H YPERPARAMETER T UNING WITH R ENYI D IFFERENTIAL P RIVACY
Anonymous authors
Paper under double-blind review
A BSTRACT
For many differentially private algorithms, such as the prominent noisy stochastic gradient descent (DP-SGD), the analysis needed to bound the privacy leakage of a single training run is well understood.
However, few studies have reasoned about the privacy leakage resulting from the multiple training runs needed to ﬁne tune the value of the training algorithm’s hyperparameters.
In this work, we ﬁrst illustrate how simply setting hyperparameters based on non-private training runs can leak private information.
Motivated by this observation, we then provide privacy guarantees for hyperparameter search procedures within the framework of
Renyi Differential Privacy.
Our results improve and extend the work of Liu and
Talwar (STOC 2019).
Our analysis supports our previous observation that tuning hyperparameters does indeed leak private information, but we prove that, under certain assumptions, this leakage is modest, as long as each candidate training run needed to select hyperparameters is itself differentially private.
I NTRODUCTION
Machine learning (ML) systems memorize training data and regurgitate excerpts from it when probed (Carlini et al., 2020).
If the training data includes sensitive personal information, then this presents an unacceptable privacy risk (Shokri et al., 2017).
It may however still be useful to apply machine learning to such data, e.g., in the case of healthcare (Kourou et al., 2015; Wiens et al., 2019).
This has led to a signiﬁcant body of research on the development of privacy-preserving machine learning methods.
Differential privacy (DP) (Dwork et al., 2006b;a) provides a robust and quantitative privacy guarantee.
It has been widely accepted as the best framework for formally reasoning about the privacy guarantees of a machine learning algorithm.
A popular method for ensuring DP is noisy (stochastic) gradient descent (a.k.a.
DP-SGD)
(Song et al., 2013; Bassily et al., 2014; Abadi et al., 2016).
DP-SGD differs from standard (stochastic) gradient descent in three ways.
First, gradients are computed on a per-example basis rather than directly averaged across a minibatch of training examples.
Second, each of these individual gradients is clipped to ensure its 2 -norm is bounded.
Third, Gaussian noise is added to the gradients as they are averaged and applied to update model parameters.
These modiﬁcations bound the sensitivity of each update so that the added noise ensures differential privacy.
The composition (Dwork et al., 2010) and privacy ampliﬁcation by subsampling (Balle et al., 2018) properties of differential privacy thus imply that the overall training procedure is differentially private.
We can compute tight privacy loss bounds for DP-SGD using techniques like the Moments Accountant (Abadi et al., 2016) or the closely related framework of Rényi DP (Mironov, 2017; Mironov et al., 2019).
Machine learning systems have hyperparameters, such as the learning rate, minibatch size, or choice of a regularizer to prevent overﬁtting.
Details of the model architecture can also be treated as hyperparameters of the optimization problem.
Furthermore, learning within the constraints of differential privacy may introduce additional hyperparameters, as illustrated in the DP-SGD optimizer by the 2 -norm bound value for clipping, the scale of the Gaussian noise, and the choice of stopping time.
Typically the training procedure is repeated many times with different hyperparameter settings in order to select the best setting, an operation known as hyperparameter tuning .
This methodology implies that even if each run of the training procedure is privacy-preserving, we need to take into account the fact that the training procedure is repeated (possibly many times) when reasoning about the privacy of the overall learning procedure.
Can the tuning of hyperparameters reveal private information?
This question has received remarkably little attention and, in practice, it is often ignored entirely.
We study this question and provide both positive and negative answers.
1. O UR C ONTRIBUTIONS
• We show that, under certain circumstances, the setting of hyperparamters can leak private information.
Hyperparameters are a narrow channel for private information to leak through, but they can still reveal information about individuals if we are careless.
Speciﬁcally, if we tune the hyperparameters in an entirely non-private fashion, then individual outliers can noticeably skew the optimal hyperparameter settings.
This is sufﬁcient to reveal the presence or absence of these outliers à la membership inference (Shokri et al., 2017); it shows that we must exercise care when setting hyperparameters.
• We provide tools for ensuring that the selection of hyperparameters is differentially private.
Speciﬁcally, if we repeat the training procedure multiple times (with different hyperparameters) and each repetition of the training procedure is differentially private on its own, then outputting the best repetition is differentially private.
Of course, a basic version of such a result follows from the composition properties of differential privacy (that is the fact that one can “sum” the privacy loss bounds of multiple differentially private analyses performed on the same data to bound the overall privacy loss from analyzing this data).
However, we provide quantitatively sharper bounds.
Speciﬁcally, our privacy loss bounds are either independent of the number of repetitions or grow logarithmically in the number of repetitions, whereas composition would give linear bounds.
Rather than repeating the training procedure a ﬁxed number of times, our results require repeating the training procedure a random number of times.
The privacy guarantees depend on the distribution of the number of runs; we consider several distributions and provide generic results.
We discover a tradeoff between the privacy parameters and how heavy-tailed the distribution of the number of repetitions is.
1. B ACKGROUND AND R ELATED W ORK
Differential privacy (DP) is a framework to reason about the privacy guarantees of randomized algorithms which analyze data (Dwork et al., 2006b;a).
An algorithm is said to be DP if its outputs on any pair of datasets that only differ on one individual’s data are indistinguishable.
A bound on this indistinguishability serves as the quantiﬁcation for privacy.
Formally, a randomized algorithm
M : X n → Y is ( ε, δ ) -DP if for any inputs x, x (cid:48) ∈
X n differing only on the addition, removal, or replacement of one individual’s records and for any subset of outputs S ⊆ Y , we have
[Equation]
Here, the parameter ε is known as the privacy loss bound – the smaller ε is, the stronger the privacy guarantee provided is, because it is hard for an adversary to distinguish the outputs of the algorithm on two adjacent inputs.
The parameter δ is essentially the probability that the guarantee fails to hold.
One of the key properties of DP is that it composes: running multiple independent DP algorithms is also DP and composition theorems allow us to bound the privacy parameters of such a sequence of mechanisms in terms of the individual mechanisms’ privacy parameters (Dwork & Roth, 2014).
There is a vast literature on differential privacy in machine learning.
A popular tool is the DP-SGD optimizer (Abadi et al., 2016).
Because the noise added is Gaussian and DP-SGD applies the same (differentially private) training step sequentially, it is easier to reason about its privacy guarantees in the framework of Rényi differential privacy (Mironov, 2017).
Rényi differential privacy (RDP) generalizes pure differential privacy (with δ = 0 ) as follows.
An algorithm M is said to be ( λ, ε ) -RDP with λ ≥ 1 and ε ≥ 0 , if for any adjacent inputs x, x (cid:48)
[Equation]
where D λ ( P (cid:107) Q ) is the Rényi divergence of order λ between distributions P and Q .
In the framework of RDP, one obtains sharp and simple composition: If each individual mechanism M i is ( λ, ε i ) -RDP, then the composition of running all of the mechanisms on the data satisﬁes ( λ, (cid:80) i ε i ) -RDP.
For instance, the privacy analysis of DP-SGD ﬁrst analyzes the individual training steps then applies composition.
Note that it is common to keep track of multiple orders λ in the analysis.
Thus ε should be thought of as a function ε ( λ ) , rather than a single number.
In many cases, such as Gaussian noise addition, this is a linear function –
i.e., ε ( λ ) =
ρ · λ for some ρ ∈ R – and such a linear bound yields the deﬁnition of zero-Concentrated DP with parameter ρ ( ρ -zCDP) (Bun & Steinke, 2016).
One could naïvely extend this composition-based approach to analyze the privacy of a training algorithm which involves hyperparameter tuning.
Indeed, if each training run performed to evaluate one candidate set of hyperparameter values is DP, the overall procedure is also DP by composition over all the hyperparameter values tried.
However, this would lead to very loose guarantees of privacy.
Chaudhuri & Vinterbo (2013) were the ﬁrst to obtain improved DP bounds for hyperparameter tuning, but their results require a stability property of the learning algorithm.
The only prior work that has attempted to obtain tighter guarantees for DP hyperparameter tuning in a black-box fashion is the work of Liu & Talwar (2019).
Their work is the starting point for ours.
Liu & Talwar (2019) show that, if we start with a ( ε, 0) -DP algorithm, repeatedly run it a random number of times following a geometric distribution, and ﬁnally return the best output produced by these runs, then this system satisﬁes (3 ε, 0)
-differential privacy.
1 Liu & Talwar (2019) also consider algorithms satisfying ( ε, δ ) -DP for δ > 0 .
However, their analysis is restricted to the ( ε, δ ) formulation of DP and they do not give any results for Rényi DP.
This makes it difﬁcult to apply these results to modern DP machine learning systems, such as models trained with DP-SGD.
Our results directly improve on the results of Liu & Talwar (2019).
We show that replacing the geometric distribution on the number of repetitions in their result with the logarithmic distribution yields (2 ε, 0) -differential privacy as the ﬁnal result.
We also consider other distributions on the number of repetitions, which give a spectrum of results.
We simultaneously extend these results to the Rényi DP framework, which yields sharper privacy analyses.
A closely related line of work is on the problem of private selection.
Well-known algorithms for private selection include the exponential mechanism (McSherry & Talwar, 2007) and the sparse vector technique (Dwork et al., 2009; Zhu & Wang, 2020).
However, this line of work assumes that there is a low-sensitivity function determining the quality of each of the options.
This is usually not the case for hyperparameters.
Our results simply treat the ML algorithm as a black box; we only assume that its output is private and make no assumptions about how that output was generated.
Our results also permit returning the entire trained model along with the selected hyperparameters.
M OTIVATION
A hyperparameter typically takes categorical values (e.g., the choice of activation function in a neural network layer), or is a single number (e.g., a real number for the learning rate or an integer for the number of epochs).
Thus, it is intuitive that a hyperparameter provides little capacity as a channel to leak private information from the training data.
Nevertheless, leakage can happen, in particular when training is done without preserving privacy.
