Paper: Differentially Private One Permutation Hashing (ICLR-2024)

Reviewer comment (Evaluation):
While there is no theoretical utility guarantee shown, it is also hard to evaluate the empirical effectiveness of the proposed algorithm because (a) the non-private baseline is missing (b) it is not clear what it means to downstream machine learning tasks given such precision.

Author response:
Q1 & W2. On the non-private performance: The precision at $\epsilon=50$ (after the curves become flat) essentially equals to the precision of the non-private methods.


Q2 & W2. On the implication of experiments: the task in our experiments is nearest neighbor search with hashing. This is a standard task to evaluate the empirical performance of hashing methods, which demonstrates the utility of different algorithms in terms of Jaccard similarity approximation. Also, nearest neighbor search is itself an important "downstream task" of the hash samples in industrial applications where hashing/sketching methods are widely used for accelerated computation. Thus, our results already show that the proposed methods is advantageous in hashing applications with privacy constraints. We presented our results on three datasets from different domains: biology, image, and web. We hope this is sufficient to justify the benefits of our proposed methods for a variety of applications.

Q4 and W2. On the theoretical utility: As you kindly pointed out, in principle the variance of the (unbiased) Jaccard estimator from DP-OPH can be computed. However, given the already very complicated combinatorial form of the variance of non-private OPH, the expression will be extremely sophisticated also considering the b-bit coding and DP flipping. Thus, a straightforward analytical comparison is hard. In Appendix A of our submission, we present the empirical MSE comparisons of different DP hashing approaches, and we hope these are convincing enough to show the advantages of DP-OPH. Moreover, we know that in general the extra variation brought by DP flipping would be largely determined by $N$, the privacy discount factor in DP-OPH-re and DP-OPH-fix. In Figure 1, we compare the $N$ of difference methods to intuitively show the advantage of the proposed approach in terms of privacy. These comparisons, together with the extensive experiments, show that the proposed algorithms provide better utility.

Reviewer comment (Evaluation):
While attribute-level DP is already a weaker privacy notion, the empirical results show that it requires $\epsilon>5$ to achieve some acceptable precision. Also, any $\epsilon > 20$ can provide extremely limited privacy protection and usually will not be considered in privacy literature.

Author response:
W3. On the value of $\epsilon$: DP has been deployed in a wide range of fields and applications, and the feasible $\epsilon$ depends on the specific use case. For example, in the tutorial [How to dp-fy ml: A
practical guide to machine learning with differential privacy, Ponomareva et al., 2023, Section 5.2] by Google, the researchers defined $\epsilon<10$ as "reasonable privacy protection". For the U.S Census use case [The use of differential privacy for census data and its
impact on redistricting: The case of the 2020 U.S. Census, Kenny et al., 2021], $\epsilon=12.2$ is chosen. The PyTorch tutorial of DP-SGD training set $\epsilon=47.2$ (https://github.com/pytorch/opacus/blob/main/tutorials/building_image_classifier.ipynb). Therefore, depending on the application and privacy requirement, we believe that different $\epsilon$ values in DP-OPH are useful in difference use cases. 

Dear Reviewer zun1,

Thanks for the reply. Our proposed methods in general approach the perormance of non-private counterparts when $\epsilon=5\sim 15$.

In the PyTorch official tutorial on DP-SGD, we see that even with $\epsilon=47$, the resnet accuracy is still way lower than the non-private model. While this is not a formal publication, we think it might still be a good example that $\epsilon$ should really depend on different privacy settings and use cases.

Also, as we mentioned in the rebuttal, the problem of our work (or more generally, many DP sketching methods) is different from many other "algorithm-specific" DP methods, because hashing/sketching is a data-level (sample-wise) privacy mechanism. That said, we find private representations for **every** data sample. Those representations can be used for large-scale search and learning also with DP guarantees. This is in general a harder problem than reporting the summary statistics, for example, the mean and median of a dataset, or the aggregated gradients over a mini-batch as in DP-SGD. If we want to find a conceptually analogous setting in the language of DP-SGD, our privacy model should correspond to DP-SGD with mini-batch size 1 (we protect and use the gradient of every single data sample). In that case, the aggregated DP noise loses the $1/B$ factor (where $B$ is the batch size) and the problem becomes more difficult---we will need an $\epsilon$ even much larger than $47$ to achieve acceptable utility in that pytorch example. We hope our reply helps the reviewer better understand the privacy setting and application scenarios of our work.

