Composition Theorems for Interactive Differential Privacy
Abstract
An interactive mechanism is an algorithm that stores a data set and answers adaptively chosen queries to it.
The mechanism is called differentially private, if any adversary cannot distinguish whether a specific individual is in the data set by interacting with the mechanism.
We study composition properties of differential privacy in concurrent compositions.
In this setting, an adversary interacts with k interactive mechanisms in parallel and can interleave its queries to the mechanisms arbitrarily.
Previously, Vadhan and Wang [2021] proved an optimal concurrent composition theorem for pure-differential privacy.
We significantly generalize and extend their results.
Namely, we prove optimal parallel composition properties for several major notions of differential privacy in the literature, including approximate DP, Rényi DP, and zero-concentrated DP.
Our results demonstrate that the adversary gains no advantage by interleaving its queries to independently running mechanisms.
Hence, interactivity is a feature that differential privacy grants us for free.
Concurrently and independently of our work, Vadhan and Zhang [2022] proved an optimal concurrent composition theorem for f -DP
[Dong et al., 2022], which implies our result for the approximate DP case.
Introduction
By now, differential privacy [Dwork et al., 2006b] has been widely accepted as a standard framework for protecting individual privacy when performing data analysis on data sets that may contain sensitive information of individuals (see, e.g., the surveys by Dwork and Roth [2014], Vadhan [2017]).
Let M be an algorithm that runs on a data set x and calculates some information about it.
Roughly speaking, M is called differentially private, if the output distribution of A remains nearly identical when we arbitrarily modify a single entry in x .
One essential feature of differential privacy is its composability .
Composition captures the scenario where a data analyst runs k differentially private algorithms sequentially and releases the results afterward.
Typically, a composition theorem has the following form: if each of the k algorithms satisfies differential privacy, then the analyst’s output is still differentially private with moderately degraded privacy parameters.
Composition theorems are important for at least two reasons.
First, we might want to perform computation tasks on the same data set multiple times and still have reasonable control over the privacy loss.
In this case, composition theorems reveal how the privacy guarantee degrades over time.
More importantly, composition theorems allow us to build more complex and powerful differentially- private algorithms from simple primitives, and argue the privacy guarantee of the combined algorithm in a straightforward way.
There is a rich literature concerning the composition property of differential privacy (see, e.g., Dwork et al.
[2006a, 2010], Kairouz et al.
[2015], Murtagh and Vadhan [2018], Bassily et al.
However, most existing composition theorems only consider the scenario where an analyst runs several private algorithms sequentially .
That is, the analyst will only move on to the next algorithm after finishing their computation with the previous one.
In contrast, many fundamental primitives in differential privacy are interactive in nature, such as the sparse vector technique [Dwork et al., 2009,
Roth and Roughgarden, 2010] and private multiplicative weight updates [Hardt and Rothblum, 2010].
Hence, the interactivity issue appears to be a significant limitation of current composition theorems.
Namely, the data analyst may want to communicate with several interactive mechanisms concurrently , and interleave its queries to the mechanisms arbitrarily.
A sequential composition theorem completely fails to capture this scenario.
Also, in practice, deployments of DP algorithms often demand a better understanding of concurrent compositions of interactive mechanisms [Hay et al., 2020].
Recently, Vadhan and Wang [2021] initiated a study of concurrent compositions and proved an optimal concurrent composition theorem for pure differential privacy.
In this work, we significantly advance this research direction by proving optimal concurrent composition theorems for several popular notions of differential privacy, including approximate DP, Rényi DP, zero-concentrated DP and truncated concentrated DP.
1.1 Setup
Before we continue, we set up necessary pieces of notation.
We use X and Y to denote the domain of query messages and responses, respectively.
We assume that both X and Y are finite sets.
This assumption is for easing some mathematical manipulation and is not restrictive: all practical applications of differential privacy have finite input and output spaces anyway.
For a set S , denote by ∆( S ) the set of all possible distributions supported over S .
We define interactive systems below.
Definition 1 (Interactive system) .
An interactive system is a (randomized) algorithm M : ( X ×Y ) ∗ ×
X → ∆( Y ) .
The input to M is an interaction history ( x 1 , y 1 ) , ( x 2 , y 2 ) , . . .
, ( x t , y t ) ∈
( X × Y ) t together with a query x t +1 .
The output of M is denoted by y t
+1 ∼ M
(( x i , y i ) i ∈ [ t ] , x t +1 ) .
A technicality worth mentioning is that due to the internal memory and randomness of an interactive system M , the response of M to the ( t + 1) -th
query might be correlated with its responses to previous queries.
Although the internal randomness of M is not explicitly stated as a parameter,
Definition 1 captures this correlation by requiring that each query x t +1 to M is attached with the interaction history ( x 1 , y 1 ) , . . .
, ( x t , y t ) .
This history is sufficient for determining the conditional distribution of the response M (( x i , y i ) i ∈
[ t ] , x t +1 ) without specifying the internal randomness and memory.
We make a distinction between mechanisms and systems.
By “mechanism” we mean a differentially private algorithm M that holds a sensitive input d and answers queries about it.
When applied to a concrete input d , M induces an interactive system, denoted by M d .
According to the definition of differential privacy, studying the privacy of a mechanism boils down to studying the pair of systems ( M d , M d ′ ) induced by running M on every pair of neighboring inputs ( d, d ′ ) .
For brevity, we usually assume W.L.O.G. that the input only consists of a single bit b ∈ { 0 , 1 } , and we compare the two systems M 0 , M 1 induced by M .
Concurrent composition.
We define concurrent composition of interactive systems.
Suppose
M 1 , M 2 , . .
, M k are k systems.
The concurrent composition of them is an interactive system
COMP( M 1 . . .
M k ) with query domain [ k ] ×X and response domain Y .
An adversary is a (possibly randomized) query algorithm A :
([ k ] × X × Y ) ∗ → ∆([ k ] × X ) .
The interaction between A and
COMP( M i ) is a stochastic process that runs as follows.
A first 1 computes a pair ( i 1 , x 1 ) ∈ [ k ] × X , sends a query x 1 to M i 1 and gets the response y 1 .
In the t -th step, A calculates the next pair ( i t , x t ) based on the history, sends the t -th query x t to M i t and receives y t .
There is no communication or interaction between the interactive systems.