We illustrate how with the constructed example of hyperparameter tuning for a support vector machine learning (SVM) learned from a synthetic data distribution.
We consider a SVM with a soft margin; we use stochastic gradient descent to minimize the corresponding objective involving the hinge loss and a weight penalty:
[Equation]
where y ∈ {− 1 , 1 } indicates the label of training example x ∈ R 2 .
Because our purpose here is to illustrate how leakage of private information can arise from hyperparameter tuning, we work with a synthetic data distribution for simplicity of exposition: we draw 100 inputs from isotropic 2D
Gaussians of standard deviation 0 .
5 for both the positive and negative classes to form the training set
D .
The negative class is centered at µ − 1 = ( − 0 .
75 , − 0 .
and the positive at µ 1 = (0 .
Our learning procedure has a single hyperparameter α controlling how much importance is given to the hinge loss, i.e., how much the SVM is penalized for using slack variables to misclassify some of the training data.
We ﬁrst tune the value of α with the training set D and report training accuracy as a function of α in Figure 1, where accuracy is deﬁned as correctly classifying the training sample outside the margin (e.g., w · x + b ≥ 1 for x in the positive class).
Next, we repeat this experiment on a dataset D (cid:48) to which we added 2 outliers x o = ( − 2 , 0) to the positive class.
The resulting hyperparameter tuning curve is added to Figure 1.
By comparing both curves, it is clear that the choice of hyperparameter α which maximizes accuracy differs in the two settings: α = 40 sufﬁces to reach the accuracy plateau with outliers whereas increasing α is beneﬁcial without outliers.
[Figure]
This difference can be exploited to perform a variant of a membership inference attack ( et al., 2017):
Here, one could infer from the value of the hyperparameter α whether or not the outlier points x o were part of the training set or not.
While the example is constructed, this shows how we must be careful when tuning hyperparameters: in corner cases such as the one presented here, it is possible for some information contained in the training data to leak in hyperparameter choices.
In particular, this implies that the common practice of tuning hyperparameters without differential privacy and then using the hyperparameter values selected to repeat training one last time with differential privacy is not ideal.
In Section 3, we will in particular show how training with differential privacy when performing the different runs necessary to tune the hyperparameter can bound such leakage effectively if one carefully chooses the number of runs hyperparameters are tuned for
O UR P OSITIVE R ESULTS 3. P ROBLEM F ORMULATION
We begin by appropriately formalizing the problem of differentially private hyperparameter tuning, following the framework of Liu & Talwar (2019).
Suppose we have m randomized base algorithms
M 1 , M 2 , · · · , M m : X n → Y .
These correspond to m possible settings of the hyperparameters.
Ideally we would simply run each of these algorithms once and return the best outcome.
For simplicity, we consider a ﬁnite set of hyperparameter possibilities; if the hyperparameters of interest are continuous, then we must pick a ﬁnite subset to search over (which is in practice sufﬁcient).
Here we make two simplifying assumptions: First, we assume that there is a total order on the range Y , which ensures that "best" is well-deﬁned.
In particular, we are implicitly assuming that the algorithm computes a quality score (e.g., accuracy on a test set) for the trained model it produces; this may require allocating some privacy budget to this evaluation.
2 Second, we are assuming that the output includes both the trained model and the corresponding hyperparameter values (i.e., the output of M j includes the index j ).
These assumptions can be made without loss of generality.
3. S TRAWMAN APPROACH : REPEAT THE BASE ALGORITHM A FIXED NUMBER OF TIMES
The obvious approach to this problem would be to run each algorithm once and to return the best of the m outcomes.
From composition, we know that the privacy cost grows at most linearly with m .
It turns out that this is in fact tight.
There exists a ( ε, 0) -DP algorithm such that if we repeatedly run it m times and return the best output, the resultant procedure is not ( mε − τ, 0) -DP for any τ > 0 .
This was observed by Liu & Talwar (2019, Appendix B) and we provide an analysis in Appendix D.1.
This negative result also extends to Rényi DP.
To avoid this problem, we will run the base algorithms a random number of times.
The added uncertainty signiﬁcantly enhances privacy.
However, we must carefully choose this random distribution and analyze it.
3. O UR ALGORITHM FOR HYPERPARAMETER TUNING
To obtain good privacy bounds, we must run the base algorithms a random number of times.
We remark that random search rather than grid search is often performed in practice (Bergstra & Bengio, 2012), so this is not a signiﬁcant change in methodology.
Speciﬁcally, we pick a total number of runs
K from some distribution.
Then, for each run k = 1 , 2 , · · · , K , we pick an index j k ∈ [ m ] uniformly at random and run M j k .
Then, at the end, we return the best of the K outcomes.
The privacy guarantee of this overall system then depends on the privacy guarantees of each of the mechanisms M j as well as the distribution of the number of runs K .
Speciﬁcally, we assume that there exists a uniform (Rényi) DP bound for all of the mechanisms M j .
Note that DP is “convex” where “convexity” here means that if M 1 , M 2 , · · · , M m are each individually DP, then running M j k for a random j k ∈ [ m ] is also DP with the same parameters.
To simplify notation, we also assume that there is a single mechanism Q : X n → Y that picks a random index j ∈ [ m ] and then runs M j .
In essence, our goal is to “boost” the success probability of Q by repeating it many times.
The distribution of the number of runs K must be chosen to both ensure good privacy guarantees and to ensure that the system is likely to pick a good setting of hyperparameters.
Also, the overall runtime of the system depends on K and we want the runtime to be efﬁcient and predictable.
Our results consider several distributions on the number of repetitions K and the ensuing tradeoff between these three considerations.
3. M AIN R ESULTS
There are many possible distributions for the number of repetitions K .
In this section, we ﬁrst consider two – the truncated negative binomial and Poisson distributions – and state our main privacy results for these distributions.
Later, in Section 3.5, we state a more general technical lemma which applies to any distribution on the number of repetitions K .
Deﬁnition 1 (Truncated Negative Binomial Distribution) .
Let γ ∈ (0 , 1) and η ∈ ( − 1 , ∞ ) .
Deﬁne a distribution D η,γ on N = { 1 , 2 , · · · } as follows.
If η (cid:54) = 0 and K is drawn from D η,γ , then
[Equation]
and E [ K ] =
η · (1 − γ ) γ · (1 − γ η ) .
If K is drawn from D 0 ,γ , then
[Equation]
and E
[ K ] = 1 /γ − 1 log(1 /γ ) .
This is called the “negative binomial distribution,” since (cid:81) k − 1 (cid:96)
[Equation]
(cid:1) if we extend the deﬁnition of binomial coefﬁcients to non-integer η .
The distribution is called “truncated” because P [ K = 0] = 0 , whereas the standard negative binomial distribution includes 0 in its support.
The η = 0 case D 0 ,γ is known as the “logarithmic distribution”.
The η = 1 case D 1 ,γ is simply the geometric distribution.
Next, we state our main privacy result for this distribution.
Theorem 2 (Main Privacy Result – Truncated Negative Binomial) .
Let Q : X n → Y be a randomized algorithm satisfying ( λ, ε ) -RDP and (ˆ λ, ˆ ε ) -RDP for some ε, ˆ ε ≥ 0 , λ ∈ (1 , ∞ ) , and ˆ λ ∈ [1 , ∞ ) .
Assume Y is totally ordered.
Let η ∈ ( − 1 , ∞ ) and γ ∈ (0 , 1) .
Deﬁne an algorithm A : X n → Y as follows.
Draw K from the truncated negative binomial distribution D η,γ (Deﬁnition 1).
Run Q ( x ) repeatedly K times.
Then
A ( x ) returns the best value from the K runs.
Then A satisﬁes ( λ, ε (cid:48) )
-RDP where
[Equation]
[Figure] [Figure]
[Figure]
Theorem 2 shows a tradeoff between privacy and utility for the distribution D η,γ of the number of repetitions.
Privacy improves as η decreases and γ increases.
However, this corresponds to fewer repetitions and thus a lower chance of success.
We will study this aspect in Section 3.6.
Theorem 2 assumes two RDP bounds, which makes it slightly hard to interpret.
Thus we consider two illustrative special cases: We start with pure DP (a.k.a. pointwise DP) – i.e., ( ε, δ ) -DP with δ = 0 , which is equivalent to ( ∞ , ε ) -RDP.
This corresponds to Theorem 2 with λ → ∞ and ˆ λ → ∞ .
Corollary 3 (Theorem 2 for pure DP) .
Let Q : X n → Y be a randomized algorithm satisfying ( ε, 0) -DP.
Let η ∈ ( − 1 , ∞ ) and γ ∈ (0 , 1) .
Deﬁne A : X n → Y as in Theorem 2.
Then A satisﬁes ((2 + η ) ε, 0) -DP.
Our result is a generalization of the result of Liu & Talwar (2019) – they show that, if K follows a geometric distribution and Q satisﬁes ( ε, 0) -DP, then A satisﬁes (3 ε, 0) -DP.
Setting η = 1 in
Corollary 3 recovers their result.
If we set η < 1 , then we obtain an improved privacy bound.
Another example is if Q satisﬁes concentrated DP (Dwork & Rothblum, 2016; Bun & Steinke, 2016).
This is the type of guarantee that is obtained by adding Gaussian noise to a bounded sensitivity function.
In particular, this is the type of guarantee we would obtain from noisy gradient descent.
Corollary 4 (Theorem 2 for Concentrated DP) .
Let Q : X n → Y be a randomized algorithm satisfying ρ
-zCDP – i.e., ( λ, ρ · λ ) -Rényi DP for all λ > 1 .
Let η ∈ ( − 1 , ∞ ) and γ ∈ (0 , 1) .
Deﬁne
A : X n → Y and K ← D η,γ as in Theorem 2.
Assume ρ ≤ log(1 /γ ) .
Then A satisﬁes ( λ, ε (cid:48) )
-Rényi
DP for all λ > 1 with ε
[Equation]
=
[Equation]
Figure 2 shows what the guarantee of Corollary 4 looks like.
