Title: Private Edge Density Estimation for Random Graphs: Optimal, Efficient and Robust
Venue: NeurIPS 2024
Accepted: yes
Keywords: differential privacy

robustness

random graph

sum of squares

average-case complexity
Abstract: We give the first polynomial-time, differentially node-private, and robust algorithm for estimating the edge density of Erdős-Rényi random graphs and their generalization, inhomogeneous random graphs. We further prove information-theoretical lower bounds, showing that the error rate of our algorithm is optimal up to logarithmic factors. Previous algorithms incur either exponential running time or suboptimal error rates.

Two key ingredients of our algorithm are (1) a new sum-of-squares algorithm for robust edge density estimation, and (2) the reduction from privacy to robustness based on sum-of-squares exponential mechanisms due to Hopkins et al. (STOC 2023).

Private Edge Density Estimation for Random Graphs: Optimal, Efficient and Robust

Abstract

We give the first polynomial-time, differentially node-private, and robust algorithm for estimating the edge density of Erdős-Rényi random graphs and their generalization, inhomogeneous random graphs. We further prove information-theoretical lower bounds, showing that the error rate of our algorithm is optimal up to logarithmic factors. Previous algorithms incur either exponential running time or suboptimal error rates.

Twokeyingredientsofouralgorithmare(1)anewsum-of-squaresalgorithm for robust edge density estimation, and (2) the reduction from privacy to robustness based on sum-of-squares exponential mechanisms due to Hopkins et al. (STOC 2023).

1 Introduction

Privacy has nowadays become a major concern in large-scale data processing. Releasing seemingly harmless statistics of a dataset could unexpectedly leak sensitive information of individuals (see e.g. [NS09, DSSU17] for privacy attacks). Differential privacy (DP) [DMNS06] has emerged as a by-now standard technique for protecting the privacy of individuals with rigorous guarantees. An algorithm is said to be differentially private if the distribution of its output remains largely unchanged under the change of a single data point in the dataset.

For datasets represented by graphs (e.g. social networks), two notions of differential privacy have been investigated in the literature: edge differential privacy [NRS07, KRSY11], where each edge is regarded as a data point; and node differential privacy [BBDS13, KNRS13], where each node along with its incident edges is regarded as a data point. Node differential privacy is an arguably more desirable notion than edge differential privacy. On the other hand, node differential privacy is also in general more difficult to achieve without compromising on utility, as many graph statistics usually have high sensitivity in the worst case. It turns out that many graph statistics can have significantly smaller sensitivity on typical graphs under natural distributional assumptions. Several recent works could thus manage to achieve optimal or nearly-optimal utility guarantees in a number of random graph parameter estimation problems [BCS15, BCSZ18, SU19, CDd + 24].

In this paper, we continue this line of work and study perhaps the most elementary statistical task in graph data analysis: Given an 𝑛 -node Erdős-Rényi random graph of which each edge is present with probability 𝑝 ◦ independently, output an estimate ˆ 𝑝 of the edge density parameter 𝑝 ◦ , subject to node differential privacy. We consider the error metric | ˆ 𝑝 / 𝑝 ◦ -1 | which can reflect the fact that, the task is more difficult for smaller 𝑝 ◦ .

Without privacy requirement, the empirical edge density 1 ˆ 𝑝 achieves the information theoretically optimal error rate | ˆ 𝑝 / 𝑝 ◦ -1 | ⩽ ˜ 𝑂 ( 1 /( 𝑛 √ 𝑝 ◦ )) . The standard way to achieve 𝜀 -differential node privacy is to add Laplace noise with standard deviation Θ ( 1 /( 𝜀 𝑛 )) to the empirical edge density ˆ 𝑝 . This will incur an additional privacy cost of Θ ( 1 /( 𝜀 𝑛𝑝 ◦ )) which dominates the non-private error ˜ 𝑂 ( 1 /( 𝑛 √ 𝑝 ◦ )) . Surprisingly, Borgs et al. [BCSZ18] gave an algorithm with privacy cost only ˜ 𝑂 ( 1 /( 𝜀 𝑛 √ 𝑛𝑝 ◦ )) which is negligible to the nonprivate error for any 𝜀 ≫ 1 / √ 𝑛 . However, their algorithm is based on a general Lipschitz extension technique that has exponential running time. Later, Sealfon and Ullman [SU19] provided a polynomial-time algorithm based on smooth sensitivity with privacy cost ˜ 𝑂 ( 1 /( 𝜀 𝑛 √ 𝑛𝑝 ◦ ) + 1 /( 𝜀 2 𝑛 2 𝑝 ◦ )) , which is much greater than that of [BCSZ18] for 𝜀 ≪ 1 /( √ 𝑛𝑝 ◦ ) . Moreover, [SU19] gives evidence that their approach is inherently prohibited from achieving better privacy cost. On the other hand, known lower bounds in [BCSZ18, SU19] are not for Erdős-Rényi random graphs. This leads us to the following question:

Is there a polynomial-time, differentially node-private, and rate-optimal edge density estimation algorithm for Erdős-Rényi random graphs?

We essentially settled this question in this paper. Specifically, we give a polynomial-time and differentially node-private algorithm with privacy cost ˜ 𝑂 ( 1 /( 𝜀 𝑛 √ 𝑛𝑝 ◦ )) . Moreover, we show this error rate is optimal up to a logarithmic factor by proving an information-theoretical lower boundof Ω ( 1 /( 𝜀 𝑛 √ 𝑛𝑝 ◦ )) . Our algorithm actually works for the more general inhomogeneous randomgraphs[BJR07]. The inhomogeneous random graph model encompasses any random graph model where edges appear independently (after conditioning on node labels). Notable examples include the stochastic block model [HLL83], the latent space model [HRH02], and graphon [BC17].

Our algorithm largely exploits the close connection between differential privacy and adversarial robustness in statistics. This connection dates back to [DL09] and has witnessed significant progress in the past few years [LKKO21, LKO22, KMV22, GH22, AUZ23, HKM22, HKMN23, AKT + 23, CCAd + 23, CDd + 24]. In particular, a very recent line of works [HKM22, HKMN23, CDd + 24] could efficiently achieve optimal or nearly-optimal accuracy guarantees in a number of high-dimensional statistical tasks, by integrating two powerful tools sum-of-squares method [RSS18] and exponential mechanisms [MT07]- in robustness and privacy respectively. Our algorithm extends this line of work. The key technical ingredients of our algorithm are (1) a new sum-of-squares algorithm for robust edge density estimation and (2) an exponential mechanism whose score function is based on the sum-of-squares program. As a consequence, our private algorithm is also robust to adversarial corruptions.

1.1 Results

To state our results formally, we need the following definitions.

Definition 1.1 (Node distance, neighboring graphs) . Let 𝑛 ∈ ℕ . The node distance between two 𝑛 -node graphs 𝐺 and 𝐺 ′ , denoted by dist ( 𝐺, 𝐺 ′ ) , is the minimum number of nodes in 𝐺 that need to be rewired to obtain 𝐺 ′ . Moreover, we say 𝐺 and 𝐺 ′ are neighboring graphs if dist ( 𝐺, 𝐺 ′ ) ⩽ 1.

Definition 1.2 (Node differential privacy) . Let 𝒢 be the set of graphs. A randomized algorithm 𝒜 : 𝒢 → ℝ is 𝜀 -differentially (node-)private if for every neighboring graphs 𝐺, 𝐺 ′ and every 𝑆 ⊆ ℝ , we have

Definition 1.3 (Node corruption model) . Let 𝑛 ∈ ℕ and 𝜂 ∈ [ 0 , 1 ] . For an 𝑛 -node graph 𝐺 , we say an 𝑛 -node graph 𝐺 ′ is an 𝜂 -corrupted version of 𝐺 if dist ( 𝐺, 𝐺 ′ ) ⩽ 𝜂 𝑛 .

Erdős-Rényi random graphs. We provide a polynomial-time, differentially node-private and robust edge density estimation algorithm for Erdős-Rényi random graphs.

Theorem 1.4 (Erdős-Rényi random graphs, combination of Theorem D.1 and Theorem F.1) . There are constants 𝐶 1 , 𝐶 2 , 𝐶 3 such that the following holds. For any 𝜂 ⩽ 𝐶 1 , 𝜀 ⩾ 𝐶 2 log ( 𝑛 )/ 𝑛 , and 𝑝 ◦ ⩾ 𝐶 3 / 𝑛 , there exists a polynomial-time 𝜀 -differentially node-private algorithm which, given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑝 ◦ ) , outputs an estimate ˜ 𝑝 satisfying

with probability 1 -𝑛 -Ω ( 1 ) .

The first term 𝑂 ( p log 𝑛 /( 𝑛 √ 𝑝 ◦ )) is the sampling error that is necessary even without privacy or robustness. The second term 𝑂 ( log 2 ( 𝑛 )/( 𝜀 𝑛 √ 𝑛𝑝 ◦ )) is the privacy cost of our algorithm, which matches the exponential-time algorithm in [BCSZ18]. The third term 𝑂 ( 𝜂 log 𝑛 / √ 𝑛𝑝 ◦ ) is the robustness cost of our algorithm, which matches the information-theoretical lower bound Ω ( 𝜂 / √ 𝑛𝑝 ◦ ) in [AJK + 22, Theorem 1.5] up to a log 𝑛 factor.

Moreover, we provide the following lower bound which shows that the privacy cost of our algorithm is optimal up to a log 𝑛 factor. 2

Theorem 1.5 (Privacy lower bound for Erdős-Rényi random graphs) . Suppose there is an 𝜀 -differentially node-private algorithm that, given an Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑝 ◦ ) , outputs an estimate ˜ 𝑝 satisfying | ˜ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability 1 -𝛽 . Then we must have

Inhomogeneous random graphs. Given an 𝑛 -by𝑛 edge connection probability matrix 𝑄 ◦ , the inhomogeneous random graph model 𝔾 ( 𝑛, 𝑄 ◦ ) defines a distribution over 𝑛 -node graphs where each edge { 𝑖, 𝑗 } is present with probability ( 𝑄 ◦ ) 𝑖𝑗 independently.

Weprovideapolynomial-time, differentially node-private and robust edge density estimation algorithm for inhomogeneous random graphs.

Theorem 1.6 (Inhomogeneous random graphs, combination of Theorem D.1 and Theorem E.1) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑝 ◦ : = ˝ 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 /( 𝑛 2 -𝑛 ) . Suppose ∥ 𝑄 ◦ ∥ ∞ ⩽ 𝑅𝑝 ◦ for some 𝑅 . There is a sufficiently small constant 𝑐 such that the following holds. For any 𝜂 such that 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝑐 , there exists a polynomial-time 𝜀 -differentially nodeprivate algorithm which, given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , outputs an estimate ˜ 𝑝 satisfying

with probability 1 -𝑛 -Ω ( 1 ) .

We improve on the previous private edge density estimation algorithm for inhomogeneous random graphs by Chen et al. [CDd + 24, Lemma 4.10]. Their algorithm is based on [SU19] and has privacy cost ˜ 𝑂 ( 𝑅 /( 𝜀 𝑛 ) + 1 /( 𝜀 2 𝑛𝑑 ◦ )) , while our algorithm only has privacy cost ˜ 𝑂 ( 𝑅 /( 𝜀 𝑛 )) . To the best of our knowledge, even without privacy requirement and in the special case of Erdős-Rényi random graphs, no previous algorithm can match our guarantees in the sparse regime. Specifically, when 𝑑 ◦ ≪ log 𝑛 and 𝜂 ⩾ Ω ( 1 ) , our algorithm can provide a constant-factor approximation of 𝑑 ◦ , while the best previous robust algorithm [AJK + 22] can not.

We also provide matching lower bounds, showing that the guarantee of our algorithm in Theorem 1.6 is optimal up to logarithmic factors.

Theorem 1.7 (Robustness lower bound for inhomogeneous random graphs) . Suppose there is an algorithm satisfies the following guarantee for any symmetric matrix 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 . Given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , the algorithm outputs an estimate ˆ 𝑝 satisfying | ˆ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability at least 0 . 99 , where 𝑝 ◦ = ˝ 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 /( 𝑛 2 -𝑛 ) . Then we must have 𝛼 ⩾ Ω ( 𝑅 𝜂 ) , where 𝑅 = max 𝑖,𝑗 𝑄 ◦ / 𝑝 ◦ .

𝑖𝑗

Theorem 1.8 (Privacy lower bound for inhomogeneous random graphs) . Suppose there is an 𝜀 -differentially node-private algorithm satisfies the following guarantee for any symmetric matrix 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 . Given an inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , the algorithm outputs an estimate ˆ 𝑝 satisfying | ˆ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability 1 -𝛽 , where 𝑝 ◦ = ˝ 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 /( 𝑛 2 -𝑛 ) . Then we must have where 𝑅 = max 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 / 𝑝 ◦ .

1.2 Techniques

We give an overview of the key techniques used to obtain our algorithm. As our techniques for Erdős-Rényi random graphs can be easily extended to the more general inhomogeneous random graph model, we will focus on Erdős-Rényi random graphs to avoid a proliferation of notation. Specifically, given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) , our goal is to output a private estimate of 𝑑 ◦ .

Reduction from privacy to robustness. Hopkins et al. [HKMN23] and Asi et al. [AUZ23] independently discovered the following black-box reduction from privacy to robustness. Given a robust algorithm 𝒜 robust , one can directly obtain a private algorithm via applying the exponential mechanism [MT07] with the following score function,

𝐴

where 𝐴 is the adjacency matrix of input graph and 𝑑 is a candidate estimate. For privacy analysis, note that the sensitivity of the above score function is bounded by 1, as the node distance between neighboring graphs is at most 1. For utility analysis, when the input graph is a typical Erdős-Rényi random graph, the exponential mechanism will with high probability output a ˆ 𝑑 of score 𝑂 ( log ( 𝑛 )/ 𝜀 ) . Then we can argue that such a ˆ 𝑑 is close to 𝑑 ◦ using the robustness of 𝒜 robust . For example, if we plug in the robust algorithm in [AJK + 22, Theorem 1.3], then the corresponding exponential mechanism will only incur a privacy cost of ˜ 𝑂 ( 1 /( 𝜀 𝑛 √ 𝑑 ◦ )) .

However, directly plugging in the robust algorithm in [AJK + 22] will lead to an exponentialtime algorithm, as a single evaluation of the score function requires enumerating all 𝑛 -node graphs. To obtain a polynomial-time algorithm, we develop a new robust algorithm via the sum-of-squares method. 3

Robust algorithm via sum-of-squares. The sum-of-squares method uses convex programming (in particular, semidefinite programming) to solve polynomial programming. It is a very powerful tool for designing polynomial-time robust estimators (see [RSS18]). To obtain a robust algorithm via sum-of-squares, we first identify a set of polynomial constraints that a typical (uncorrupted) Erdős-Rényi random graph would satisfy. Specifically, these polynomial constraints encode the following regularity conditions: (1) the degrees of the nodes are highly concentrated, and (2) the centered adjacency matrix is spectrally bounded.

We also include the constraint that at most 𝜂 fraction of the nodes in the graph are corrupted. Then we give a proof that if a graph satisfies the above constraints, then its average degree will be close to 𝑑 ◦ , even when 𝜂 fraction of nodes in the input graph are arbitrarily corrupted. Importantly, the proof is simple enough that it is captured by the sum-of-squares proof system (see [FKP + 19]). This allows us to extend the utility guarantee of the polynomial program to its semidefinite programming relaxation, which results in a polynomial-time robust algorithm.

Sum-of-squares exponential mechanism. Given the above robust algorithm, we then use the sum-of-squares exponential mechanism developed in [HKM22, HKMN23] to obtain a private algorithm. More specifically, we apply the exponential mechanism with the sum-ofsquares relaxation of the score function in Eq. (1.1). In this way, we obtain a private algorithm that is also robust to adversarial corruptions.

1.3 Notation

We introduce some notation used throughout this paper. We write 𝑓 ≲ 𝑔 to denote the inequality 𝑓 ⩽ 𝐶 · 𝑔 for some absolute constant 𝐶 > 0. We write 𝑂 ( 𝑓 ) and Ω ( 𝑓 ) to denote quantities 𝑓 -and 𝑓 + satisfying 𝑓 -≲ 𝑓 and 𝑓 ≲ 𝑓 + respectively. We use boldface to denote random variables, e.g., 𝑿 , 𝒀 , 𝒁 . For a matrix 𝑀 , we use ∥ 𝑀 ∥ op for the spectral norm of 𝑀 . Let 𝟙 and 𝟘 denote the all-one and all-zero vector respectively, of which the size will be clear from the context. We use a graph 𝐺 and its adjacency matrix 𝐴 = 𝐴 ( 𝐺 ) interchangeably when there is no ambiguity. For an 𝑛 -by𝑛 matrix 𝑀 , we use 𝑑 ( 𝑀 ) to denote its average row/column sum, i.e., 𝑑 ( 𝑀 ) = ˝ 𝑖,𝑗 𝑀𝑖𝑗 / 𝑛 . For any matrices (or vectors) 𝑀, 𝑁 of the same shape, we use 𝑀 ⊙ 𝑁 to denote the element-wise product (aka Hadamard product) of 𝑀 and 𝑁 .

