds|

0.74

0.65

0.1·k|D×Ds|

0.72

0.01·k|D×Ds|

w/o privacy

0.60

w/oprivacy

0.70

1

2

4

0.01

0.1

1

10

epsilon

|DR| / IDRα Dsl

1.0

EMNiST test accuracy vs. Join size.  = 1. k = 10, |D×Ds| = 20K

0.9

0.95

accuracy

0.90

accuracy

0.8

0.85

0.7

0.80

司

0.6

0.75

10·k|D×Ds|

0.5

100·k|D:Dsl

10 ·k|D  Dsl

0.70

0.1·k|D×Ds|

1·k|DDs|

1 ·k|D × Ds|

0.65

0.01-k|DDs|

0.4

0.1 ·k|D DsI

0.60

w/o privacy

1

2

4

8

0.1

1

10

[DRI / IDR Dsl

epsilon

Imperfect joins, where D R has some IDs not present in D S , are simulated by randomly removing most of the rows in the training set, and then adding some back only to D R . The left halves of Figs. 2 and 3 show the results. The performance drops as this fraction increases, which is expected since unmatched rows in D R are assigned random labels that add noise to the training. In practice, party R would benefit by filtering D R to contain only identities likely to be in D S , e.g., if D S contains people in Ohio, R should also filter D R to Ohio. Note that on the right panel of Fig. 3, when ε = 1 , the test accuracy is around 92%, however, on the left panel of Fig. 3, the performance drops to 80% for ε = 1 . This is due to the smaller training set size (240K on the right vs 20K on the left).

We also train a neural net on the EMNIST bymerge dataset consisting of 760K images of handwritten digits and uppercase and lowercase letters, with 47 classes. We conduct this experiment to investigate the effects of large label domain sizes, i.e., large k . Fig. 4, shows test accuracy as a function of the number of labels. For each run, we randomly chose out of 47 classes, and applied our method with ε = 1 . The figure shows that, as expected, the performance degrades significantly as k increases, but the method is still viable with k = 45 . Note that in this experiment, the size of the dataset, and thus the join size, changes as we change k .

Our results are consistent with the dependence of Thm. D.2 on the parameters ε , b , and ϕ = | D R | / | D R ▷ ◁ D S | : test accuracy improves as ε or b increase, or | D R | / | D R ▷ ◁ D S | or k decrease. Training details can be found in Appendix G.

7.2 Comparison with other methods

To our knowledge, there is no past work on non-interactive private joins in the repository setting. However, one can replace our simplified private count sketch (Definition 3.5) with other private sketches. To this end, we incorporate Zhao et al's [39] private linear sketches into our method. Party S generates a sketch of ( id , value ) pairs as before, but builds the sketch using Algorithms 1 and 3 from Zhao et al. instead of our Definition 3.5. Then, line 2 of Algorithm 3 is replaced with LinearSketchQuery from Zhao et al.s' Algorithm 2: w id ,y ← clip(LinearSketchQuery( id , y )) .

The EMNIST experiment is run with different combinations of Zhao et al.'s parameters γ, β, ρ . Their protocol satisfies ρ -zCDP; we use Proposition 1.4 of [8] to compare our results by equating ρ = 1 2 ε 2 . The number of hash buckets b is related to γ as b = 1 /γ and the number of hash functions (one for us) is given by log(2 /β ) .

EMNIST test accuracy for different k. ε=1,d= 10·k|DDs|

0.900

0.875

0.850

2

0.825

C

0.800

0.775

0.750

0.725

10

15

20

25

30

35

40

45

The size oflabel domaink

EMNiSTtestaccuracy.Oursvs.Zhaoetal.

EMNiST test accuracy of our method vs Label DP.|DrDs|= 240K

1.0

1.0

....0.9703

0.9

y=0.9359

0.9

accura

2

0.7

0.8

(1e-07, 0.1)

(1e-07, 0.001)

(1e-07, 0.01)

(1e-07, 0.3)

(1e-06, 0.001)

0.8

(1e-06, 0.01)

S

0.6

(1e-06, 0.1)

(1e-06, 0.3)

(1e-05, 0.001)

0.7

0.5

(1e-05, 0.01)

0.6

0.25/0.5/0.75quantile

(1e-05, 0.1)

Ours,d=10·IDDsl

0.4

(1e-05, 0.3)

Ours, d = 2.4 × 106

0.5

Label-DP

10-1

100

101

101

100

101

epsilon

epsilon

Zhao et al. describe two sketch implementations, Count-Min and CountSketch. Count-Min sketch is a random classifier on EMNIST for ε ≲ 10 , possibly because Count-Min is designed to avoid underestimating frequencies, whereas in our case it is more important to be correct on average. CountSketch leads to better results, Fig. 5. For β = 0 . 3 , there is one hash function, as with our method, and the remaining differences between the two methods is the kind of added noise (Gaussian vs two-sided geometric), and that LinearSketchQuery omits the denominator N ( h ( id , y )) on Line 2 of our Algorithm 3. Our method provides better results, especially for smaller ε .

The accuracy of the model is roughly proportional to the number of correct vs. incorrect labels reconstructed in the join. For the corresponding values of ε and ( ρ, β, γ ) in the two methods, the number of incorrect labels reconstructed is fewer for the two sided geometric noise than Gaussian. Gaussian noise has thinner tails which is helpful for reducing the probability of large error values but not helpful in our application where queries are in any case clipped to the range [ -1 , 1] .

We also compare with LabelDP [21], which is a Local DP protocol that protects the labels . LabelDP is not designed to perform joins, and so we run it without splitting the training set. Results are shown in the right panel of Fig. 5. The definition of 'neighbouring datasets' differs in the two settings: we use the 'add/remove' definition where a single row is added or removed, but in LabelDP's definition, a single value is changed. To account for this, we double the privacy budget for LabelDP, so for example at ε = 1 on the x -axis, we actually give LabelDP a privacy budget of ε = 2 .

The LabelDP method benefits from not needing to perform a join, and so we expect it to perform better than our method, where the parties must join using a non-interactive protocol. We were surprised to see our method perform better for small ε , and do not understand why this happens.

Future Work. This work focused on when the sender has a single private label column. To broaden applicability, data with multiple columns and data of different types, such as real-valued or text, deserve consideration. New privacy challenges arise in the streaming setting where organizations continuously receive new data and discard outdated data.

Acknowledgments

We would like to thank Joan Feigenbaum, Bill Horne, Yonatan Naamad, Aaron Roth, Doug Terry, Tal Wagner, and the anonymous reviewers for helpful feedback, comments and suggestions that improved this paper.

References

Adult. Adult. UCI Machine Learning Repository, 1996.

F. Alda and B. I. Rubinstein. The bernstein mechanism: Function release under differential privacy. In Thirty-First AAAI Conference on Artificial Intelligence , 2017.

N. Alon, Y. Matias, and M. Szegedy. The space complexity of approximating the frequency moments. Journal of Computer and system sciences , 58(1):137-147, 1999.

N. Alon, P. B. Gibbons, Y. Matias, and M. Szegedy. Tracking join and self-join sizes in limited storage. Journal of Computer and System Sciences , 64(3):719-747, 2002.

M. Anthony and P. L. Bartlett. Neural network learning: Theoretical foundations . cambridge university press, 1999.

R. Bassily, K. Nissim, U. Stemmer, and A. Thakurta. Practical locally private heavy hitters. J. Mach. Learn. Res. , 21:16-1, 2020.

J. Blocki, A. Blum, A. Datta, and O. Sheffet. The johnson-lindenstrauss transform itself preserves differential privacy. In 2012 IEEE 53rd Annual Symposium on Foundations of Computer Science , pages 410-419. IEEE, 2012.

M. Bun and T. Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In M. Hirt and A. Smith, editors, Theory of Cryptography , pages 635-658, Berlin, Heidelberg, 2016. Springer Berlin Heidelberg. ISBN 978-3-662-53641-4.

M. Byali, H. Chaudhari, A. Patra, and A. Suresh. Flash: Fast and robust framework for privacy-preserving machine learning. Cryptology ePrint Archive, Paper 2019/1365, 2019. URL https://eprint.iacr.org/2019/1365 . https://eprint.iacr.org/2019/1365 .

M. Charikar, K. Chen, and M. Farach-Colton. Finding frequent items in data streams. In International Colloquium on Automata, Languages, and Programming , pages 693-703. Springer, 2002.