Here we start with 0 .
1 -zCDP
and perform repetition following the logarithmic distribution ( η = 0 ) with varying scales (given by γ ) and plot the Rényi DP guarantee attained by outputting the best of the repeated runs.
The improvement over naive composition, which instead grows linearly, is clear.
We also study other distributions on the number of repetitions, obtained by varying η , and Figure 3 gives a comparison.
Figure 4 shows what these bounds look like if we convert to approximate ( ε, δ ) -DP with δ = 10 − 6 .
Remark 5.
Corollary 4 uses the monotonicity property of Rényi divergences: If λ 1 ≤ λ 2 , then
D λ 1 ( P (cid:107) Q ) ≤ D λ 2 ( P (cid:107) Q ) (Van Erven & Harremos, 2014, Theorem 3).
Thus ( λ 2 , ε ) -RDP implies ( λ 1 , ε ) -RDP for any λ 1 ≤ λ 2 .
In particular, the bound of Theorem 2 yields ε (cid:48)
→ ∞ as λ → 1 , so we use monotonicity to bound ε (cid:48) for small λ .
Poisson Distribution.
We next consider the Poisson distribution, which offers a different privacyutility tradeoff than the truncated negative binomial distribution.
The Poisson distribution with mean µ ≥ 0 is given by P [ K = k ] =
e − µ µ k k !
for all k ≥ 0 .
Note that P [ K = 0] =
e − µ > 0 here, whereas the truncated negative binomial distribution does not include 0 in its support.
We could condition on K ≥ 1 here too, but we prefer to stick with the standard deﬁnition.
We remark that (modulo the issue around P [ K = 0] ) the Poisson distribution is closely related to the truncated negative binomial distribution.
If we take the limit as η → ∞ while the mean remains ﬁxed, then the negative binomial distribution becomes a Poisson distribution.
Conversely, the negative binomial distribution can be represented as a convex combination of Poisson distributions or as a compound of Poisson and logarithmic; see Appendix A.2 for more details.
Theorem 6 (Main Privacy Result – Poisson Distribution) .
Let Q : X n → Y be a randomized algorithm satisfying ( λ, ε ) -RDP and (ˆ ε, ˆ δ )
-DP for some λ ∈ (1 , ∞ ) and ε, ˆ ε, ˆ δ ≥ 0 .
Assume Y is totally ordered.
Let µ > 0 .
Deﬁne an algorithm A : X n → Y as follows.
Draw K from a Poisson distribution with mean µ – i.e., P [ K = k ] =
e − µ · µ k k !
for all k ≥ 0 .
Run Q ( x ) repeatedly K times.
Then A ( x ) returns the best value from the K runs.
If K = 0 , A ( x ) returns some arbitrary output independent from the input x .
If e ˆ ε ≤ 1 + 1 λ − 1 , then A satisﬁes ( λ, ε (cid:48) )
-RDP where
[Equation]
The assumptions of Theorem 6 are different from Theorem 2: We assume a Rényi DP guarantee and an approximate DP guarantee on Q , rather than two Rényi DP guarantees.
We remark that a Rényi
DP guarantee can be converted into an approximate DP guarantee – ( λ, ε ) -RDP implies (ˆ ε, ˆ δ )
-DP for all ˆ ε ≥ ε and ˆ δ =
e ( λ − 1)(ˆ ε − ε ) · 1 λ · (cid:0) 1 − 1 λ (cid:1) λ − 1 (Mironov, 2017; Canonne et al., 2020).
Thus this statement can be directly compared to our other result.
We show such a comparison in Figure 3 and
Figure 4.
The proofs of Theorems 2 and 6 are included in Appendix B.2.
3. G ENERIC R ÉNYI DP B OUND FOR A NY D ISTRIBUTION ON THE N UMBER OF R EPETITIONS
We now present our main technical lemma, which applies to any distribution on the number of repetitions K .
Theorems 2 and 6 are derived from this result.
It gives a Rényi DP bound for the repeated algorithm in terms of the Rényi DP of the base algorithm and the probability generating function of the number of repetitions applied to probabilities derived from the base algorithm.
Lemma 7 (Generic Bound) .
Fix λ > 1 .
Let K be a random variable supported on N ∪ { 0 } .
Let f : [0 , 1] → R be the probability generating function of K – i.e., f ( x ) :
= (cid:80) ∞
k =0 P [ K = k ] · x k .
Let Q and Q (cid:48) be distributions on Y .
Assume Y is totally ordered.
Deﬁne a distribution A on Y as follows.
First sample K .
Then sample from Q independently K times and output the best of these samples.
This output is a sample from A .
We deﬁne A (cid:48) analogously with Q (cid:48) in place of Q .
Then
[Equation]
(6) where applying the same postprocessing to Q and Q (cid:48) gives probabilities q and q (cid:48) respectively – i.e., there exists an arbitrary function g : Y → [0 , 1] such that q =
E X ← Q [ g ( X )] and q (cid:48) =
E X (cid:48)
← Q (cid:48)
[ g ( X (cid:48) )] .
The proof of this generic bound is found in Appendix B.1.
To interpret the theorem, we should imagine adjacent inputs x, x (cid:
) ∈
X n , and then the distributions correspond to the algorithms run on these inputs:
A =
A ( x ) , A (cid:48)
=
A ( x (cid:48) ) , Q = Q ( x ) , and Q (cid:48)
=
Q ( x (cid:48) ) .
The bounds on Rényi divergence thus correspond to Rényi DP bounds.
The derivative of the probability generating function – f (cid:48) ( x ) = E (cid:2) K · x K − 1 (cid:3) – is somewhat mysterious.
A ﬁrst-order intuition is that, if q = q (cid:48) , then f (cid:48) ( q ) λ · f (cid:48)
( q (cid:48) )
1 − λ = f (cid:48)
( q ) ≤ f (cid:48) (1) =
E [ K ] and thus the last term in the bound (6) is simply log E [ K ] λ − 1 .
A second-order intuition is that q ≈ q (cid:48) by DP and postprocessing and, if f (cid:48) is smooth, then f (cid:48)
( q ) ≈ f (cid:48)
( q (cid:48) ) and the ﬁrst-order intuition holds up to these approximations.
Vaguely, f (cid:48) being
[Figure]
[Figure] [Figure]
experiment.
smooth corresponds to the distribution of K being spread out (i.e., not a point mass) and not too heavy-tailed (i.e. K is small most of the time).
The exact quantiﬁcation of this smoothness depends on the form of the DP guarantee q ≈ q (cid:48) .
In our work, we primarily compare three distributions on the number of repetitions: a point mass (corresponding to naïve repetition), the truncated negative binomial distribution, and the Poisson distribution.
A point mass would have a polynomial as the probability generating function – i.e., if P [ K = k ]
= 1 , then f ( x ) =
E (cid:2) x K (cid:3) =
x k .
The probability generating function of the truncated negative binomial distribution (Deﬁnition 1) is
[Equation]
The probability generating function of the Poisson distribution with mean µ is given by f ( x ) =
e µ · ( x − 1) .
We discuss probability generating functions further in Appendix A.2.
3. U TILITY AND R UNTIME OF OUR H YPERPARAMETER T UNING A LGORITHM
Our analytical results thus far, Theorems 2 and 6 and Lemma 7, provide privacy guarantees for our hyperparameter tuning algorithm
A when it is used with various distributions on the number of repetitions K .
We now turn to the utility that this algorithm provides.
The utility of a hyperparameter search is determined by how many times the base algorithm (denoted Q in the theorem statements) is run when we invoke the overall algorithm ( A ).
The more often Q is run, the more likely we are to observe a good output and A is more likely to return the corresponding hyperparameter values.
Note that the number of repetitions K also determines the algorithm’s runtime, so these are closely linked.
How does this distribution on the number of repetitions K map to utility?
As a ﬁrst-order approximation, the utility and runtime are proportional to E [ K ] .
Hence several of our ﬁgures compare the different distributions on K based on a ﬁxed expectation and Figure 4 plots E
[ K ] on the vertical axis.
However, this ﬁrst-order approximation ignores the fact that some of the distributions we consider are more concentrated than others; even if the expectation is large, there might still be a signiﬁcant probability that K is small.
Indeed, for η ≤ 1 , the mode of the truncated negative binomial distribution is K = 1 .
We found this to be an obstacle to using the (truncated) negative binomial distribution in practice in our experiments, and discuss this further in Appendix A.2.1.
We can formulate utility guarantees more precisely by looking at the expected quantile of the output to measure our algorithm’s utility.
If we run the base algorithm Q once, then the quantile of the output is (by deﬁnition) uniform on [0 , 1] and has mean 0 .
If we repeat the base algorithm a ﬁxed number of times k , then the quantile of the best output follows a Beta ( k, 1) distribution, as it is the maximum of k independent uniform random variables.
The expectation in this case is k k +
= 1 − 1 k +1 .
If we repeat a random number of times K , the expected quantile of the best result is given by
[Equation]
where f ( x ) = E (cid:2) x K (cid:3) is the probability generating function of K ; see Appendix A.2.1 for further details.
Figure 5 plots this quantity against privacy.
We see that the Poisson distribution performs very well in an intermediate range, while the negative binomial distribution with η = 0 .
5 does well if we want a strong utility guarantee.
This means that Poisson is best used when little privacy budget is available for the hyperparameter search.
Instead, the negative binomial distribution with η = 0 .allows us to improve the utility of the solution returned by the hyperparameter search, but this only holds when spending a larger privacy budget (in our example, the budget has to be at least ε
=otherwise Poisson is more advantageous).
The negative binomial with η = − 0 .
5 does very poorly.
From a runtime perspective, the distribution of K should have light tails.
All of the distributions we have considered have subexponential tails.
However, larger η corresponds to better concentration in the negative binomial distribution with the Poisson distribution having the best concentration.
Experimental Evaluation.