We again sincerely appreciate the reviewer for the review and discussion. Thank you and happy thanksgiving.

Reviewer comment (Writing):
The writing of the paper can be improved. For example, $\tilde{f}$ in equation (3) and $N_{emp}$ are never introduced in the main text, which harm the integrity of  the main text.

Author response:
W4. $\tilde f$ is the number of non-zeros in a non-empty bin, which is defined in a lemma in the Appendix. We will clarify in the main paper. Thank you.

Reviewer comment (Experiments):
What is the non-private OPH performance on the same datasets?

Author response:
Q1 & W2. On the non-private performance: The precision at $\epsilon=50$ (after the curves become flat) essentially equals to the precision of the non-private methods.

Reviewer comment (Evaluation):
How useful are the retrieved samples to the downstream tasks with the shown precision?

Author response:
Q2 & W2. On the implication of experiments: the task in our experiments is nearest neighbor search with hashing. This is a standard task to evaluate the empirical performance of hashing methods, which demonstrates the utility of different algorithms in terms of Jaccard similarity approximation. Also, nearest neighbor search is itself an important "downstream task" of the hash samples in industrial applications where hashing/sketching methods are widely used for accelerated computation. Thus, our results already show that the proposed methods is advantageous in hashing applications with privacy constraints. We presented our results on three datasets from different domains: biology, image, and web. We hope this is sufficient to justify the benefits of our proposed methods for a variety of applications.

Reviewer comment (Theory):
Is there any theoretical performance guarantee for the DP OPH algorithms?

Author response:
Q4 and W2. On the theoretical utility: As you kindly pointed out, in principle the variance of the (unbiased) Jaccard estimator from DP-OPH can be computed. However, given the already very complicated combinatorial form of the variance of non-private OPH, the expression will be extremely sophisticated also considering the b-bit coding and DP flipping. Thus, a straightforward analytical comparison is hard. In Appendix A of our submission, we present the empirical MSE comparisons of different DP hashing approaches, and we hope these are convincing enough to show the advantages of DP-OPH. Moreover, we know that in general the extra variation brought by DP flipping would be largely determined by $N$, the privacy discount factor in DP-OPH-re and DP-OPH-fix. In Figure 1, we compare the $N$ of difference methods to intuitively show the advantage of the proposed approach in terms of privacy. These comparisons, together with the extensive experiments, show that the proposed algorithms provide better utility.

Reviewer comment (Theory):
How tight is the proposed privacy splitting compared to the existing sequential composition techniques (e.g., Renyi DP)?

Author response:
Q5. On alternative composition theorems: The analysis of our work is based on two parts: (1) establish a high probability event (with probability $1-\delta$) that the number of changed hashes is smaller than $N$ between any two neighboring data; (2) apply DP composition to the individually pure $\epsilon'$-DP mechanisms for the $N$ hashes. It is known that if in step (2) we don't want to invoke additional failure probability $\delta'$ and stick with pure $\epsilon$-DP after composition, then the basic composition applied in our method is optimal, see, for example, a nice summary and tutorial in [1]. 

[1] Composition of Differential Privacy and Privacy Amplification by Subsampling, Steinke 2022.

Alternatively, we may use other composition theorems, like the advanced composition, or composition theorems induced by concentrated DP or Renyi DP as you kindly mentioned. We have two remarks on their comparisons here: (i) These advanced composition theorems may not be better than the basic composition, especially when the number of composition elements is not very large, e.g., Figure 1 in [1] (for DP-OPH, this corresponds to the case where the data is not extremely sparse, which is common in practice); (2) In these methods, composing $\epsilon'$-DP mechanisms would introduce an extra $\delta'$ in $(\epsilon,\delta)$-DP which needs to be counted in the total budget of $\delta$ in addition to the $\delta$ derived in step (1). Therefore, for simplicity and convenience, in our methods we adopted the basic composition.

We take your suggestion and agree that a brief discussion on this would be helpful. We will include a remark on these alternative choices for DP composition in the paper.