1.4 Organization

The rest of the paper is organized as follows. In Section 2, we give a proof overview of our results and defer full proofs to the appendices. The appendices are organized as follows. We provide some sum-of-squares background in Appendix A and some concentration inequalities for random graphs in Appendix B. In Appendix C, we present a general sum-ofsquares exponential mechanism that all of our private algorithms in this paper are based on. In Appendix D, we present our coarse estimation algorithm and give a full proof of its guarantees (Theorem D.1). In Appendix E, we present our fine estimation algorithm for inhomogeneous random graphs and give a full proof of its guarantees (Theorem E.1). In Appendix F, we present our fine estimation algorithm for Erdős-Rényi random graphs and give a full proof of its guarantees (Theorem F.1). All lower bounds are proved in Appendix G.

2 Private and robust algorithm for Erdős-Rényi random graphs

In this section, we describe our private and robust algorithm for Erdős-Rényi random graphs. We also give an overview of the analysis of our algorithm and sketch the proof of our lower bounds.

Our overall algorithm consists of two stages. In the first stage, we compute a coarse estimate that approximates the edge density parameter within constant factors. In the second stage, we improve the accuracy of this coarse estimate to the optimum. Since our algorithm is private in both stages, it is also private overall by the composition theorem of differential privacy (see [DR14, Section 3.5]).

We remark that for the Erdős-Rényi random graph model 𝔾 ( 𝑛, 𝑝 ◦ ) , estimating its edge density parameter 𝑝 ◦ is equivalent to estimating its expected average degree 𝑑 ◦ : = 𝑛𝑝 ◦ . 4 For the convenience of notation, we set our goal as estimating the expected average degree 𝑑 ◦ throughout this section.

2.1 General algorithm framework

Given an 𝑛 -by𝑛 symmetric matrix 𝐴 and a scalar 𝛾 ∈ [ 0 , 1 ] , let 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) be a polynomial system with indeterminates 𝑌 = ( 𝑌𝑖𝑗 ) 𝑖,𝑗 ∈[ 𝑛 ] and 𝑧 = ( 𝑧 𝑖 ) 𝑖 ∈[ 𝑛 ] that encodes the node distance between 𝑌 and 𝐴 :

Let ℛ( 𝑌 ) be A polynomial system that encodes regularity conditions of Erdős-Rényi random graphs. The key observation here is that, for any 𝑌 ∈ { 0 , 1 } 𝑛 × 𝑛 and 𝑧 ∈ { 0 , 1 } 𝑛 that satisfy constraints in 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 )∪ℛ( 𝑌 ) , 𝑌 is a graph that behaves like Erdős-Rényi random graphs (in the sense of the regularity conditions) and is within node distance 𝛾 𝑛 to 𝐴 where they agree on { 𝑖 ∈ [ 𝑛 ] : 𝑧 𝑖 = 1 } .





The key ingredient of our result is that, given proper regularity conditions ℛ( 𝑌 ) , we can give degree-8 sum-of-squares proofs: for any 𝑌 that satisfies constraints in 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) , the average degree of 𝑌 is close to the expected average degree 𝑑 ◦ , even when the input graph 𝐴 is a 𝛾 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) . As a result of the sumof-squares proofs-to-algorithms framework (see Theorem A.6), we can get an efficient and robust estimator ˜ 𝔼 [ 𝑑 ( 𝑌 )] , where ˜ 𝔼 is a pseudo-expectation obtained by solving level-8 sum-of-squares relaxation of 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) .

Based on the above identifiability proof for robust estimation, we design a private and robust algorithm by applying the exponential mechanism 5 with the following score function:

Similar to Eq. (1.1), it is easy to observe this exponential mechanism is private.

Lemma 2.1 (Privacy) . Consider the distribution 𝜇 𝐴, 𝜀 with support [ 0 , 𝑛 ] and density

where sos-score ( 𝑑 ; 𝐴 ) is defined in Eq. (2.2) . A sample from 𝜇 𝐴, 𝜀 is 2 𝜀 -differentially private.

Proof. Since the node distance between neighboring graphs is at most 1, the sensitivity of the following score function is bounded by 1:

One can show that such sensitivity bound is inherited by its sum-of-squares relaxation sos-score as defined in Eq. (2.2). By a standard sensitivity-to-privacy argument (see e.g. [DR14, Theorem 3.10]), the exponential mechanism is 2 𝜀 -differentially private. □

To analyze the utility of the private algorithm, we use the robustness of the score function. Assume the input graph is uncorrupted for simplicity. For a typical Erdős-Rényi random graph 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) , we have sos-score ( 𝑑 ◦ , 𝐴 ◦ ) = 0. By a standard volume argument (see e.g. [DR14, Theorem 3.11]), the exponential mechanism with high probability outputs a scalar 𝑑 satisfying sos-score ( 𝑑 ; 𝐴 ◦ ) ≲ log ( 𝑛 )/ 𝜀 . By the definition of our score function in Eq. (2.2), this implies that there exists a level-8 pseudo-distribution satisfying 𝒯( 𝑌, 𝑧 ; 𝐴 ◦ , 𝛾 ) ∪ ℛ( 𝑌 ) with 𝛾 ≲ log ( 𝑛 )/( 𝜀 𝑛 ) . The utility then follows from the above identifiability proof for robust estimation.

2.2 Coarse estimation

In this part, we describe a private and robust algorithm that can estimate the expected average degree 𝑑 ◦ within a constant approximation ratio.

Theorem 2.2 (Coarse estimation algorithm, informal restatement of Theorem D.1) . For 𝜂 smaller than some constant, there is a polynomial-time 𝜀 -differentially node-private algorithm which, given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) , outputs an estimate ˆ 𝑑 such that | ˆ 𝑑 -𝑑 ◦ | ⩽ 0 . 5 𝑑 ◦ .

We give a proof sketch of Theorem 2.2 at the end of this subsection. The formal theorem and proofs are deferred to Appendix D.

Identifiability proof for robust estimation. We first give a polynomial system that can identify the expected average degree 𝑑 ◦ up to constant factors, even when 𝜂 -fraction of nodes are corrupted. Consider the following regularity condition on degrees:

The following lemma shows that Erdős-Rényi random graphs satisfy 𝒯( 𝑌, 𝑧 ; 𝐴, 2 𝜂 ) ∪ ℛ( 𝑌 ) with high probability.

Lemma 2.3 (Feasibility) . Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and let 𝐴 be an 𝜂 -corrupted version of 𝐴 ◦ . With high probability, there exists a graph 𝑌 that satisfies the constraints in 𝒯( 𝑌, 𝑧 ; 𝐴, 2 𝜂 ) ∪ ℛ( 𝑌 ) .

Proof sketch. For 𝑑 ◦ ≫ log ( 𝑛 ) , the maximum degree of 𝐴 ◦ is of order 𝑂 ( 𝑑 ◦ ) . Therefore, the uncorrupted graph 𝐴 ◦ satisfies the constraints. For 𝑑 ◦ ≪ log 𝑛 , using concentration properties of random graphs, we can show that the number of high degree nodes is bounded by 𝜂 𝑛 . A feasible graph can then be obtained from the uncorrupted graph 𝐴 ◦ by trimming these highest degree nodes. □

Next, we show that these polynomial constraints give an identifiability proof for the expected average degree 𝑑 ◦ .

Lemma 2.4 (Identifiability) . Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and let 𝐴 be an 𝜂 -corrupted version of 𝐴 ◦ . For 𝜂 smaller than some constant and 𝛾 ⩽ 𝑂 ( 𝜂 ) , with high probability there is a degree8 sum-of-squares proof that, if 𝑌 satisfies 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) , then | 𝑑 ( 𝑌 ) -𝑑 ◦ | ⩽ 0 . 001 𝑑 ◦ .

Proof sketch. We first assume that 𝑑 ◦ ≫ log ( 𝑛 ) , for which the proof is simpler. By the degreebound constraint ℛ( 𝑌 ) , we have 𝑛 | 𝑑 ( 𝑌 ) -𝑑 ( 𝐴 ◦ )| ⩽ 2 log ( 1 / 𝜂 ) · ( 𝑑 ( 𝑌 ) + 𝑑 ◦ ) · dist ( 𝑌, 𝐴 ◦ ) . Using the constraints 𝑌 ⊙ 𝑧𝑧 ⊤ = 𝐴 ⊙ 𝑧𝑧 ⊤ and ⟨ 1 , 𝑧 ⟩ ⩾ ( 1 -𝛾 ) 𝑛 , we have dist ( 𝑌, 𝐴 ) ⩽ 𝛾 𝑛 . Since dist ( 𝐴, 𝐴 ◦ ) ⩽ 𝜂 𝑛 , by triangle inequality, we have dist ( 𝑌, 𝐴 ◦ ) ⩽ ( 𝛾 + 𝜂 ) 𝑛 . Therefore, we have | 𝑑 ( 𝑌 ) -𝑑 ( 𝐴 ◦ )| ⩽ 0 . 0001 𝑑 ◦ when 𝛾 , 𝜂 are at most some small constants. Finally, by random graph concentration, we have | 𝑑 ◦ -𝑑 ( 𝐴 ◦ )| ⩽ 𝑜 ( 𝑑 ◦ ) with high probability. Therefore, we have | 𝑑 ( 𝑌 ) -𝑑 ( 𝐴 ◦ )| ⩽ 0 . 001 𝑑 ◦ .

To deal with the sparse regime where 𝑑 ◦ ≪ log 𝑛 , we need to truncate the nodes of 𝐴 ◦ with degree Ω ( log ( 1 / 𝜂 ) 𝑑 ◦ ) . Our key observation is that, the average degree of the graph before and after truncation only differ by a constant factor. Therefore, we can still get | 𝑑 ( 𝑌 ) -𝑑 ( 𝐴 ◦ )| ⩽ 0 . 001 𝑑 ◦ .

Furthermore, it can be shown that this proof is a degree-8 sum-of-squares proof. □

Robust algorithm via sum-of-squares. Consider the algorithm that finds a level-8 pseudoexpectation satisfying 𝒯( 𝑌, 𝑧 ; 𝐴, 2 𝜂 ) ∪ ℛ( 𝑌 ) -with ℛ( 𝑌 ) given in Eq. (2.4)- and outputs ˜ 𝔼 [ 𝑑 ( 𝑌 )] . By Lemma 2.3, such a pseudo-expectation ˜ 𝔼 exists with high probability. It follows from the sum-of-squares identifiability proof in Lemma 2.4 that | ˜ 𝔼 [ 𝑑 ( 𝑌 )] -𝑑 ◦ | ⩽ 0 . 001 𝑑 ◦ . Moreover, the algorithm can be implemented by semidefinite programming and run in polynomial time.

Private and robust algorithm via sum-of-squares exponential mechanism. We present our private and robust algorithm in Algorithm 2.5 and give a proof sketch of Theorem 2.2.

Algorithm 2.5 (Private coarse estimation for Erdős-Rényi random graphs) . Input: 𝜂 -corrupted Erdős-Rényi random graph 𝐴 .

Privacy parameter: 𝜀 .

Output: Asample from the distribution 𝜇 𝐴, 𝜀 with support [ 0 , 𝑛 ] and density

where sos-score ( 𝑑 ; 𝐴 ) : = min 0 ⩽ 𝛾 ⩽ 1 𝛾 𝑛 s.t. ∃ level-8 pseudo-expectation ˜ 𝔼 satisfying 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) ∪ GLYPH<8> | 𝑑 ( 𝑌 ) -𝑑 | ⩽ 1 / poly ( 𝑛 ) GLYPH<9> , (2.6)

with ℛ( 𝑌 ) given in Eq. (2.4).

Proof sketch of Theorem 2.2. Privacy. By Lemma 2.1, Algorithm 2.5 is 2 𝜀 -differentially private.

Utility. For simplicity, we consider the case when there is no corruption (i.e. 𝜂 = 0). The analysis for the case when 𝜂 > 0 is similar. Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) . Then with high probability sos-score ( 𝑑 ◦ ; 𝐴 ◦ ) = 0. By a standard volume argument, Algorithm 2.5 outputs a scalar 𝑑 that satisfies sos-score ( 𝑑 ; 𝐴 ◦ ) ≲ log ( 𝑛 )/ 𝜀 with high probability. By the definition of sos-score in Eq. (2.6), this implies that there exists a level-8 pseudo-distribution satisfying 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) ∪ {| 𝑑 ( 𝑌 ) -𝑑 | ⩽ 1 / poly ( 𝑛 )} with 𝛾 ≲ log ( 𝑛 )/( 𝜀 𝑛 ) . When log ( 𝑛 )/( 𝜀 𝑛 ) is at most a small constant, it follows from our sum-of-squares identifiability proof in Lemma 2.4 that, Algorithm 2.5 outputs a constant-factor approximation of 𝑑 ◦ with high probability. □

2.3 Fine estimation

From Section 2.2, we know how to obtain a constant-factor approximation of 𝑑 ◦ privately and robustly. In this section, we show how to improve the accuracy to the optimum.

Theorem 2.6 (Fine estimation algorithm, informal restatement of Theorem F.1) . Let 0 . 5 𝑑 ◦ ⩽ ˆ 𝑑 ⩽ 2 𝑑 ◦ . For 𝜂 smaller than some constant, there is a polynomial-time 𝜀 -differentially node-private algorithm which, given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and ˆ 𝑑 , outputs an estimate ˜ 𝑑 such that

We give a proof sketch of Theorem 2.6 at the end of this section. The formal theorem and proofs are deferred to Appendix F.

Identifiability proof for robust estimation. We first give a polynomial system which can identify the expected average degree 𝑑 ◦ with optimal error rate, when provided with a coarse estimate ˆ 𝑑 . Consider the following regularity conditions on degrees and eigenvalues:

Lemma 2.7 (Feasibility) . Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and let 𝐴 be an 𝜂 -corrupted version of 𝐴 ◦ . Suppose 𝑑 ◦ / 2 ⩽ ˆ 𝑑 ⩽ 2 𝑑 ◦ . Then with high probability, there exists a graph 𝑌 that satisfies the constraints in 𝒯( 𝑌, 𝑧 ; 𝐴, 𝜂 ) ∪ ℛ( 𝑌 ) .





Proof. By Chernoff bound, with high probability, the degree of each node in 𝐴 ◦ deviates from 𝑑 ◦ by at most 𝑂 ( √ 𝑑 ◦ log 𝑛 ) . By the concentration of the spectral norm of random

matrices [BvH16], with high probability, we have ∥ 𝐴 ◦ -𝑑 ( 𝐴 ◦ ) 𝑛 𝟙𝟙 ⊤ ∥ op ≲ p 𝑑 ◦ log 𝑛 . Hence, 𝒯( 𝑌, 𝑧 ; 𝐴, 𝜂 ) ∪ ℛ( 𝑌 ) is satisfied by 𝑌 = 𝐴 ◦ and 𝑧 = 𝑧 ◦ where 𝑧 ◦ is the indicator vector for uncorrupted nodes. □

Next we give a sum-of-squares identifiability proof for expected average degree estimation with optimal accuracy.

Lemma 2.8 (Identifiability) . Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and let 𝐴 be an 𝜂 -corrupted version of 𝐴 ◦ . Suppose 𝑑 ◦ / 2 ⩽ ˆ 𝑑 ⩽ 2 𝑑 ◦ . For 𝜂 smaller than some constant and 𝛾 ⩽ 𝑂 ( 𝜂 ) , with high probability there is a degree8 sum-of-squares proof that, if 𝑌 satisfies 𝒯( 𝑌, 𝑧 ; 𝐴, 𝜂 ) ∪ ℛ( 𝑌 ) , then

Proof sketch. Let 𝑌 1 , 𝑌 2 be two graphs satisfying the regularity condition ℛ( 𝑌 1 ) and ℛ( 𝑌 2 ) as described in Eq. (2.7), respectively. We give sum-of-squares proof that, if dist ( 𝑌 1 , 𝑌 2 ) ⩽ 𝜁 𝑛 and 𝜁 is at most some small constant, then | 𝑑 ( 𝑌 1 ) -𝑑 ( 𝑌 2 )| ⩽ 𝜁 p ˆ 𝑑 log 𝑛 .