To conﬁrm these ﬁndings, we apply our algorithm to a real hyperparameter search task.
Speciﬁcally, we ﬁne-tune the learning rate of a convolutional neural network trained on MNIST.
We implement DP-SGD in JAX for an all-convolutional architecture with a stack of 32, 32, 64, 64, 64 feature maps generated by 3x3 kernels.
We vary the learning rate between 0.
and 1 on a logarithmic scale but ﬁx all other hyperparameters: 60 epochs, minibatch size of 256, (cid:96)clipping norm of 1, and noise multiplier of 1 . 1 .
In Figure 7, we plot the maximal accuracy achieved during the hyperparameter search for the different distributions considered previously as a function of the total privacy budget expended by the search.
The experiment is repeated 500 times and the mean result reported.
This experiment shows that the Poisson distribution achieves the best privacy-utility tradeoff for this relatively simple hyperparameter search.
This agrees with the theoretical analysis we just presented above that shows that the Poisson distribution performs well in the intermediate range of utility, as this is a simple hyperparameter search.
C ONCLUSION
Our positive results build on the work of Liu & Talwar (2019) and show that repeatedly running the base algorithm and only returning the best output can incur much lower privacy cost than naïve composition would suggest.
This however requires that we randomize the number of repetitions, rather than repeating a ﬁxed number of times.
We analyze a variety of distributions for the number of repetitions, each of which gives a different privacy/utility tradeoff.
While our results focused on the privacy implications of tuning hyperparameters with, and without, differential privacy, our ﬁndings echo prior observations that tuning details of the model architecture without privacy to then repeat training with DP affords suboptimal utility-privacy tradeoffs (Papernot et al., 2020); in this work, the authors demonstrated that the optimal choice of activation function in a neural network can be different when learning with DP, and that tuning it with DP immediately can improve the model’s utility at no changes to the privacy guarantee.
We envision that future work will be able to build on our algorithm for private tuning of hyperparameters to facilitate privacy-aware searches for model architectures and training algorithm conﬁgurations to effectively learn with them.
Limitations.
We show that hyperparameter tuning is not free from privacy cost.
Our theoretical and experimental results show that, in the setting of interest, the privacy parameter may double or even triple after accounting for hyperparameter tuning, which could be prohibitive.
In this case, one compromise would be to state both privacy guarantees – that of the base algorithm that does not account for hyperparameter tuning, and that of the overall system that does account for this.
The reader may wonder whether our positive results can be improved.
In Appendix D, we explore give some intuition for why they cannot (easily) be improved.
We also note that our results are only immediately applicable to the hyperparameter tuning algorithm from Section 3.3.
Other algorithms, in particular those that adaptively choose hyperparameter candidates will require further analysis.
Finally, among the distributions on the number of repetitions K that we have analyzed, the distribution that provides the best privacy-utility tradeoffs will depend on the setting.
While it is good to have choices, this does leave some work to be done by those using our results.
Fortunately, the differences between the distributions seem to be relatively small, so this choice is unlikely to be critical.
R EPRODUCIBILITY & E THICS S TATEMENTS
Reproducibility.
We give precise theorem statements for our main results and we have provided complete proofs in the Appendix, as well as all the necessary calculations and formulas for plotting our ﬁgures.
We have also fully speciﬁed the setup required to reproduce our experimental results, including hyperparameters.
Our algorithm is simple, fully speciﬁed and can be easily implemented.
Ethics.
Our work touches on privacy, which is an ethically sensitive topic.
If differentially private algorithms – such as ours – are applied to real-world sensitive data, then potential harms to the people whose data is being used must be carefully considered.
However, our work is not directly using real-world sensitive data.
Our main results are theoretical and our experiments use either synthetic data or MNIST, which is a standard non-private dataset
A F URTHER B ACKGROUND A. D IFFERENTIAL P RIVACY & R ÉNYI DP
For completeness, we provide some basic background on differential privacy and, in particular, Rényi differential privacy.
We start with the standard deﬁnition of differential privacy:
Deﬁnition 8 (Differential Privacy) .
A randomized algorithm M : X n → Y is ( ε, δ ) -differentially private if, for all neighbouring pairs of inputs x, x (cid:48) ∈
X n and all measurable S ⊂ Y ,
[Equation]
When δ = 0 , this is referred to as pure (or pointwise) differential privacy and we may abbreviate ( ε, 0)
-DP to ε -DP.
When δ > 0 , this is referred to as approximate differential privacy.
The deﬁnition of pure DP was introduced by Dwork et al.
(2006b)
and approximate DP was introduced by Dwork et al.
(2006a).
Note that the notion of neighbouring datasets is context-dependent, but this is often glossed over.
Our results are general and can be applied regardless of the speciﬁcs of what is a neighbouring dataset.
(However, we do require symmetry – i.e., if ( x, x (cid:48) ) are a pair of neighbouring inputs, then so are ( x (cid:48) x ) .)
Usually two datasets are said to be neighbouring if they differ only by the addition/removal or replacement of the data corresponding to a single individual.
Some papers only consider addition or removal of a person’s records, rather than replacement.
But these are equivalent up to a factor of two.
In order to deﬁne Rényi DP, we ﬁrst deﬁne the Rényi divergences:
Deﬁnition 9 (Rényi Divergences) .
Let P and Q be probability distributions on a common space Ω .
Assume that P is absolutely continuous with respect to Q – i.e., for all measurable S ⊂ Ω , if
Q ( S ) = 0 , then P ( S ) = 0 .
Let P ( x ) and Q ( x ) denote the densities of P and Q respectively.
The
KL divergence from P to Q is deﬁned as
[Equation]
The max divergence from P to Q is deﬁned as
[Equation]
For λ ∈ (1 , ∞ ) , the Rényi divergence from P to Q of order λ is deﬁned as
[Equation]
We state some basic properties of Rényi divergences; for further information see, e.g., Van Erven &
Harremos (2014).
Lemma 10.
Let P , Q , P (cid:48) , and Q (cid:48) be probability distributions.
Let λ ∈ [1 , ∞ ] .
The following hold.
• Non-negativity: D λ ( P (cid:107) Q ) ≥ 0 .
• Monotonicity & Continuity: D λ
( P (cid:107) Q ) is a continuous and non-decreasing function of λ .
• Data processing inequality (a.k.a.
Postprocessing): Let f ( P ) denote the distribution obtained by applying some (possibly randomized) function to a sample from P and let f ( Q ) denote the distribution obtained by applying the same function to a sample from Q .
Then D λ ( f ( P ) (cid:107) f
( Q ))
≤ D λ
( P (cid:107) Q ) .
• Finite case sufﬁces:
We have D λ ( P (cid:107) Q ) =
sup f D λ
( f ( P ) (cid:107) f ( Q )) even when f is restricted to functions with a ﬁnite range.
• Chain rule (a.k.a.
Composition): D λ ( P × P (cid:48)
(cid:107) Q × Q (cid:48) )
=
D λ
( P (cid:107) Q )
+ D λ ( P (cid:48)
(cid:107) Q (cid:48) ) , where P × P (cid:48) and Q × Q (cid:48) denote the product distributions of the individual distributions.
• Convexity: The function ( P, Q ) (cid:55)→ e ( λ − 1)D λ
( P (cid:107) Q ) is convex for all λ ∈ (1 , ∞ ) .
The function ( P, Q ) (cid:55)→ D λ ( P (cid:107) Q ) convex if and only if λ = 1 .
Now we can state the deﬁnition of Rényi DP (RDP), which is due to Mironov (2017).
Deﬁnition 11 (Rényi Differential Privacy) .
A randomized algorithm M : X n → Y is ( λ, ε ) -Rényi differentially private
if, for all neighbouring pairs of inputs x, x (cid:48) ∈
X n , D λ ( M ( x ) (cid:107) M
( x (cid:48) )) ≤ ε .
A closely related deﬁnition is that of zero-concentrated differential privacy (Bun & Steinke, 2016) (which is based on an earlier deﬁnition (Dwork & Rothblum, 2016) of concentrated differential privacy that does not refer to Rényi divergences).
Deﬁnition 12 (Concentrated Differential Privacy) .
A randomized algorithm M : X n → Y is ρ -zCDP
if, for all neighbouring pairs of inputs x, x (cid:48) ∈
X n and all λ ∈ (1 , ∞ ) , D λ ( M ( x ) (cid:107) M ( x (cid:48) )) ≤ ρ · λ .
Usually, we consider a family of ( λ, ε ( λ ))
-RDP guarantees, where ε ( λ ) is a function, rather than a single function.
Concentrated DP is one example of such a family, where the function is linear, and this captures the behaviour of many natural algorithms.
In particular, adding Gaussian noise to a bounded sensitivity function: If f : X n → R d has sensitivity ∆ – i.e., (cid:107) f
( x ) − f ( x (cid:48) )
(cid:107) 2 ≤ ∆ for all neighbouring x, x (cid:48) – and M : X n → R d is the algorithm that returns a sample from N ( f ( x ) , σ 2 I ) , then M satisﬁes ∆ 2 2 σ 2 -zCDP.
We can convert from pure DP to concentrated or Rényi DP as follows (Bun & Steinke, 2016).
Lemma 13.
If M satisﬁes ( ε, 0) -differential privacy, then M satisﬁes 12 ε 2 -zCDP – i.e., ( λ, 12 ε 2 λ ) -
RDP for all λ ∈ (1 , ∞ ) .
Conversely, we can convert from concentrated or Rényi DP to approximate DP as follows (Canonne et al., 2020).
Lemma 14.
If M satisﬁes ( λ, ˆ ε ) -RDP, then M satisﬁes ( ε, δ ) -DP where ε ≥ 0 is arbitrary and
[Equation]
A.
P ROBABILITY G ENERATING F UNCTIONS
Let K be a random variable supported on N ∪ { 0 } .
The probability generating function (PGF) of K is deﬁned by
[Equation]
The PGF f ( x ) is always deﬁned for x ∈ [0 , 1] , but may or may not be deﬁned for x > 1 .