Each system M i can only see its own interaction with A .
Let IT ( A : M 1 , . . .
, M k ) denote the random variable recording the transcript of the interaction.
In the special case k = 1 , there is only one system M and the adversary is interacting with it.
We define approximate differential privacy for interactive mechanisms in this case.
Definition 2 (Indistinguishability and ( ε, δ ) -DP) .
Two interactive systems M 0 , M 1 are called ( ε, δ ) - indistinguishable, if for every b ∈ { 0 , 1 } , every adversary A and every collection of transcripts
S ⊆ { ( x i , y i ) i ∈
[ T ] } , it holds that
[Equation]
Let M be an interactive mechanism.
M is called ( ε, δ ) -approximate differentially private (or ( ε, δ ) -DP for short), if for every two neighboring data sets d and d ′ , the systems M d and M d ′ are ( ε, δ ) -indistinguishable.
1.2 Differential Privacy in Concurrent Compositions
We study the privacy guarantee under concurrent compositions.
Let M b 1 , . . .
, M bk be k interactive mechanisms, each satisfying ( ε, δ ) -DP.
Consider their concurrent composition COMP( M b 1 . . .
M bk ) .
We want to find out the smallest parameters ε ′ , δ ′ such that COMP( M b i ) satisfies ( ε ′ , δ ′ )
-DP.
In the sequential composition, the adversary A interacts with M i ’s in order and cannot interleave its queries.
In this case, it is known by the advanced composition theorem [Dwork et al., 2010] that IT ( A :
M 01 , . .
, M 0 k ) and IT ( A : M 11 , . . .
, M 1 k ) are ( O ( (cid:112) k
log(1 /δ ′ )
ε ) , kδ + δ ′ )
-indistinguishable.
However, in general, the adversary can interleave its queries arbitrarily, and the differential privacy guarantee warranted by COMP( M i ) is less clear.
Vadhan and Wang [2021] were the first to formally study this question.
They showed that in the special case δ = 0 , an optimal composition holds for
COMP( M i ) .
That is, if we can prove an ( ε ′ , δ ′ )
upper bound on the privacy parameter for sequential compositions of M b 1 , . .
, M bk , then the concurrent composition COMP( M i ) also enjoys the same ( ε ′ , δ ′ )
-DP.
Vadhan and Wang [2021] also considered the case δ >
(i.e., approximate DP).
However, for this case, they only showed an upper bound on ε ′ , δ ′ that is inferior to the basic composition in the sequential setting.
It was asked as an open question in Vadhan and Wang [2021] whether the optimal composition theorem for approximate DP still holds in the concurrent composition.
Besides pure and approximate DP, there are also other notions of differential privacy that are extensively studied in the literature.
A non-exhaustive list includes Rényi DP [Mironov, 2017], concentrated DP [Dwork and Rothblum, 2016, Bun and Steinke, 2016, Bun et al., 2018], Gaussian
DP and f -DP
[Dong et al., 2022] etc.
Compared with the standard notion of ( ε, δ ) -approximate DP, these variants of DP either allow for a simplified analysis of private algorithms or give sharper bounds of privacy guarantee.
In the sequential composition, the composition property of these variants has been well understood.
It is also interesting to extend these composition theorems to the concurrent composition, thereby expanding the potential applicability of these DP notions.
Our Results
In this work, we give an affirmative answer to the open question mentioned above.
Moreover, our result confirms that several major differential privacy definitions in the literature enjoy the same composition guarantee in the concurrent composition, just as they do in the sequential composition.
Approximate differential privacy.
( ε, δ ) -DP is arguably the most widely studied notion of differential privacy and is deemed the “standard” definition of DP.
As our first main result, we show an optimal concurrent composition theorem for approximate DP.
Theorem 1.
Let M 1 , . . .
, M k be k interactive mechanisms that run on the same data set.
Suppose that each mechanism M i satisfies ( ε i , δ i ) -DP.
Then COMP( M 1 . . .
M k ) is ( ε ′ , δ ′ )
-DP, where ε ′ , δ ′ are given by the optimal (sequential) composition theorem [Kairouz et al., 2015, Murtagh and Vadhan, 2018].
In particular, when the privacy parameter for each mechanism is the same ( ε, δ ) , their concurrent composition satisfies O ( (cid:112) k
log(1 /δ ′ )
ε, δ ′ + kδ )
-DP for all δ ′ ∈ (0 , 1) .
Rényi differential privacy.
Rényi differential privacy was first defined by Mironov [2017].
We recall its definition.
Definition 3 (Rényi divergence and differential privacy) .
Let P, Q be two distributions supported over X .
For each α > 1 , define the Rényi divergence of order α of P from Q as
[Equation]
Two interactive systems are called ( α, ε ) -Rényi close, if for every adversary A and every b ∈ { 0 , 1 } , it holds that
[Equation]
Let M be a mechanism.
M is called ( α, ε ) -Rényi differentially private (or ( α, ε ) -RDP for short), if for every two neighboring data sets d and d ′ , the systems M d and M d ′ are ( α, ε ) -Rényi close.
A main advantage of Rényi DP is that it has a natural and simple composition.
In the sequential setting, it is known that if two mechanisms M 1 , M 2 are ( α, ε 1 ) and ( α, ε 2 ) -RDP, respectively, then the composition of M 1 and M 2 is ( α, ε 1 + ε 2 ) -RDP.
Our next theorem generalizes this result to the concurrent composition setting.
Theorem 2.
Let M 1 , . . .
, M k be k interactive mechanisms that run on the same data set.
Suppose that each mechanism M i is ( α, ε i ) -RDP.
Then COMP( M 1 . . .
M k ) is ( α, (cid:80) ki
=1 ε i ) -RDP.
One implication of Theorem 2 is that the zero-concentrated differential privacy by Bun and Steinke [2016] and the truncated concentrated differential privacy by Bun et al.
[2018] also compose nicely under the concurrent composition.
We state the corollary below, and prove it in Appendix A.3 for completeness.
Corollary 1.
Let M 1 , . . .
, M k are k interactive mechanisms that run on the same data set.
Suppose that each mechanism M i is η i -zCDP (resp.
( ρ i , ω ) -tCDP).
Then COMP( M 1 . . .
M k ) is ( (cid:80) i η i ) - zCDP (resp.