Reviewer comment (Evaluation):
Lack of utility analysis. As motivated in the introduction, hashing is frequently for the purpose of approximately calculating the similarity between two high-dimensional binary vectors. The paper also mentions the bias and variance of non-private estimators of the Jaccard similarity. However, except in Section A of the Appendix, there is not much mention of how the estimation accuracy, using the proposed hashing methods, depends on the privacy parameters, dimension of data, number of bins, etc. The discussion in Section A is also limited in two ways: (1) the variance analysis is only empirical; (2) it only considers replacing the non-private hash values in a specific estimator defined in equation (2) by private hash values, while there is no clear justification given for why this particular estimator is still the best candidate for private estimation of Jaccard similarity. Some utility analysis can be very useful for assessing the proposed algorithms in their own right, or relative to existing methods. For example, one advantage of this paper's set up, as suggested at the end of Section 1.2, is that it makes no assumptions about whether hash functions are kept private. However, without understanding the cost of this generality, potential users may still have difficulty in choosing between competing methods of DP hashing.

Author response:
As you kindly pointed out, in principle the variance of the (unbiased) Jaccard estimator from DP-OPH can be computed. However, given the already very complicated combinatorial form of the variance of non-private OPH, the expression will be extremely sophisticated also considering the b-bit coding and DP flipping. Thus, a straightforward analytical comparison is hard. We hope the empirical MSE comparisons in the appendix suffice to demonstrate that DP-OPH-re has smaller variance. Moreover, we know that in general the extra variation brought by DP would be largely determined by $N$, the privacy discount factor in DP-OPH-re and DP-OPH-fix. In Figure 1, we compare the $N$ of difference methods to intuitively show the advantage of the proposed approach in terms of privacy. These comparisons, together with the extensive experiments, show that the proposed algorithms provide better utility.

Reviewer comment (Theory):
Some gap in motivating One Permutation Hashing and b-bit coding. The paper mainly studies One Permutation Hashing with hash values restricted to b-bit integers, but the justifications for these choices appear somewhat ambiguous, especially to readers without much background in this topic. For example, it would be helpful if the last sentence of the first paragraph in Section 3.1 can include some more details (why unstable? violating the triangle inequality with respect to which metric?). For another example, restricting hash values to b-bit integers appears to be crucial to the DP algorithms (otherwise, the randomized response mechanism may not apply), however the paragraph on b-bit coding on page 3 feels rushed and leaves out some important details (without considering privacy yet, is there any accuracy loss by restricting to b-bits? How is b usually chosen? Is b-bit coding convenient, or rather, necessary for DP hashing?)

Author response:
Clarification on the background: Thanks for the nice suggestion. When we drafted the paper, we had to omit some contents due to the space limitation. We will definitely add more clarifications on the background of OPH and b-bit coding strategy. 1) Instability of naive OPH: without densification, the Jaccard estimation of OPH is (# of hash collisions)/(# of jointly non-empty bins). For sparse data, the denominator could be very small. Thus, the estimated value may vary a lot. For the metric, we refer to the Hamming distance. 2) We will add more references on b-bit coding, especially the empirical evaluations. Using b-bit coding will lead to some performance drop, which increases as $b$ gets smaller. However, truncating the hash values in this way is a standard step for the convenient use in practice. Since the vanilla OPH or MH hash values are large integers, b-bit coding is important for our DP methods---it limits the output domain so that bit flipping is able to guarantees a certain level of utility.

Reviewer comment (Theory):
On the usefulness of "attribute-level" privacy, is there any application of hashing/Jaccard similarity where it is more natural to consider the entire D-dimensional vector, as opposed to one coordinate of the vector, as the data of "one individual"?

Author response:
As we mentioned/cited in the paper, attribute-level DP is a standard setup in the literature of private sketching/hashing, e.g., [Kenthapadi et al, 2013], [Stausholm, 2021], [Zhao et al, 2022], [Smith et al, 2020], [Dickens et al, 2022]. The reason is that, our goal is to privatize the output hash values, and they are representations (or called "signatures" in some fields) of each data vector. It then becomes natural to treat a data vector as the "database", and define "neighboring" on the coordinate level. 