The PGF characterizes K .
In particular, we can recover the probability mass function from the derivatives of the PGF (hence the name):
[Equation]
where f ( k ) ( x ) denotes the k th derivative of f ( x ) and, in particular, P [ K = 0]
= f (0) .
We remark that is is often easiest to specify the PGF and derive the probability distribution from it, rather than vice versa; indeed, we arrived at the truncated negative binomial distribution by starting with the PGF that we want and then differentiating.
We can also easily recover the moments of K from the PGF:
We have f ( k ) ( x ) = (cid:80) ∞ (cid:96) =
k P [ K = (cid:96) ] · x (cid:96) − k · (cid:96) · ( (cid:96) − 1) · ( (cid:96) − 2) · · · ( (cid:96) − k + 1) .
In particular, f (1) =
E [1] = 1 and f (cid:48) (1) =
E [ K ] and f (cid:48)(cid:48) (1) =
E
[ K ( K − 1)] .
Note that the PGF is a rescaling of the moment generating function (MGF) g ( t ) :
= E (cid:2) e tK (cid:3) =
f ( e t ) .
The PGF can be related to the MGF in another way: Suppose Λ is a random variable on [0 , ∞ ) .
Now suppose we draw K ← Poisson (Λ) .
Then the PGF of K is the MGF of Λ – i.e., E (cid:2)
x K (cid:3) =
E Λ (cid:20)
E K ← Poisson (Λ) (cid:2)
[Equation]
=
[Equation]
(cid:2)
[Equation]
· ( x
[Equation]
) (cid:3) =
g ( x − 1) , where g is the MGF of Λ .
In particular, if Λ is drawn from a Gamma distribution, then this would yield K from a negative binomial distribution which has a PGF of the form f NB ( x ) = (cid:16) 1 − (1 − γ ) x γ (cid:17) − η . 8 Note that our results work with a truncated negative binomial distribution, which is a negative binomial conditioned on K (cid:54) = 0 .
This corresponds to an afﬁne rescaling of the PGF, namely f TNB ( x ) =
f NB ( x ) − f NB (0)
f NB (1) − f NB (0) .
We can also obtain a negative binomial distribution as a compound of a Poisson distribution and a logarithmic distribution.
That is, if we draw T from a Poisson distribution and draw K 1 , K 2 , · · · , K T independently from a logarithmic distribution, then K = (cid:80) T t =1 K t follows a negative binomial distribution.
The PGF of the logarithmic distribution is given by f K t ( x ) =
E (cid:2)
x K t (cid:3)
=
log(1 − (1 − γ ) x ) log( γ ) and the PGF of Poisson is given by f T ( x ) =
E (cid:2) x T (cid:3) =
e µ · ( x − 1) .
Hence
[Equation]
, which is equivalent to f NB ( x ) = (cid:16) 1 − (1 − γ ) x γ
[Equation]
− η with η =
[Equation]
Finally we remark that we can also use the PGF to show convergence in probability.
In particular,
[Equation]
That is, if we take the limit of the negative binomial distribution as η → ∞ but the mean µ = η 1 − γγ remains ﬁxed, then we obtain a Poisson distribution.
If we take η → 0 , then f NB ( x ) → 1 , which is to say that the negative binomial distribution converges to a point mass at 0 as η → 0 .
However, the truncated negative binomial distribution converges to a logarithmic distribution as η → 0 .
A.2. P ROBABILITY G ENERATING F UNCTIONS AND U TILITY
Recall that in Section 3.6, we analyzed the expected utility and runtime of different distributions on the number of repetitions K .
Given our discussion of probability generating functions for these distributions, we can offer an alternative perspective on the expected utility and runtime.
Suppose each invocation of Q has a probability 1 /m of producing a “good” output.
This would be the case if we are considering m hyperparameter settings and only one is good—where here we consider the outcome to be binary (good or bad) for simplicity and what is a good or bad is determined only by the total order on the range Y and some threshold on the quality score (e.g., accuracy).
Then A has a probability β :
[Equation]
of outputting a good output, where f ( x ) = E (cid:2) x K (cid:3) is the probability generating function of the distribution.
If we make the ﬁrst-order approximation f (1 − 1 /m )
≈ f (1) − f (cid:48) (1) · 1 /m = 1 − E
[ K ] /m , then we have β ≈ E
[ K ] /m .
In other words, for small values of 1 /m , the probability of success is ampliﬁed by a multiplicative factor of E [ K ] .
However, the above ﬁrst-order approximation only holds for large m and, hence, small overall success probabilities β .
In practice, we want β ≈ 1 .
The different distributions (Poisson truncated negative binomial with different values of η ) have very different behaviours even with the same expectation.
In the regime where we want the overall success probability to be high (i.e., β ≈ 1 ), smaller η performs worse, because the distribution is more heavy-tailed.
The best performing distribution is the Poisson distribution, which is almost as concentrated as naïve repetition.
Figureshow the success probability β as a function of the ﬁnal ( ε, 10 − 6 ) -DP guarantee.
This demonstrates that there is a tradeoff between distributions.
More generally, we can relate the PGF of K to the expected utility of our repeated algorithm.
Let
X ∈ R be random variable corresponding to the utility of one run of the base algorithm Q .
E.g. X could represent the accuracy, loss, AUC/AUROC, or simply the quantile of output.
Now let Y ∈ R be the utility of our repeated algorithm
A which runs the base algorithm Q repeatedly K times for a random K .
That is, Y = max { X 1 , · · · , X K } where X 1 , X 2 , · · · are independent copies of X .
Let cdf X
( x ) = P [ X ≤ x ] and
[Equation]
where f ( x ) = E (cid:2) x K (cid:3) is the PGF of the number of repetitions K .
Assuming for the moment that
X is a continuous random variable, we can derive the probability density function of Y from the cumulative distribution function:
[Equation]
This allows us to compute the expected utility:
[Equation]
In particular, we can compute the expected quantile (8) in which case X is uniform on [0 , 1] and, hence, cdf X ( x ) = x and pdf X ( x ) = 1 for x ∈ [0 , 1] .
Integration by parts gives
E [
[Equation]
Note that
[Equation]
Finally, we also want to ensure that the runtime of our hyperparameter tuning algorithm is wellbehaved.
In particular, we wish to avoid heavy-tailed runtimes.
We can obtain tail bounds on the number of repetitions K from the PGF or MGF too:
For all t > 0 , we have
[Equation]
Thus, if the PGF f ( x ) = E (cid:2) x K (cid:3) is ﬁnite for some x = e t > 1 , then we obtain a subexponential tail bound on K .
B P ROOFS FROM S ECTIONB. P ROOF OF G ENERIC B OUND
Proof of Lemma 7.
We assume that Y is a ﬁnite set and that P [ K = 0] = 0 ; this is, essentially, without loss of generality.
9 Denote Q ( ≤ y ) :
= (cid:80) y (cid:48)
∈Y I [ y (cid:48) ≤ y ] · Q ( y (cid:48) ) and similarly for Q ( < y ) and analogously for Q (cid:48) in place of Q .
For each y ∈ Y , we have
[Equation]
and, likewise, A (cid:48)
[Equation]
) =
Q
[Equation]
y ) ·
[Equation]
f
[Equation]
X
[Equation]
Thus e
[Equation]
=
[Equation]
The second inequality follows from Hölder’s inequality.
The ﬁrst inequality follows from the fact that, for any λ ∈ R , the function h : (0 , ∞ ) 2 → (0 , ∞ ) given by h ( u, v ) =
u λ · v 1 − λ is convex and, hence, E
[ U ] λ E [ V ] 1 − λ = h ( E [( U, V )])
≤ E [ h ( U, V )]
=
E (cid:2) U λ · V 1 − λ (cid:3) for any pair of positive random variables ( U, V ) .
Note that we require X to be uniform on [ Q ( < y ) , Q ( ≤ y )] and X (cid:48) to be uniform on [ Q (cid:48) ( < y ) , Q (cid:48) ( ≤ y )] , but their joint distribution can be arbitrary.
We will couple them so that X − Q ( <y ) Q ( y )
[Equation]
In particular, this implies that, for each y ∈ Y , there exists some t ∈ [0 , 1] such that
[Equation]
Hence
[Equation]
To prove the result
[Equation]
we simply ﬁx y ∗ ∈ Y and t ∗ ∈ [0 , 1] achieving the maximum above and deﬁne
[Equation]
B. P ROOFS OF D ISTRIBUTION - SPECIFIC B OUNDS Truncated Negative Binomial Distribution
Proof of Theorem 2.
The probability generating function of the truncated negative binomial distribution is
[Equation]
Thus
[Equation]
Now we delve into the privacy analysis: Let Q = Q ( x ) and Q (cid:48)
=
Q ( x (cid:48) ) denote the output distributions of Q on two neighbouring inputs.
Similarly, let A
=
A ( x ) and A (cid:48)
=
A ( x (cid:48) ) be the corresponding pair of output distributions of the repeated algorithm.