H. Chaudhari, A. Choudhury, A. Patra, and A. Suresh. Astra: High throughput 3pc over rings with application to secure prediction. In Proceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop , CCSW'19, page 81-92, New York, NY, USA, 2019. Association for Computing Machinery. ISBN 9781450368261. doi: 10.1145/3338466.3358922. URL https://doi.org/10.1145/3338466.3358922 .

S. G. Choi, D. Dachman-Soled, M. Kulkarni, and A. Yerukhimovich. Differentially-private multi-party sketching for large-scale statistics. Cryptology ePrint Archive , 2020.

E. F. Codd. Further normalization of the data base relational model. Research Report / RJ / IBM / San Jose, California , RJ909, 1971.

B. Coleman and A. Shrivastava. A one-pass private sketch for most machine learning tasks. arXiv preprint arXiv:2006.09352 , 2020.

B. Coleman and A. Shrivastava. A one-pass distributed and private sketch for kernel sums with applications to machine learning at scale. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages 3252-3265, 2021.

G. Cormode and S. Muthukrishnan. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms , 55(1):58-75, 2005.

C. Dwork and K. Nissim. Privacy-preserving datamining on vertically partitioned databases. In M. Franklin, editor, Advances in Cryptology - CRYPTO 2004 , pages 528-544, Berlin, Heidelberg, 2004. Springer Berlin Heidelberg. ISBN 978-3-540-28628-8.

C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci. , 9(3-4):211-407, 2014. doi: 10.1561/0400000042. URL https://doi. org/10.1561/0400000042 .

C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In S. Halevi and T. Rabin, editors, Theory of Cryptography , pages 265-284, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg. ISBN 978-3-540-32732-5.

M. J. Freedman, K. Nissim, and B. Pinkas. Efficient private matching and set intersection. In International conference on the theory and applications of cryptographic techniques , pages 1-19. Springer, 2004.

B. Ghazi, N. Golowich, R. Kumar, P. Manurangsi, and C. Zhang. Deep learning with label differential privacy, 2021.

A. Ghosh, T. Roughgarden, and M. Sundararajan. Universally utility-maximizing privacy mechanisms. CoRR , abs/0811.2841, 2008. URL http://arxiv.org/abs/0811.2841 .

O. Goldreich. Foundations of cryptography: volume 2, basic applications . Cambridge university press, 2009.

R. Hall, A. Rinaldo, and L. Wasserman. Differential privacy for functions and functional data. The Journal of Machine Learning Research , 14(1):703-727, 2013.

P. Indyk and R. Motwani. Approximate nearest neighbors: towards removing the curse of dimensionality. In Proceedings of the thirtieth annual ACM symposium on Theory of computing , pages 604-613, 1998.

L. Kissner and D. Song. Privacy-preserving set operations. In Annual International Cryptology Conference , pages 241-257. Springer, 2005.

P. Mohassel and Y. Zhang. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 19-38, 2017. doi: 10.1109/SP.2017.12.

A. Patra and A. Suresh. Blaze: Blazing fast privacy-preserving machine learning. Cryptology ePrint Archive, Paper 2020/042, 2020. URL https://eprint.iacr.org/2020/042 . https: //eprint.iacr.org/2020/042 .

N. Ponomareva, H. Hazimeh, A. Kurakin, Z. Xu, C. Denison, H. B. McMahan, S. Vassilvitskii, S. Chien, and A. G. Thakurta. How to DP-fy ML: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research , 77:1113-1201, jul 2023. doi: 10.1613/jair.1.14649. URL https://doi.org/10.1613%2Fjair.1.14649 .

J. Vaidya and C. Clifton. Privacy preserving association rule mining in vertically partitioned data. In Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining , pages 639-644, 2002.

J. Vaidya and C. Clifton. Privacy-preserving k-means clustering over vertically partitioned data. In Proceedings of the ninth ACM SIGKDD international conference on Knowledge discovery and data mining , pages 206-215, 2003.

J. Vaidya and C. Clifton. Secure set intersection cardinality with application to association rule mining. Journal of Computer Security , 13(4):593-622, 2005.

J. Vaidya, C. Clifton, M. Kantarcioglu, and A. S. Patterson. Privacy-preserving decision trees over vertically partitioned data. ACMTransactions on Knowledge Discovery from Data (TKDD) , 2(3):1-27, 2008.

S. Wagh, D. Gupta, and N. Chandran. Securenn: 3-party secure computation for neural network training. Proceedings on Privacy Enhancing Technologies , 2019:26 - 49, 2019. URL https://api.semanticscholar.org/CorpusID:78090069 .

S. Wagh, S. Tople, F. Benhamouda, E. Kushilevitz, P. Mittal, and T. Rabin. Falcon: Honestmajority maliciously secure framework for private deep learning. Proceedings on Privacy Enhancing Technologies , 2021(1):188-208, Nov 2020. ISSN 2299-0984. doi: 10.2478/ popets-2021-0011. URL http://dx.doi.org/10.2478/popets-2021-0011 .

D. Xu, S. Yuan, and X. Wu. Achieving differential privacy in vertically partitioned multiparty learning. In 2021 IEEE International Conference on Big Data (Big Data) , pages 5474-5483. IEEE, 2021.

A. C.-C. Yao. How to generate and exchange secrets. In 27th Annual Symposium on Foundations of Computer Science (sfcs 1986) , pages 162-167. IEEE, 1986.

Q. Ye, H. Hu, X. Meng, and H. Zheng. Privkv: Key-value data collection with local differential privacy. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019 , pages 317-331. IEEE, 2019. doi: 10.1109/SP.2019.00018. URL https://doi.org/10.1109/SP.2019.00018 .

F. Zhao, D. Qiao, R. Redberg, D. Agrawal, A. E. Abbadi, and Y.-X. Wang. Differentially private linear sketches: Efficient implementations and applications. Neurips , 2022.

Appendices

A Illustration of Algorithm 1

Figure 6 provides a visual depiction of the private count sketch that the sender uploads to the public repository. The noise values Z ε are sampled from TGeom( e -ε ) (Def. 3.3). For example, if we choose ε = 1 (which gives a 'strong' privacy guarantee [29, §5.2.1]), then the variance of each Z ε is about 1.84.

Private Count Sketch

Sender S's Data

Hash

Noise

Name

Cancer?

1

0

Ze

-1

h(Bob,+1)

2

s(Bob,+1)

Ze

h(Alice,-1)

+1

0

Ze

h(Carol,-1)

Carol

-1

0

+

Ze

+1

h(Ed,+1)b

s(Alice,-1) +

Ze

s(Carol,-1)

s(Ed,+1)

Ze

(Private Count

Public

h: (Name, Cancer?) → [1...,b]

Sketch, h, s)

Repository

s: (Name, Cancer?) →{-1,+1}

B Some Useful Definitions and Theorems

B.1 More on the two-sided geometric distribution

We repeat the definition for convenience:

Definition 3.3. The two-sided geometric distribution with parameter α , denoted TGeom( α ) , is a distribution over Z with probability mass function Pr[ Z = z ] = 1 -α 1+ α α | z | .

TGeom( α ) is the same distribution as the difference between two independent geometric random variables, Geom( p = 1 -α ) . This fact can be verified directly from the probability mass functions, and it provides a convenient way to sample from the distribution when using a library that provides the geometric distribution. From this it immediately follows that the expectation and variance of TGeom( α ) are given by:

B.2 Mutually independent hash families

Definition B.2. A distribution H over pairs of hash functions h : U →{ 1 ..b } , s : U →{-1 , 1 } is a mutually k -way independent hash family iff for any fixed distinct inputs x 1 , . . . , x k and outputs y 1 , . . . , y k ∈ { 1 ..b } and z 1 , . . . , z k ∈ {-1 , 1 } ,

In other words, the outputs h ( x 1 ) , . . . , h ( x k ) , s ( x 1 ) , . . . , s ( x k ) are distributed uniformly over { 1 ..b } k ×{-1 , 1 } k .