We may also "consider the entire D-dimensional vector" as you mentioned. We discuss two settings here. First, for real data vectors and when the randomness of the hashing algorithm is internal and private [Blocki et al.2012], there is a privacy definition that $\|u-u'\|\leq 1$ for neighboring vectors $u$ and $u'$. For binary data, this is equivalent to our definition. We may extend the definition to "differing in multiple coordinates", which is similar to the notion of "group privacy". This requires more involved analysis, which could be an independent study for future investigation. In this paper, we follow the common definition of "one coordinate change" in most related works on private sketching.

Second, if what the reviewer suggested is to protect arbitrarily different vectors $u$ and $u'$, then the problem becomes impossible to solve because the output hash values of two arbitrary vectors $u$ and $u'$ in $R^d$ can also be arbitrarily different. It is hard to find useful data representation while requiring that the representation of any data vector should look similar (which is required by DP).

Reviewer comment (Theory):
In the DP literature, it is customary to set $\delta$ to be smaller than 1 divided by the data set's size ($1/D$ in the case of this paper). What value of $\delta$ do you recommend in general, and what is its relationship to $1/D$?

Author response:
Thanks for the question and we would like to provide our thoughts here. In some DP papers, $\delta=1/n$ ($n$ is the size of the database) is used, but in our understanding this might be largely because the interpretation "at most one user's record will be leaked" seems more consistent with the "unit change" notions in the definition of DP. There are also many other papers that simply choose a deterministic value for $\delta$, which, based on our experience, is usually between $\delta=10^{-6}\sim 10^{-4}$. In our work, we presented the results with $\delta=10^{-6}$ which is smaller than $1/D$ for all the datasets in our experiments. The comparisons indeed hold for other $\delta$ values that we have experimented.

Reviewer comment (Theory):
Does your approach require that the dimension $D$ is fixed and/or public information? Strictly speaking, the notion of DP also allows adding/deleting one record from the data set, as opposed to merely replacing one record and keeping the data size unchanged.

Author response:
$D$ can be publicly known and fixed. When we interpret binary vectors as sets, $D$ is the size of the universe of items, and "1" means the item is in the set. So basically, in our problem we assume the universe itself does not change. The add/deletion operation is on the set level---the data coordinate of $x$ changing from 0 to 1 means "adding the item to the set", and changing from 1 to 0 means "deleting the item from the set".

Reviewer comment (Evaluation):
Impact of the results: all algorithms are proven private, but their privacy-accuracy tradeoffs do not seem widely applicable in practice. The evaluation of Section 4 shows that estimations are accurate for only very large values of $\epsilon$ (i.e. between 10 and 50) and therefore a large privacy loss. A partial exception is DP-OPH-rand, which shows fairly better accuracy already when $\epsilon$ reaches 5. However, its behavior is not clear since plots focus on a larger scale and we cannot see in detail what is happening in the range [0.1, 10].

Author response:
1. DP has been deployed in a wide range of fields and applications, and the feasible $\epsilon$ depends on the specific use case. For example, in the tutorial [How to dp-fy ml: A
practical guide to machine learning with differential privacy, Ponomareva et al., 2023, Section 5.2] by Google, the researchers defined $\epsilon<10$ as "reasonable privacy protection". For the U.S Census use case [The use of differential privacy for census data and its
impact on redistricting: The case of the 2020 U.S. Census, Kenny et al., 2021], $\epsilon=12.2$ is chosen. The PyTorch tutorial of DP-SGD training sets $\epsilon=47.2$ (https://github.com/pytorch/opacus/blob/main/tutorials/building_image_classifier.ipynb). Therefore, depending on the application and privacy requirement, we believe that different $\epsilon$ values in DP-OPH are useful in difference use cases. 

In our plots, we presented $\epsilon\in [1,50]$. We referred to the recent paper [Zhao et al., Differentially private linear sketches: Efficient implementations and applications. NeurIPS 2022] when presenting the range of $\epsilon$. [Zhao et al. 2022] studied DP count sketch, which is similar to MinHash/OPH in terms of DP since count sketch also produces multiple hash values for each data vector. The range of $\epsilon$ used in [Zhao et al. 2022] is $[2.45, 33.5]$ (converted from zCDP). We presented larger $\epsilon$ to demonstrate the difference between DP-OPH-rand and densified DP-OPH-re.