By Lemma 7, for appropriate values q, q (cid:48) ∈ [0 , 1] and for all λ > 1 and all ˆ λ > 1 , 10 we have
[Equation]
q ))
u (cid:17) ( ˆ λν =
( λ − 1)(1 + η ) and (1 − ˆ λ )
ν
+ u = − λ
η + 1) )
≤ D λ
( Q (cid:107) Q (cid:48) )
+ λ − 1 log (cid:16) γ η +1 · E [ K ] · (cid:16) γ + (1 − γ ) ·
e (ˆ λ − 1)D
ˆ λ ( Q (cid:48) (cid:107) Q )
(cid:17) ν · ( γ + (1 − γ )(1 − q ))
u (cid:17) (
≤ D λ
( Q (cid:107) Q (cid:48) )
+ λ
[Equation]
1 log (cid:16)
[Equation]
] · (cid:16)
[Equation]
[Equation] [Equation]
(ˆ
[Equation]
ˆ
[Equation]
(cid:48) (cid:107)
[Equation]
(cid:17)
[Equation]
(cid:17) ( γ ≤ γ + (1 − γ )(1 − q ) and u ≤ 0 ) =
D λ ( Q (cid:107) Q (cid:48) )
+ ν λ − 1 log (cid:16) γ + (1 −
[Equation]
) · e (ˆ λ
[Equation]
1)D ˆ λ ( Q (cid:48) (cid:107) Q )
(cid:17) + λ − 1 log (cid:0)
[Equation]
· E [ K ]
[Equation]
(cid:1)
=
D λ ( Q (cid:107) Q (cid:48) )
+ ν λ −(cid:16)
(ˆ λ − 1)D
ˆ λ ( Q (cid:48) (cid:107) Q ) + log (cid:16) 1 − γ · (cid:16) 1 − e − (ˆ λ − 1)D
ˆ λ ( Q (cid:48)
[Equation]
and u = − (1 +
[Equation] [Equation]
+
[Equation] [Equation]
log
[Equation]
E
[Equation]
K ]
[Equation]
λ
[Equation] [Equation]
Proof of Corollary 4.
We assume that Q : X n → Y is a randomized algorithm satisfying ρ
-zCDP – i
[Equation]
e., ( λ, ρ · λ ) -Rényi DP for all λ > 1 .
Substituting this guarantee into Theorem 2 (i
[Equation]
e., setting ε = ρ · λ and ˆ ε = ρ · ˆ λ ) gives that the repeated algorithm A satisﬁes ( λ, ε (cid:48) )
-RDP for
[Equation]
This holds for all λ ∈ (1 , ∞ ) and all ˆ λ ∈ [1 , ∞ ) .
We set ˆ λ = (cid:112) log(1 /γ )
/ρ to minimize this expression.
Note that we assume ρ ≤ log(1 /γ ) and hence this is a valid setting of ˆ λ ≥ 1 .
This reduces the expression to
[Equation]
This bound is minimized when λ − 1 = (cid:112) log( E [ K ]) /ρ .
If λ − 1 < (cid:112) log( E [ K ]) /ρ , then we can apply the monotonicity property of Renyi DP (Remark 5 and Lemma 10) and substitute in the bound with this optimal λ .
That is, we obtain the bound ε (cid:48) ≤
[Equation]
Proof of the Poisson Distribution Bound
Proof of Theorem 6.
The probability generating function for the Poisson distribution is f ( x ) =
E (cid:2)
x K (cid:3) =
e µ ( x − 1) .
Thus f (cid:48) ( x ) = µ · e µ ( x − 1) .
As in the previous proofs, let x and x (cid:48) be neighbouring inputs.
Denote Q = Q ( x ) , Q (cid:48)
=
Q ( x (cid:48) ) ,
A =
A ( x ) , and A (cid:48)
=
A ( x ) .
By Lemma 7,
[Equation]
(by our (ˆ ε, ˆ δ ) -DP assumption on Q and since 1 − q and 1 − q (cid:48) are postprocessings)
[Equation]
where the ﬁnal inequality follows from our assumption that e ˆ ε ≤
+ 1 λ − 1 .
C C ONDITIONAL S AMPLING A PPROACH
In the main text, we analyzed the approach where we run the underlying algorithm Q a random number of times according to a carefully-chosen distribution and output the best result from these independent runs.
An alternative approach – also studied by Liu & Talwar (2019) – is to start with a pre-deﬁned threshold for a “good enough” output and to run Q repeatedly until it produces such a result and then output that.
This approach has some advantages, namely being simpler and avoiding the heavy-tailed behaviour of the logarithmic distribution while attaining the same kind of privacy guarantee.
However, the disadvantage of this approach is that we must specify the acceptance threshold a priori.
If we set the threshold too high, then we may have to keep running Q for a long time.
11 If we set the threshold too low, then we may end up with a suboptimal output.
We analyze this approach under Rényi DP, thereby extending the results of Liu & Talwar (2019).
Our algorithm A now works as follows.
We start with a base algorithm Q and a set of good outputs
S .
Now A ( x ) computes y = Q
( x ) and, if y ∈ S , then it returns y and halts.
Otherwise, A repeats the procedure.
This is equivalent to sampling from a conditional distribution Q ( x ) | Q ( x ) ∈ S .
The number of times Q is run will follow a geometric distribution with mean 1 /Q ( S ) .
Proposition 15.
Let λ ∈ (1 , ∞ ) .
Let Q and Q (cid:48) be probability distributions on Ω with D λ ( Q (cid:107) Q (cid:48) ) <
∞ .
Let S ⊂ Ω have nonzero measure under Q (cid:48) and also under Q .
Let Q S and Q (cid:48)
S denote the conditional distributions of Q and Q (cid:48) respectively conditioned on being in the set S .
That is,
Q S ( E ) =
Q ( E ∩ S ) /Q
( S ) and Q (cid:48)
S ( E ) =
Q (cid:48)
( E ∩ S ) /Q
(cid:48) ( S ) for all measurable E ⊂ Ω .
Then, for all p, q, r ∈ [1 , ∞ ] satisfying 1 /p
+ 1 /q + 1 /r
= 1 , we have
[Equation]
Proof.
For x ∈ Ω , denote the various distributional densities at x (relative to some base measure) by Q S ( x ) , Q (cid:48) S ( x ) , Q ( x ) , and Q (cid:48)
( x ) .
We have Q S ( x ) =
Q ( x ) I [ x ∈ S ] /Q
( S ) and Q (cid:48) S ( x ) =
Q (cid:48)
( x ) I [ x ∈ S ] /Q (cid:48) ( S ) .
Now we have
[Equation]
inequality)
[Equation]
The number of parameters in Proposition 15 is excessive.
Thus we provide some corollaries that simplify the expression somewhat
[Equation]
Corollary
[Equation]
Let λ
[Equation]
Q
[Equation]
Q (cid:48) , S
[Equation]
Q S
[Equation]
Q (cid:48)
S be as in Proposition 15.
The following inequalities all hold.
[Equation]
The ﬁrst inequality in Corollary 16 is essentially the result given by Liu & Talwar (2019): If Q satisﬁes ε -DP, then A satisﬁes 2 ε -DP.
Figure 8 plots the guarantee of the second inequality in Corollary 16 when D λ ( Q (cid:107) Q (cid:48) )
= 0 .
1 λ
and
D λ − 1 ( Q (cid:48) (cid:107) Q ) = 0 .
1( λ − 1) .
D N EGATIVE R ESULTS ON I MPROVEMENTS TO OUR A NALYSIS
It is natural to wonder whether our results could be further improved.
In this section, we give some examples that demonstrates that quantitatively there is little room for improvement.
D. W HY A FIXED NUMBER OF REPETITIONS DOES NOT RESULT IN GOOD PRIVACY .
We ﬁrst consider more closely the strawman approach discussed in Section 3.2: the base algorithm Q is repeated a ﬁxed number of times k
and we return the best output.
This corresponds to picking k from a point mass distribution.
To understand why it performs so poorly from a privacy standpoint, we ﬁrst apply our main result from Section 3.5 to the resulting point mass distribution.
Point Mass: Suppose K is just a point mass – i.e., P [ K = k ] = 1 .
So A runs the algorithm Q a deterministic number of times.
Then the probability generating function (PGF) is f ( x ) =
x k and its derivative is f (cid:48)
( x ) = k · x k − 1 .
Let Q denote the base algorithm.
We abuse notation and let Q = Q ( x ) and Q (cid:48)
=
Q ( x (cid:48) ) , where x and x (cid:48) are neighbouring inputs.
Similarly, let A
=
A ( x ) and A (cid:48)
=
A ( x (cid:48) ) be the ﬁnal output distributions obtained by running Q and Q (cid:48) repeatedly k times and returning the best result.
We follow the same pattern of analysis that we applied to the other distributions in
Theorems 2 and 6: Lemma 7 gives the bound
[Equation]
where the ﬁnal inequality follows from the fact that Bern ( q ) and Bern ( q (cid:48) ) are postprocessings of Q and Q (cid:48) respectively.
This bound is terrible.
In fact, it is slightly worse than a naïve composition analysis which would give D λ
( A (cid:107) A (cid:48) )
≤ D λ (cid:0) Q ⊗ k (cid:13)(cid:13) Q (cid:48)⊗ k (cid:1)
=
k · D λ ( Q (cid:107) Q (cid:48) ) .
It shows that a deterministic number of repetitions does not yield good privacy parameters, at least with this analysis.
It is surprising that running the base algorithm Q a ﬁxed number of times k and returning the best output performs so poorly from a privacy standpoint.
We will now give a simple example that demonstrates that this is inherent and not just a limitation of our analysis.
Liu & Talwar (2019,
Appendix B) give a similar example.
Proposition 17.
For all ε > 0 , there exists a ε -DP algorithm Q : X n → Y such that the following holds.
Deﬁne an algorithm A : X n → Y that runs Q a ﬁxed number of times k and returns the best output from these runs.
Then A is not ˆ ε -DP for any ˆ ε < kε .
Furthermore, for all λ > 1 , A is not ( λ, ˆ ε ( λ ))
-Rényi DP for any ˆ ε ( λ ) < ε (cid:48) ( λ ) , where
[Equation]
Proof.
The base algorithm is simply randomized response.
We will let Y =
{ 1 , 2 } with the total order preferring 1 , then 2 .
We will deﬁne a pair of distributions Q and Q (cid:48) on { 1 , 2 } and then the base algorithm is simply set so that these are its output distributions on a pair of neighbouring inputs.
We let
[Equation]
Then D ∞ ( Q (cid:107) Q (cid:48) )
=
D ∞ ( Q (cid:48) (cid:107) Q ) = ε .
Thus we can ensure that the base algorithm yielding this pair of distributions is ε -DP.
Now we look at the corresponding pair of distributions from repeating the base algorithm k times.