B.3 McDiarmid's Inequality

Theorem B.3 (McDiarmid's Inequality) . Let f : X 1 ×··· × X n → R have the property that for every index i ∈ { 1 ..n } and every pair of sequences ⃗ x, ⃗ y ∈ X 1 ×··· × X n that differ only in the i -th coordinate, | f ( ⃗ x ) -f ( ⃗ y ) | ≤ c i . Then if X 1 ∼ X 1 , . . . , X n ∼ X n are independent random variables, then for any µ ≥ 0 ,

B.4 Measuring the complexity of a function class

When analyzing an optimization algorithm, it is useful to have a measure of the complexity of a class of functions. One such measure is the uniform covering number .

Definition B.4 (Covering number in R n [5]) . An ℓ ∞ µ -cover of a set S ⊆ R n is a set C ⊆ S such that ∀ x ∈ S ∃ c ∈ C | x -c | ∞ < µ . The ℓ ∞ µ -covering number of S , denoted N ( µ, S, ℓ ∞ ) , is the cardinality of the smallest such C .

Definition B.5 (Uniform covering number of a function class [5]) . Given a function f : X → R and a sequence ⃗ x = ( x 1 , . . . , x n ) ∈ X n , the restriction of f to ⃗ x is

The restriction of a class of functions F is the set of restrictions of the functions in it:

The uniform covering number N ∞ ( µ, F , n ) is the largest covering number of any restriction F| ⃗ x to a lengthn sequence:

The Vapnik-Chervonenkis dimension or VC-dimension is another measure of complexity that applies to boolean-valued functions. In the case of boolean-valued functions, the uniform covering number is called the growth function :

Definition B.6 (Growth function [5]) . Let F be a class of functions f : X →{ 0 , 1 } . The growth function of F is a function Π F : N → N defined by Π F ( m ) = N ∞ ( 1 2 , F , m ) .

( 1 2 could be replaced by any number less than 1.) Note that Π F ( m ) ≤ 2 m since there are only 2 m possible restrictions f | ⃗ x for a lengthm sequence ⃗ x .

Definition B.7 (VC Dimension [5]) . Let F be a class of functions f : X → { 0 , 1 } . The VC dimension of F , denoted VCdim( F ) , is the largest d such that Π F ( d ) = 2 d .

The VC dimension summarizes the behaviour of the growth function in a way captured by the following lemma:

Lemma B.8 (Theorem 3.7 of [5]) . Let F be a class of boolean-valued functions with VC dimension d . Then for any m ≥ 1 , Π F ( m ) ≤ m d +1 .

We will make use of a simple connection between the complexity of a collection of classifiers f and of the corresponding set of error functions e f :

Lemma B.9. Let F be a class of functions f : X →{ 0 , 1 } . For f ∈ F define e f : X ×{ 0 , 1 } → { 0 , 1 } by e f ( x, y ) = | f ( x ) -y | , and let G = { e f : f ∈ F} . Then

Proof. Let d G = VCdim( G ) and d F = VCdim( F ) .

First we'll show d G ≥ VCdim( G ) . Unpacking the definitions of VC dimension and growth function, we see there is ⃗ x = ( x 1 , . . . , x d F ) ∈ X d F such that F| ⃗ x includes every one of the 2 d F sequences in { 0 , 1 } d F . Let ⃗ z = (( x 1 , 0) , . . . , ( x d F , 0)) . Observe that for any f ∈ F , f | ⃗ x = e f | ⃗ z ∈ { 0 , 1 } d F . Therefore G ⃗ z includes all 2 d F sequences, and so VCdim( G ) ≥ d F .

To show d G ≥ VCdim( G ) , note there is some ⃗ z = (( x 1 , y 1 ) , . . . , ( x d G , y d G )) ∈ ( X ×{ 0 , 1 } d G such that G| ⃗ z includes every sequence in { 0 , 1 } d G . Let ⃗ x = ( x 1 , . . . , x d G ) ∈ X d G . Given a sequence s ∈ { 0 , 1 } x d G , we would like to show s ∈ F| ⃗ x . Indeed, define the sequence s ′ ∈ { 0 , 1 } x d G by s ′ i = | s i -y i | , and let e f be a function in G (corresponding to some f ∈ F such that e f | ⃗ z = s ′ . Then for any i ∈ { 1 ..d G } , f ( x i ) = | e f ( x i ) -y i | = | s ′ i -y i | = s i , and so f | ⃗ x = s . We were able to do this for an arbitrary s , so F ⃗ x includes all 2 d G sequences, so VCdim( F ) ≥ d G .

C Linear Queries: Proof of Theorem 5.1

We prove Thm. 5.1, repeated here for convenience:

Theorem 5.1. For any datasets D R ⊆ U × X,D S ⊆ U × { 1 ..k } , function f : X ×{ 1 ..K } → R , privacy parameter ε > 0 , number of hash buckets b , and accuracy parameter µ > 0 , if h and s are drawn from a mutually 4-way independent hash family, the following holds. Let M be an upper bound on | f ( x, y ) | , k be the range of the value column of D S , n = | D R ▷ ◁ D S | , C = PrivCountSketch b,h,s,ε ( D S ) . Then

The probability is taken over h, s and the noise added to PrivCountSketch b,h,s,ε ( D S ) .

The proof follows by applying Chebyshev's inequality to the following lemma:

Lemma C.1. If h and s are drawn from a mutually 4-way independent hash family (Definition B.2), then

and where k is the number of possible values allowed in S's value column, | f | ∞ = sup x,y f ( x, y ) , C = PrivCountSketch b,h,s,ε ( D S ) , and the randomness is over the choice of h and s and the noise from TGeom( e -ε ) that was added to C .

Proof. We write C = Z + ∑ ( id ,y ) ∈ D S C ( id , y ) where C ( id , y ) is a vector with s ( id , y ) at coordinate h ( id , y ) and 0 everywhere else, and Z is a vector of independent TGeom( e -ε ) random variables.

For every id , x, y , we have

̸

On the other hand, if ( id , y ′ ) = ( id ′ , y ) then E [ q ( id , x, y ′ ) T C ( id ′ , y )] = 0 . This follows from the facts that s is independent of h and that s is two-way independent and so E [ s ( id , y ′ ) s ( id ′ , y )] = 0 . Finally, E [ q ( id , x, y ) T Z ] is zero, since Z is independent of Q and has expectation zero. So:

Moving on to the variance, we have

where A = ∑ ( id ,x ) ∈ D R ∑ k y =1 q ( id , x, y ) T Z and

̸

Using (1) can write

B -SumOverJoin D R ,D S ( f ) = ∑ ( id ,x ) ∈ D R k ∑ y ′ =1 ∑ ( id ′ ,y ) ∈ D S [( id , y ′ ) = ( id ′ , y )] q ( id , x, y ′ ) T C ( id ′ , y

̸

where [( id , y ′ ) = ( id ′ , y )] denotes a function which is 0 whenever id = id ′ and y ′ = y and 1 otherwise, and similarly [ h ( id , y ′ ) = h ( id ′ , y )] is 1 when the hashes are equal. We write,

̸

Var[ Q T C ] = E [ A 2 ] + 2 E [ A ( B -SumOverJoin D R ,D S ( f ))] + E [( B -SumOverJoin D R ,D S ( f )) 2 ] and compute each term separately.

̸

Note that cross terms in A 2 are zero in expectation because each includes a product s ( id , y ) s ( id ′ , y ′ ) where ( id , y ) = ( id ′ , y ′ ) . The variance of the two-sided geometric distribution comes from Lemma B.1. We have

since (referring to (2)) each term includes a product of distinct ID-y pairs s ( id , y ) s ( id ′ , y ′ ) s ( id ′′ , y ′′ ) or s ( id , y ) s ( id ′ , y ′ ) 2 which are both 0 in expectation since s is 3-way independent. Finally, looking at (2), we see

̸

where C = [( id , y ′ ) = ( id ′ , y )][( id ′′ , y ′′′ ) = ( id ′′′ , y ′′ )] Pr[ h ( id , y ′ ) = h ( id ′ , y ) ∧ h ( id ′′ , y ′′′ ) = h ( id ′′′ , y ′′ )] and D = E [ s ( id , y ′ ) s ( id ′ , y ) s ( id ′′ , y ′′′ ) s ( id ′′′ , y ′′ )]

̸

̸

Since s is 4-way independent, D is 1 when every pair in { ( id , y ′ ) , ( id ′ , y ) , ( id ′′ , y ′′′ ) , ( id ′′′ , y ′′ ) } appears at least twice, and 0 otherwise. So, C · D is 1 /b 2 when either ( id , y ′ ) = ( id ′′ , y ′′′ ) = ( id ′ , y ) = ( id ′′′ , y ′′ ) or ( id , y ′ ) = ( id ′′′ , y ′′ ) = ( id ′ , y ) = ( id ′′ , y ′′′ ) and 0 otherwise, so

̸

̸

̸

Combining (3), (4) and (5) gives:

where for the last inequality we use the fact that | D R ▷ ◁ D S | ≤ min {| D R | , | D S |} since by assumption identities are unique.