For our proposed methods, DP-OPH-rand typically performs well with $\epsilon<10$. The densified DP-OPH-re may outperform DP-OPH-rand when $\epsilon>5\sim 15$, depending on the dataset. Therefore, we hope that all the variants could find useful use cases in practice.

Reviewer comment (Novelty):
Novelty: I do not find substantial novelty in the work. The application of randomized response to MH sketches is already present in Aumüller et al. (2020). It is true that the authors found a mistake on the proof of this related work and corrected it, but as said in the paper, this mistake is minor. It seems that the application of these ideas to the proposed OPH variations do not have substantial changes. If the authors could clearly explain the novelty in the content of their proofs with respect to Aumüller et al. (2020), I will take this point back and re-asses my score.

Author response:
2. The analysis of DP-OPH is much more involving than DP-MH with some complicated combinatorial calculations due to the binning operations in OPH. Rigorously obtaining the flipping probability requires non-trivial efforts. On the high level, we propose DP-OPH and show that it can significantly improved DP-MH. We believe these new algorithm designs and results themselves are novel contributions to the literature of private sketching/hashing.

Reviewer comment (Writing):
The degree of "locality" of the DP guarantee could be more clearly explained. In the contribution, there is no need to trust a central party to take two vectors and output a noisy estimation of its Jaccard distance as it would be needed in central DP. Clarifying this aspect would also help to better motivate the scope of application of the result.

Author response:
3. Thanks for the nice suggestions. Not requiring a trusted central server is indeed one advantage of our proposed methods. We will highlight it in the revision.

Reviewer comment (Theory):
My major concern is the missing analysis of the utility. From what I read, the DP guarantee is shown but the utility is justified by experiments. It is somewhat an incomplete work if no upper/lower bound on the utility is discussed, and further weaken some of the experimental results. For example: Though the proposed DP-Minhash and DP-OPH are similar at a schematic level, it is unfair if the DP-MH is not the optimal algorithm however DP-OPH is. I will say more in the questions section.

Author response:
Q3. About the OPH paper: We appreciate your very detailed research on the prior work. Actually, the Arxiv version of the NIPS 2012 paper https://arxiv.org/pdf/1208.1259.pdf included more details. The exact analysis of the OPH type algorithms is highly complicated with involved combinatorial calculations. In Lemma 6 and Lemma 7, the authors showed that the approximate Jaccard estimation variance ratio of OPH over minhash is smaller than 1. In Figure 8, we see that empirically OPH can perform better than minhash with smaller MSE.

Q4. The error bound in [1] is a simple consequence of applying Chernoff bound on the average of iid Bernoulli random variables. A minor point: in their Theorem 2, $\tau$ does not equal to $n$. Actually, it is the number of non-zeros in the data vector which can be much smaller than $n$. So the rate is $O(1/\sqrt{\tau \epsilon})$.

For DP-OPH, the analysis would be much harder and challenging. The key reason is that the hash values of OPH are not independent---recall that OPH is a "sample-without-replacement" approach, so the hash values are correlated to each other. Thus, the standard concentration tools would not be applicable here. Moreover, even if we compute the variance explicitly, it would be extremely sophisticated considering both the $b$-bit coding and DP flipping. Thus, a direct analytical comparison would be difficult. Given these reasons, we chose to present the comparison on the privacy discount factor $N$ in Figure 1, an empirical comparison of the Jaccard estimation variances in Appendix A, and justify the performance of DP-OPH methods through extensive experiments on datasets from computer vision, biology, and the web. We hope these results are convincing to show the effectiveness of DP-OPH methods.

Reviewer comment (Theory):
There should be discussion on pure-DP.

Author response:
W3. The DP-OPH-rand variant (Algorithm 5) with random bits for empty bins achieves $\epsilon$-DP, see Theorem 3.3.

Reviewer comment (Writing):
What is $J$ in the equation after equation 2 on page 3?

Author response:
Q1. $J$ is the Jaccard similarity between $u$ and $v$ defined in equation (1), i.e., $J = J(u,v)$. We omitted "$(u,v)$" here. We will make the notation more clear. Thanks for pointing it out.