We have
[Equation]
The ﬁrst part of the result follows:
[Equation]
For all λ > 1 ,
[Equation]
Hence
D
[Equation]
The second part of Proposition 17 shows that this problem is not speciﬁc to pure DP.
For λ ≥ 1+1 /ε , we have ε
[Equation]
) , so we are paying linearly in k .
However, Proposition 17 is somewhat limited to pure ε -DP or at least ( λ, ε ( λ ))
-RDP with not-toosmall values of λ .
This is because the “bad” event is relatively low-probability.
Speciﬁcally, the high privacy loss event has probability (1 + e − ε ) − k .
This is small, unless ε ≥ Ω(log k ) .
We can change the example to make the bad event happen with constant probability.
However, the base algorithm will also not be pure ε -DP any more.
Speciﬁcally, we can replace the two distributions in Proposition 17 with the following:
[Equation]
If we repeat this base algorithm a ﬁxed number of times k , then the corresponding pair of distributions is given by
[Equation]
Now we have D ∞ ( A (cid:107) A (cid:48) )
=
kε 0 and the bad event happens with probability e − 1 ≈ 0 .
On the other hand, D ∞ ( Q (cid:107) Q (cid:48) ) =
ε 0 like before, but D ∞ ( Q (cid:48)
(cid:107) Q )
= log(1 − exp( − ε 0 − 1 /k ))
− log(1 − exp( − 1 /k ))
≈ log( kε
+ 1) .
But we still have a good guarantee in terms of Renyi divergences.
In particular, D 1 ( Q (cid:48) (cid:107) Q ) ≤ ( ε 0 + 1 /k ) log( kε 0 + 1) , and we can set ε 0 ≤ o (1 / log k ) to ensure that we get reasonable ( λ, ε ( λ ))
-RDP guarantees for small λ .
At a higher level, it should not be a surprise that this negative example is relatively brittle.
Our positive results show that it only takes a very minor adjustment to the number of repetitions to obtain signiﬁcantly tighter privacy guarantees for hyperparameter tuning than what one would obtain from naive composition.
In particular, running a ﬁxed number of times k versus running Poisson ( k ) times is not that different, but our positive results show that it already circumvents this problem in general.
D. T IGHT EXAMPLE FOR CONDITIONAL SAMPLING .
We are also interested in the tightness of our generic results.
We begin by studying the conditional sampling approach outlined in Appendix C.
This approach is simpler and it is therefore easier to give a tight example.
This also proves to be instructive for the random repetition approach in Section 3.
Our tight example for the conditional sampling approach consists of a pair of distributions Q and Q (cid:48) .
These should be thought of as the output distributions of the algorithm Q on two neighbouring inputs.
The distributions are supported on only three points.
Such a small output space seems contrived, but it should be thought of as representing a partition of a large output space into three sets.
The ﬁrst set is where the privacy loss is large and the second set is where the privacy loss is very negative, while the third set is everything in between.
Fix s, t > 0 and a ∈ [0 , 1 / 4] .
Note (1 − 2 a ) − 1 ≤ e 3 a .
Let
[Equation]
Intuitively, the set S corresponds to the outputs that (1) have large privacy loss or (2) very negative privacy loss and we exclude (3) the outputs with middling privacy loss.
Once we condition on S we still have the outputs (1) with large privacy loss, but that privacy loss is further increased because of the renormalization.
Speciﬁcally, the negative privacy loss means the renormalization constants are very different – Q ( S ) =
[Equation]
e
[Equation]
s (cid:28) Q
[Equation]
( S )
= a · (1 + e − s − t ) – if s is large.
In effect, the negative privacy loss becomes a positive privacy loss that is added to the already large privacy loss.
We make the above intuition more precise by calculating the various quantities.
For all λ > 1 , we have
[Equation]
R e n y i
d i v e r g e
n
c e
D ( Q S | Q 0 S ) upper bound
D ( Q | Q 0 ) =
D ( Q 0 | Q )
[Equation]
This example shows that our upper bound is tight up to small factors, namely the lower order terms we ignore with ≈ and λ − 2 λ − 1 log 2 .
Figure 8 illustrates how the upper and lower bounds compare
D. T IGHTNESS OF OUR GENERIC RESULT .
Now we consider the setting from Section 3 where our base algorithm is run repeatedly a random number of times and the best result is given as output.
Let Q : X n → Y denote the base algorithm.
Assume Y is totally ordered.
Let K ∈ N be a random variable and let f ( x ) = E (cid:2) x K (cid:3) be its probability generating function.
Deﬁne A : X n → Y to be the algorithm that runs Q repeatedly K times and returns the best output.
For a tight example, we again restrict our attention to distributions supported on three points:
[Equation]
Here the total ordering prefers the ﬁrst option (corresponding to the ﬁrst coordinate probability), then the second, and then the third, which implies the expressions for A and A (cid:48) .
Note that the probability values are not necessarily ordered the same way as the ordering on outcomes.
Now we must set these four values to show tightness of our results
[Equation]
We make the ﬁrst-order approximation
[Equation]
We take this approximation and get
[Equation]
where the ﬁnal approximation assumes that the second term is dominant in the equation
[Equation]
Contrast this with our upper bound (Lemma 7), which says
[Equation]
where q and q (cid:48) are arbitrary postprocessings of Q and Q (cid:48) .
In particular, we can set the values so that q = c and q (cid:48) =
c (cid:48) .
This is not a formal proof, since we make imprecise approximations.
But it illustrates that our main generic result (Lemma 7) is tight up to low order terms.
D. S ELECTION & L OWER B OUNDS
Private hyperparameter tuning is a generalization of the private selection problem.
In the private selection problem we are given a utility function u : X n × [ m ] → R which has sensitivity 1 in its ﬁrst argument – i.e., for all neighbouring x, x (cid:48) ∈
X n and all j ∈ [ m ] = { 1 , 2 , · · · , m } , we have | u ( x, j ) − u ( x (cid:48) , j ) | ≤ 1 .
The goal is to output and approximation to arg max j ∈ [ m ] u ( x, j ) subject to differential privacy.
The standard algorithm for private selection is the exponential mechanism (McSherry & Talwar, 2007).
The exponential mechanism is deﬁned by
[Equation]
It provides ( ε, 0) -DP
and, at the same time, 18 ε 2 -zCDP
(Rogers & Steinke, 2021).
On the utility side, we have the guarantees
[Equation]
for all inputs x and all β > 0 (Bassily et al., 2021, Lemma 7.1) (Dwork & Roth, 2014, Theorem 3.11).
It is also well-known that the exponential mechanism is optimal up to constants.
That is, ( ε, 0) -DP selection entails an additive error of Ω(log( m ) /ε )
(Steinke & Ullman, 2017).
Our results can be applied to the selection problem.
The base algorithm Q ( x ) will simply pick an index j ∈ [ m ] uniformly at random and the privately estimate u ( x, j ) by adding Laplace or Gaussian noise ξ and output the pair ( j, u ( x, j ) + ξ ) .
The total order on the output space [ m ] × R simply selects for the highest estimated utility (breaking ties arbitrarily).
If we take ξ to be Laplace noise with scale 1 /ε , then Q is ( ε, 0) -DP.
Applying Corollary 3 yields a ((2 + η ) ε, 0)
-DP algorithm A with the following utility guarantee.
Let
K be the number of repetitions and let ( j 1 , u ( x, j 1 ) + ξ 1 ) , · · · , ( j K , u ( x, j K ) + ξ K ) be the outputs from the runs of the base algorithm.
The probability that the repeated algorithm A will consider j ∗ := arg max
[Equation]
where f ( x ) = E (cid:2) x K (cid:3) is the probability generating function of the number of repetitions K .
For each noise sample, we have ∀ k P [ | ξ k | ≤ t ] ≥ 1 − e − εt for all t > 0 .
Thus, for all t > 0 , the probability that all noise samples are smaller than t is P [ ∀ k ∈
[ K ] | ξ k | ≤ t ] = f
(1 − e − εt ) .
By a union bound, we have P [ u ( x, M ( x )) ≥ u ( x, j ∗ ) − 2 t ] ≥ f (1 − e − εt ) − f (1 − 1 /m ) for all t > 0 .
Setting η = 0 , yields f ( x ) =
log(1 − (1 − γ ) x ) log γ , so P [ u ( x, M ( x )) ≥ u ( x, j ∗ ) − 2 t ] ≥ 1 log(1 /γ ) log (cid:18)
+ 1 − γγ · 1 m 1+ 1 − γγ · e − εt (cid:19) .
Now set t = log( m 10 − 1) /ε
and γ = 1 exp( εt )+
= m − 10 so that 1 − γγ e − εt
= 1 and 1 −
γγ 1 m = m 9 − 1 m .
Then
P (cid:2) u ( x, M ( x )) ≥ u ( x, j ∗ ) − 20 ε log m (cid:3) ≥
[Equation]
(cid:16)
[Equation]
(cid:17) ≥
[Equation] [Equation]
m .
That is, we can match the result of the exponential mechanism up to (large) constants.
In particular, this means that the lower bounds for selection translate to our results – i.e., our results are tight up to constants.
E E XTENDING OUR R ESULTS TO A PPROXIMATE DP
Our results are all in the framework of Rényi DP.
A natural question is what can be said if the base algorithm instead only satisﬁes approximate DP – i.e., ( ε, δ ) -DP with δ > 0 .
Liu & Talwar (2019) considered these questions and gave several results.
We now brieﬂy show how to our results can be extended in a black-box fashion to this setting.
We begin by deﬁning approximate Rényi divergences and approximate Rényi DP:
Deﬁnition 18 (Approximate Rényi Divergence) .
Let P and Q be probability distributions over Ω .
Let λ ∈ [1 , ∞ ] and δ ∈ [0 , 1] .