Let 𝑤 ∈ { 0 , 1 } 𝑛 be the indicator vector for the shared induced subgraph between 𝑌 1 and 𝑌 2 , i.e 𝑌 1 ⊙ 𝑤𝑤 ⊤ = 𝑌 2 ⊙ 𝑤𝑤 ⊤ . When dist ( 𝑌 1 , 𝑌 2 ) ⩽ 𝜁 𝑛 , we have ⟨ 𝑤, 𝟙 ⟩ ⩾ ( 1 -𝜁 ) 𝑛 . We have

By rearranging terms, we can get

For the first term ⟨ 𝑌 1 -𝑑 ( 𝑌 1 ) 𝑛 𝟙𝟙 ⊤ , 𝟙𝟙 ⊤ -𝑤𝑤 ⊤ ⟩ , we have

From constraints |( 𝑌 1 𝟙 ) 𝑖 -𝑑 ( 𝑌 1 )| ⩽ p ˆ 𝑑 log ( 𝑛 ) for all 𝑖 ∈ [ 𝑛 ] , we have

From constraints GLYPH<13> GLYPH<13> GLYPH<13> 𝑌 1 -𝑑 ( 𝑌 1 ) 𝑛 𝟙𝟙 ⊤ GLYPH<13> GLYPH<13> GLYPH<13> op ⩽ 𝛿 p ˆ 𝑑 , we have

The same bounds also apply for the second term ⟨ 𝑌 2 -𝑑 ( 𝑌 2 ) 𝑛 𝟙𝟙 ⊤ , 𝟙𝟙 ⊤ -𝑤𝑤 ⊤ ⟩ . Since ⟨ 𝟙 , 𝑤 ⟩ ⩾ Ω ( 𝑛 ) , it follows that | 𝑑 ( 𝑌 1 ) -𝑑 ( 𝑌 2 )| ⩽ ˜ 𝑂 ( 𝜁 p ˆ 𝑑 ) ⩽ ˜ 𝑂 ( 𝜁 √ 𝑑 ◦ ) .

Since the original uncorrupted graph satisfies the regularity conditions, this gives the identifiability proof that | 𝑑 ( 𝑌 ) -𝑑 ( 𝐴 ◦ )| ⩽ ˜ 𝑂 ( 𝜁 √ 𝑑 ◦ ) . By random graph concentration, with high probability, we have | 𝑑 ◦ -𝑑 ( 𝐴 ◦ )| ⩽ ˜ 𝑂 ( p 𝑑 ◦ / 𝑛 ) . The claim thus follows. □

Robust algorithm via sum-of-squares. Consider the algorithm that finds a level-8 pseudoexpectation satisfying 𝒯( 𝑌, 𝑧 ; 𝐴, 𝜂 ) ∪ ℛ( 𝑌 ) -with ℛ( 𝑌 ) given in Eq. (2.7)- and outputs ˜ 𝔼 [ 𝑑 ( 𝑌 )] . By Lemma 2.7, such a pseudo-expectation ˜ 𝔼 exists with high probability. It follows from the sum-of-squares identifiability proof in Lemma 2.8 that | ˜ 𝔼 [ 𝑑 ( 𝑌 )]/ 𝑑 ◦ -1 | ⩽ ˜ 𝑂 ( 1 / √ 𝑛𝑑 ◦ + 𝜂 / √ 𝑑 ◦ ) . Moreover, the algorithm can be implemented by semidefinite programming and run in polynomial time.

Private and robust algorithm via sum-of-squares exponential mechanism. We present our private and robust algorithm in Algorithm 2.9 and give a proof sketch of Theorem 2.6.

Proof sketch of Theorem 2.6. Privacy. By Lemma 2.1, Algorithm 2.9 is 2 𝜀 -differentially private. Utility. For simplicity, we consider the case when there is no corruption (i.e. 𝜂 = 0). The analysis for the case when 𝜂 > 0 is similar. Let 𝐴 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) . Then with high probability sos-score ( 𝑑 ◦ ; 𝐴 ◦ ) = 0. By a standard volume argument, Algorithm 2.9 outputs a scalar 𝑑 that satisfies sos-score ( 𝑑 ; 𝐴 ◦ ) ≲ log ( 𝑛 )/ 𝜀 with high probability. By the definition of sos-score in Eq. (2.9), this implies that with high probability there exists a level-8 pseudo-distribution satisfying 𝒯( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ ℛ( 𝑌 ) with 𝛾 ≲ log ( 𝑛 )/( 𝜀 𝑛 ) . Taking 𝜂 = log ( 𝑛 )/( 𝜀 𝑛 ) in Lemma2.8, it follows that Algorithm 2.9 outputs an estimate ˜ 𝑑 suchthat | ˜ 𝑑 / 𝑑 ◦ -1 | ⩽ ˜ 𝑂 ( 1 / √ 𝑛𝑑 ◦ + 1 /( 𝜀 𝑛 √ 𝑑 ◦ )) with high probability. □

2.4 Lower bound

We sketch the proof of Theorem 1.5. Let 𝛼 ∈ [ 0 , 1 ] and 𝑑 = ( 1 -𝛼 ) 𝑑 ◦ . We can construct a coupling 𝜔 between the distributions 𝔾 ( 𝑛, 𝑑 / 𝑛 ) and 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) with the following property. For ( 𝑮 , 𝑮 ′ ) ∼ 𝜔 , we have dist ( 𝑮 , 𝑮 ′ ) bounded by ˜ 𝑂 ( 𝛼 𝑛 √ 𝑑 ◦ ) with overwhelmingly high probability. By the definition of differential privacy, when 𝜀𝛼 𝑛 √ 𝑑 ◦ ⩽ 1 / polylog ( 𝑛 ) , the output of an 𝜀 -differentially private algorithm are indistinguishable under 𝔾 ( 𝑛, 𝑑 / 𝑛 ) and 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) . Therefore, by setting 𝛼 = ˜ 𝑂 ( 1 / 𝜀 𝑛 √ 𝑑 ◦ ) , we conclude that no 𝜀 -differentially private algorithm can achieve error rate better than ˜ 𝑂 ( 1 / 𝜀 𝑛 √ 𝑑 ◦ ) . This provides a matching lower bound for our private edge density estimation algorithm.

References

[AJ06] José A Adell and Pedro Jodrá, Exact kolmogorov and total variation distances between some familiar discrete distributions , Journal of Inequalities and Applications 2006 (2006), 1-8. 38

[AJK + 22] Jayadev Acharya, Ayush Jain, Gautam Kamath, Ananda Theertha Suresh, and Huanyu Zhang, Robust estimation for random graphs , Conference on Learning Theory, PMLR, 2022, pp. 130-166. 3, 4, 20, 37

[AKT + 23] Daniel Alabi, Pravesh K Kothari, Pranay Tankala, Prayaag Venkat, and Fred Zhang, Privately estimating a gaussian: Efficient, robust, and optimal , Proceedings of the 55th Annual ACM Symposium on Theory of Computing, 2023, pp. 483-496. 2

[AUZ23] Hilal Asi, Jonathan Ullman, and Lydia Zakynthinou, From robustness to privacy and back , International Conference on Machine Learning, PMLR, 2023, pp. 11211146. 2, 4

[BBDS13] Jeremiah Blocki, Avrim Blum, Anupam Datta, and Or Sheffet, Differentially private data analysis of social networks via restricted sensitivity , Proceedings of the 4th conference on Innovations in Theoretical Computer Science, 2013, pp. 87-96. 1

[BC17] Christian Borgs and Jennifer Chayes, Graphons: A nonparametric method to model, estimate, and design algorithms for massive networks , Proceedings of the 2017 ACM Conference on Economics and Computation, 2017, pp. 665-672. 2

[BCS15] Christian Borgs, Jennifer T. Chayes, and Adam Smith, Private graphon estimation for sparse graphs , 2015. 1

[BCSZ18] Christian Borgs, Jennifer Chayes, Adam Smith, and Ilias Zadik, Revealing network structure, confidentially: Improved rates for node-private graphon estimation , 2018. 1, 2, 3

[BJR07] Béla Bollobás, Svante Janson, and Oliver Riordan, The phase transition in inhomogeneous random graphs , Random Structures & Algorithms 31 (2007), no. 1, 3-122. 2

[BS14] Boaz Barak and David Steurer, Sum-of-squares proofs and the quest toward optimal algorithms , Proceedings of the International Congress of Mathematicians-Seoul 2014. Vol. IV, Kyung Moon Sa, Seoul, 2014, pp. 509-533. MR 3727623 14

[BS16] , Proofs, beliefs, and algorithms through the lens of sum-of-squares , lecture notes, 2016. 14

[BvH16] Afonso S. Bandeira and Ramon van Handel, Sharp nonasymptotic bounds on the norm of random matrices with independent entries , Ann. Probab. 44 (2016), no. 4, 2479-2506. MR 3531673 9, 18

[CCAd + 23] Hongjie Chen, Vincent Cohen-Addad, Tommaso d'Orsi, Alessandro Epasto, Jacob Imola, David Steurer, and Stefan Tiegel, Private estimation algorithms for stochastic block models and mixture models , Advances in Neural Information Processing Systems 36 (2023), 68134-68183. 2

[CDd + 24] Hongjie Chen, Jingqiu Ding, Tommaso d'Orsi, Yiding Hua, Chih-Hung Liu, and David Steurer, Private graphon estimation via sum-of-squares , arXiv preprint arXiv:2403.12213 (2024). 1, 2, 3, 19

[DL09] Cynthia Dwork and Jing Lei, Differential privacy and robust statistics , Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 371-380. 2

[DMNS06] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith, Calibrating noise to sensitivity in private data analysis , Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, Springer, 2006, pp. 265-284. 1

[DR14] Cynthia Dwork and Aaron Roth, The algorithmic foundations of differential privacy , Foundations and Trends® in Theoretical Computer Science 9 (2014), no. 3-4, 211-407. 5, 6

[DSSU17] Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonathan Ullman, Exposed! a survey of attacks on private data , Annual Review of Statistics and Its Application 4 (2017), 61-84. 1

[FKP + 19] Noah Fleming, Pravesh Kothari, Toniann Pitassi, et al., Semialgebraic proofs and efficient algorithm design , Foundations and Trends® in Theoretical Computer Science 14 (2019), no. 1-2, 1-221. 5

[GH22] Kristian Georgiev and Samuel Hopkins, Privacy induces robustness: Informationcomputation gaps and sparse mean estimation , Advances in Neural Information Processing Systems (S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, eds.), vol. 35, Curran Associates, Inc., 2022, pp. 6829-6842. 2

[HKM22] SamuelBHopkins,GautamKamath,andMahbodMajid, Efficient mean estimation with pure differential privacy via a sum-of-squares exponential mechanism , Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing, 2022, pp. 1406-1417. 2, 5

[HKMN23] Samuel B. Hopkins, Gautam Kamath, Mahbod Majid, and Shyam Narayanan, Robustness implies privacy in statistical estimation , Proceedings of the 55th Annual ACMSymposium on Theory of Computing (New York, NY, USA), STOC 2023, Association for Computing Machinery, 2023, p. 497-506. 2, 4, 5, 18

[HL18] Samuel B. Hopkins and Jerry Li, Mixture models, robustness, and sum of squares proofs , Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of Computing (New York, NY, USA), STOC 2018, Association for Computing Machinery, 2018, p. 1021-1034. 14

[HLL83] Paul W Holland, Kathryn Blackmond Laskey, and Samuel Leinhardt, Stochastic blockmodels: First steps , Social networks 5 (1983), no. 2, 109-137. 2

[Hop20] Samuel B Hopkins, Mean estimation with sub-gaussian rates in polynomial time , The Annals of Statistics 48 (2020), no. 2, 1193-1213. 14

[HRH02] Peter D Hoff, Adrian E Raftery, and Mark S Handcock, Latent space approaches to social network analysis , Journal of the american Statistical association 97 (2002), no. 460, 1090-1098. 2

[KMV22] Pravesh Kothari, Pasin Manurangsi, and Ameya Velingker, Private robust estimation by stabilizing convex relaxations , Proceedings of Thirty Fifth Conference on Learning Theory (Po-Ling Loh and Maxim Raginsky, eds.), Proceedings of Machine Learning Research, vol. 178, PMLR, 02-05 Jul 2022, pp. 723-777. 2

[KNRS13] Shiva Prasad Kasiviswanathan, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith, Analyzing graphs with node differential privacy , Theory of Cryptography: 10th Theory of Cryptography Conference, TCC 2013, Tokyo, Japan, March 3-6, 2013. Proceedings, Springer, 2013, pp. 457-476. 1

[KRSY11] Vishesh Karwa, Sofya Raskhodnikova, Adam Smith, and Grigory Yaroslavtsev, Private analysis of graph structure , Proceedings of the VLDB Endowment 4 (2011), no. 11, 1146-1157. 1

[KSS18] Pravesh K Kothari, Jacob Steinhardt, and David Steurer, Robust moment estimation and improved clustering via sum of squares , Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of Computing, 2018, pp. 1035-1046. 14

[LKKO21] Xiyang Liu, Weihao Kong, Sham Kakade, and Sewoong Oh, Robust and differentially private mean estimation , Advances in neural information processing systems 34 (2021), 3887-3901. 2

[LKO22] Xiyang Liu, Weihao Kong, and Sewoong Oh, Differential privacy and robust statistics in high dimensions , Conference on Learning Theory, PMLR, 2022, pp. 11671246. 2

A Sum-of-squares background

A.1 Sum-of-squares hierarchy

In this paper, we use the sum-of-squares semidefinite programming hierarchy [BS14, BS16, RSS18] for both algorithm design and analysis. The sum-of-squares proof-to-algorithm framework has been proven useful in many optimal or state-of-the-art results in algorithmic statistics [HL18, KSS18, PS17, Hop20]. We provide here a brief introduction to pseudodistributions, sum-of-squares proofs, and sum-of-squares algorithms.

Pseudo-distribution. We can represent a finitely supported probability distribution over ℝ 𝑛 by its probability mass function 𝜇 : ℝ 𝑛 → ℝ such that 𝜇 ⩾ 0 and ˝ 𝑥 ∈ supp ( 𝜇 ) 𝜇 ( 𝑥 ) = 1. We define pseudo-distributions as generalizations of such probability mass distributions by relaxing the constraint 𝜇 ⩾ 0 to only require that 𝜇 passes certain low-degree non-negativity tests.

Definition A.1 (Pseudo-distribution) . A levelℓ pseudo-distribution 𝜇 over ℝ 𝑛 is a finitely supported function 𝜇 : ℝ 𝑛 → ℝ such that ˝ 𝑥 ∈ supp ( 𝜇 ) 𝜇 ( 𝑥 ) = 1 and ˝ 𝑥 ∈ supp ( 𝜇 ) 𝜇 ( 𝑥 ) 𝑓 ( 𝑥 ) 2 ⩾ 0 for every polynomial 𝑓 of degree at most ℓ / 2.

We can define the expectation of a pseudo-distribution in the same way as the expectation of a finitely supported probability distribution.

Definition A.2 (Pseudo-expectation) . Given a pseudo-distribution 𝜇 over ℝ 𝑛 , we define the pseudo-expectation of a function 𝑓 : ℝ 𝑛 → ℝ by

The following definition formalizes what it means for a pseudo-distribution to satisfy a system of polynomial constraints.

Definition A.3 (Constrained pseudo-distributions) . Let 𝜇 : ℝ 𝑛 → ℝ be a levelℓ pseudodistribution over ℝ 𝑛 . Let 𝒜 = { 𝑓 1 ⩾ 0 , . . . , 𝑓 𝑚 ⩾ 0 } be a system of polynomial constraints. Wesay that at level , denoted by , if for every multiset and every

𝜇 satisfies 𝒜 𝑟 𝜇 𝑟 𝒜 𝑆 ⊆ [ 𝑚 ] sum-of-squares polynomial ℎ such that deg ( ℎ ) + ˝ 𝑖 ∈ 𝑆 max { deg ( 𝑓 𝑖 ) , 𝑟 } ⩽ ℓ ,

We say 𝜇 satisfies 𝒜 and write 𝜇 𝒜 (without further specifying the degree) if 𝜇 0 𝒜 .

We remark that if 𝜇 is an actual finitely supported probability distribution, then we have 𝜇 𝒜 if and only if 𝜇 is supported on solutions to 𝒜 .

Sum-of-squares proof. We introduce sum-of-squares proofs as the dual objects of pseudodistributions, which can be used to reason about properties of pseudo-distributions. We say a polynomial 𝑝 is a sum-of-squares polynomial if there exist polynomials ( 𝑞 𝑖 ) such that 𝑝 = ˝ 𝑖 𝑞 2 .

𝑖

Definition A.4 (Sum-of-squares proof) . A sum-of-squares proof that a system of polynomial constraints 𝒜 = { 𝑓 1 ⩾ 0 , . . . , 𝑓 𝑚 ⩾ 0 } implies 𝑞 ⩾ 0 consists of sum-of-squares polynomials ( 𝑝𝑆 ) 𝑆 ⊆[ 𝑚 ] such that 6

If such a proof exists, we say that 𝒜 (sos-)proves 𝑞 ⩾ 0 within degree ℓ , denoted by 𝒜 ℓ 𝑞 ⩾ 0. In order to clarify the variables quantified by the proof, we often write 𝒜( 𝑥 ) ℓ 𝑥 𝑞 ( 𝑥 ) ⩾ 0.

We say that the system 𝒜 sos-refuted within degree ℓ if 𝒜 ℓ -1 ⩾ 0. Otherwise, we say that the system is sos-consistent up to degree ℓ , which also means that there exists a levelℓ pseudo-distribution satisfying the system.