D Optimization: Proof and generalization of Theorem 6.4 (Optimization)

Here we state and prove Thm. D.2, a generalization of Thm. 6.4. For the proof of Thm. 6.4 itself, see Section D.2.

Our general optimization theorem states that our optimization method, Algorithm 3 from §6, produces close-to-optimal results under certain conditions. Specifically, we show that the estimated optimal function ˆ f , which we define in Definition 6.3 and show how to compute in §6.2, has a value close to the true optimum f opt = arg min f ∈F SumOverJoin D R ,D S ( f ) . Our bound on the accuracy of ˆ f given in Thm. D.2 depends on a quality score (Definition D.1) and the uniform covering number of the function class.

Definition D.1. The quality rating κ ( D R , D S , k, b, ε ) > 0 depends on a pair of datasets D R ⊆ U× X and D S ⊆ U × { 1 ..k } , an integer b > 0 (number of hash buckets) and a real number ε > 0 (privacy parameter), and is defined as:

where

Theorem D.2 (Generalization of Thm. 6.4) . Fix a pair of datasets D R , D S , parameters b (number of hash buckets) and ε > 0 , a bound M > 0 , a class F of functions f : X × Y → [ -M,M ] , and an error parameter µ > 0 . Let C = PrivCountSketch b,h,s,ε ( D S ) be the sketch sent by S, and

That is, f opt and ˆ f are the true optimal function and the function returned by Algorithm 3, respectively. Then

where c is the uniform covering number

and κ, ϕ, W R , W S are given in Definition D.1.

For reference, we define N ∞ in Appendix B.4. We prove Thm. D.2 through a careful combination of tail bounds. It has similarities to classic machine learning results relating empirical loss to expected loss on an underlying distribution, but note that we instead relate two empirical values: the sum of a function over a true join, versus what we recover from the sketch.

D.1 Proof of Theorem D.2

Central to the proof is the following bound on the error in the score of a single function:

Lemma D.3. Fix a pair of datasets D R , D S , parameters b (number of hash buckets) and ε > 0 , and a bound M > 0 . Then there is a real number β = β ( D R , D S , b, ε ) ≥ 1 18 W R W S , where W R and W S are as in Definition D.1, such that for every function f : X × Y → [ -M,M ] , the value β -1 Φ D R ,C ( f ) approximates SumOverJoin D R ,D S ( f ) in the following sense.

Let the hash functions h : U → { 1 ..b } and s : U → {1 , 1 } be sampled uniformly at random, and let C = PrivCountSketch b,h,s,ε ( D S ) . Then for every µ > 0 ,

We first show how to prove Thm. D.2 from Lemma D.3, and then prove Lemma D.3 in §D.1.1.

Proof of Thm. D.2 from Lemma D.3. The proof can be summarized as a chain of two approximate equalities and one inequality:

where each of the ≈ is proved by Lemma D.3, and the ≤ follows by the definition of ˆ f . Unfortunately, since ˆ f depends on some randomness (the noise added for privacy, and the hash functions), we cannot directly prove the first ≈ through an application of Lemma D.3, and so we first find a cover of functions, and apply the Lemma to each function in the cover.

Let J ⊆ X × Y be the inner join D R ▷ ◁ D S excluding the id column. Let V ⊆ R | J | be a set of size c which is an ℓ ∞ µW R W S 72 kϕ -cover of F| J .

For any f, f ′ ∈ F satisfying the 'closeness' condition guaranteed by the cover; that is, as long as

is true, we have

and similarly, from Definition 6.2 and the triangle inequality, together with Lemma D.8 (which says β ≥ 1 18 W R W S ),

(For the last step, recall ϕ = | D R | | D R ▷ ◁D S | .)

Let E be the event that every function in V , as well as f opt , has its value approximated by β -1 times its score within µ 4 :

By combining Lemma D.3 (with µ 4 in the place of µ ) with a union bound over every f ∈ V ∪{ f opt } ,

Assume E holds and let ˆ f ′ be a function in V which is close to ˆ f ; that is, ∀ ( x, y ) ∈ J | ˆ f ( x, y ) -ˆ f ′ ( x, y ) | < µ 4 kϕ . Then, using (6) and (7), and the fact that by definition Φ D R ,C ( ˆ f ) ≤ Φ D R ,C ( f opt ) :

D.1.1 Proof of Lemma D.3

Restated for convenience:

Lemma D.3. Fix a pair of datasets D R , D S , parameters b (number of hash buckets) and ε > 0 , and a bound M > 0 . Then there is a real number β = β ( D R , D S , b, ε ) ≥ 1 18 W R W S , where W R and W S are as in Definition D.1, such that for every function f : X × Y → [ -M,M ] , the value β -1 Φ D R ,C ( f ) approximates SumOverJoin D R ,D S ( f ) in the following sense.

Let the hash functions h : U → { 1 ..b } and s : U → {1 , 1 } be sampled uniformly at random, and let C = PrivCountSketch b,h,s,ε ( D S ) . Then for every µ > 0 ,

To prove Lemma D.3, we begin by describing the factor β in (Definition D.7) and bounding it (Lemma D.8). Next, we show Φ D R ,C ( f ) has the correct value in expectation (Lemma D.9), and finally we complete the proof using a combination of tail bounds.

A technical lemma:

Lemma D.4. For any two nondecreasing sequences a 1 ≥ a 2 ≥ · · · ≥ a n and b 1 ≥ b 2 ≥ · · · ≥ b n ,

Proof. First, we rewrite each side of the inequality:

and

It suffices to show that each term in the first sum is greater than or equal to the corresponding term in the second sum. To see this, note that

and a i -a j and b i -b j are either both nonnegative or both nonpositive, depending on whether i ≤ j .

Lemma D.5. Let X = Z + ∑ n i =1 S i where Z, S 1 , . . . , S n are independent random variables, and Z ∼ TGeom( e -ε ) for some ε > 0 and each S i is drawn from the uniform distribution on {-1 , 1 } . Then

and

Proof. The distribution of X is symmetric around 0: Pr[ X = x ] = Pr[ X = -x ] for any x . Thus, Pr[ X ≤ -1] = Pr[ X ≥ 1] , so E [clip( X )] = Pr[ X ≥ 1] -Pr[ X ≤ 1] = 0 .

It remains to bound E [clip( X +1)] , which equals Pr[ X ≥ 0] -Pr[ X ≤ -2] . Once again using the symmetry of X , we see Pr[ X ≤ -2] = Pr[ X ≥ 2] , and so

To avoid some repetition, let T = ∑ n i =1 S i . Since T has the same parity as n , we'll pay some attention to parities in what follows. Let n = 2 k + r where r ∈ { 0 , 1 } is n 's parity. Then

where z 0 will be chosen later. For an integer z , let a z = Pr[ T = 2 z + r ] and b z = Pr[ Z -2 z -r ∈ { 0 , 1 } ] , so

Consider the sequence z = 0 , -1 , 1 , -2 , 2 , -3 , 3 , . . . : that is 0 and then -i, i for each positive integer i . Both ( a z ) and ( b z ) are nondecreasing with respect to this order:

This nondecreasing property of ( a z ) follows because ( T + n ) / 2 is a binomial random variable with mean n/ 2 , and so its probability mass falls away monotonically from the mode(s) at ( T + n ) / 2 = ⌊ n/ 2 ⌋ , ⌈ n/ 2 ⌉ , that is, T = -r, r . The nondecreasing property for ( b z ) follows from the fact that the probability mass of Z falls away monotonically from the mode at Z = 0 .