We deﬁne
[Equation]
D λ
( P (cid:48)
(cid:107) Q (cid:48) ) :
P = (1 − δ ) P (cid:48)
+ δP (cid:48)(cid:48) , Q = (1 − δ ) Q (cid:48)
+ δQ (cid:48)(cid:48) } , where P = (1 − δ ) P (cid:48)
+ δP (cid:48)(cid:48) denotes the fact that P can be expressed as a convex combination of two distributions P (cid:48) and P (cid:48)(cid:48) with weights 1 − δ and δ respectively.
Deﬁnition 19 (Approximate Rényi Differential Privacy) .
A randomized algorithm M : X n → Y is δ -approximately ( λ, ε ) -Rényi differentially private
if, for all neighbouring pairs of inputs x, x (cid:48) ∈
X n ,
D δλ ( M ( x ) (cid:107) M
( x (cid:48) )) ≤ ε .
Deﬁnition 19 is an extension of the deﬁnition of approximate zCDP
(Bun & Steinke, 2016).
Some remarks about the basic properties of approximate RDP are in order:
• ( ε, δ ) -DP is equivalent to δ -approximate ( ∞ , ε ) -RDP.
• ( ε, δ ) -DP implies δ -approximate ( λ, 12 ε 2 λ ) -RDP for all λ ∈ (1 , ∞ ) .
• δ -approximate
( λ, ε ) -RDP implies (ˆ ε, ˆ δ ) -DP for ˆ δ
= δ + exp(( λ − 1)(ˆ ε − ε ))
λ · (cid:18) 1 − 1 λ (cid:19) λ
−. • δ -approximate ( λ, ε ) -Rényi
differential privacy is closed under postprocessing.
• If M 1 is δ 1 -approximately
( λ, ε 1 ) -Rényi differentially private and M 2 is δ 2 -approximately
( λ, ε 2 ) -Rényi
differentially private, then their composition is ( δ 1 + δ 2 ) -approximately
( λ, ε 1 + ε 2 ) -RDP.
Our results for Rényi DP can be extended to approximate Rényi DP by the following Lemma.
Lemma 20.
Assume Y is a totally ordered set.
For a distribution Q on Y and a random variable
K supported on N ∪ { 0 } , deﬁne A KQ as follows.
First we sample K .
Then we sample from Q independently K times and output the best of these samples.
This output is a sample from A .
Let Q, Q (cid:48) , Q 1 − δ 0 , Q δ 0 , Q (cid:48) 1 − δ 0 , Q (cid:48)
δ 0 be distributions on Y satisfying Q =
(1 − δ 0 ) Q 1 − δ
+ δ 0 Q
δ 0 and
Q (cid:48)
= (1 − δ 0 ) Q (cid:48)
1 − δ
+ δ 0 Q (cid:48)
δ 0 .
Let K be a random variable on N ∪ { 0 } and let f ( x ) = E (cid:2) x K (cid:3) be the probability generating function of K .
Deﬁne a random variable K (cid:48) on N ∪ { 0 } by P [ K (cid:48)
=
k ] =
P [ K = k ] · (1 − δ 0 )
k /f (1 − δ 0 ) .
Then, for all λ ≥ 1 , we have
[Equation]
where
[Equation]
= 1 − f
[Equation]
How do we use this lemma?
We should think of A KQ as representing the algorithm we want to analyze.
The base algorithm Q satisﬁes δ 0 -approximate ( λ, ε ) -RDP.
The above lemma says it sufﬁces to analyze the algorithm A K (cid:48)
˜ Q where ˜ Q satisﬁes ( λ, ε ) -RDP.
We end up with a δ -approximate RDP result, where the ﬁnal δ depends on δ 0 and the PGF of K .
As an example, we can combine Lemma 20 with Theorem 6 to obtain the following result for the approximate case.
Corollary 21.
Let Q : X n → Y be a randomized algorithm satisfying ( ε 0 , δ 0 ) -DP.
Assume Y is totally ordered.
Let µ > 0 .
Deﬁne an algorithm A : X n → Y as follows.
Draw K from a Poisson distribution with mean µ .
Run Q ( x ) repeatedly K times.
Then A ( x ) returns the best value from the K runs.
(If K = 0 , A ( x ) returns some arbitrary output independent from the input x .)
For all λ ≤ 1 + 1 e ε − 1 , the algorithm A satisﬁes δ (cid:48) -approximate ( λ, ε (cid:48) ) -RDP where
[Equation]
Proof of Lemma 20.
For a distribution P on Y and an integer k ≥ 0 , let max P k denote the distribution on Y obtained by taking k independent samples from P and returning the maximum value per the total ordering on Y .
(If k = 0 , this is some arbitrary ﬁxed distribution.)
Using this notation, we can express A KQ as a convex combination:
[Equation]
Suppose P = (1 − δ ) P (cid:48)
+ δP (cid:48)(cid:48) is a convex combination.
We can view sampling from P as a two-step process: ﬁrst we sample a Bernoulli random variable B ∈ { 0 , 1 } with expectation δ ; if B = 0 , we return a sample from P (cid:48) and, if B = 1 , we return a sample from P (cid:48)(cid:48) .
Thus, if we draw k independent samples from P like this, then with probability (1 − δ )
k all of these Bernoullis are
and we generate k samples from P (cid:48) ; otherwise, we generate some mix of samples from P (cid:48) and P (cid:48)(cid:48) .
Hence we can write max P k = (1 − δ ) k max( P (cid:48) )
k
+ (1 − (1 − δ ) k ) P (cid:48)(cid:48)(cid:48) for some distribution P (cid:48)(cid:48)(cid:48) .
It follows that we can express
[Equation]
P ∗ for some distributions P 0 , P 1 , · · · and (1 − f (1 − δ 0 ))
P ∗ = (cid:80) ∞
k =
P [ K = k ](1 − (1 − δ 0 ) k ) P k .
Similarly, we can express A KQ (cid:48)
=
f (1 − δ 0 )
A K (cid:48) Q (cid:48)
1 − δ 0 + (1 − f (1 − δ 0 )) P (cid:48)∗ for some distribution P (cid:48)∗ .
Using these convex combinations we have, by the deﬁnition of approximate Rényi divergence,
[Equation]
as δ = 1 − f (1 − δ 0 ) .
Proof of Corollary 21.
Fix neighbouring inputs x, x (cid:48) and let Q = Q ( x ) and Q (cid:48)
=
Q ( x (cid:48) ) be the corresponding pair of output distributions from the base algorithm.
Then, in the notation of Lemma 20,
A ( x ) =
A KQ and A ( x (cid:48) )
=
A KQ (cid:48) for K ∼ Poisson ( µ ) .
Setting δ (cid:48)
= 1 − f (1 − δ 0 )
= 1 − e − µ · δ 0 ≤ µ · δ 0 , we have
[Equation]
where K (cid:48) ∼ Poisson ( µ · (1 − δ 0 )) .
Now we apply Theorem 6 to the algorithm corresponding to the pair of distributions
A K (cid:48)
Q 1 − δ 0 and
A K (cid:48) Q (cid:48)
1 − δ 0 .
The base algorithm, corresponding to the pair Q 1 − δ 0 and Q (cid:48) 1 − δ 0 satisﬁes ( ε 0 , 0) -DP.
This yields
[Equation]
if e ε 0 ≤ 1 + 1 / ( λ − 1) .
Setting λ
= 1 + 1 / ( e ε 0 − 1) and applying monotonicity (Remark 5 and
Lemma 10) and we obtain the result.
E. T RUNCATING THE N UMBER OF R EPETITIONS
Another natural question is what happens if we truncate the distribution of the number of repetitions
K .
For example, we may have an upper limit on the acceptable runtime.
This does not require relaxing to approximate DP, as done by Liu & Talwar (2019).
Let K be the non-truncated number of repetitions and let f ( x ) = E (cid:2) x K (cid:3) be the PGF.
Let m ∈ N .
Let ˜ K be the truncated number of repetitions.
That is, P (cid:104) ˜
K = k (cid:105) =
I [ K ≤ m ] · P [ K = k ] / P [ K ≤ m ] .
Let ˜ f
( x ) =
E (cid:104) x
˜ K (cid:105) be the corresponding PGF.
We have f (cid:48)
( x ) = (cid:80) ∞
k =1 k · x k − 1 · P [ K = k ] and ˜ f (cid:48) ( x ) = (cid:80) mk =1 k · x k − 1 · P [ K = k ] P [ K ≤ m ] .
Hence, for x ∈ [0 , 1] ,
[Equation]
Now ˜ f
[Equation]
x ) · P [ K ≤ m ] =
[Equation] [Equation]
[ K
[Equation]
[ K
[Equation]
m ]] .
Thus
[Equation]
˜
[Equation]
Now we can bound the quantity of interest in Lemma 7:
For all q, q
[Equation]
∈ [0 , 1] , we have
[Equation]
This gives us a generic result for truncated distributions:
Lemma 22 (Generic Bound (Lemma 7) for Truncated distributions) .
Fix λ > 1 and m ∈ N .
Let
K be a random variable supported on N ∪ { 0 } .
Let f : [0 , 1] → R be the probability generating function of K – i.e., f ( x )
[Equation]
Let Q and Q (cid:48) be distributions on Y .
Assume Y is totally ordered.
Deﬁne a distribution A on Y as follows.
First we sample ˜ K which is K conditioned on K ≤ m – i.e. P (cid:104)
˜ K
= k (cid:105) =
P [ K = k | K ≤ m ] .
Then we sample from Q independently ˜
K times and output the best of these samples.
This output is a sample from A .
We deﬁne A (cid:48) analogously with Q (cid:48) in place of Q .
Then
[Equation] [Equation]
where q and q (cid:48) are probabilities attained by applying the same arbitrary postprocessing to Q and
Q (cid:48) respectively – i.e., there exists a function g : Y → [0 , 1] such that q =
E X ← Q [ g ( X )] and q (cid:48) =
[Equation]
This will give almost identical bounds to the using the non-truncated distribution as long as P [ K > m ] (cid:28) 1 and E [ K · I [ K > m ]] (cid:28) E [ K ] , which should hold for large enough m .
(cid:48) .