( (cid:80) i ρ i , ω ) -tCDP).
Theorem 1, 2 and Corollary 1 provide compelling evidence that the adversary gains no advantage by interleaving its queries to independently running mechanisms.
Consequently, interactivity can be viewed as a feature that differential privacy grants us for free.
Concurrent and independent work.
Concurrently to our work, a recent work by Vadhan and Zhang [2022] proves an optimal concurrent composition theorem for f -DP
[Dong et al., 2022].
By the standard connection, their result implies the optimal concurrent composition theorem for approximate
DP.
However, our techniques are very different than theirs.
Their result is stronger, as it is known that approxiamte-DP can be seen as a special case of f -DP [Dong et al., 2022].
However, our proof for approximate DP is more elementary: we do not need to work through f -DP as their proof does.
Furthermore, our proof comes with several interesting technical ingredients that might be of independent interests.
This includes a structural result for interactive mechanisms (Theorem 3), as well as a dual perspective to reason about Rényi divergences (Lemma 4).
Implications of Our Results
In this section, we discuss implications of our results, and demonstrate how they offer more than the sequential composition theorems.
Designing new algorithms.
The optimal concurrent composition theorem makes it possible to design new differentially private algorithm that involves running several building blocks concurrently.
As one motivating example, consider the Sparse Vector Technique (SVT).
The standard SVT (as in
Dwork and Roth [2014]) and its variants have been studied extensively in the literature.
In particular, it was observed by Lyu et al.
[2017], Zhu and Wang [2020] that one can add noise to the threshold only once , and then use the noisy threshold to answer c > 1 “meaningful” queries (namely, after reporting each meaningful query, the SVT algorithm does NOT refresh the noisy threshold).
It was argued in [Lyu et al., 2017, Zhu and Wang, 2020] that this variant of SVT can offer a higher accuracy while consuming the same amount of privacy budget, both theoretically and empirically.
However, this variant of SVT has received relatively less attention in literature.
One reason might be that it is unclear what happens if we compose this SVT with other mechanisms.
In particular, the standard SVT refreshes its threshold after answering each “meaningful” query, which allows one to decompose the algorithm into c pieces of smaller SVT algorithms, and then compose with other mechanisms via the sequential computation.
In contrast, the variants by Lyu et al.
[2017], Zhu and
Wang [2020] work by answering each “meaningful query” using the same noisy threshold, which do not seem to admit such a decomposition.
This makes this variant less appealing: in most applications, people want to use SVT as a supporting subroutine for other algorithms.
Therefore, it is crucial to understand the (concurrent) composition behavior of SVT with other mechanisms.
Now, with the new concurrent composition theorem, we can plug this variant of SVT in any algorithm, and argue the privacy guarantee of the whole computation by black-box applying Theoremsand 2 (depending on whether we are working with ( ε, δ ) -DP or RDP).
To illustrate the idea, in
Appendix B, we apply Theorem 1 to analyze a simple algorithm: private “Guess-and-Check” with the aforementioned variant of SVT as a subroutine.
We hope our example can motivate people to design more powerful algorithms by concurrently composing simple building blocks.
Practical Implication.
Besides the theoretical interests, our theorem has implications for practical deployments of interactive DP mechanisms.
For one example, suppose there is a data center that holds the private information of individuals and offers data analysts access to the database (interactively and differentially-privately).
Without knowing the concurrent composition theorem, it might be possible that some k > 1 analysts can collude by coordinating their (interactive) queries to the database and extracting much more sensitive information.
Our result refutes the possibility of such an attack.
In particular, suppose each data analyst has only an ( ε, δ ) -DP amount of privacy “quota”.
Then, even if they collude and spend their privacy budget in whatever way, their computation result is still ( O ( (cid:112) k log(1 /δ ′ ) ε ) , kδ + δ ′ )
-DP with respect to the private database.
Proof of Main Results
In this section, we show the proof of our results.
We start with a very brief proof overview.
We prove
Theorem 1 by a reduction to the sequential composition of k (approximate) randomized response mechanisms.
This generalizes the idea developed by Vadhan and Wang [2021].
To prove Theorem 2, we take a completely different approach, and our technique offers new tools to analyze Rényi DP.
Namely, we propose an alternative characterization of Rényi divergence (Lemma 4), which allows for a fine-grained account of the privacy loss in the complex interaction involving multiple mechanisms.
The characterization of Rényi divergence might find itself useful in other applications.
Notation.
Let P, Q be two distributions supported over X .
For a real η > 0 , we say that P ≥ ηQ , if for every S ⊆ X , it holds that
[Equation]
Furthermore, we say P ≡ Q , if P and Q are identically distributed.
4.1 Approximate Differential Privacy
To prove Theorem 1, we follow the approach by Vadhan and Wang [2021], where they showed that one can simulate two ( ε, 0) -indistinguishable interactive systems by post-processing a randomized response mechanism.
This simulation enables them to reduce the concurrent composition to a sequential composition, and the optimal composition theorem follows.
It was asked as an open question in Vadhan and Wang [2021] whether the same simulation can be carried out for approximate
DP.
We answer this question affirmatively.
Review of the Vadhan-Wang approach.
It would be instructive to review the proof by Vadhan and
Wang [2021] first.
Let M 0 , M 1 be the pair of systems by running the private mechanism on a pair of neighboring data sets.
The adversary A interacts with M b for some b ∈ { 0 , 1 } and wants to find out the value of b .
An intuitive yet delicate fact due to Vadhan and Wang [2021] is that, if M 0 and Mare ( ε, 0) -indistinguishable, then there exist two systems N 0 , N 1 such that, for every adversary A , the distribution of IT
( A : M b ) is identical to e ε 1+ ε IT
( A : N b ) + 1
+ e ε IT
( A : N 1 − b ) .
This enables one to simulate the many-round interaction between A and M b by running a one-round randomized response mechanism.
In more detail, let RR bε denote the standard randomized response mechanism, defined as follows.
RR bε only accepts one query.
On the query, RR bε ignores the query message, returns b with probability e ε 1+ e ε , and returns 1 − b otherwise.
We modify A to a new adversary A ′ :
A ′ first sends a query to
RR bε and receives a bit b ′ .
Then A ′ simulates the interaction between A and N b ′ , and outputs the transcript (i.e., IT ( A : N b ′ ) ).