The following lemma shows that sum-of-squares proofs allow us to deduce properties of pseudo-distributions that satisfy some constraints.

Lemma A.5. Let 𝜇 be a pseudo-distribution, and let 𝒜 , ℬ be systems of polynomial constraints. Suppose there exists a sum-of-squares proof 𝒜 𝑟 ′ ℬ . If 𝜇 𝑟 𝒜 , then 𝜇 · ′ + ′ ℬ .

𝑟

𝑟

𝑟

Sum-of-squares algorithm. Given a system of polynomial constraints, the sum-of-squares algorithm searches through the space of pseudo-distributions that satisfy this polynomial system by semidefinite programming.

Since semidefinite programing can only be solved approximately, we can only find pseudodistributions that approximately satisfy a given polynomial system. We say that a levelℓ pseudo-distribution approximately satisfies a polynomial system, if the inequalities in Eq. (A.2) are satisfied up to an additive error of 2 -𝑛 ℓ · ∥ ℎ ∥ · ˛ 𝑖 ∈ 𝑆 ∥ 𝑓 𝑖 ∥ , where ∥·∥ denotes the Euclidean norm 7 of the coefficients of a polynomial in the monomial basis.

Theorem A.6 (Sum-of-squares algorithm) . There exists an ( 𝑛 + 𝑚 ) 𝑂 ( ℓ ) -time algorithm that, given any explicitly bounded 8 and satisfiable system 9 𝒜 of 𝑚 polynomial constraints in 𝑛 variables, outputs a levelℓ pseudo-distribution that satisfies 𝒜 approximately.

Remark A.7 (Approximation error and bit complexity) . For a pseudo-distribution that only approximately satisfies a polynomial system, we can still use sum-of-squares proofs to reason about it in the same way as Lemma A.5. In order for approximation errors not to amplify throughout reasoning, we need to ensure that the bit complexity of the coefficients in the sum-of-squares proof are polynomially bounded.

A.2 Useful sum-of-squares lemmas

Proof. The first inequality is trivial due to { 𝑥 2 = 𝑥 } 2 𝑥 𝑥 = 𝑥 2 ⩾ 0. For the second inequality, it follows that

Rearranging the terms, we get

Lemma A.9.

Proof. By Lemma A.8, it follows that

Therefore, we have

□

Proof.

Lemma A.10. Given constant 𝐶 , we have

Lemma A.11. Given constant 𝐶 , we have

Proof. For the first inequality, we have

For the second inequality, we have

B Concentration inequalities

Lemma B.1 (Average degree concentration) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Let 𝑨 ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) . Then for any 𝛿 ∈ ( 0 , 1 ) ,

Proof. Let 𝜇 : = 𝔼 ˝ 𝑖 < 𝑗 𝑨 𝑖𝑗 = ˝ 𝑖 < 𝑗 𝑝𝑖𝑗 . Using Chernoff bound, for 𝛿 ∈ ( 0 , 1 ) ,

Lemma B.2 (Degree distribution) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix. Let 𝑑 be a parameter such that 𝑑 ⩾ 5 and ∥ 𝑄 ◦ ∥∞ ⩽ 𝑑 / 𝑛 . Then for every 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] , an inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) has at least 𝑒 -𝑡 𝑛 nodes with degree at least 𝑡𝑑 with probability at most exp (-𝑡𝑒 -𝑡 𝑛𝑑 / 4 ) .

□

Proof. Let 𝒎 𝑘 denote the number of nodes with degree at least 𝑘 in 𝔾 ( 𝑛, 𝑄 ◦ ) . Then for every 𝛾 ∈ [ 0 , 1 ] ,

Plugging in 𝛾 = 𝑒 -𝑡 gives

For 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] and 𝑑 ⩾ 5,

Lemma B.3 (Degree pruning) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix. Let 𝑑 be a parameter such that 𝑑 ⩾ 5 and ∥ 𝑄 ◦ ∥∞ ⩽ 𝑑 / 𝑛 . Then with probability at least 1 -𝑛 1 -𝑑 / 4 , an inhomogeneous graph 𝔾 ( 𝑛, 𝑄 ◦ ) has the following property. For all 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] , the number of edges incident to nodes with degree at least 𝑡𝑑 is at most 2 𝑡𝑒 -𝑡 𝑛𝑑 ;

Proof. Let 𝒎 𝑘 denote the number of nodes with degree at least 𝑘 in 𝔾 ( 𝑛, 𝑄 ◦ ) . By Lemma B.2, for any 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] and 𝑑 ⩾ 5,

Applying union bound, the event that 𝑚𝑘 ⩽ 𝑒 -𝑘 / 𝑑 𝑛 for any integer 𝑘 ∈ [ 2 𝑒 2 𝑑, ( log 𝑛 ) 𝑑 ] happens with probability at least 1 -𝑛 1 -𝑑 / 4 . We condition our following analysis on this event.

Fix a 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] . The number of edges incident to nodes with degree at least 𝑡𝑑 is at most

Lemma B.4 (Degree-truncated subgraph) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Let 𝑑 be a parameter such that 𝑑 ⩾ 5 and ∥ 𝑄 ◦ ∥∞ ⩽ 𝑑 / 𝑛 . For 𝛿 ∈ ( 0 , 1 ) , an inhomogeneous graph 𝑨 ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) has the following property with probability at least 1 -𝑛 1 -𝑑 / 4 -exp (-𝛿 2 𝑛𝑑 ◦ / 6 ) . For every 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] , 𝐴 contains an 𝑛 -node subgraph ˜ 𝐴 of such that

( ˜ 𝐴 𝟙 ) 𝑖 ⩽ 𝑡𝑑 for any 𝑖 ∈ [ 𝑛 ] ;

( 1 -𝛿 ) 𝑑 ◦ -4 𝑡𝑒 -𝑡 𝑑 ⩽ 𝑑 ( ˜ 𝐴 ) ⩽ ( 1 + 𝛿 ) 𝑑 ◦ .

Proof. By Lemma B.1 and Lemma B.3, 𝑨 ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) has the following two properties with probability at least 1 -𝑛 1 -𝑑 / 4 -exp (-𝛿 2 𝑛𝑑 ◦ / 6 ) .

| 𝑑 ( 𝐴 ) -𝑑 ◦ | ⩽ 𝛿 𝑑 ◦ .

For all 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] , the number of edges incident to nodes with degree at least 𝑡𝑑 is at most 2 𝑡𝑒 -𝑡 𝑛𝑑 .

Consider a graph 𝐴 with the above two properties. Fix a 𝑡 ∈ [ 2 𝑒 2 , log 𝑛 ] . By removing at most 2 𝑡𝑒 -𝑡 𝑛𝑑 edges from 𝐴 , we can obtain a graph ˜ 𝐴 such that the maximum degree of ˜ 𝐴 is at most 𝑡𝑑 . Moreover,

□

Lemma B.5 (Spectral bound [BvH16]) . Let 𝑨 ∼ 𝔾 ( 𝑛, 𝑝 0 ) and suppose 𝑛𝑝 0 ⩾ 5 . Then with probability at least 1 -𝑛 -Ω ( 1 ) ,

C Sum-of-squares exponential mechanism

In this section, we present our sum-of-squares exponential mechanism and prove its properties in a general setting that incorporates all special cases in Appendix D, Appendix E and Appendix F.

Setup. Let 𝒟 ⊂ ℝ 𝑁 . Given an 𝑛 -by𝑛 symmetric matrix 𝐴 , our goal is to output an element 𝑑 from 𝒟 privately. We say two symmetric matrices are neighboring if they differ in at most one row and one column. The utility of an element 𝑑 ∈ 𝒟 is quantified by a score function defined as follows.

Score function. For an 𝑛 -by𝑛 symmetric matrix 𝐴 and a scalar 𝛾 , consider the following polynomial system with indeterminates ( 𝑌𝑖𝑗 ) 𝑖,𝑗 ∈[ 𝑛 ] , ( 𝑧 𝑖 ) 𝑖 ∈[ 𝑛 ] and coefficients that depend on 𝐴, 𝛾 :

  For an element 𝑑 ∈ 𝒟 , let 𝒬 2 ( 𝑌 ; 𝑑 ) be a polynomial system with coefficients depending on 𝑑 (and independent of 𝐴, 𝛾 ). Then for a matrix 𝐴 and an element 𝑑 ∈ 𝒟 , we define the score of 𝑑 with regard to 𝐴 to be

For 𝑠 ( 𝑑 ; 𝐴 ) to be well-defined, we assume that for every 𝑑 ∈ 𝒟 there exists a symmetric matrix 𝐴 ∗ ∈ [ 0 , 1 ] 𝑛 × 𝑛 such that 𝒬 2 ( 𝐴 ∗ ; 𝑑 ) is true.

Remark C.1 (Score function computation) . Observe that a levelℓ pseudo-expectation satisfying 𝒬 1 ( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ 𝒬 2 ( 𝑌 ; 𝑑 ) is also a levelℓ pseudo-expectation satisfying 𝒬 1 ( 𝑌, 𝑧 ; 𝐴, 𝛾 ′ ) ∪ 𝒬 2 ( 𝑌 ; 𝑑 ) for any 𝛾 ′ ⩾ 𝛾 . Thus we can compute 𝑠 ( 𝑑 ; 𝐴 ) using binary search. Given a scalar 𝛾 , checking if there exists a levelℓ pseudo-expectation satisfying 𝒬 1 ( 𝑌, 𝑧 ; 𝐴, 𝛾 ) ∪ 𝒬 2 ( 𝑌 ; 𝑑 ) is equivalent to checking if a semidefinite program of size 𝑛 𝑂 ( ℓ ) is feasible. Since we only have efficient algorithms for semidefinite programming up to a given precision, we can only efficiently search for pseudo-distributions that approximately satisfy a given polynomial system. In spite of this, as long as the bit complexity of the coefficients in our sum-of-squares proof are polynomially bounded, the analysis of our algorithm based on sum-of-squares proofs will still work due to our discussion in Remark A.7. We refer interested readers to [HKMN23] for a formal (and quite technical) treatment of approximate pseudo-expectations.

Exponential mechanism. Given an 𝑛 -by𝑛 symmetric matrix 𝐴 , our sos exponential mechanism with privacy parameter 𝜀 outputs a sample from the distribution 𝜇 𝐴, 𝜀 that is supported on 𝒟 and has density

Remark C.2 (Sampling) . To efficiently sample from 𝜇 𝐴, 𝜀 , we can use the following straightforward discretization scheme. More specifically, given a discretization parameter 𝛿 , we output an element 𝑑 ∈ { 0 , 𝛿 , 2 𝛿 , . . . , ⌊ 𝑛 / 𝛿 ⌋ 𝛿 } with probability proportional to exp (-𝜀 · sos-score ( 𝑑 ; 𝐴 )) . As the error introduced by discretization is at most 𝛿 and our target estimation error is 𝜔 ( 1 / 𝑛 ) , we can choose 𝛿 = 1 / 𝑛 and the discretization error is then negligible. Moreover, our algorithm requires at most 𝑛 2 evaluations of score functions.

Properties. The following lemma shows that the sensitivity of score function 𝑠 ( 𝑑 ; 𝐴 ) is at most 1.

Lemma C.3 (Sensitivity bound) . For any 𝑑 ∈ 𝒟 and any two 𝑛 -by𝑛 symmetric matrices 𝐴, 𝐴 ′ that differ in at most one row and one column, the score function defined in Eq. (C.2) satisfies

Proof. Without loss of generality, we assume that 𝐴 and 𝐴 ′ differ in the first row and column. Consider the linear functions ( ℓ 𝑖 ) where ℓ 1 ( 𝑧 ) = 0 and ℓ 𝑖 ( 𝑧 ) = 𝑧 𝑖 for 𝑖 ⩾ 2. Then for every polynomial inequality 𝑞 ( 𝑌, 𝑧 ) ⩾ 0 in 𝒬 1 ( 𝑌, 𝑧 ; 𝐴 ′ , 𝛾 + 1 / 𝑛 ) ∪ 𝒬 2 ( 𝑌 ; 𝑑 ) ,

The same argument also holds for polynomial equalities. Then by [CDd + 24, Lemma 8.1], 𝑠 ( 𝑑 ; 𝐴 ′ ) ⩽ 𝑠 ( 𝑑 ; 𝐴 ) + 1. Due to symmetry of 𝐴 and 𝐴 ′ , we also have 𝑠 ( 𝑑 ; 𝐴 ) ⩽ 𝑠 ( 𝑑 ; 𝐴 ′ ) + 1. Therefore, | 𝑠 ( 𝑑 ; 𝐴 ) -𝑠 ( 𝑑 ; 𝐴 ′ )| ⩽ 1. □

The following privacy guarantee of our sos exponential mechanism is a direct corollary of Lemma C.3.

Lemma C.4 (Privacy) . The exponential mechanism defined in Eq. (C.3) is 2 𝜀 -differentially node private.

Lemma C.5 (Volume of low-score points) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and 𝜀 > 0 . Consider the distribution 𝜇 𝐴, 𝜀 defined by Eq. (C.3) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to 𝒬 1 ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ ) . Then for any 𝑡 ⩾ 0 ,

where 𝒢( 𝐴 ∗ ) : = { 𝑑 ∈ 𝒟 : 𝒬 2 ( 𝐴 ∗ ; 𝑑 ) is true } .

Proof. Note ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is also a solution to 𝒬 1 ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ ) ∪ 𝒬 2 ( 𝑌 ; 𝑑 ) for any 𝑑 such that 𝒬 2 ( 𝐴 ∗ ; 𝑑 ) is true. Let 𝒢( 𝐴 ∗ ) : = { 𝑑 ∈ 𝒟 : 𝒬 2 ( 𝐴 ∗ ; 𝑑 ) is true } . Thus 𝑠 ( 𝑑 ; 𝐴 ) ⩽ 𝛾 ∗ 𝑛 for any 𝑑 ∈ 𝒢( 𝐴 ∗ ) . For 𝑡 ⩾ 0,

D Coarse estimation

In this section, we describe our coarse estimation algorithm that achieves constant multiplicative approximation of the expected average degree 𝑑 ◦ .

Theorem D.1 (Coarse estimation for inhomogeneous random graphs) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . There are constants 𝐶 1 , 𝐶 2 , 𝐶 3 such that the following holds. For any 𝜂 , 𝜀 , 𝑑 ◦ such that 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝐶 1 , 𝜀 ⩾ 𝐶 2 log 2 ( 𝑛 ) 𝑅 / 𝑛 , and 𝑑 ◦ ⩾ 𝐶 3 , there exists a polynomial-time 𝜀 -differentially node private algorithm which, given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , outputs an estimate ˆ 𝑑 satisfying | ˆ 𝑑 / 𝑑 ◦ -1 | ⩽ 0 . 5 with probability 1 -𝑛 -Ω ( 1 ) .

We make a few remarks on Theorem D.1.

Our algorithm in Theorem D.1 is a sum-of-squares exponential mechanism. 𝑅, 𝜂 , 𝜀 are parameters given as inputs to our algorithm.

We can get a constant estimate of 𝑝 ◦ by taking ˆ 𝑝 = ˆ 𝑑 𝑛 -1 . Since ˆ 𝑝 𝑝 ◦ = ˆ 𝑑 𝑑 ◦ , it follows that | ˆ 𝑝 𝑝 ◦ -1 | ⩽ 0 . 5.

When 𝑄 ◦ = 𝑝 ◦ ( 𝟙𝟙 ⊤ -Id ) , the inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) is just the Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑝 ◦ ) . Thus, by setting 𝑅 = 𝑛 𝑛 -1 in Theorem D.1, we directly obtain a coarse estimation result for Erdős-Rényi random graphs.

The utility guarantee of our algorithm holds in the constant-degree regime (i.e. 𝑑 ◦ ⩾ Ω ( 1 ) ). To the best of our knowledge, even without privacy requirement and in the special case of Erdős-Rényi random graphs, no previous algorithm can match our guarantees in the constant-degree regime. Specifically, when 𝑑 ◦ ≪ log 𝑛 and 𝜂 ⩾ Ω ( 1 ) , the robust algorithm in [AJK + 22] can not provide a constant-factor approximation of 𝑑 ◦ .

In Appendix D.1, we set up polynomial systems that our algorithm uses and prove useful sos inequalities. In Appendix D.2, we show that we can easily obtain a robust algorithm via sos proofs in Appendix D.1. Then in Appendix D.3, we describe our algorithm and prove Theorem D.1.