Using the above order, we may apply Lemma D.4 to the sequences ( a z ) , ( b z ) , to get:

and

where A = Pr[ T ∈ [ -2 z 0 -r, 2 z 0 + r ]] , B = Pr[ Z ∈ [ -2 z 0 -r, 2 z 0 + r +1]] . From the probability mass function of TGeom( e -ε ) we directly compute B = 1 -e -(2 z 0 + r +1) ε . We apply Hoeffding's inequality to see

Taking z 0 = ⌈ √ n ⌉ gives A > 1 -2 e -2 and B = 1 -e -(2 ⌈ √ n ⌉ + r +1) ε . If 2 ⌈ √ n ⌉ + r +1 ≥ ε , then B ≥ 1 -e -1 , so we have

Otherwise ( 2 ⌈ √ n ⌉ + r +1 < ε ) we use the fact that for x < 0 , e x < 1+ x + x 2 2 to get B > Cε -1 2 C 2 ε 2 where C = 2 ⌈ √ n ⌉ + r +1 < ε , and so

Lemma D.6. If X is a binomially-distributed random variable X ∼ Binom( n, p ) then

Proof. Let P = Pr[ X ≥ max { 5 np, 1 } ] = min { Pr[ X ≥ 5 np ] , Pr[ X ≥ 1] } .

If np < 1 3 , then using Markov's inequality,

Otherwise ( np ≥ 1 3 ), we apply the Chernoff bound in the following form:

Definition D.7. Given datasets D R , D S and parameters b, ε , we define

where 1 is the constant function 1 ( x, y ) = 1 , and the expectation is taken over the random choice of hash functions h, s and the noise from TGeom( e -ε ) that party S added to C . (Note that SumOverJoin D R ,D S ( 1 ) = | D R ▷ ◁ D S | .)

Lemma D.8. β ( D R , D S , b, ε ) ≥ 1 18 W R W S where W R and W S are as in Definition D.1.

Proof. For any id ∈ U and i ∈ { 1 ..k } , define

So that taking δ = 4 to get

It suffices to show that for every ( id , x ) ∈ D R and i ∈ { 1 ..k } , if ( id , y i ) ∈ D S , then

and otherwise E [ T ( D R , C, id , i )] = 0 .

Suppose ( id , y i ) ̸∈ D S . Then s ( id , i ) is independent of C and N R ( h ( id , i )) , and so the probability distribution of T ( D R , C, id , i ) is symmetric about 0 , so E [ T ( D R , C, id , i )] = 0 as required.

Now suppose ( id , y i ) ∈ D S . Let N R = N R ( h ( id , i )) and define N S to be the number of rows ( id ′ , y i ′ ) ∈ D S such that h ( id ′ , i ′ ) = h ( id , i ) . Note N R ≥ 1 because ( id , x ) ∈ D R , and N S ≥ 1 because ( id , y i ) ∈ D S . Then

where

Conditioned on a particular value N S = n S ≥ 1 , s ( id , i ) C h ( id ,i ) is distributed as

where Z ∼ TGeom( e -ε ) is the noise party S added to C for privacy, and S 1 , . . . , S N S -1 are independent uniform samples from {-1 , 1 } , each having the value s ( id , i ) s ( id ′ , i ′ ) for some other ( id ′ , i ′ ) ∈ D S for which h ( id ′ , i ′ ) = h ( id , i ) . So, by Lemma D.5,

In particular, E n R ,n S ≥ 0 , so in our effort to lower bound E [ T ( D R , C, id , i )] , we are free to focus our attention on a subset of the terms:

where we choose

and E min is the minimum value of E n R ,n S over all n R ≤ B R , n S ≤ B S .

Recall that to complete our proof it suffices to prove (8). For this, it suffices to show that

and

(10) follows from Lemma D.6 since N R -1 ∼ Binom( n = k | D R | -1 , p = 1 b ) and N S -1 ∼ Binom( n = | D S | -1 , p = 1 b ) .

It remains to prove (11).

From (9) we have

By considering the cases 5 k | D R | b ≥ 1 , 5 k | D R | b ≤ 1 separately it can be seen that 1 ⌊ B R ⌋ ≥ min { 1 2 , b 10 k | D R | } = 1 2 W R . It remains only to be shown that

We consider two cases. If 5 | D S | b ≤ 1 , then B S = 2 and

Otherwise ( 5 | D S | b > 1 ) we have B S = 1 + 5 | D S | b > 2 , and so

In both cases, we find

as required.

Lemma D.9. For any datasets D R , D S and parameters b, ε , for uniformly random functions h : U → { 1 ..b } and s : U → {1 , 1 } ,

where C = PrivCountSketch b,h,s,ε ( D S ) .

Proof.

with T as defined in the proof of Lemma D.8. As observed in that proof, when ( id , y i ) ̸∈ D S we have E [ T ( D R , C, id , i ] = 0 , and so,

By the definition of β ,

Now, observe that T ( D R , C, id , i ) has exactly the same distribution for every ( id , x, y i ) ∈ D R ▷ ◁ D S : it is distributed as 1 N R (1 + Z + ∑ N S i =1 S i ) as described in the proof of Lemma D.8, where the random variables N R and N S are counts of hash collisions with ( id , i ) . So, E [ T ( D R , C, id , i )] has the same value for any ( id , x, y i ) ∈ D R ▷ ◁ D S . From (13) we see that value is exactly β ( D R , D S , b, ε ) , and so from (12) we have

Proof of Lemma D.3. We begin with an account of the randomness affecting Φ D R ,C ( f ) , as being in three parts: hash values h ( id , i ) ∈ { 1 ..b } , hash values s ( id , i ) ∈ {-1 , 1 } , and the noise values Z ∼ TGeom( e -ε ) that were added by party S to each coordinate of the private count sketch C . We define a sequence of random variables representing each of these parts.

Let id 1 , id 2 , . . . , id | D R | ∈ U be the identities that appear in D R . Let s = | D S | - | D R ▷ ◁ D S | (the number of identities that appear in D S but not D R ) and let ( id ′ 1 , y i 1 ) , . . . , ( id ′ n , y i s ) ∈ D S be the entries in D S which do not participate in the join D R ▷ ◁ D S . We define the following random variables:

Z i ∼ TGeom( e -ε ) for i ∈ { 1 ..b } .

We will complete the proof in two steps: first, we use Hoeffding's inequality to deal with the variables Z i , and then we use McDiarmid's inequality to deal with the other four kinds of random variable ( H,S,H ′ , S ′ ). The value C , defined next, connects the two steps together.

Let A be the expected value of Φ D R ,C ( f ) with respect to the random variables Z i :

Note that A is a random variable still depending on the values H i,j , S i,j , H ′ i , S ′ i , and

We have

We'll begin with ( ∗ ) . The probability is taken over the choice of h, s and Z , but we will look at the worst-case hash functions h and s :

For fixed functions h 0 , s 0 , we can write

where X a = 0 when N R ( a ) = 0 and otherwise

Here, [ h ( id , i ) = a ] is the indicator with value 1 if h ( id , i ) = a and 0 otherwise. X a is bounded between -M and M , since N R ( a ) equals the number of terms in the sum for which [ h ( id , i ) = a ] = 1 . Therefore, changing the value of one variable Z a while leaving the others the same changes the corresponding X a by at most 2 M . Now, Φ D R ,C ( f ) depends on at most k | D R | random variables Z a , namely the ones for which at least one pair ( id , i ) hashes to a for some id ∈ D R . We apply Hoeffding's inequality to get:

To bound (#) we use McDiarmid's inequality (Thm. B.3). We will view A as being a function of the random variables ( H i,j ) i,j , ( S i,j ) i,j , ( H ′ i ) i , ( S ′ i ) i , described above and call this function r :

Changing the value of one hash value H i,j or H ′ i affects at most two of the variables X a , and so changes (#) by at most 4 M . Changing the value of one hash value S i,j or S ′ i affects at most one of the variables X a , and so changes (#) by at most 2 M . Summing up the squares of these difference values, we get (4 2 +2 2 )( k | D R | + s ) M 2 = 20 M 2 , so applying Thm. B.3, we have:

Combining these bounds with Lemma D.8, we have

as required.

D.2 Proof of Theorem 6.4

We prove Thm. 6.4, repeated here for convenience. Recall that F is a set of classifiers, and for a function f ∈ F , f : X →{ 0 , 1 } , we define the corresponding error function e f ( x, y ) = | f ( x ) -y | ; for the full context, see §6.3.