Let Output ( A ′ : RR bε ) denote the output distribution of A ′ when interacting with RR bε .
It is clear that
[Equation]
Therefore, A ′ simulates the interaction between A , M b faithfully, by a single query to RR bε .
Now, suppose the adversary A is interacting with k mechanisms M b 1 , . .
, M bk in parallel.
For each i ∈ [ k ] , assuming that M 0 i and M 1 i are ( ε i , 0) -indistinguishable, there is a decomposition of M 0 i , M 1 i by some N
i and N 1 i .
Again, we modify A to a new mechanism A ′ .
A ′ first queries
RR bε i , i ∈ [ k ] in order, and receives k bits b ′ 1 , . . .
, b ′ k .
Then A ′ simulates the interaction between A and ( N b ′ i i ) i ∈
[ k ] and outputs the transcript.
One can show that
[Equation]
Note that the left hand side of (2) can be simulated by a sequential composition of k randomized response mechanisms.
Invoking the optimal composition theorem for sequential composition [Kairouz et al., 2015, Murtagh and Vadhan, 2018] concludes the proof.
Extension to approximate DP.
Now, if M 0 and M 1 are ( ε, δ ) -indistinguishable with δ > 0 , there might not be a nice decomposition of M b into e ε 1+ e ε N b + 1 1+ e ε N 1 − b .
Still, it is plausible to conjecture that there is a decomposition of M 0 , M 1 with four systems N 0 , N 1 , E 0 , E 1 such that for each b ∈ { 0 , 1 } ,
[Equation]
Our main technical result in this subsection proves the existence of such a decomposition.
Theorem 3.
Two systems M 0 , M 1 are ( ε, δ ) -indistinguishable, if and only if there are four systems
N 0 , N 1 , E 0 , E 1 satisfying the following: for every adversary A and b ∈ { 0 , 1 } , it holds that
[Equation]
Theorem 3 implies Theorem 1 by a similar reduction to (approximate) random response.
For completeness, we include a proof in Appendix A.1.
We prove Theorem 3 by establishing a series of lemmas.
In the following, we state these lemmas and explain their intuition.
We defer the formal proof to Appendix A.1.
Lemma 1.
Suppose M 0 , M 1 are ( ε, δ ) -indistinguishable.
There are two systems E 0 , E 1 satisfying the following.
• For every adversary A and b ∈ { 0 , 1 } , it holds that IT ( A : M b ) ≥ δ · IT ( A : E b ) .
• For every adversary A , every set of transcripts S ⊆ { ( x i , y i ) i ∈
[ T ] } and b ∈ { 0 , 1 } , it holds that
[Equation]
Roughly, Lemma 1 says that there are two systems E 0 , E 1 that capture the low-probability “bad behavior” of M 0 , M 1 .
It is the primary technical contribution of this subsection.
We prove Lemmaby explicitly constructing the two systems E 0 , E 1 .
That is, we specify the probability density functions
Pr[ E b (( x j , y j )
j<i , x i ) =
y i ] for E 0 , E 1 step by step, in the increasing order of i = 1 , 2 , . . .
, T .
Lemma 2.
Suppose M , E are two systems such that for every adversary A , it holds that IT ( A :
M ) ≥ δ IT
( A : E ) .
Then there is a system N such that for every adversary A , it holds that
[Equation]
For intuition, suppose P, Q are two distributions such that P ≥ δQ .
Then one can easily find a distribution Q ′ such that P ≡ δQ + (1 − δ ) Q ′ .
The proof of Lemma 2 extends this simple idea.
Lemma 3 (Vadhan and Wang [2021]) .
Suppose N 0 , N 1 are ( ε, 0) -indistinguishable.
Then there are two systems N 0 ′ , N 1 ′ such that for every adversary A , it holds that
[Equation]
Wrap-up.
We can conclude the proof for Theorem 3 now.
The “if” direction is obvious: the existence of a decomposition satisfying (4) implies that M 0 , M 1 are ( ε, δ ) -indistinguishable.
For the other direction, we start by constructing E 0 , E 1 using Lemma 1.
Then we construct N 0 , Nby Lemma 2.
Lemma 1 and 2 together ensure that N 0 and N 1 are ( ε, 0) -indistinguishable, which enables us to invoke Lemma 3 and decompose N 0 , N 1 into N 0 ′ , N 1 ′ .
( E 0 , E 1 , N 0 ′ , N 1 ′ ) forms the final decomposition.
It is straightforward to verify that they satisfy (4).
4.2 Rényi Differential Privacy
Our result for Rényi differential privacy (Theorem 2) takes a completely different approach.
An intuition.
Let M 1 be an ( α, ε ) -Rényi DP mechanism.
Intuitively, ( α, ε ) -Rényi
DP means that
M 1 has ε unit of privacy budget and can distribute it to T queries.
Viewing the privacy budget as a form of “deposit”, we hope to argue that two or more independently running mechanisms spend their deposit independently, and an adversary cannot trigger any mechanism to spend more privacy budget than it holds by interacting with other mechanisms.
However, unlike some intuitive and easy-to-measure resources such as time and energy, the notion of privacy loss looks somewhat illusive.
Even worse, we need to reason about this elusive resource in a stochastic process consisting of interactions with multiple systems.
It was not clear how one can quantify the privacy loss in such an interactive and complex process.
Nonetheless, we manage to find a new approach to do so.
An alternative characterization for Rényi DP.
We introduce the following characterization of Rényi divergence based on Hölder’s inequality and duality.
That is, we prove
Lemma 4 (An alternative characterization of Rényi divergence) .
Suppose P, Q are two distributions supported over Y .
For every α > 1 and B ≥ 0 , let β = αα − 1 be the Hölder conjugate of α .
The following statements are equivalent.
• D α ( P ∥ Q ) ≤ B .
• For every function
h : Y → R ≥ 0 , it holds that E y ∼ P [ h ( y )] ≤ e B ( α − 1)
α E y ∼ Q [ h ( y ) β ] 1 /β .
Note that if we let α → ∞ , then Lemma 4 converges to a characterization of pure-DP.
That is,
D ∞ ( P ∥ Q ) ≤ B if and only if Pr[ P = y ] ≤ e B Pr[ Q = y ] for every y ∈ Y .