D.1 Sum-of-squares

For an adjacency matrix 𝐴 and two nonnegative scalars 𝛾 and 𝜎 , consider the following polynomial systems with indeterminates 𝑌 = ( 𝑌𝑖𝑗 ) 𝑖,𝑗 ∈[ 𝑛 ] , 𝑧 = ( 𝑧 𝑖 ) 𝑖 ∈[ 𝑛 ] and coefficients that depend on 𝐴, 𝛾 , 𝜎 :

For convenience of notation, we will consider the following combined polynomial system in remaining of the section

Lemma D.2. If ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 ) and 1 -2 𝛾𝜎 -2 𝛾 ∗ 𝜎 > 0 , then it follows that

Proof. Let 𝑤 = 𝑧 ⊙ 𝑧 ∗ , by constraint 𝑌 ⊙ 𝑧𝑧 ⊤ = 𝐴 ⊙ 𝑧𝑧 ⊤ and 𝐴 ∗ ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ = 𝐴 ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ , we have

Applying this equality, it follows that

Therefore, it follows that

For the second term, we have

where the last inequality is due to Lemma A.9. From constraints ˝ 𝑖 ∈[ 𝑛 ] 1 -𝑧 ∗ 𝑖 ⩽ 𝛾 ∗ 𝑛 , ˝ 𝑖 ∈[ 𝑛 ] 1 -𝑧 𝑖 ⩽ 𝛾 𝑛 and ( 𝑌 𝟙 ) 𝑖 ⩽ 𝜎 𝑑 ( 𝑌 ) for all 𝑖 ∈ [ 𝑛 ] , it follows that

For the third term, since 𝒞 2 𝑌,𝑧 𝑌𝑖,𝑗 ⩾ 0 and 𝒞 2 𝑌,𝑧 1 -𝑤𝑖 ⩾ 0 for all 𝑖, 𝑗 ∈ [ 𝑛 ] , it follows that

Combining Eq. (D.4), Eq. (D.5) and Eq. (D.6), we can get

Swapping the roll of 𝐴 ∗ and 𝑌 , we can use the same proof to get

This completes the proof.

□

Lemma D.3. Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥ ∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for 𝑅 ∈ ℝ . Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) . Suppose 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝐶 1 for some constant 𝐶 1 that is small enough. With probability 1 -𝑛 -Ω ( 1 ) , there exists 𝐴 ∗ and 𝑧 ∗ such that

| 𝑑 ( 𝐴 ∗ ) -𝑑 ◦ | ⩽ 0 . 1 𝑑 ◦ .

( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 ) with 𝛾 = 2 𝜂 and 𝜎 = 2 log ( 1 / 𝜂 ) 𝑅 .

For the first term, since 𝐴 ∗ 𝑖,𝑗 ∈ [ 0 , 1 ] , 𝑧 ∗ 𝑖 ∈ { 0 , 1 } and 𝒞 2 𝑌,𝑧 0 ⩽ 𝑧 𝑖 ⩽ 1 for all 𝑖, 𝑗 ∈ [ 𝑛 ] , we have

Proof. Let 𝑨 ◦ be the adjacency matrix of 𝑮 ◦ and 𝑧 ◦ ∈ { 0 , 1 } 𝑛 denote the set of uncorrupted nodes ( 𝑧 ◦ = 1 if and only if node 𝑖 is uncorrupted).

𝑖

By Lemma B.2 and Lemma B.3, we know that, with probability 1 -𝑛 -Ω ( 1 ) , there exists a degree-pruned adjacency matrix ˜ 𝐴 such that

GLYPH<13> GLYPH<13> ˜ 𝐴 𝟙 GLYPH<13> GLYPH<13> ∞ ⩽ log ( 1 / 𝜂 ) 𝑅𝑑 ◦ .

At most 𝜂 𝑛 nodes are pruned.

At most 2 𝜂 log ( 1 / 𝜂 ) 𝑛𝑅𝑑 ◦ edges are pruned.

Let ˜ 𝑧 ∈ { 0 , 1 } 𝑛 denote the set of unpruned nodes ( 𝑧 ◦ 𝑖 = 1 if and only if node 𝑖 is not pruned). We will show that 𝐴 ∗ = ˜ 𝐴 and 𝑧 ∗ = 𝑧 ◦ ⊙ ˜ 𝑧 satisfies the lemma.

Guarantee 1. By Lemma B.1, we know that, with probability 1 -𝑛 -Ω ( 1 ) ,

From degree pruning guarantee (3), we have that

Combining Eq. (D.7) and Eq. (D.8), for some constant 𝐶 1 that is small enough, we have

Guarantee 2. It is easy to check that 𝑧 ∗ ⊙ 𝑧 ∗ = 𝑧 ∗ , 0 ⩽ 𝐴 ∗ ⩽ 𝟙𝟙 ⊤ and 𝐴 ∗ = ( 𝐴 ∗ ) ⊤ . Since ⟨ 𝟙 , ˜ 𝑧 ⟩ ⩾ 1 -𝜂 𝑛 by degree pruning condition (2) and ⟨ 𝟙 , 𝑧 ◦ ⟩ ⩾ 1 -𝜂 𝑛 by corruption rate, it is easy to verify that

Moreover, we have 𝐴 ∗ ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ = 𝐴 ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ due to

From Eq. (D.9), we can get that 𝑑 ◦ ⩽ 2 𝑑 ( ˜ 𝐴 ) . Plugging this into degree pruning condition (1), we get

Therefore, we have for all 𝑖 ∈ [ 𝑛 ] .

Thus, ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 ) with 𝛾 = 2 𝜂 and 𝜎 = 2 log ( 1 / 𝜂 ) 𝑅 . □

D.2 Robust algorithm

In this section, we show that the following algorithm based on sum-of-squares proofs in Appendix D.1 obtains a robust constant multiplicative approximation of 𝑑 ◦ .

Algorithm D.4 (Robust coarse estimation algorithm) . Input: 𝜂 -corrupted adjacency matrix 𝐴 , corruption fraction 𝜂 and parameter 𝑅 .

Algorithm: Obtain level-8 pseudo-expectation ˜ 𝔼 by solving sum-of-squares relaxation of program 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 ) (defined in Eq. (D.3)) with 𝐴 , 𝛾 = 2 𝜂 and 𝜎 = 2 log ( 1 / 𝜂 ) 𝑅 .

Output: ˜ 𝔼 [ 𝑑 ( 𝑌 )]

Theorem D.5 (Robust coarse estimation) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) . Suppose 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝑐 for some constant 𝑐 that is small enough. With probability 1 -𝑛 -Ω ( 1 ) , Algorithm D.4 outputs an estimate ˆ 𝑑 satisfying | ˆ 𝑑 ◦ -1 | ⩽ 0 . 5 .

𝑑

Proof. By Lemma D.2 and Lemma D.3, we know that

and,

Therefore, we have

Consider 4 𝛾𝜎 , for constant 𝑐 that is small enough, we have

This implies that 0 . 9 ( 1 -4 𝛾𝜎 ) ⩾ 1 2 and 1 . 1 1 -4 𝛾𝜎 ⩽ 11 9 ⩽ 3 2 . Therefore, we have

Thus, the level-8 pseudo-expectation ˜ 𝔼 satisfies

which implies that

D.3 Private algorithm

In this section, we present our algorithm and prove Theorem D.1. Our algorithm instantiates the sum-of-squares exponential mechanism in Appendix C.

Score function. For an 𝑛 -by𝑛 symmetric matrix 𝐴 and a scalar 𝑑 , we define the score of 𝑑 with regard to 𝐴 to be

where 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 ) is the polynomial system defined in Eq. (D.3), and 𝜎 , 𝛼 are fixed parameters whose values will be decided later. Note that ( 𝑌 = 𝑑 𝑛 𝟙𝟙 ⊤ , 𝑧 = 𝟘 ) is a solution to the polynomial system 𝒞( 𝑌, 𝑧 ; 𝐴, 1 , 𝜎 ) ∪ {| 𝑑 ( 𝑌 ) -𝑑 | ⩽ 𝛼 𝑑 } for any 𝐴 ∈ ℝ 𝑛 × 𝑛 , 𝑑 ∈ [ 0 , 𝑛 ] , and 𝜎 ⩾ 1.

To efficiently compute 𝑠 ( 𝑑 ; 𝐴 ) , we can use the scheme as described in Remark C.1.

□

Exponential mechanism. Given a privacy parameter 𝜀 and an 𝑛 -by𝑛 symmetric matrix 𝐴 , our algorithm is the exponential mechanism with score function Eq. (D.10) and range [ 0 , 𝑛 ] .

Algorithm D.6 (Coarse estimation) .

Input:

Parameters: 𝜀 , 𝜎 , 𝛼 .

Output: Asample from the distribution 𝜇 𝐴, 𝜀 with support [ 0 , 𝑛 ] and density

where 𝑠 ( 𝑑 ; 𝐴 ) is defined in Eq. (D.10).

To efficiently sample from 𝜇 𝐴, 𝜀 , we can use the scheme as described in Remark C.2.

Privacy. The following privacy guarantee of our algorithm is a direct corollary of Lemma C.4.

Lemma D.7 (Privacy) . Algorithm D.6 is 2 𝜀 -differentially node private.

Utility. The utility guarantee of our algorithm is stated in the following lemma.

Lemma D.8 (Utility) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . There are constants 𝐶 1 , 𝐶 2 , 𝐶 3 such that the following holds. For any 𝜂 , 𝜀 , 𝑑 ◦ such that 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝐶 1 , 𝜀 ⩾ 𝐶 2 log 2 ( 𝑛 ) 𝑅 / 𝑛 , and 𝑑 ◦ ⩾ 𝐶 3 , given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , Algorithm D.6 outputs an estimate ˆ 𝑑 satisfying | ˆ 𝑑 -𝑑 ◦ | ⩽ 0 . 5 𝑑 ◦ with probability 1 -𝑛 -Ω ( 1 ) .

Before proving Lemma D.8, we need the following two lemmas.

Lemma D.9 (Volume of low-score points) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and 𝜀 > 0 . Consider the distribution 𝜇 𝐴, 𝜀 defined by Eq. (D.11) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 ) and 𝑑 ( 𝐴 ∗ ) ⩾ 2 . Then for any 𝑡 ⩾ 0 ,

Proof. Apply Lemma C.5 with 𝒟 = [ 0 , 𝑛 ] and

As [ 𝑑 ( 𝐴 ∗ )/( 1 + 𝛼 ) , 𝑑 ( 𝐴 ∗ )] ⊆ 𝒢( 𝐴 ∗ ) and 𝑑 ( 𝐴 ∗ ) ⩾ 2 ⩾ 1 + 𝛼 , we have vol (𝒢( 𝐴 ∗ )) ⩾ 𝛼 . □

Lemma D.10 (Low score implies utility) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and consider the score function 𝑠 (· ; 𝐴 ) defined in Eq. (D.10) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 ) . For a scalar 𝑑 such that 𝑠 ( 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 and ( 𝛾 ∗ + 𝜏 ) 𝜎 ⩽ 0 . 1 ,

Proof. Applying Lemma D.2 with ( 𝛾 ∗ + 𝜏 ) 𝜎 ⩽ 0 . 1, we have

Thus,

Now we are ready to prove Lemma D.8.

Proof of Lemma D.8. Let 𝐴 be a realization of 𝜂 -corrupted 𝔾 ( 𝑛, 𝑄 ◦ ) . By Lemma D.3, the following event happens with probability 1 -𝑛 -Ω ( 1 ) . There exists a solution ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) to 𝒞( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 ) with 𝛾 ∗ = 2 𝜂 , 𝜎 = 2 log ( 1 / 𝜂 ) 𝑅 , and 0 . 9 𝑑 ◦ ⩽ 𝑑 ( 𝐴 ∗ ) ⩽ 1 . 1 𝑑 ◦ .

As 𝑑 ( 𝐴 ∗ ) ⩾ 0 . 9 𝑑 ◦ ⩾ 2, then it follows by setting 𝑡 = 10 and 𝛼 = 0 . 01 in Lemma D.9 that,

As an 𝜂 -corrupted graph is actually uncorrupted when 𝜂 < 1 / 𝑛 , we can assume 𝜂 ⩾ 1 /( 2 𝑛 ) without loss of generality. Thus,

For 𝜂 log ( 1 / 𝜂 ) 𝑅 and log 2 ( 𝑛 ) 𝑅 /( 𝜀 𝑛 ) smaller than some constant, we have ( 2 𝜂 + 𝜏 ) 𝜎 ⩽ 0 . 1. Let ˆ 𝑑 be a scalar such that 𝑠 ( ˆ 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 . Then by Lemma D.10,

Plugging in 𝛼 ⩽ 0 . 01 and 0 . 9 𝑑 ◦ ⩽ 𝑑 ( 𝐴 ∗ ) ⩽ 1 . 1 𝑑 ◦ , we have

Proof of Theorem D.1. By Lemma D.7 and Lemma D.8.

E Fine estimation for inhomogeneous random graphs

From Appendix D, we have a constant multiplicative approximation of the expected average degree 𝑑 ◦ . In this section, we show how to use this coarse estimate to obtain our fine estimator for inhomogeneous random graphs.

Theorem E.1 (Fine estimation for inhomogeneous random graphs) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥ ∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . There is a sufficiently small constant 𝑐 such that the following holds. For any 𝜂 such that 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝑐 , there exists a polynomial-time 𝜀 -differentially node private algorithm which, given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) and a constant-factor approximation of 𝑑 ◦ , outputs an estimate ˜ 𝑑 satisfying

with probability 1 -𝑛 -Ω ( 1 ) .

We make a few remarks on Theorem E.1.

Our algorithm in Theorem E.1 is a sum-of-squares exponential mechanism. 𝑅, 𝜂 , 𝜀 are parameters given as input to our algorithm.

𝑑

We can get an estimate of 𝑝 ◦ by taking ˜ 𝑝 = ˜ 𝑑 𝑛 -1 . Since ˜ 𝑝 𝑝 ◦ = ˜ 𝑑 ◦ , it follows that

Combining Theorem D.1 and Theorem E.1 gives us an efficient, private, and robust edge density estimation algorithm for inhomogeneous random graphs whose utility guarantee is information-theoretically optimal up to a factor of log 𝑛 and log ( 1 / 𝜂 ) .

In Appendix E.1, we set up polynomial systems that our algorithm uses and prove useful sos inequalities. In Appendix E.2, we show that we can easily obtain a robust algorithm via sos proofs in Appendix E.1. Then in Appendix E.3, we describe our algorithm and prove Theorem E.1.

□

E.1 Sum-of-squares

For an adjacency matrix 𝐴 and nonnegative scalars 𝛾 , 𝜎 and ˆ 𝑑 , consider the following polynomial systems with indeterminates 𝑌 = ( 𝑌𝑖𝑗 ) 𝑖,𝑗 ∈[ 𝑛 ] , 𝑧 = ( 𝑧 𝑖 ) 𝑖 ∈[ 𝑛 ] and coefficients that depend on 𝐴, 𝛾 , 𝜎 , ˆ 𝑑 :

For convenience of notation, we will consider the following combined polynomial system in the remaining of this section

Lemma E.2. If ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , ˆ 𝑑 ) , then it follows that

Proof. Let 𝑤 = 𝑧 ⊙ 𝑧 ∗ . Using similar analysis as in the proof of Lemma D.2, it follows that

and,

By rearranging the terms, we have

Swapping the roll of 𝑌 and 𝐴 ∗ , we can also get

This completes the proof.

Lemma E.3. Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥ ∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for 𝑅 ∈ ℝ . Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) . Suppose 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝐶 1 for some constant 𝐶 1 that is small enough. With probability 1 -𝑛 -Ω ( 1 ) , there exists 𝐴 ∗ and 𝑧 ∗ such that

( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , ˆ 𝑑 ) with 𝜂 -corrupted 𝐴 , 𝛾 = 2 𝜂 , 𝜎 = 10 log ( 1 / 𝜂 ) 𝑅 and ˆ 𝑑 ⩾ 1 𝑑 ◦ .

2

Proof. Let 𝑨 ◦ be the adjacency matrix of 𝑮 ◦ and 𝑧 ◦ ∈ { 0 , 1 } 𝑛 denote the set of uncorrupted nodes ( 𝑧 ◦ = 1 if and only if node 𝑖 is uncorrpted).

𝑖

By Lemma B.2 and Lemma B.3, we know that, with probability 1 -𝑛 -Ω ( 1 ) , there exists a degree-pruned adjacency matrix ˜ 𝐴 such that

At most 𝜂 𝑛 nodes are pruned.

At most 2 𝜂 log ( 1 / 𝜂 ) 𝑛𝑅𝑑 ◦ edges are pruned.

Let ˜ 𝑧 ∈ { 0 , 1 } 𝑛 denote the set of unpruned nodes ( ˜ 𝑧 𝑖 = 1 if and only if node 𝑖 is not pruned). We will show that 𝐴 ∗ = ˜ 𝐴 and 𝑧 ∗ = 𝑧 ◦ ⊙ ˜ 𝑧 satisfies the lemma.