Reviewer comment (Theory):
In the section of __Privacy statement and applications__, it is mentioned the privacy model is "attribute-level". Are there other privacy models for this type of problem? (Such as node/edge level privacy for graphs)

Author response:
Q2. As we mentioned/cited in the paper, attribute-level DP is a standard setup in the literature of private sketching/hashing, e.g., [Kenthapadi et al, 2013], [Stausholm, 2021], [Zhao et al, 2022], [Smith et al, 2020], [Dickens et al, 2022]. The reason is that, our goal is to privatize the output hash values, and they are representations (or called "signatures" in some fields) of each data vector. Thus, it is natural to treat a data vector as the "database", and define "neighboring" on the coordinate level.  For real data vectors and when the randomness of the hashing algorithm is internal and private, there is another privacy definition that $\|u-u'\|\leq 1$ for neighboring vectors $u$ and $u'$. However, for binary data, this is equivalent to our definition.

Reviewer comment (Theory):
Corresponding to the major concern. I briefly checked two previous papers on this topic and really appreciate it if the authors help me understand why the analysis of utility is not available in this work. In [2], it is claimed that One Permutation Hashing outperforms Minwise Hashing, and the theoretical analysis includes two lemma on page 5: Lemma 1 says the expected number of 'jointly empty bins' has an upper bound; Lemma 2 says the estimator of the resemblance is unbiased. Would you please explain intuitively how these two analysis show the better utility?

Author response:
Q3. About the OPH paper: We appreciate your very detailed research on the prior work. Actually, the Arxiv version of the NIPS 2012 paper https://arxiv.org/pdf/1208.1259.pdf included more details. The exact analysis of the OPH type algorithms is highly complicated with involved combinatorial calculations. In Lemma 6 and Lemma 7, the authors showed that the approximate Jaccard estimation variance ratio of OPH over minhash is smaller than 1. In Figure 8, we see that empirically OPH can perform better than minhash with smaller MSE.

Reviewer comment (Theory):
To continue, in [1], where there is a small error of probability distribution fixed in this paper, the authors gave utility analysis. Looking at lemma 5 and theorem 2 on page 6 (arxiv version), the upper bound of additive error seems to be $O(\frac{1}{\sqrt{n\varepsilon}})$ by taking $\alpha =1, \tau = n$ if I did not misunderstand. Why cannot we do a similar analysis on the algorithms proposed here?

Author response:
Q4. The error bound in [1] is a simple consequence of applying Chernoff bound on the average of iid Bernoulli random variables. A minor point: in their Theorem 2, $\tau$ does not equal to $n$. Actually, it is the number of non-zeros in the data vector which can be much smaller than $n$. So the rate is $O(1/\sqrt{\tau \epsilon})$.

For DP-OPH, the analysis would be much harder and challenging. The key reason is that the hash values of OPH are not independent---recall that OPH is a "sample-without-replacement" approach, so the hash values are correlated to each other. Thus, the standard concentration tools would not be applicable here. Moreover, even if we compute the variance explicitly, it would be extremely sophisticated considering both the $b$-bit coding and DP flipping. Thus, a direct analytical comparison would be difficult. Given these reasons, we chose to present the comparison on the privacy discount factor $N$ in Figure 1, an empirical comparison of the Jaccard estimation variances in Appendix A, and justify the performance of DP-OPH methods through extensive experiments on datasets from computer vision, biology, and the web. We hope these results are convincing to show the effectiveness of DP-OPH methods.

Reviewer comment (Novelty):
The methods seem to be straight forward and hence scientific content appears not that substantial.

Author response:
Dear Reviewer QDZh:

Thanks for your feedback.

Private sketching/hashing methods have attracted more and more attention in the research community recently. However, min-wise hashing and its efficient alternative, one permutation hashing, have not been studied under the differential privacy model. As we have extensively cited in the paper, these important algorithms have many applications in practice, so we believe providing private versions of these methods would be helpful to many researchers and practitioners. We actually tried several different ways to achieve DP, and it turns out that the "classic" generalized randomized response technique is the most effective one and well fits the discrete nature of our problem. While the DP tool is not completely new, the main technical contributions of our work is to properly specify the privacy parameters in DP-OPH (Lemma 3.1), which requires non-trivial design and analysis. We also provided three variants that can be chosen flexibly under different scenarios. We hope that our work can serve as a good guidance and reference for private hashing methods of the Jaccard similarity.

We hope our rebuttal could help the reviewer better appreciate our contributions. Again, thanks for your review of our work.