Lemma 4 provides a convenient tool to reason about the privacy loss in an interactive environment consisting of multiple rounds.
Intuitively, this is because Condition 2 in the statement above is more amenable to a “hybrid argument”.
However, to quantify the privacy loss during an interaction, we still need to find a way to track the privacy loss.
Measure theory setup.
Before we continue, it would be more convenient to switch to a measuretheoretic language.
Consider two measures P, Q on a space Y ( P and Q are not necessarily probability measures), we say that P is β -dominated by Q , denoted by P ⪯ β Q , if for every measurable function f : Y → R ≥ 0 , it holds that
[Equation]
When Y is a finite set, the integral coincides with an equivalent summation.
i.e.,
[Equation]
We will use integral and summation interchangeably.
In this notation, Lemma 4 can be equivalently stated as D α ( P ∥ Q ) ≤ B if and only if P is βdominated by e B Q for β = αα − 1 .
The following lemma is essential for us.
Lemma 5.
Let Y 1 ×Y 2 be a space.
Consider two distributions P, Q on Y 1 ×Y 2 .
Assume supp( P ) =
supp( Q ) =
Y 1 ×Y 2 .
Let P 1 , P 2 be the margin of P on Y 1 , Y 2 .
For each y 1 ∈ Y 1 , denote by P 2 | P 1 = ythe marginal distribution of y 2 conditioning on y 1 .
Also define the same notation for Q .
Let β ≥ 1 , B ≥ 0 be two reals.
Let α = ββ − 1 .
For each y 1 ∈ Y 1 , define
[Equation]
Suppose P ⪯ β e B Q .
Consider the measure spaces ( Y 1 , P 1 ( y 1 ) · ℓ 1 ( y 2 ) 1 /β ) and ( Y 1 , Q 2 ) .
We have
[Equation]
Intuitively, the function ℓ ( y 1 ) serves as the role of “privacy budget monitor”.
To see this, fix an adversary A and think of ( y 1 , y 2 ) as the responses of the system to the adversary 2 .
After observing y 1 , the adversary wants to distinguish between two conditional distributions P 2 | P 1 = y 1 and Q 2 | Q 1 = y 1 .
At this moment, ℓ ( y 1 ) shows up as an upper bound of “extra information” that the adversary can extract by utilizing their second query.
Alternatively, ℓ ( y 1 ) quantifies the amount of the remaining privacy budget the mechanism has after outputting y 1 .
On average, the function ℓ 1 ( y 1 ) provides a fine-grained control of the privacy loss in the sense that P 1 ℓ 1 /β⪯ β e B Q 1 .
Proof for a 3 -round toy example.
We are ready to describe the proof for Theorem 2.
To illustrate the idea, we prove a toy case here and defer the full proof to Appendix A.2.
The proof for the toy case includes all the important ideas.
Extending it to a full proof is straightforward.
We describe the toy scenario now.
Suppose there are two mechanisms M 1 , M 2 that run on a sensitive input bit b ∈ { 0 , 1 } .
The interaction consists of 3 rounds.
The adversary
A communicates with M 1 , M 2 , M 1 in order, and outputs the response ( y 1 , y 2 , y 3 ) .
For brevity, we assume that each response y i contains a copy of the query message x i , so that we recover the whole transcript (( x 1 , y 1 ) , ( x 2 , y 2 ) , ( x 3 , y 3 )) only from the responses.
Let P, Q ∈ ∆( Y × Y × Y ) be the output distribution when A interacts with ( M 01 , M 02 ) and ( M 11 , M 12 ) , respectively.
Suppose M 1 , M 2 are ( α, ε 1 ) , ( α, ε 2 ) -Rényi
DP respectively.
Our goal is to prove that
[Equation]
We bound D α ( P ∥ Q ) below.
The bound for D α ( Q ∥ P ) is symmetric.
Be Lemma 4, it suffices to show that for every h :
Y × Y → Y → R ≥ 0 that
[Equation]
where β = αα − 1 is the Hölder conjugate of α .
Let P 1 , P 2 , P 3 be the projection of P onto the three rounds, and let P i |
y <
i denote the distribution of y i conditioning on y 1 , . . .
, y i − 1 .
Also define the same notation for Q .
Then we write
[Equation]
For every y 1 ∈ Y , let M 01 | y 1 (resp.
M 11 | y 1 ) denote the interactive system M 01 (resp.
M 11 ) conditioning on that it has answered y 1 to the first query (recall we have assumed that y 1 contains x 1 ).
Formally, for every b ∈ { 0 , 1 } , ( x 2 , y 2 ) , . . .
, ( x t , y t ) and x t +1 , define
[Equation]
Next, define
[Equation]
From Lemma 5, one can show that P 1 ℓ 1 /β⪯ e B Q 1 .
Turning back to (5), we then have
[Equation]
Here, we used inequalities of the form (cid:80) y P ( y ) · h ( y ) ≤ (cid:16) C · (cid:80) y Q ( y ) · h
[Equation]
β
[Equation]
1 /β three times (they are (8) ⇒ (9) ⇒ (10) and (11) ⇒ (12)).
We use underlines to highlight the “ h ” part of each step in the deductions above.
(8) ⇒ (9) is the most critical step.
To see this, observe that knowing y 2 does not change the view of the first mechanism, because the second query is sent to the independently running mechanism M b 2 .
Therefore, M b 1 | y 1 remains the same after conditioning on both y 1 and y 2 .
Now, note that P 3 | y < 3 (resp.
Q 3 | y < 3 ) exactly describes one round of interaction between the adversary and M 01 | y 1 (resp.
M 11 | y 1 ).
Consequently, the information leaked by y 3 must be subject to the bound (7) and the inequality holds.
Having verified (8) ⇒ (9), the steps (9) ⇒ (10) and (11) ⇒ (12) are straightforward.
Having justified (13) for every measure function h , we conclude that D α ( P ∥ Q ) ≤ e ε 1 + ε 2 .
A symmetric argument shows that D α ( Q ∥ P ) ≤ e ε 1 + ε 2 .
This completes the proof for the toy example.
Proof sketch for the general case.
The proof for the general case extends the idea above with some minor twists.
By induction, we only need to prove the composition theorem for the case with two mechanisms and many rounds.
An issue worth noting is that A can choose the next query object based on previous responses.