Guarantee 1. By Lemma B.1, we know that, with probability 1 -𝑛 -Ω ( 1 ) ,

From degree pruning guarantee (3), we have that

Combining Eq. (E.4) and Eq. (E.5), we have

Guarantee 2. It is easy to check that 𝑧 ∗ ⊙ 𝑧 ∗ = 𝑧 ∗ , 0 ⩽ 𝐴 ∗ ⩽ 𝟙𝟙 ⊤ and 𝐴 ∗ = ( 𝐴 ∗ ) ⊤ . Since ⟨ 𝟙 , ˜ 𝑧 ⟩ ⩾ 1 -𝜂 𝑛 by degree pruning condition (2) and ⟨ 𝟙 , 𝑧 ◦ ⟩ ⩾ 1 -𝜂 𝑛 by corruption rate, it is easy to verify that

Moreover, we have 𝐴 ∗ ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ = 𝐴 ⊙ 𝑧 ∗ ( 𝑧 ∗ ) ⊤ due to

By degree pruning condition (1), we have

for all 𝑖 ∈ [ 𝑛 ] .

Thus, ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , ˆ 𝑑 ) with 𝛾 = 2 𝜂 , 𝜎 = 10log ( 1 / 𝜂 ) 𝑅 and ˆ 𝑑 ⩾ 1 2 𝑑 ◦ . □

E.2 Robust algorithm

In this section, we show that the following algorithm based on sum-of-squares proofs in Appendix E.1 obtains a robust approximation of 𝑑 ◦ that is optimal up to logarithmic factors.

Algorithm E.4 (Robust fine estimation algorithm for inhomogeneous random graphs) . Input: 𝜂 -corrupted adjacency matrix 𝐴 , corruption fraction 𝜂 and parameter 𝑅 .

Algorithm:

Obtain coarse estimator ˆ 𝑑 by applying Algorithm D.4 with 𝐴, 𝜂 , 𝑅 as input.

Obtain level-8 pseudo-expectation ˜ 𝔼 by solving sum-of-squares relaxation of program 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , ˆ 𝑑 ) (defined in Eq. (E.3)) with 𝐴 , 𝛾 = 2 𝜂 , 𝜎 = 10 log ( 1 / 𝜂 ) 𝑅 and ˆ 𝑑 .

Output: ˜ 𝔼 [ 𝑑 ( 𝑌 )]

Theorem E.5 (Robust fine estimation for inhomogeneous random graphs) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑄 ◦ ) . Suppose

𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝑐 for some constant 𝑐 that is small enough. With probability 1 -𝑛 -Ω ( 1 ) , Algorithm E.4 outputs an estimate ˜ 𝑑 satisfying

Proof. By Theorem D.5, we have 1 2 𝑑 ◦ ⩽ ˆ 𝑑 ⩽ 3 2 𝑑 ◦ . Let 𝛾 ∗ = 2 𝜂 , by Lemma E.2 and Lemma E.3, it follows that

and,

Therefore, we have

Thus, the level-8 pseudo-expectation ˜ 𝔼 satisfies

which implies that

E.3 Private algorithm

In this section, we present our algorithm and prove Theorem E.1. Our algorithm instantiates the sum-of-squares exponential mechanism in Appendix C.

Score function. For an 𝑛 -by𝑛 symmetric matrix 𝐴 and a scalar 𝑑 , we define the score of 𝑑 with regard to 𝐴 to be

where 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , ˆ 𝑑 ) is the polynomial system defined in Eq. (E.3), ˆ 𝑑 is a coarse estimate, and 𝜎 , 𝛼 are fixed parameters whose values will be decided later. Note that ( 𝑌 = 𝑑 𝑛 𝟙𝟙 ⊤ , 𝑧 = 𝟘 ) is a solution to the polynomial system 𝒟( 𝑌, 𝑧 ; 𝐴, 1 , 𝜎 , ˆ 𝑑 ) ∪ {| 𝑑 ( 𝑌 ) -𝑑 | ⩽ 𝛼 𝑑 } for any 𝐴 ∈ ℝ 𝑛 × 𝑛 and any 𝑑 such that 0 ⩽ 𝑑 ⩽ min { 𝜎 ˆ 𝑑, 𝑛 } .

To efficiently compute 𝑠 ( 𝑑 ; 𝐴 ) , we can use the scheme as described in Remark C.1.

Exponential mechanism. Given a privacy parameter 𝜀 and an 𝑛 -by𝑛 symmetric matrix 𝐴 , our private algorithm in Theorem E.1 is the exponential mechanism with score function Eq. (E.6) and range [ 0 , min { 𝜎 ˆ 𝑑, 𝑛 }] .

□

Algorithm E.6 (Fine estimation for inhomogeneous random graphs) .

Input: Graph 𝐴 , coarse estimate ˆ 𝑑 .

Parameters: 𝜀 , 𝜎 , 𝛼 .

Output: Asample from the distribution 𝜇 𝐴, 𝜀 with support [ 0 , min { 𝜎 ˆ 𝑑, 𝑛 }] and density

where 𝑠 ( 𝑑 ; 𝐴 ) is defined in Eq. (E.6).

To efficiently sample from 𝜇 𝐴, 𝜀 , we can use the scheme as described in Remark C.2.

Privacy. The following privacy guarantee of our algorithm is a direct corollary of Lemma C.4.

Lemma E.7 (Privacy) . Algorithm E.6 is 2 𝜀 -differentially node private.

Utility. The utility guarantee of our algorithm is stated in the following lemma.

Lemma E.8 (Utility) . Let 𝑄 ◦ be an 𝑛 -by𝑛 edge connection probability matrix and let 𝑑 ◦ : = 𝑑 ( 𝑄 ◦ ) . Suppose ∥ 𝑄 ◦ ∥ ∞ ⩽ 𝑅𝑑 ◦ / 𝑛 for some 𝑅 . There is a sufficiently small constant 𝑐 such that the following holds. For any 𝜂 such that 𝜂 log ( 1 / 𝜂 ) 𝑅 ⩽ 𝑐 , given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) and a coarse estimate ˆ 𝑑 such that 0 . 5 𝑑 ◦ ⩽ ˆ 𝑑 ⩽ 2 𝑑 ◦ , Algorithm E.6 outputs an estimate ˜ 𝑑 satisfying with probability 1 -𝑛 -Ω ( 1 ) .

Before proving Lemma E.8, we need the following two lemmas.

Lemma E.9 (Volume of low-score points) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and 𝜀 > 0 . Consider the distribution 𝜇 𝐴, 𝜀 defined by Eq. (E.7) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , ˆ 𝑑 ) and 2 ⩽ 𝑑 ( 𝐴 ∗ ) ⩽ 𝜎 ˆ 𝑑 . Then for any 𝑡 ⩾ 0 ,

Proof. Apply Lemma C.5 with 𝒟 = [ 0 , min { 𝜎 ˆ 𝑑, 𝑛 }] and

As [ 𝑑 ( 𝐴 ∗ )/( 1 + 𝛼 ) , 𝑑 ( 𝐴 ∗ )] ⊆ 𝒢( 𝐴 ∗ ) and 𝑑 ( 𝐴 ∗ ) ⩾ 2 ⩾ 1 + 𝛼 , we have vol (𝒢( 𝐴 ∗ )) ⩾ 𝛼 . □

Lemma E.10 (Low score implies utility) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and consider the score function 𝑠 (· ; 𝐴 ) defined in Eq. (E.6) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , ˆ 𝑑 ) . For a scalar 𝑑 such that 𝑠 ( 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 ,

Thus,

𝒟( 𝑌, 𝑧 ; 𝐴, 𝜏 , 𝜎 , ˆ 𝑑 ) ∪ {| 𝑑 ( 𝑌 ) -𝑑 | ⩽ 𝛼 𝑑 }

□

Now we are ready to prove Lemma E.8.

Proof of Lemma E.8. Let 𝐴 be a realization of 𝜂 -corrupted 𝔾 ( 𝑛, 𝑄 ◦ ) . By Lemma E.3, the following event happens with probability at least 1 -𝑛 -Ω ( 1 ) . There exists a solution ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) to 𝒟( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , ˆ 𝑑 ) with 𝛾 ∗ = 2 𝜂 , 𝜎 = 10 log ( 1 / 𝜂 ) 𝑅 , and

For 𝜂 log ( 1 / 𝜂 ) 𝑅 smaller than some constant, we have 0 . 9 𝑑 ◦ ⩽ 𝑑 ( 𝐴 ∗ ) ⩽ 1 . 1 𝑑 ◦ . Note that 𝑑 ( 𝐴 ∗ ) ⩾ 0 . 9 𝑑 ◦ ⩾ 2 and 𝑑 ( 𝐴 ∗ ) ⩽ 1 . 1 𝑑 ◦ ⩽ 𝜎 ˆ 𝑑 . Then it follows by setting 𝑡 = 10 and 𝛼 = 𝑛 -2 in Lemma E.9 that,

Let ˜ 𝑑 be a scalar such that 𝑠 ( ˜ 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 . Then by Lemma E.10,

Plugging in everything, we have

As an 𝜂 -corrupted graph is actually uncorrupted when 𝜂 < 1 / 𝑛 , we can assume 𝜂 ⩾ 1 /( 2 𝑛 ) without loss of generality. Therefore,

Proof of Theorem E.1. By Lemma E.7 and Lemma E.8.

F Fine estimation for Erdős-Rényi random graphs

From Appendix D, we have a a constant multiplicative approximation of the expected average degree 𝑑 ◦ . In this section, we show how to use this coarse estimate to obtain our fine estimate for Erdős-Rényi random graphs.

Theorem F.1 (Fine estimation for Erdős-Rényi random graphs) . There are constants 𝐶 1 , 𝐶 2 , 𝐶 3 such that the following holds. For any 𝜂 ⩽ 𝐶 1 , 𝜀 ⩾ 𝐶 2 log ( 𝑛 )/ 𝑛 , and 𝑑 ◦ ⩾ 𝐶 3 , there exists a polynomial-time 𝜀 -differentially node private algorithm which, given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and a constant-factor approximation of 𝑑 ◦ , outputs an estimate ˜ 𝑑 satisfying

with probability 1 -𝑛 -Ω ( 1 ) .

We make a few remarks on Theorem F.1.

Our algorithm in Theorem F.1 is an sum-of-squares exponential mechanism. 𝑅, 𝜂 , 𝜀 are parameters given as input to our algorithm.

We can get an estimate of 𝑝 ◦ by taking ˆ 𝑝 = ˆ 𝑑 𝑛 -1 . Since ˆ 𝑝 𝑝 ◦ = ˆ 𝑑 𝑑 ◦ , it follows that

Combining Theorem D.1 and Theorem F.1 gives us an efficient, private, and robust edge density estimation algorithm for Erdős-Rényi random graphs whose utility guarantee is information-theoretically optimal up to a factor of log 𝑛 .

In Appendix F.1, we set up polynomial systems that our algorithm uses and prove useful sos inequalities. In Appendix F.2, we show that we can easily obtain a robust algorithm via sos proofs in Appendix F.1. Then in Appendix F.3, we describe our algorithm and prove Theorem F.1.

F.1 Sum-of-squares

For an adjacency matrix 𝐴 and nonnegative scalars 𝛾 , 𝜎 and ˆ 𝑑 , consider the following polynomial systems with indeterminates 𝑌 = ( 𝑌𝑖𝑗 ) 𝑖,𝑗 ∈[ 𝑛 ] , 𝑧 = ( 𝑧 𝑖 ) 𝑖 ∈[ 𝑛 ] and coefficients that depend on 𝐴, 𝛾 , 𝜎 , 𝛿 , ˆ 𝑑 :

  For convenience of notation, we will consider the following combined polynomial system in remaining of the section

Lemma F.2. If ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , 𝛿 , ˆ 𝑑 ) and 𝛾 + 𝛾 ∗ < 1 , then it follows that

.

Proof. Let 𝑤 = 𝑧 ⊙ 𝑧 ∗ . Notice that, by Lemma A.9, we have ℰ 4 𝑧 1 -𝑤𝑖 ⩽ 2 -𝑧 𝑖 -𝑧 ∗ 𝑖 for all 𝑖 ∈ [ 𝑛 ] . Moreover, using similar analysis as in the proof of Lemma D.2, it follows that

Therefore, we can get

By rearranging terms, we can get

We bound the two terms on the right-hand side separately. For the first term ⟨ 𝑌 -𝑑 ( 𝑌 ) 𝑛 𝟙𝟙 ⊤ , 𝟙𝟙 ⊤ -𝑤𝑤 ⊤ ⟩ , we have

From constraints |( 𝑌 𝟙 ) 𝑖 -𝑑 ( 𝑌 )| ⩽ 𝜎 p ˆ 𝑑 for all 𝑖 ∈ [ 𝑛 ] , ⟨ 𝟙 , 𝑧 ⟩ ⩾ ( 1 -𝛾 ) 𝑛 and ⟨ 𝟙 , 𝑧 ∗ ⟩ ⩾ ( 1 -𝛾 ∗ ) 𝑛 , we have

From constraints GLYPH<13> GLYPH<13> GLYPH<13> 𝑌 -𝑑 ( 𝑌 ) 𝑛 𝟙𝟙 ⊤ GLYPH<13> GLYPH<13> GLYPH<13> op ⩽ 𝛿 p ˆ 𝑑 , ⟨ 𝟙 , 𝑧 ⟩ ⩾ ( 1 -𝛾 ) 𝑛 and ⟨ 𝟙 , 𝑧 ∗ ⟩ ⩾ ( 1 -𝛾 ∗ ) 𝑛 , we have

where the equality is because ℰ 2 𝑧 ( 1 -𝑤𝑖 ) 2 = ( 1 -𝑧 𝑖 𝑧 ∗ 𝑖 ) 2 = 1 -𝑧 𝑖 𝑧 ∗ 𝑖 = 1 -𝑤𝑖 . Plugging Eq. (F.7) and Eq. (F.8) into Eq. (F.6), it follows that

For the second term ⟨ 𝑑 ( 𝐴 ∗ ) 𝑛 𝟙𝟙 ⊤ -𝐴 ∗ , 𝟙𝟙 ⊤ -𝑤𝑤 ⊤ ⟩ , we can apply the same proof as above to get

Plugging Eq. (F.9) and Eq. (F.10) into Eq. (F.5), it follows that

Using the same proof strategy, we can also get

Applying Lemma A.10, it follows that

Now, we would like to lower bound ⟨ 𝟙 , 𝑤 ⟩ 4 . By Lemma A.9, we have ℰ 4 𝑧 𝑤𝑖 ⩾ 𝑧 𝑖 + 𝑧 ∗ 𝑖 -1 for all 𝑖 ∈ [ 𝑛 ] . Therefore,

Since 𝛾 + 𝛾 ∗ < 1, we have 1 -𝛾 -𝛾 ∗ > 0, and, therefore,

Plugging this into Eq. (F.11), we have

Applying Lemma A.11, it follows that

Lemma F.3. Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ 𝑛 ) . With probability 1 -𝑛 -Ω ( 1 ) , there exists 𝐴 ∗ and 𝑧 ∗ such that

| 𝑑 ( 𝐴 ∗ ) -𝑑 ◦ | ⩽ 10 q 𝑑 ◦ log 𝑛 𝑛 .

( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , 𝛿 , ˆ 𝑑 ) with 𝛾 = 𝜂 , 𝜎 = 4log 𝑛 , 𝛿 = 4 𝐶 p log 𝑛 for some constant 𝐶 and ˆ 𝑑 ⩾ 1 2 𝑑 ◦ .

Proof. Let 𝑨 ◦ be the adjacency matrix of 𝑮 ◦ and 𝑧 ◦ ∈ { 0 , 1 } 𝑛 denote the set of uncorrupted nodes ( 𝑧 ◦ 𝑖 = 1 if and only if node 𝑖 is uncorrupted).We will show that 𝐴 ∗ = 𝑨 ◦ and 𝑧 ∗ = 𝑧 ◦ satisfies the lemma.

Guarantee 1. By Lemma B.1, we know that, with probability 1 -𝑛 -Ω ( 1 ) ,

Guarantee 2. It is easy to check that 𝑧 ∗ ⊙ 𝑧 ∗ = 𝑧 ∗ , 0 ⩽ 𝐴 ∗ ⩽ 𝟙𝟙 ⊤ , 𝐴 ∗ = ( 𝐴 ∗ ) ⊤ and ⟨ 𝟙 , 𝑧 ∗ ⟩ ⩾ 1 -𝜂 𝑛 . By Lemma B.2, we know that, with probability 1 -𝑛 -Ω ( 1 ) ,

Combining Eq. (F.12) and Eq. (F.13), we have

Therefore, for 𝜎 = 4 log 𝑛 and ˆ 𝑑 ⩾ 1 2 𝑑 ◦ , it follows that

for all 𝑖 ∈ [ 𝑛 ] .

By Lemma B.5, we know that, with probability 1 -𝑛 -Ω ( 1 ) , for some universal constant 𝐶 ,

Combining Eq. (F.12) and Eq. (F.15), we have

Therefore, for 𝛿 = 4 𝐶 p log 𝑛 and ˆ 𝑑 ⩾ 1 2 𝑑 ◦ , it follows that

Thus, ( 𝐴 ∗ , 𝑧 ∗ ) is a feasible solution to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , 𝛿 , ˆ 𝑑 ) with 𝛾 = 𝜂 , 𝜎 = 4log 𝑛 , 𝛿 = 4 𝐶 p log 𝑛 and ˆ 𝑑 ⩾ 1 2 𝑑 ◦ . □

F.2 Robust algorithm

In this section, we show that the following algorithm based on sum-of-squares proofs in Appendix F.1 obtains a robust approximation of 𝑑 ◦ that is optimal up to logarithmic factors.