Theorem 6.4. For any datasets D R ⊆ U × X,D S ×U×{ 1 ..k } , function class F , privacy parameter ε > 0 , number of hash buckets b and accuracy parameter µ > 0 , if h and s are drawn uniformly at random from the set of all 4 functions U × { 1 ..k } → { 1 ..b } , the following holds. Let f opt be the classifier that minimizes L f , and let ˆ f be the classifier corresponding to the function e ˆ f output by Algorithm 3. Let d be the VC dimension of F , n = | D R ▷ ◁ D S | , and

Then

We prove the theorem by combining Thm. D.2 with a standard result relating covering number to VC dimension (Lemma B.8), as well as Lemma B.9 to relate the VC dimension of F to that of the class G of error functions e f .

Proof. Taking M = 1 , Thm. D.2 (applied using the function class G = { e f | f ∈ F} ) says:

Where c is the uniform covering number

For any f ∈ F , we have SumOverJoin D R ,D S ( e f ) = L f , so we can rewrite that as:

All that remains is to bound the uniform covering number c . Note that the range of functions in G is { 0 , 1 } , and the ℓ ∞ distance between points in { 0 , 1 } n is always 1 . An examination of Definitions B.4 and B.5 then shows:

If µW R W S 72 kϕ ≥ 1 then c ≤ 1 .

So:

and since by assumption and (14) follows.

b

= Ω(

n

Apply Lemma B.9 (recall d = VCdim( F )

So:

D.3 Proof of Corollary 6.5

We prove Cor. 6.5, repeated here for convenience:

Corollary 6.5. Assume D R and D S have the same set of identities, so the join is 'perfect' in the sense that | D R | = | D S | = | D R ▷ ◁ D S | . Let n = | D R ▷ ◁ D S | and let d be the VC dimension of F . Assume also that b = Ω( n ) . Let f opt be the classifier that minimizes L f , and let ˆ f be the classifier corresponding to the function e ˆ f output by Algorithm 3. Then for any µ > 0 ,

Proof. By Thm. 6.4, it suffices to show

). = n d +1

Where W R , W S , ϕ, ψ are given in the theorem statement. Indeed, since by assumption | D R | = | D S | = n , we have

|

) = Ω(

D

R

|

) = Ω(

|

D

S

|

)

, we have

E Training a binary classifier with a difference sketch

If R wishes to train a binary classification model to predict labels in {-1 , 1 } that appear in D S , the approach described in this section might give better results than the one described in §6.2. The reconstructed dataset it produces does not have weights, so will work with a broader class of optimization algorithms. Also, the lack of negative weights avoids a problem with unbounded loss functions: since the approach in §6.2 can produce a dataset with negative weights, if the loss function is not bounded above, then the training loss may not be bounded below, causing the optimization algorithm to diverge.

Instead of the usual private count sketch, S will send a difference sketch C = DS b,h,s,ε ( D S ) defined as follows to R, along with the parameters b, h, s, ε .

Definition E.1. The difference sketch DS b,h,s,ε ( D S ) ∈ Z b is only defined when Y = {-1 , 1 } (so k = 2 ). It equals PrivCountSketch b,h,s,ε (ids( D S , 1) -ids( D S , -1)) , where ids( D S , y ) is the collection of identities associated with y in D S . As usual, the four parameters b, h, s, ε should be published along with DS b,h,s,ε ( D S ) .

Based on this and D R , party R builds a dataset D = D ( b, h, s, D R , C ) which is similar to the one described in §6.2, but does not have weights:

Definition E.2. To construct D = D ( b, h, s, D R , C ) , for each element ( id , x ) ∈ D R , R checks whether s ( id ) C h ( id ) is positive, negative, or zero. If it is positive or negative, R adds the element ( x, 1) or ( x, -1) to D , respectively, and if it is zero, R does not add anything to D (we say ( id , x ) is dropped ).

One justification for using the difference sketch is that as b →∞ (so there are no hash collisions) and ε →∞ (so no noise is added for privacy), D ( b, h, s, D R , C ) approaches the true join D R ▷ ◁ D S (but without an id column). Besides avoiding negative weights, an advantage of using a difference sketch instead of an ordinary private count sketch is that each time R processes an element ( id , x ) ∈ D R , only one noise sample perturbs the result (the noise that was added to C h ( id ) ), whereas with an ordinary private count sketch, two noise samples would affect the answer (the noise values added to C h ( id , 1) and C h ( id , 2) ).

In our experiments, we found the approach from §6.2 sufficient. We leave the application of difference sketches to future work.

F Experiments with linear queries

We consider the question of how accurately we can estimate a joint distribution using linear queries. Suppose R has a categorical feature race that takes values such as white, asian-pac islander and etc., and S has label income ≤ 50K or > 50K. In Table 1, we show the true counts of the actual number of people who fall into the combination of race and income , e.g., the fraction of asian pacific islanders who make less than 50K. We use the training set of 32,562 rows of the UCI Adult dataset in this experiment.

Below the true counts in the table are counts estimated by noisy sketches. The estimated count for the above example can be obtained by a linear query for which f ( x, y ) = 1 for y = 0 and x = asian-pac islander. Recall that y ∈ { 1 ..k } , and for this example k = 2 with y = 0 and y = 1 corresponding to ≤ 50K or > 50K respectively.

For this experiment, we set ε = 1 and the sketch dimension is set to 500K. In the event a linear query produces a negative answer or 0, we change it 1 to avoid negative fractions. In order to compute the error of the distribution, we compute the average of the absolute difference between the true fraction who make less than 50K for each value of x and the estimated fraction. Note that a linear query that involves a smaller number of people is more likely to misestimated, e.g., American Indian/Eskimo. Conversely, linear queries that involve a larger number of people are better estimated. We expect this outcome. Even if one party held all of the data, i.e., no joins, but we wanted a differentially private answer the TGeom( e -ε ) noise drowns out the signal for a small number of people.

Next, we fix the sketch dimension to 500K and vary the differential privacy parameter ε in the top panel of Fig. 7. Note how the error drops with increasing ε as expected. We also repeat this

experiment for other categorical variables such as sex , education , marital-status and etc. Note the feature with the highest average error: native-country . This is because there are some categories in this feature, e.g., Holland, with just a few people in the dataset.

In Fig. 7(b), we fix ε = 1 . 0 and show the effect of the sketch dimension on average error. As expected, error drops with increasing sketch dimension.

Joint Distribution:Avg Error asafunction of ε

workclass education

marital-status occupation

race sex

native-country

100

Joint Distribution:Avg Error as afunction of Sketch Dimension

0.175

workclass

0.150

education

AverageError over 10runs

marital-status

0.125

occupation

race

0.100

native-country

sex

0.075

0.050

0.025

0.000

104

10°

E

G Training details

G.1 UCI Adult Dataset

R has the features race, education , etc, and S has the label income ≤ 50K or > 50K. R would like to predict the label column given the feature columns. We one-hot encode the categorical columns for every feature and implement logistic regression in PyTorch with full batch gradient descent for 1K epochs with a learning rate of 1 × 10 -3 . The dataset has 48,845 rows split into a training set of 32,562 rows and a test set of 16,283 rows. S creates a sketch for rows belonging to the train set; the test set is only used to evaluate the model.

G.2 Extended MNIST

EMNIST is an extension of the widely used MNIST dataset of handwritten characters. We use the 240K (40K) images of digits to train (test) our protocol. The images are 28x28 pixels with labels '0' through '9'. The sender S generates a private count sketch of the (id, label) pairs and the receiver R possesses the feature vectors. R would like to learn to predict labels given features.

Stochastic gradient descent plays the role of WeightedOpt , and the function f ( x, y ) is modelled by a fully connected neural net with cross-entropy loss with input features x and output labels y . The neural net has 5 hidden layers with dropout, batch norm, residual connections and ReLU

0.25

AverageError over10runs

0.20

0.15

0.10

0.05

0.00

3 × 10-1

4 × 10-1

6 × 10-1

activations for a total of 1M parameters. In the non-private setting, we train it using the Adam optimizer and a learning rate of 10 -4 , batch size of 128 and obtain a test accuracy of 98.04%. In the presence of privacy, we conduct experiments to quantify the change in accuracy as we vary d , ε and | D R | / | D R ▷ ◁ D S | . We use AdamW with a learning rate of 1 × 10 -5 and a batch size of 2048 for 200 epochs.