However, we can suppose without loss of generality that A always communicates with mechanisms alternately, by adding a vanilla query x ∗ to the query space.
If the current mechanism is not the one A wishes to speak with, A just sends the vanilla query x ∗ .
The mechanism then returns a fixed response, which does not leak any information.
We refer to
Appendix A.2 for the detail of the proof.
Conclusion and Future Directions
In this work, we consider the concurrent composition of interactive mechanisms.
Regarding the general privacy guarantee under the concurrent composition, our result gives optimal composition theorems for several popular definitions of differential privacy, including ( ε, δ ) -DP and Rényi DP.
Our work is purely theoretical, and we do not see any negative societal impacts it may cause.
For future directions, we ask whether one can use our composition theorems to design new differentially-private algorithms that may involve running several differentially-private mechanisms in parallel.
It is also interesting to explore more practical implications of the concurrent composition phenomena.
We also note that there is a recent interest in fully adaptive compositions of differential privacy, which studies how the data analyst can manage the privacy budget and monitor the privacy loss themselves.
In particular, the notion of privacy odometers and filters were proposed to capture these demands
Rogers et al.
[2016], Feldman and Zrnic [2021], Whitehouse et al.
[2022], Lécuyer [2021].
This question necessitates a better understanding of information leakage in an interactive environment.
Our work developed several new tools and techniques to reason about interactive mechanisms.
Can our technique be useful in studying fully adaptive compositions?
Acknowledgements
I am grateful to Jelani Nelson for advising this project and providing useful comments on an early draft of this paper.
I would also like to thank Salil Vadhan and Wanrong Zhang for insightful discussions about their work.
X. Lyu was supported by ONR DORECG award N00014-17-1-2127.
A Appendix: Missing Proofs
In this appendix, we show the formal proofs for all the lemmas and claims in the main paper.
A.1 Proofs for Approximate Differential Privacy
This subsection present omitted proofs in Section 4.1.
A.1.1 The key lemma
We start with the proof for Lemma 1.
Reminder of Lemma 1.
Suppose M 0 , M 1 are ( ε, δ ) -indistinguishable.
There are two systems
E 0 , E 1 satisfying the following.
• For every adversary A and b ∈ { 0 , 1 } , it holds that IT ( A : M b ) ≥ δ · IT ( A : E b ) .
• For every adversary A , every set of transcripts S ⊆ { ( x i , y i ) i ∈
[ T ] } and b ∈ { 0 , 1 } , it holds that Pr[ IT ( A : M b ) ∈ S ] − δ Pr[ IT ( A : E b ) ∈ S ] ≤
e ε (cid:0) Pr[ IT ( A : M 1 − b ) ∈ S ] − δ Pr
[ IT ( A : E 1 − b ) ∈ S ] (cid:1) .
Proof.
Without loss of generality, we assume that the interaction between M 0 / 1 and A consists of exactly T ∈ N rounds.
For every t ∈ [ T ] , each ( x i , y i ) i ∈ [ t ] and b ∈ { 0 , 1 } , denote
[Equation]
(cid:89) i =
[Equation]
Pr
[Equation] [Equation]
y
[Equation]
<
[Equation]
y
[Equation]
Intuitively, M b (( y i ) i ∈
[ t ] , ( x i ) i ∈
[ t ] ) is the probability of M b responding ( y 1 , . . .
, y t ) , conditioning on that the query messages are fixed to ( x 1 , . . .
, x t ) .
Note that knowing M b (( y i ) i ∈
[ T ] , ( x i ) i ∈
[ T ] ) for every ( x i , y i ) i ∈
[ T ] uniquely determines the system.
Let A be an arbitrary adversary.
For each ( x i , y i ) i ∈ [ t − 1] and x t , denote
[Equation]
Note that A (( x i ) i ∈
[ t ] , ( y i ) i ∈ [ t − 1] ) is the probability of A sending queries ( x 1 , . . .
, x t ) , conditioning on that the responses to the first t − 1 queries are fixed to ( y 1 , . . .
, y t − 1 ) .
In the following, when the size of a list ( ℓ i ) i ∈
[ L ] is clear from context, we may omit the subscript and simply write ( ℓ i ) to denote the list.
Now, having defined (14) and (15), we observe for each transcript ( x i , y i )
i ∈
[ T ] that
[Equation]
In the following, we will construct two systems E 0 / 1 such that, for every ( x i , y i ) i ∈ [ T ] , it holds that
[Equation]
and
[Equation]
If we have two systems E 0 / 1 satisfying the above, then we can verify that they satisfy the lemma statement by combining (16), (17) and (18).
Now we describe the construction.
We start by defining for each b ∈ { 0 , 1 } , t ≤ T and every partial history ( x i , y i )
i ≤ t − 1 ∈
( X × Y ) t − 1 , x t ∈ X a control function as
[Equation]
For every t ≤ T − 1 and ( x i , y i ) i ≤ t , we also define the following control function:
[Equation]
We need the following two facts regarding the control functions.
Claim 1.
For each b ∈ { 0 , 1 } and x 1 ∈ X , it holds that Lower b ( ∅ , x 1 ) ≤ δ .
Proof.
We construct an adversary A ∗ as follows.
A ∗ is deterministic.
It always sends x 1 as the first query.
For every 1 ≤ t ≤ T − 1 and history ( x i , y i ) i ∈ [ t ] , A ∗ computes the next query as
A ∗
[Equation]
Now, define
[Equation]
Given that M 0 and M 1 are ( ε, δ ) -indistinguishable, we know that
[Equation]
On the other hand, by the definition of A ∗ and (19), it holds that
[Equation]
This can be verified by tracing how Lower b ( ∅ , x 1 ) is determined from queries ( x 1 , . . .
, x T ) (in the “max” operator), and noting that A ∗ follows exactly the same queries.
Combining two equations above concludes the proof of Claim.
Claim 2.
For every b ∈ { 0 , 1 } , t ≤ T − 1 and ( x i , y i )
i ≤ t − 1 ∈
( X × Y ) t − 1 , x t ∈ X , it holds that
[Equation]
Proof.
We prove this claim by downward induction on t .
For the case t = T − 1 , we have by definition that
[Equation]
We justify the deductions briefly.
(21) is by definition.
(22) uses a simple trick that max { a, 0 }
= a + max {− a, 0 } .