Algorithm F.4 (Robust fine estimation algorithm for Erdős-Rényi random graphs) . Input: 𝜂 -corrupted adjacency matrix 𝐴 and corruption fraction 𝜂 .

Algorithm:

Obtain coarse estimator ˆ 𝑑 by applying Algorithm D.4 with 𝐴, 𝜂 , 𝑅 = 1 as input.

Obtain level-8 pseudo-expectation ˜ 𝔼 by solving sum-of-squares relaxation of program ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , 𝛿 , ˆ 𝑑 ) (defined in Eq. (F.3)) with 𝐴 , 𝛾 = 𝜂 , 𝜎 = 4log 𝑛 , 𝛿 = 4 𝐶 p log 𝑛 and ˆ 𝑑 .

Output: ˜ 𝔼 [ 𝑑 ( 𝑌 )]

Theorem F.5 (Robust fine estimation for Erdős-Rényi random graphs) . Let 𝐴 be an 𝜂 -corrupted adjacency matrix of a random graph 𝑮 ◦ ∼ 𝔾 ( 𝑛, 𝑑 ◦ 𝑛 ) . With probability 1 -𝑛 -Ω ( 1 ) , Algorithm F.4 outputs an estimate ˜ 𝑑 satisfying

Proof. By Theorem D.5, we have 1 2 𝑑 ◦ ⩽ ˆ 𝑑 ⩽ 3 2 𝑑 ◦ . Let 𝛾 ∗ = 𝜂 , by Lemma F.2 and Lemma F.3, it follows that

for some constant 𝐶 ′ , and,

Therefore, we have

Thus, the level-8 pseudo-expectation ˜ 𝔼 satisfies

which implies that

F.3 Private algorithm

In this section, we present our algorithm and prove Theorem F.1. Our algorithm instantiates the sum-of-squares exponential mechanism in Appendix C.

Score function. For an 𝑛 -by𝑛 symmetric matrix 𝐴 and a scalar 𝑑 , we define the score of 𝑑 with regard to 𝐴 to be

where ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 , 𝜎 , 𝛿 , ˆ 𝑑 ) is the polynomial system defined in Eq. (F.3), ˆ 𝑑 is a coarse estimate, and 𝜎 , 𝛿 , 𝛼 are fixed parameters whose values will be decided later. Note that ( 𝑌 = 𝑑 𝑛 𝟙𝟙 ⊤ , 𝑧 = 𝟘 ) is a solution to the polynomial system ℰ( 𝑌, 𝑧 ; 𝐴, 1 , 𝜎 , 𝛿 , ˆ 𝑑 ) ∪ {| 𝑑 ( 𝑌 )/ 𝑑 -1 | ⩽ 𝛼 } for any 𝐴 ∈ ℝ 𝑛 × 𝑛 and any 𝑑 ∈ [ 0 , 𝑛 ] .

To efficiently compute 𝑠 ( 𝑑 ; 𝐴 ) , we can use the scheme as described in Remark C.1.

Exponential mechanism. Given a privacy parameter 𝜀 and an 𝑛 -by𝑛 symmetric matrix 𝐴 , our private algorithm in Theorem F.1 is the exponential mechanism with score function Eq. (F.17) and range [ 0 , 𝑛 ] .

Algorithm F.6 (Fine estimation for Erdős-Rényi random graphs) .

Input: Graph 𝐴 , coarse estimate ˆ 𝑑 .

Parameters: 𝜀 , 𝜎 , 𝛿 , 𝛼 .

Output: Asample from the distribution 𝜇 𝐴, 𝜀 with support [ 0 , 𝑛 ] and density

where 𝑠 ( 𝑑 ; 𝐴 ) is defined in Eq. (F.17).

To efficiently sample from 𝜇 𝐴, 𝜀 , we can use the scheme as described in Remark C.2.

Privacy. The following privacy guarantee of our algorithm is a direct corollary of Lemma C.4.

Lemma F.7 (Privacy) . Algorithm F.6 is 2 𝜀 -differentially node private.

□

Utility. The utility guarantee of our algorithm is stated in the following lemma.

Lemma F.8 (Utility) . There are constants 𝐶 1 , 𝐶 2 , 𝐶 3 such that the following holds. For any 𝜂 ⩽ 𝐶 1 , 𝜀 ⩾ 𝐶 2 log ( 𝑛 )/ 𝑛 , and 𝑑 ◦ ⩾ 𝐶 3 , given an 𝜂 -corrupted Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) and a coarse estimate ˆ 𝑑 such that 0 . 5 𝑑 ◦ ⩽ ˆ 𝑑 ⩽ 2 𝑑 ◦ , Algorithm F.6 outputs an estimate ˜ 𝑑 satisfying

with probability 1 -𝑛 -Ω ( 1 ) .

Before proving Lemma F.8, we need the following two lemmas.

Lemma F.9 (Volume of low-score points) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and 𝜀 > 0 . Consider the distribution 𝜇 𝐴, 𝜀 defined by Eq. (F.18) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ ) and 𝑑 ( 𝐴 ∗ ) ⩾ 2 . Then for any 𝑡 ⩾ 0 ,

Proof. Apply Lemma C.5 with 𝒟 = [ 0 , 𝑛 ] and

As [ 𝑑 ( 𝐴 ∗ )/( 1 + 𝛼 ) , 𝑑 ( 𝐴 ∗ )] ⊆ 𝒢( 𝐴 ∗ ) and 𝑑 ( 𝐴 ∗ ) ⩾ 2 ⩾ 1 + 𝛼 , we have vol (𝒢( 𝐴 ∗ )) ⩾ 𝛼 . □

Lemma F.10 (Low score implies utility) . Let 𝐴 ∈ ℝ 𝑛 × 𝑛 and consider the score function 𝑠 (· ; 𝐴 ) defined in Eq. (F.17) . Suppose ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) is a solution to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ ) . For a scalar 𝑑 such that 𝑠 ( 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 and 𝛾 ∗ + 𝜏 ⩽ 0 . 1 ,

Proof. Applying Lemma F.2 with 𝛾 ∗ + 𝜏 ⩽ 0 . 1, we have

Thus,

Now we are ready to prove Lemma F.8.

Proof of Lemma F.8. Let 𝐴 be a realization of 𝜂 -corrupted 𝔾 ( 𝑛, 𝑑 ◦ / 𝑛 ) . By Lemma F.3, the following event happens with probability at least 1 -𝑛 -Ω ( 1 ) . There exists a solution ( 𝑌 = 𝐴 ∗ , 𝑧 = 𝑧 ∗ ) to ℰ( 𝑌, 𝑧 ; 𝐴, 𝛾 ∗ , 𝜎 , 𝛿 , ˆ 𝑑 ) where 𝛾 ∗ = 𝜂 , 𝜎 ⩽ 𝑂 ( log 𝑛 ) , 𝛿 ⩽ 𝑂 ( p log 𝑛 ) , and | 𝑑 ( 𝐴 ∗ ) -𝑑 ◦ | ⩽ 𝑂 GLYPH<16> p 𝑑 ◦ log ( 𝑛 )/ 𝑛 GLYPH<17> .

As 𝑑 ( 𝐴 ∗ ) ⩾ 0 . 9 𝑑 ◦ ⩾ 2, then it follows by setting 𝑡 = 10 and 𝛼 = 𝑛 -2 in Lemma F.9 that,

Let ˜ 𝑑 be a scalar such that 𝑠 ( ˜ 𝑑 ; 𝐴 ) ⩽ 𝜏 𝑛 . For 𝜂 and log ( 𝑛 )/( 𝜀 𝑛 ) smaller than some constant, we have 2 𝜂 + 𝜏 ⩽ 0 . 1. Then by Lemma F.10,

Plugging in everything, we have

Proof of Theorem F.1. By Lemma F.7 and Lemma F.8.

G Lower bounds

In this section, we prove Theorem 1.5, Theorem 1.7, and Theorem 1.8.

G.1 Lower bound for Erdős-Rényi random graphs

In this section, we prove Theorem 1.5.

Theorem (Restatement of Theorem 1.5) . Suppose there is an 𝜀 -differentially node-private algorithm that, given an Erdős-Rényi random graph 𝔾 ( 𝑛, 𝑝 ◦ ) , outputs an estimate ˜ 𝑝 satisfying | ˜ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability 1 -𝛽 . Then we must have

We leave the formal proof of Theorem 1.5 to the end of this section. Now we sketch the proof idea. One natural idea to prove this theorem is to construct a coupling 𝜔 of 𝔾 ( 𝑛, 𝑝 ◦ ) and 𝔾 ( 𝑛, ( 1 -2 𝛼 ) 𝑝 ◦ ) such that for ( 𝑮 , 𝑮 ′ ) ∼ 𝜔 , the typical distance between 𝑮 and 𝑮 ′ can be well controlled. However, such a coupling is tricky to construct directly, as the node degrees in an Erdős-Rényi random graph are not independent. To avoid dealing with such dependence, we instead consider the directed Erdős-Rényi random graphs, which is inspired by the proof of [AJK + 22, Theorem 1.5]. The directed Erdős-Rényi random graph model, denoted by ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) , is a distribution over 𝑛 -node directed graphs where each edge ( 𝑖, 𝑗 ) is present with probability 𝑝 ◦ independently. Since the outdegrees in a directed Erdős-Rényi random graph are i.i.d. Binomial random variables, it is not so difficult to construct a coupling of ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) and ˜ 𝔾 ( 𝑛, ( 1 -2 𝛼 ) 𝑝 ◦ ) . Then we can convert such a coupling into a coupling of 𝔾 ( 𝑛, 𝑝 ◦ ) and 𝔾 ( 𝑛, ( 1 -2 𝛼 ) 𝑝 ◦ ) .

Lemma G.1 (Coupling) . Let 𝑝 ◦ ∈ [ 0 , 1 ] , 𝛼 ∈ [ 0 , 1 / 2 ] , and 𝑝 ′ : = ( 1 -2 𝛼 ) 𝑝 ◦ . There exists a coupling 𝜔 of 𝔾 ( 𝑛, 𝑝 ◦ ) and 𝔾 ( 𝑛, 𝑝 ′ ) with the following property. For ( 𝑮 , 𝑮 ′ ) ∼ 𝜔 , the distribution of dist ( 𝑮 , 𝑮 ′ ) is the binomial distribution Bin ( 𝑛, Δ ) where Δ = TV ( Bin ( 𝑛, 𝑝 ◦ ) , Bin ( 𝑛, 𝑝 ′ )) . Moreover, if 𝑝 ◦ ⩽ 𝑐 and 𝛼 ⩽ 𝑐 ′ / √ 𝑛𝑝 ◦ for some constants 𝑐, 𝑐 ′ , then Δ ≲ 𝛼 √ 𝑛𝑝 ◦ .

Proof. We first show that it suffices to construct a coupling of ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) and ˜ 𝔾 ( 𝑛, 𝑝 ′ ) . For a directed graph ˜ 𝐺 , it can be converted into an undirected graph 𝑈 ( ˜ 𝐺 ) by letting { 𝑖, 𝑗 } ∈ 𝑈 ( ˜ 𝐺 ) iff 𝑖 ⩽ 𝑗 and ( 𝑖, 𝑗 ) ∈ ˜ 𝐺 . It is easy to see that 10 dist ( ˜ 𝐺, ˜ 𝐺 ′ ) = dist ( 𝑈 ( ˜ 𝐺 ) , 𝑈 ( ˜ 𝐺 ′ )) . Also observe that if ˜ 𝑮 ∼ ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) then 𝑈 ( ˜ 𝑮 ) ∼ 𝔾 ( 𝑛, 𝑝 ◦ ) . Therefore, a coupling ˜ 𝜔 of ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) and ˜ 𝔾 ( 𝑛, 𝑝 ′ ) can be easily converted in to a coupling 𝜔 of 𝔾 ( 𝑛, 𝑝 ◦ ) and 𝔾 ( 𝑛, 𝑝 ′ ) such that, for ( ˜ 𝑮 , ˜ 𝑮 ′ ) ∼ ˜ 𝜔 and ( 𝑮 , 𝑮 ′ ) ∼ 𝜔 , we have

Now we construct a coupling of ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) and ˜ 𝔾 ( 𝑛, 𝑝 ′ ) . Instead of sampling each edge independently, an equivalent way to sample from ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) is as follows. For each 𝑖 ∈ [ 𝑛 ] :

Then

Sample an outdegree 𝒅 ∼ Bin ( 𝑛, 𝑝 ◦ ) .

Sample a uniformly random subset 𝑺 ⊆ [ 𝑛 ] of size 𝒅 . For each 𝑗 ∈ 𝑺 , add an edge from 𝑖 to 𝑗 .

Then it is easy to see there exists a coupling ˜ 𝜔 of ˜ 𝔾 ( 𝑛, 𝑝 ◦ ) and ˜ 𝔾 ( 𝑛, 𝑝 ′ ) such that if ( ˜ 𝑮 , ˜ 𝑮 ′ ) ∼ ˜ 𝜔 then dist ( ˜ 𝑮 , ˜ 𝑮 ′ ) ∼ Bin ( 𝑛, Δ ) where

We have the following bound on the total variation between binomial distributions (see e.g. [AJ06, Equation (2.15)]). For 0 < 𝑝 < 1 and 0 < 𝑥 < 1 -𝑝 ,

√

where 𝜏 ( 𝑥 ) : = 𝑥 q 𝑁 + 2 2 𝑝 ( 1 -𝑝 ) , provided 𝜏 ( 𝑥 ) < 1. Plugging in 𝑁 = 𝑛 , 𝑝 = 𝑝 ◦ , and 𝑥 = 2 𝛼 𝑝 ◦ , we have provided 𝑝 ◦ ⩽ 𝑐 and 𝛼 ⩽ 𝑐 ′ / √ 𝑛𝑝 ◦ for sufficiently small absolute constants 𝑐, 𝑐 ′ . □

Proof of Theorem 1.5. Let 𝒜 be an algorithm satisfying the theorem's assumptions. Let 𝑝 ′ : = ( 1 -2 𝛼 ) 𝑝 ◦ . Let 𝜔 be a coupling of 𝔾 ( 𝑛, 𝑝 ◦ ) and 𝔾 ( 𝑛, 𝑝 ′ ) as guaranteed by Lemma G.1. Then for ( 𝑮 , 𝑮 ′ ) ∼ 𝜔 , we have dist ( 𝑮 , 𝑮 ′ ) ∼ Bin ( 𝑛, Δ ) where Δ = TV ( Bin ( 𝑛, 𝑝 ◦ ) , Bin ( 𝑛, 𝑝 ′ )) .

By the utility assumption of algorithm 𝒜 ,

As algorithm 𝒜 is 𝜀 -DP, we have for any graphs 𝐺, 𝐺 ′ that,

Taking expectation w.r.t. the coupling 𝜔 on both sides gives

By the utility assumption of algorithm 𝒜 and 𝑝 ′ < 𝑝 ◦ , the left-hand side of Eq. (G.1) is at least 1 -𝛽 . Using the Cauchy-Schwartz inequality, the right-hand side of Eq. (G.1) can be upper bounded as follows,

By squaring both sides of Eq. (G.1) and plugging in the above two bounds, we have

Using the formula for the moment generating function of binomial distributions, we have

Since 𝑝 ′ -𝑝 ◦ = 2 𝛼 𝑝 ◦ , the two events { ˆ 𝑝 : | ˆ 𝑝 -𝑝 ◦ | < 𝛼 𝑝 ◦ } and { ˆ 𝑝 : | ˆ 𝑝 -𝑝 ′ | < 𝛼 𝑝 ◦ } are disjoint. Thus,

Therefore, we have the following lower bound

which is Δ ≳ log ( 1 / 𝛽 ) 𝑛 𝜀 for samll enough 𝜀 and 𝛽 .

By Lemma G.1, if 𝑝 ◦ ⩽ 𝑐 and 𝛼 ⩽ 𝑐 ′ / √ 𝑛𝑝 ◦ for some constants 𝑐, 𝑐 ′ , then Δ ≲ 𝛼 √ 𝑛𝑝 ◦ . Combined with the lower bound Δ ≳ log ( 1 / 𝛽 ) 𝑛 𝜀 , we have

G.2 Lower bound for inhomogeneous random graphs

In this section, we prove Theorem 1.7 and Theorem 1.8.

We first show the lower bound for the error rate of robust estimation.