For the experiment involving different k in Fig. 4, we use the EMNIST bymerge dataset of 760K images. We train a ResNet of 11M parameters, using AdamW with a batch size of 1024 and learning rate of 1 × 10 -6 for 25 epochs. For each experiment, we randomly sample k classes from a total of 47 different classes, and train the model from scratch.

H Comparison to local differential privacy

The repository setting explored in this work is similar in some ways to local differential privacy , also called randomized response [19]. In the local model, individuals perturb their responses before releasing them, so that their privacy is preserved even if the server gathering responses is untrusted.

Definition H.1 (Local differential privacy) . Let ε be a positive real number. A mechanism M is ε -locally differentially private if it consists of applying some randomized algorithm A to each element of the input and publishing the results:

and that algorithm A satisfies, for any two possible private values x, x ′ ∈ X and any S ⊆ Range( A ) :

For example, suppose we wish to estimate the fraction of people who have cancer, with X = {-1 , +1 } , where +1 means an individual has cancer. The algorithm A could randomly flip an individual's answer with probability 1 / (1 + e ε ) :

and, after gathering the responses, an appropriate correction could be applied to the fraction of +1 responses to compensate for the flipped answers.

By contrast, in the repository model , illustrated in Fig. 1, each party holds a dataset of many individuals' responses keyed by unique and sensitive identifiers which must not be revealed. The challenge is for one party to release a representation of their entire dataset which is differentially private which another party can combine with their dataset to approximate the result of joining on the private identifiers. This is an instance of function release in the curator model; the definition of 'differentially private' in Section 3 replaces Definition H.1.

H.1 Is it possible to join on individual identifiers in the local setting?

Ye et al. [38] show how (key, value) pairs can be released in the local model. However, their approach only works well with keys that appear many times, so it is not a feasible way to join on identifiers which appear at most once each.

A naïve way to adapt our approach to the local model is illustrated in Fig. 8. Each individual holding a pair ( id i , y i ) could release a private count sketch c i = PrivCountSketch b,h,s,ε ( { ( id , y ) } ) ∈ Z b of just their own data. The sender could then publish the sum C = ∑ n S i =1 c i ∈ Z b of these individual responses, instead of PrivCountSketch b,h,s,ε ( D S ) . The problem with this method is that each coordinate of C has n S independent noise values Z ε ∼ TGeom( e -ε ) added to it, compared to just one in the repository setting. This makes it impractical to recover any useful information from C .

Although this example shows the settings are different, there may be better ways to solve this problem in the local setting. Moreover, techniques from the local differential privacy literature may be useful, when appropriately adapted to the repository setting.

+

Name

Cancer?

Noise

PublicRepository

Noise

Name

Cancer?

-1

Noise

(sum of sketches)

Noise

-1

h(Alice,-1)

Noise

Noise

h(Ed,+1)

Noise

2

Noise

s(Alice,-1)+

4oNoise

Noise

Noise

s(Bob,+1)+ 4Noise

s(Ed,+1)+Noise

Noise

4oNoise

4oNoise

1

Name

Cancer?

Noise

Noise

Name

Cancer?

s(Alice,-1)+

+1

h(Bob,+1)

s(Bob,+1) +

s(Carol,-1)

Noise

Carol

-1

Noise

+4oNoise

Noise

Noise

s(Ed,+1)+4oNoise

Noise

Noise

s(Carol,-1)

Noise

+Noise

h(Carol,-1)

Noise

Noise

Noise' is drawn iid from TGeom(e-)

I Multi-way joins and non-unique identifiers

In this appendix, we conduct some experiments to study multi-way joins and the effects of having non-unique identifiers.

I.1 Multi-way joins

In the repository setting the receiver party can in principle join with as many senders as it wants. In §§4-6, we studied the case where the receiver joins with the dataset of one sender. Here we study the case of two senders for the Adult UCI dataset.

As before, we simulate the join setting by adding a unique id to each row of the dataset and split its columns. The receiver has education , one sender has relationship and the other sender has income . The receiver trains a logistic regression model using education and relationship as features to predict income (more or less than 50K). The test accuracy for different values of ε is shown in blue on the right side of Fig. 9. Note that the ε value is per sketch, so the total privacy cost of the three-way join (blue line) is 2 ε . For comparison, the red line shows test accuracy if the receiver does a two-way join using only the income sketch, so their model's only feature is education . The difference between the red and blue lines shows that for sufficiently high ε the receiver is able to make use of the three-way join.

I.2 Non-unique identifiers

We also analyse the case where the identifier is not unique. There are many practical reasons to consider such a scenario. For instance if two datasets are being joined on legal name , there will be several rows that correspond to different persons but have the same legal name . Our sketch (Definition 3.5) is well-defined even if values in the id column ( legal name here) are repeated. However, our Theorems 5.1 and 6.4 no longer apply when identities are not unique, and it is possible to construct adversarial examples where false matches steer Algorithms 2 or 3 in the wrong direction. Finding a better solution is a great direction for future work.

In Fig. 10, we show the performance of our method on the EMNIST dataset. We first add a unique identity to the digits (240K examples), and create sender and receiver datasets with labels and images respectively. Then we add extra rows to D S which duplicate the identities of existing rows, but with

UCIAdult testaccuracyvs.epsilonfor multi-wayjoins

0.82

0.80

Testaccuracy

0.78

0.76

Non-private,IncomefromEducation&Relationship

Non-private,IncomefromEducation

0.74

Private3-way,IncomefromEducation&Relationship

Private2-way,Income from Education

0.1

0.5

1

5

10

epsilon

EMNiST test accuracywithpseudo-identifiers atε=1

0.92

+

min

0.90

0.25/0.5/0.75quantile

0.88

2

accurac

0.86

心

0.84

司

0.82

0.80

0.78

1

2

3

4

5

6

7

8

|Ds|/Numberofuniqueidentifiers

random labels, and apply our method with ε = 1 . At x = 1 no new rows are added and at x = 8 each identity appears an average of 8 times in D S , once with the true label and 7 times with random labels. We left D R unchanged. This simulates a situation where 'pseudo' identifiers may be repeated but are independent of the data. The test accuracy on the y -axis shows that our method is robust and gives useful results even when the randomly-labelled false matches significantly outnumber the true matches.

Note that assuming duplicate rows have random labels is a strong assumption. Again consider the use case where legal name is the identifier, and the receiver has the features of a biomedical dataset. Different people with the same legal name might have non-trivial correlations. For instance, if a particular legal name is predominant amongst males, certain biological features will be correlated amongst the duplicate rows having that legal name . Although, it is possible that this correlation might benefit our method.

J Comparison with secure function evaluation

Secure function evaluation (SFE) protocols are cryptographic protocols for two parties holding values x A and x B to jointly compute a function f ( x A , x B ) with neither party learning anything other than

the value of the function [37, 23]. If x A and x B are sets with f ( x A , x B ) = x A ∩ x B then the problem is called private set intersection (PSI), and if f ( x A , x B ) = | x A ∩ x B | then it is called private set intersection cardinality (PSI-CA). These problems can be generalized to joining datasets to answer linear queries or solve optimization problems. Unfortunately, implementations require multiple rounds of communication, and we are unaware of a protocol that would allow efficient large neural network training [35, 9, 11, 28, 27, 34]. PSI is an active area of research, and we expect future developments to increase efficiency. There are some qualitative differences between our method and PSI(-CA):

Interaction: Our method requires no interaction. With PSI, two parties mutually agree to estimate the intersection of their inputs. With our method parties do not have to pre-agree on a joint function, and can use the same sketch to estimate joint distributions or train neural networks using stochastic gradient descent.

Exact vs. Approximate Answers: While the generality of our sketch implies that more functions can be estimated without interaction, this flexibility comes at the cost of more noise and therefore lower accuracy than SFE, which can either give exact answers or add just enough noise to satisfy DP.

Simple Implementation: SFE protocols can be quite complex to implement. This paper proposes a simple implementation with two hash functions and some noise.

Data Discovery in the Wild: We are targeting a data repository of one-time sketches enabling data discovery in the wild. The proposed method lowers the barrier to private joins. Data repositories such as UCI ML repository and MIMIC (healthcare data) presently, rightly, conceal information about individuals making it challenging to join.