The last step (23) is by definition again.
In particular, we observe that for every x T ∈ X , it holds that
[Equation]
This proves the base case for t = T − 1 .
Assume the claim is true for t + 1 ≤ T − 1 .
We consider the case of t .
We have
Lower b (( x i , y i ) i<t , x t ) =
(cid:88)
y t max x t +1 { Lower b (( x i , y i )
i ≤ t , x t +1 ) }
[Equation]
y t max x t
[Equation]
{ Upper b
[Equation]
x i
[Equation]
y i
[Equation]
i
[Equation]
t
[Equation]
− ε
[Equation]
1 − b
[Equation]
x
[Equation]
y i
[Equation]
+
[Equation]
1 −
[Equation]
x
[Equation]
y i
[Equation]
≤
[Equation]
x t +1 )
[Equation]
−
[Equation]
The first inequality is due to the induction hypothesis.
The second inequality is straightforward.
This completes the proof for the claim.
The construction.
We are ready to describe the construction.
In the following, we will assume ε > 0 .
Having shown the construction for every ε > 0 , the case for ε = 0 can be argued by continuity.
We will construct E 0 , E 1 by specifying for every t ∈ [ T ] and ( x i , y i ) i ≤ t the following:
[Equation]
Note that a valid E b ( · ) uniquely defines a system E b .
For brevity, we also define E 0 ( ∅ ) =
E 1 ( ∅ )
= 1 .
Intuitively, we use ∅ to denote two “empty lists” (i.e., two lists ( y i ) i ≤ t , ( x i ) i ≤ t with t = 0 ).
We will construct E b (( y i ) i ≤ t , ( x i ) i ≤ t ) for t = 1 , 2 , . . .
, T in order.
Throughput the construction, we maintain the following property.
For every 0 ≤ t ≤ T , ( x i , y i ) i ≤ t and b ∈ { 0 , 1 } , we require
[Equation]
i
[Equation]
and
[Equation]
Meanwhile, for E b (( y i ) , ( x i )) to describe a valid system, it is necessary and sufficient for it to be non-negative and satisfy the following equation for every ( x i , y i )
i ≤ t ∈ ( X × Y ) t and x t +1 :
[Equation]
[Equation]
Next, we shall prove that we can construct a valid E 0 / 1 satisfying (24), (25) and (26).
As we have said, we will construct E b gradually in the increasing order of t ∈ [ T ] .
For t = 0 , we have set
E 0 ( ∅ ) =
E
[Equation]
∅ )
[Equation]
(24) holds by Claim 1, and (25) holds trivially.
Now let t < T .
Also let ( y i )
i ≤ t ∈ Y t , ( x i ) i
≤ t ∈
X t be two lists.
Suppose we have constructed
E 0 / 1 (( y i ) i ≤ t , ( x i ) i ≤ t ) that satisfies (24) and (25).
For every x t +1 ∈ X and y t +1 ∈ Y , we construct
E 0 / 1 (( y i )
i ≤ t +1 , ( x i )
i ≤ t +1 ) in the following.
Fix x t +1 ∈ X .
We temporarily set
[Equation]
By Claim 2, we know that (cid:101)
E b satisfies (25).
By the construction, (cid:101)
E
b satisfies (24).
However, (cid:101) E b may fail to satisfy (26).
Still, we have
[Equation]
In the following, we show that one can adjust (cid:101) E b by increasing some (cid:101) E b
(( y i )
i ≤ t +1 , ( x i )
i ≤ t +1 ) properly, so that the new (cid:101)
E b satisfies all of (24), (25) and (26).
To begin with, we define for each b ∈ { 0 , 1 } the quantity
[Equation]
Our goal is to decrease Gap 0 , Gap 1 to zero by increasing (cid:101) E .
Since we only increase (cid:101) E b
(( y i ) i ≤
[Equation]
+1 , ( x i ) i ≤ t +1 ) , (24) can never be compromised and we only need to consider (25).
Consider y t +1 and b ∈ { 0 , 1 } .
We say that (cid:101) E b is tight at y t +1 , if
[Equation]
Intuitively, (cid:101) E b being tight at y t
+1 means that we cannot increase (cid:101)
E b
( y i )
i ≤ t +1 , ( x i ) i
≤ t +1 ) without increasing (cid:101) E
1 − b (( y i )
i ≤ t +1 , ( x i ) i
≤ t +1 ) .
Here shows our adjustment strategy.
We consider each y t +1 ∈ Y in an arbitrary but fixed order.
For each y t +1 , we gradually increase (cid:101) E 0 /
( y i )
i ≤ t +1 , ( x i ) i
≤ t +1 ) until one of the following events happens.
• Both (cid:101) E 0 and (cid:101)
E 1 get tight at y t
+1 .
• Gap 0 = 0 , and (cid:101)
E 1 is tight at y t
+1 .
• Gap 1 = 0 , and (cid:101) E 0 is tight at y t
+1 .
• Gap 0 =
Gap 1 = 0 .
It is easy to see that if none of the above happens, we can keep increasing (cid:101) E 0 / 1 at y t +1 3 .
This completes the description of the adjustment strategy.
Now, we claim that after the adjustment, we must have Gap
=
Gap 1 = 0 .
Suppose it is not the case.
For example, suppose Gap 0 ̸ = 0 .
Then we know that (cid:101) E 0 is tight at every y t
+1 .
This means that (cid:88)
y t +
[Equation]
Recall that
[Equation]
Subtracting the inequality with the equality above, we deduce that Gap 0 ≤ e − ε Gap 1 .
It implies that
Gap 1 > 0 .
And we can use a symmetric argument to show that Gap 1 ≤ e − ε Gap 0 .
Since e − ε < 1 , the only solution to the system of inequalities is Gap 0 =
Gap 1 = 0 , a contradiction!
Having proven the claim, we know there is a way to adjust (cid:101) E 0 / 1 so that they satisfy all of (24), (25), (26).
We then set E 0 / 1 (( y i )
i ≤ t +1 , ( x i ) i
≤ t +1 ) to be (cid:101) E 0 / 1 (( y i )
i ≤ t +1 , ( x i ) i
≤ t +1 ) and finish the construction for ( x i , y i )
i ≤ t and x t +1 .
We use the construction above for t = 0 , 1 , . .