Theorem (Restatement of Theorem 1.7) . Suppose there is an algorithm satisfies the following guarantee for any symmetric matrix 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 . Given an 𝜂 -corrupted inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , the algorithm outputs an estimate ˆ 𝑝 satisfying | ˆ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability at least 0 . 99 , where 𝑝 ◦ = ˝ 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 /( 𝑛 2 -𝑛 ) . Then we must have 𝛼 ⩾ Ω ( 𝑅 𝜂 ) , where 𝑅 = max 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 / 𝑝 ◦ .

Proof. Let 𝑝 ◦ ∈ [ 0 , 1 ] , and let 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 be the matrix, in which all entries are 𝑝 ◦ , except for the rows and columns corresponding to a set of 𝜂 𝑛 nodes setting to be 𝑅𝑝 ◦ . Let 𝑄 be the matrix, in which all entries are 𝑝 ◦ , except for the rows and columns corresponding to a set of 𝜂 𝑛 nodes setting to be 0.

We construct the following pair of distributions 𝒟 0 and 𝒟 1 :

𝒟 0 : The distribution of 𝑮 ∼ 𝔾 ( 𝑄 ◦ ) .

𝒟 1 : The distribution of 𝑮 ∼ 𝔾 ( 𝑄 ) .

Then we have 1 𝑛 2 | ∥ 𝑄 ◦ ∥ 1 - ∥ 𝑄 ∥ 1 | ⩾ Ω ( 𝑅 𝜂 𝑛 2 𝑝 ◦ ) .

On the other hand, there is a coupling between ˜ 𝐺 ∼ 𝔾 ( 𝑄 ◦ ) and ˜ 𝐺 ′ ∼ 𝔾 ( 𝑄 ) such that dist ( ˜ 𝐺, ˜ 𝐺 ′ ) ⩽ 𝜂 𝑛 . Therefore, the two distributions are indistinguishable under the 𝜂 -corruption model. Since the edge density of 𝔾 ( 𝑄 ◦ ) differs from 𝔾 ( 𝑄 ) by Ω ( 𝑅 𝜂 𝑝 ◦ ) , no algorithm can achieve error rate 𝑜 ( 𝑅 𝜂 𝑝 ◦ ) with probability 1 -𝑜 ( 1 ) for both distributions under the corruption of 𝜂 -fraction of the nodes. □

Theorem (Restatement of Theorem 1.8) . Suppose there is an 𝜀 -differentially node-private algorithm satisfies the following guarantee for any symmetric matrix 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 . Given an inhomogeneous random graph 𝔾 ( 𝑛, 𝑄 ◦ ) , the algorithm outputs an estimate ˆ 𝑝 satisfying | ˆ 𝑝 / 𝑝 ◦ -1 | ⩽ 𝛼 with probability 1 -𝛽 , where 𝑝 ◦ = ˝ 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 /( 𝑛 2 -𝑛 ) . Then we must have

where 𝑅 = max 𝑖,𝑗 𝑄 ◦ 𝑖𝑗 / 𝑝 ◦ .

□

Proof of Theorem 1.8. We will prove the lower bound by constructing a pair of distributions 𝒟 0 and 𝒟 1 such that the total variation distance between them is small, but the difference in edge density is significant. Then since 𝜀 -differentially node-private algorithm needs to have similar distributions in the output, it could not succeed in accurately estimating the edge density accurately under both distributions.

Let 𝜂 ∈ [ 0 , 0 . 001 ) . Let 𝑝 ◦ ∈ [ 0 , 1 ] , and let 𝑄 ◦ ∈ [ 0 , 1 ] 𝑛 × 𝑛 be the matrix, in which all entries are 𝑝 ◦ , except for the rows and columns corresponding to a set of 𝜂 𝑛 nodes setting to be 0. Let 𝑄 be the matrix, in which all entries are 𝑝 ◦ , except for the rows and columns corresponding to a set of 𝜂 𝑛 nodes setting to be 𝑅𝑝 ◦ .

We construct the following pair of distributions 𝒟 0 and 𝒟 1 :

𝒟 0 : The distribution of 𝑮 ∼ 𝔾 ( 𝑄 ◦ ) .

𝒟 1 : The distribution of 𝑮 ∼ 𝔾 ( 𝑄 ) .

On the other hand, there is a coupling between ˜ 𝐺 ∼ 𝔾 ( 𝑄 ) and ˜ 𝐺 ′ ∼ 𝔾 ( 𝑄 ◦ ) such that dist ( ˜ 𝐺, ˜ 𝐺 ′ ) ⩽ 𝜂 𝑛 . Taking expectation w.r.t. the coupling 𝜔 on both sides gives

By the utility assumption of algorithm 𝒜 and 𝑝 < 𝑝 ◦ , the left-hand side is at least 1 -𝛽 . Using the Cauchy-Schwartz inequality, the right-hand side can be upper bounded as follows,

Thus

Then

Since | 𝑝 -𝑝 ◦ | ⩾ 𝑅 𝜂 𝑝 ◦ , the two events { ˆ 𝑝 : | ˆ 𝑝 -𝑝 ◦ | < 𝑅 𝜂 2 𝑝 ◦ } and { ˆ 𝑝 : | ˆ 𝑝 -𝑝 | < 𝑅 𝜂 2 𝑝 ◦ } are disjoint, which implies

Therefore, we have 𝛽 ⩾ ( 1 -𝛽 ) 2 exp (-𝜀𝜂 𝑛 ) . As result, we need to have 𝜂 ⩾ Ω GLYPH<16> log ( 𝛽 ) 𝜀 𝑛 GLYPH<17> . Thus we have

Since 𝑝 ◦ ⩾ 𝑝 ′ , it follows that which finishes the proof.

□

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We have formal proofs for what we claim in the abstract and introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

Theabstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. ANoor NA answer to this question will not be perceived well by the reviewers.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We prove matching upper and lower bounds of error rate. We show polynomial running time of our algorithm.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors are encouraged to create a separate "Limitations" section in their paper.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We state everything formally and provide full proofs. When we say something intuitive and informal, we always have formal counterparts in the appendices.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All assumptions should be clearly stated or referenced in the statement of any theorems.

All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Theorems and Lemmas that the proof relies upon should be properly referenced.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [NA]

Justification: Our paper does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [NA]

Justification: This paper does not include experiments requiring code.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

Please see the NeurIPS code and data submission guidelines ( https://nips. cc/public/guides/CodeSubmissionPolicy ) for more details.

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https://nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [NA]

Justification: This is a theoretical paper that does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The full details can be provided either with the code, in appendix, or as supplemental material.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [NA]

Justification: This is a theoretical paper that does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

The assumptions made should be given (e.g., Normally distributed errors).

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [NA]

Justification: This is a theoretical paper that does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The authors conform, in every respect, with the NeurIPS Code of Ethics while writing this paper.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: This is a theoretical paper on random graph estimation that does not have societal impact.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: This is a theoretical paper that does not poses such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [NA]

Justification: This is a theoretical paper that does not use existing assets. Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should state which version of the asset is used and, if possible, include a URL.

The authors should cite the original paper that produced the code package or dataset.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: This is a theoretical paper that does not involve new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

The paper should discuss whether and how consent was obtained from people whose asset is used.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: This is a theoretical paper that does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: This is a theoretical paper that does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies edge density estimation for Erdos-Renyi random graph under node-level differential privacy. They then show that their approach can actually be used to estimating edge density for inhomogeneous graphs. In particular, this paper proposes an efficient algorithm with optimal privacy cost $O(1/(\\varepsilon n \\sqrt{np}))$, which is negligible to the non-private error for any epsilon in a moderate regime. To achieve this, the main technical approach in this paper is to design a new sum-of-squares algorithm for robust edge density estimation, and then based on the reduction from privacy to robustness in Hopkins et al., this paper uses an exponential mechanism whose score function is based on the correspoinding the sum-of-squares program.\n\nTo design a robust algorithm for edge density estimation of ER random graphs, this paper established several polynomial constraints to ensure that a ER random graph will satisfy with high probability. The proof that if a graph meets these constraints, its average degree will remain close to $d$ is straightforward enough for the sum-of-squares proof system, extends the utility guarantee of the polynomial program to its semidefinite programming relaxation, resulting in a polynomial-time robust algorithm.\n\nSTRENGTHS:\n1. Graph parameter approximation under node-level privacy is an important topic, and this paper gives optimal algorithm with a polynomial time implementation by sum-of-squares relaxation, under the most natrual setting of random graphs.\n2. Their techniques of using sum-of-squares method for exponential mechanism is sophisticated.\n3. All theorems are clearly stated and technically correct.\n\nWEAKNESSES:\nAs far as I can see, the most relevant work is Chen et al. \"Private graphon estimation via sum-of-squares\", but it appears to me that this paper lacks discussion and comparison in [Chen et al.]. Please see \"Questions\" for details. I would be happy to raise my score if all my questions are adressed.\n\nQUESTIONS:\n1. Could you please elaborate on which part of your proof technique deviates from that in [Chen et al.]? Alternatively, are the proof techniques similar, while you are just addressing different problems in this paper?\n2. There is also a theorem in [Chen et al.] for edge density estimation of stochastic block random graphs (Lemma 4.10), and it appears that their utility is better. Could you explain the fundamental obstacle between stochastic block random graphs and the more general inhomogeneous graphs that prevents the estimation for inhomogeneous graphs from achieving results as good as those for stochastic block random graphs? Would you mind adding more discussion about the results in [Chen et al.]?\n\nLIMITATIONS:\nThis paper discusses several limitations.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-28"}

comments: SUMMARY:
The authors propose a robust and efficient (polynomial time) algorithm to estimate the edge density of Erdos-Renyi graph, which achieves optimal error up to logarithmic factors. The authors also design an optimal algorithm for inhomogenous graphs where edges are drawn iid from different Bern(p_i).

STRENGTHS:
1. The theoretical results are very strong. The authors prove matching (up to logarithmic factors) error bounds for both Inhomogeneous and Erdos-Renyi graphs. The algorithms are polynomial-time.
2. The techniques are interesting. The authors use recent results for the connection between privacy and robustness. To design a time-efficient algorithm, the authors go beyond simple reduction from privacy to robustness and apply the sum-of-squares method.
3. The paper is well-written.

WEAKNESSES:
There is no obvious weakness with regard to the results and technical parts of the paper. The only minor weaknesses are the problem formulation.
1. Both the Erdos-Renyi graph and the inhomogeneous model assume edges are independently chosen. In real applications, graphs are often fixed, and edges may not be independent.
2. The algorithm only works for edge density estimation. There should be many other interesting graph statistics, even on the Erdos-Renyi graph.

QUESTIONS:
1. Is it possible to design algorithms when the entries of the connection probability matrix are not independent?
2. Do any algorithmic ideas translate to other graph statistics like the number of triangles and k-stars?

LIMITATIONS:
Limitations and negative social impact are adequately addressed.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-12

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper gives the first polynomial time DP algorithm for estimating edge density of random graphs (Erdos-Renyi and inhomogeneous). The authors also give information-theoretic lower bounds to show that the error achieved is optimal (up to log factors). The paper utilizes the recent results of Hopkins et al who gave a black box reduction from privacy to robustness via a sum-of-squares exponential mechanism to design their new algorithm. Their main new contribution is a sum-of-squares algorithm for estimating the edge density which they then use together with the Hopkins et al framework to get their final algorithm.\n\nSTRENGTHS:\nThe main result of the paper is novel and significantly advances the area of DP algorithms for estimating graph parameters in random graphs.\n\nWEAKNESSES:\nThe techniques used heavily rely on the recent framework given by the Hopkins et al STOC paper. What is unclear to me is --- what were the challenges in designing the sum-of-squares algorithm for estimating the edge density? Since this algorithm is the main contribution of the paper in some sense, I would like to understand better if the design of the sum-of-squares algorithm itself was previously known and one only needed the Hopkins et al framework to obtain this result.\nGeneral comment about the paper --- you should define the quantity edge density formally somewhere since the whole paper hinges on the reader understanding what it is.\n\nQUESTIONS:\nThe results of this paper are very important and exciting. However, can you expand on the challenges in designing the sum-of-squares algorithm for estimating the edge density? I would like to be more convinced that this result is not simply piggybacking off on the Hopkins et al result. Thanks!\n\nLIMITATIONS:\nThere was no explicit discussion regarding the limitations of this work in the main body.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a sum-of-squares-based polynomial-time differentially node-private algorithm for estimating the edge density of Erdos-Renyi random graphs that achieves optimal accuracy; the algorithm is simultaneously robust to corruptions. Specifically, if p is the true Erdos-Renyi parameter, then the estimate q released by the algorithm has error |q/p - 1| bounded by 1/(n sqrt{p}) + 1/(eps n \\sqrt{np}) + eta / sqrt{np} (up to factors of log n), where eta is the corruption rate for robustness. Up to log n factors, the first term is the information-theoretically optimal error rate with neither privacy or robustness (which is also the error of the empirical edge density), and the third term is known to be required for robustness ([AJK+22]). The paper further shows a lower bound demonstrating that the remaining error term is necessary for privacy (a lower bound had been shown by BCSZ18 for a closely related family of random graphs but not for standard Erdos-Renyi graphs, so the new lower bound closes this gap). Moreover, the paper extend this result to present an algorithm for the much more general problem of edge density estimation in inhomogeneous random graphs (e.g. SBMs or graphons) and proves lower bounds in this setting as well showing that this algorithm also achieves optimal error rate up to logarithmic factors.\n\nSTRENGTHS:\nThis paper achieves optimal accuracy in polynomial time for both private and robust edge density estimation of Erdos-Renyi graphs and for the more general setting of inhomogeneous random graphs, nicely closing the gaps from prior work. It achieves this by bringing a new approach to the problem: the sum-of-squares framework, along with leveraging a reduction from privacy to robustness. The paper is generally well-written.\n\nFor DP edge density estimation of Erdos-Renyi graphs (even without requiring robustness), the new algorithm matches the (already optimal) accuracy achieved by [BCSZ18] while running in polynomial time instead of exponential time; it also improves over the rate of the polynomial-time algorithm of [SU19], which was suboptimal in the sparse or very-high-privacy regimes (that is, when epsilon * sqrt{pn} << 1). For robust edge density estimation of Erdos-Renyi graphs (even without requiring privacy), the new algorithm also improves of the accuracy of prior work ([AJK+22]) in the sparse regime. Thus, the Erdos-Renyi result improves on SOTA for both privacy and robustness, achieving the optimal bound (up to log n factors). Moreover, the results are extended to the more challenging inhomogenous random graph setting, achieving optimal rate in polynomial time here as well, and novel, tight lower bounds are shown for both settings as well.\n\nWEAKNESSES:\nThe discussion of prior work is clear for the Erdos-Renyi setting, but it would be useful to have a clearer discussion of what was previously known for the more general inhomogeneous random graph setting under DP and under robustness; see the specific questions 1--2 below.\n\nQUESTIONS:\n1) How does the rate achieved for inhomogeneous random graphs compare to the rate achieved by the exponential-time algorithm of [BCSZ18] for graphons?\n\n2) Is there prior work on robust estimation of general inhomogeneous random graphs, and if so, what rate was achieved?\n\n3) Can we hope to extend the privacy lower bounds (Theorem 1.5 and 1.8) to (epsilon, delta)-DP and not just epsilon-DP?\n\nMinor comment: \nline 188: should d^\\circ be defined as (n-1) p^\\circ instead of n p^\\circ?\n\nLIMITATIONS:\nYes, adequately addressed.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-15"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper concerns the graph density estimation question for random Erdos-Renyi graphs. The optimal algorithm, without additional constraints, for this problem is to output the density of edges in the graph.\n\nThe paper considers a node-private robust flavor of the question, however:\n\n1. The output is not supposed to reveal much information about any node. More precisely, for any node, the distribution on estimates the algorithm produces is not supposed to be significantly different whether it is included or not. (This task is much easier to achieve in the edge privacy model.)\n\n2. The algorithm is supposed to be robust, i.e., if the edges involving a small number of vertices are arbitrarily edited, this should not throw the estimate off significantly. (This may require, for instance, disregarding some fraction of vertices that are significantly off.)\n\nThe paper gives a near optimal algorithm in this setting that runs in polynomial time and it establishes asymptotic bounds on the error achieved by the algorithm.\n\nAdditionally, the paper gives an extension of the result to non-homogeneous random graphs.\n\nSTRENGTHS:\nThis is a technically impressive achievement with the paper combining many desirable properties of algorithms for a natural toy problem. This is an interesting result for anyone studying private estimation and private release of graph parameters.\n\nWEAKNESSES:\nThis is not directly a very practical problem, since Erdos-Renyi graphs do not appear frequently in natural contexts and even the generalization assumes that the selection of different edges is independent, which is not true for many models of real-world graphs.\n\nThe algorithm may be difficult to implement and run in practice due to the complexity of tools used, which include semidefinite programming.\n\nQUESTIONS:\nJust to make sure, in the inhomogeneous setting, the algorithm has to know $Q^\\circ$, right? Otherwise, it could be a zero-one matrix equal to the graph adjacency matrix. What guarantees can be given if $Q^\\circ$ is unknown?\n\nLIMITATIONS:\nNo limitations.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-17"}