A sketch-based public repository enables fast and easy data discovery.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper considers a scenario where a data owner wishes to publish a private view of their data set, so that others can evaluate join (aggregations) against this data, and related questions.  Formally, the problem is to support the following problem: the data owner has a high-dimensional vector which is sparse, and wants to publish an object that will allow others to estimate the inner product of this vector with their own individual vectors.  This is represented by the SumOverJoin problem presented in Subproblem 1.2.  Building on this primitive, the paper then considers how to use this within an optimization setting, i.e., to search for a vector within some subspace that approximately optimizes some loss function.  This is sufficient to pick some approximate models, e.g. logistic regression, with a privacy guarantee.\n\nSTRENGTHS:\nThe paper sets out a clearly defined problem, and shows how an efficient combination of sketches and noise can be applied to solve it.  The algorithm is very amenable to implementation, and performs well in experiments. \n\nThe proof that the optimization queries are accurate is quite technical and involved, demonstrating technical skill on the part of the authors.\n\nWEAKNESSES:\nThe scenario may be viewed as potentially narrow: the authors describe several alternative approaches that could be used, but which fail due to the requirement that the protocol is non-interactive (e.g., private set intersection approaches).  I like the non-interactive property, but given the promotion of private set intersection protocols, it could be argued that it is not a compelling need,\n\nIt may be debatable how novel the core contribution is: there is precedent for using sketches with DP noise.  However, the extension to optimization queries goes beyond results I have seen before.\n\nA few opportunities for improving presentation, e.g., \n\"we can view the sketch as a function accepting as query an entire dataset\" - I found this hard to parse\n\"we are not trying to compress a stream\"  clarify that the objective is to take an input with n non-zeros over a domain of size D.  The goal is to be proportional to n in size, but sublinear in D.  Maybe discuss more what the solution would be if D were small. \n\"secure hash functions should give the same guarantees\"  Perhaps more precise to say 'give the same performance'\n\nQUESTIONS:\nCould the optimization results be interpreted in terms of defining a subspace embedding?   I think the result follows if we can argue that the SumOverJoin bound holds for all vectors within a subspace.\n\nLIMITATIONS:\nNo limitations in the sense of negative societal impacts. \nThe paper could say more about the technical limitations of the approach, e.g., extending to more complex non-linear transformations.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-06-16"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors study the problem of computing a function of a join of two datasets on a user key so that the two datasets are owner by independent parties that never share their data directly. Instead the sender party gives out a DP sketch of the data that is later used by any receiver to compute an approximate answer to the query on the join. This is a very interesting formulation as it allows practical exchanges of information when the data exchanged is so sensitive (e.g., medical condition) that no party would want to participate. Contrary to other works (e.g., MPC, vertifcal Fed learning) this is one shot and does not require iterative algorithms or coordination. \n\nThe method is based on count sketch with added noise for privacy. The sender algorithm algorithm is simple to implement, efficient and elegant. The received algorithm is also straighforward for linear queries. The authors report results also on optimization of arbitrary functions. This requires that an optimizer is known for a weighted dataset ( a mild assumption). The algorithm for optimization is also very elegant requiring only a sketch-based weighting for the examples (and a factor k blow up in the number of examples to generate all possible labels) \n\nThe authors implement their method and test it for learning classification functions for up to k = 10 classes. They use standard public datasets and compare their method with a sketch-based method showing improved results.\n\nSTRENGTHS:\n+ the problem is very relevant to Neurips\n+ the algorithm proposed are elegant and efficient.\n+ theoretical analysis show utility and privacy guarantees for a wide range of applications\n\nWEAKNESSES:\n- The sender domain must be a small set {1, … k}. So this does not allow arbitrary regression (but is ok for classification in few classes).  The factor k appears in the blow up of space, time and in the utility / privacy tradeoff so it really needed to have small k. \n- The comparison is only with one baseline. I agree that this area is quite new but it would be informative to compare with some other baselines with different computational models. E.g., in the case that a curator can be trusted with the label data the equivalent privacy property is Label DP. It would be interesting to see how the results here compare with the best central label DP algorithm--thus showing the price for not having a trusted curator.\n\nMinor: /NR(h(id, y). Missing closed parenthesis.\n\nQUESTIONS:\n1) what is the largest k for which you find meaningful results in experiments?  \n\n2) Given the lack of baselines for this exact model, can you compare this result with the SOTA baselines in some other relaxed or more restrictive settings e.g., the trust curator model equivalent to running a central Label DP on the join, or local DP baseline (e.g., randomized response on the label)?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper considers the problem of publishing a privacy-preserving version of a dataset consisting of an identifier and a sensitive attribute. Additionally, it should be possible to join this published dataset by the identifiers with another dataset and compute aggregate statistics on the sensitive attributes in the joined database. This is a natural application that comes up in many scenarios, and a key innovation of this paper is the non-interactive nature of the solution. The privacy-preserving database needs to be published only once and can be reused by multiple recipients.  \n\nThe approach followed is quite interesting. A dataset D \\subseteq U \\time {1... k} is processed as follows. For each entry (x,i) \\in D store the value i + noise_i in the published table's h(x) row. In case of collisions, multiple entries are added to the same row. The noise in each row makes it differentially private. \n\nIn addition to computing aggregate statistics, the paper also considers the task of performing learning tasks over the privacy-preserving dataset.\n\nSTRENGTHS:\n+ The application considered is exciting. \n+ The construction is relatively simple to understand.\n\nWEAKNESSES:\n- The abstract/intro does not talk about the amount of noise needed or the level of accuracy they get. It would be helpful in better understanding the results of the paper. \n- The system does not define the correctness desired in this system. In particular, the joins in the proposed system will create false \"positive matched rows.\" Does this mean that the correctness is quantified for a random receiver dataset? In particular, a particular receiver dataset can have a lot of false positive matches.\n\nQUESTIONS:\n- Can you please formally define the correctness and privacy properties your system satisfies? \n- For my understanding, what is the magnitude of noise you expect in Z_\\epsilon in Figure 5 of Appendix A for the case where the output of s is \\in {0,1}?\n\nLIMITATIONS:\n- The paper says that the published database has DP. Can the authors expand on what this means? Typically in DP, aggregate statistics on the database are published. However, here the entire database is published. Thus, one would expect that a much larger noise parameter will be needed. \n- The paper reports an increase in test results accuracy with lower noise. This makes sense but does not provide insight into the appropriate noise level.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 1, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nEdit: Change from Weak Accept to Accept under the expectation that the reviewer discussions are incorporated into the manuscript.\n\nThe manuscript presumes that two independent parties hold different data related to persons in a repository. As the data is vertically partitioned across the repositories, cross-referencing both repositories by joining on some person identifier yields a richer repository that interrelates more data dimensions which can be useful for data discovery/analysis.\n\nAs sharing personal data with another party could potentially lead to a violation of user privacy, the manuscript adopts the setting where party A sends a differentially private (DP) sketch of their repository to a party B such that party B can generate an approximate/noisy join result where data dimensions coming from party A can be inaccurate. The manuscript proposes a novel DP sketch to improve the accuracy of the approximate/noisy join and compares it to differentially private linear sketches (Zhao et al @ NeurIPS'22).\n\nSTRENGTHS:\nS1) Method proposed in manuscript satisfies pure DP unlike prior work on DP linear sketches that satisfies zCDP (which can only be translated to ADP regimes with delta > 0).\n\nS2) Empirical results are promising: improvement over baseline and reasonable test accuracy for epsilon <= 1.\n\nS3) Claims seem to be substantiated and key concepts are presented clearly.\n\nWEAKNESSES:\nW1) Many-to-many relationships (e.g., pseudo-identifiers) and multi-way join not explicitly considered. \n\nW2) Not clear why the other party could not also receive a private sketch to improve the private sketch they provide to the other party (apart from complicating the setting).\n\nW3) Minor:\n\np.9, l. 326: \"as does private multi-dimensional sketches\" => \"as do private multi-dimensional sketches\"\n\nQUESTIONS:\nQ1) How do the methods potentially generalise to pseudoidentifiers (e.g. non-unique person names) and multi-way joins with multiple private repositories (see W1).\n\nQ2) Could a private sketch of the 2nd repository (non-private from our point of view) be helpful to guide the sketching of the private repository to improve utility when using it for join with 2nd repository? (see W2)\n\nQ3) What does the last sentence refer to when it mentions multi-dimensional sketches? (could multiple categorical dimensions not simply be merged into one unless there are multi-dimensional range queries over numerical attributes?)\n\nLIMITATIONS:\nRelevant limitations seem to be discussed.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}