, T − 1 in order to construct E 0 / 1 .
It remains to verify that E 0 / 1 satisfies the lemma statement.
It suffices to verify for every ( x i , y i )
i ≤ T ∈ ( X × Y ) T and b ∈ { 0 , 1 }
that
[Equation]
and
[Equation]
In fact, since e ε > 1 , it suffices to verify the second inequality for b ∈ { 0 , 1 } .
This can be verified by utilizing (25): note that Upper b (( x i , y i ) i ≤ T ) =
M b (( y i ) , ( x i ))
− e − ε M 1 − b (( y i ) , ( x i )) , and (25) tells us that
[Equation]
Re-arranging proves the desired inequality.
Remark 1.
Note that to verify the correctness of E 0 / 1 , we only used the condition (25) .
It seems that (24) is useless in this proof.
However, note that it is possible that Upper b (( y i ) , ( x i )) is negative for some ( x i , y i ) i ≤ t , which makes it unclear whether (25) can always be satisfied by a positive valuation of E .
This is why we need the other control function Lower .
A.1.2 Wrap-up
Next, we quickly prove Lemma 2.
Reminder of Lemma 2.
Suppose M , E are two systems such that for every adversary A , it holds that IT ( A : M ) ≥ δ IT ( A : E ) .
Then there is a system N such that for every adversary A , it holds that
[Equation]
Proof.
We follow the notation in Section A.1.1.
Namely, for each ( x i , y i ) i ≤ t , define
[Equation]
Also define the same notation for E .
Then we construct
[Equation]
Since M ≥ δ E , we know that N (( y i ) , ( x i )) is always non-negative.
Moreover, N encodes a valid system because (cid:88)
[Equation]
Finally, it is easy to verify IT ( A : M ) ≡ δ IT ( A : E ) + (1 − δ ) IT
( A : M ) .
As we have shown in Section 4.1, combining Lemma 1, 2 and 3 together, we can prove Theoremeasily.
Next, we show how Theorem 3 implies Theorem 1.
Proof of Theorem 1.
Let M 1 , . . .
, M k be k mechanisms, where M i is ( ε i , δ i ) -approximate differentially private.
We assume without loss of generality that all of M
i ’s hold a bit b ∈ { 0 , 1 } as the sensitive data.
Let A be an arbitrary adversary interacting with COMP( M 1 , . . .
, M k ) .
Next, we show how one can simulate IT ( A , COMP( M b 1 , . . .
, M bk ))
by running k (approximate) randomized response mechanisms.
For each M bi , construct an approximate randomized response mechanism RR bε i ,δ i .
The output distribution of RR bε i ,δ i is:
[Equation]
We also prepare the decomposition of M 0 / 1 i with N 0 / 1 i , E 0 / 1 i as promised by Theorem 3.
Now, we construct a simulator S as follows.
For each i ∈ [ k ] , S runs RR bε i ,δ i and gets a pair ( b i , σ i ) .
If σ i = ⊤ , then let B i ← E
b
i
i .
Otherwise, let B i ← N b
i
i .
In this way, S gets a list of k systems ( B 1 , . . .
, B k ) .
The simulator then simulates the interaction between A and B 1 , . . .
, B , and outputs the interaction history.
Let Output ( S , b ) denote the output distribution of S .
We claim that
[Equation] [Equation]
To see this, for each M bi , consider a two-party communication, where one party is M bi , and the other party consists of A and M bj for j ̸
= i .
The second party simulates all the interactions between A and
M b j , and only sends queries to M b i when A queries M b i .
From the second party’s viewpoint, M b i looks identical to δ i E bi + (1 − δ i )
e ε 1+ e ε N bi + (1 − δ i ) 1 1+ e ε N 1 − b i .
Therefore,
[Equation]
M
[Equation] [Equation]
Here, we use ( p 1 , p 2 , p 3 ) =
( δ i , (1 − δ i )
e ε 1+ e ε , (1 − δ i ) 1 1+ e ε ) and ( M bi, 1 , M bi, 2 , M bi, 3 ) =
( E bi , N bi , N 1 − b i ) for convenience.
Applying this decomposition for every i ∈ [ k ] proves (28).
Finally, note that Output ( S , b ) is just a post-processing of the sequential composition of k (approximate) randomized response mechanisms.
Hence, the optimal sequential composition theorem holds for Output ( S , b ) , which completes the proof.
A.2 Proofs for Rényi Differential Privacy
In this section, we show omitted proofs for Theorem 2.
A.2.1 Preliminaries
We need some technical preparations first.
Consider a measure space ( X, µ ) .
For two measurable functions f, g , define their inner product as
[Equation]
For a real α ≥ 1 , define the ℓ α -norm of a function f as
[Equation]
Recall Hölder’s inequality, which is essential for our proof.
Fact 1.
Suppose α, β ≥ 1 are Hólder conjugates of each other (i.e., 1 α + 1 β = 1 ).
Suppose f, g are two measurable functions.
Then we have
[Equation]
The inequality is sharp in the sense that for every measurable function f , we have
[Equation]
Recall our definition of dominance.
For two measures P, Q on a space
Y
, we say that P is βdominated by Q , denoted by P ⪯ β Q , if for every measurable function f : Y → R ≥ 0 , it holds that ∥ f ∥ P, 1 ≤ ∥ f
∥ Q,β .
A.2.2 Proof for lemmas
We are ready to show the proofs now.
We start with Lemma 4.
Reminder of Lemma 4.
Suppose P, Q are two distributions supported on Y .
For every α > 1 and
B ≥ 0 , let β = αα − 1 be the Hölder conjugate of α .
The following statements are equivalent.
• D α ( P ∥ Q ) ≤ B .
• For every function
h : Y → R ≥ 0 , it holds that E y ∼ P [ h ( y )] ≤ e B ( α − 1)
α E y ∼ Q [ h ( y ) β ] 1 /β .
Proof.
First, if there is y ∈ Y such that
=
Pr[ Q = y ] <
Pr[ P = y ] , then we have D α ( P ∥ Q ) = ∞ and Condition 2 does not hold for any B < ∞ .
In the following, we assume supp( P ) =
supp( Q ) =
Y .
Note that in this case, we have D α ( P ∥ Q ) < ∞ .
We write P ( y ) , Q ( y ) as shorthands for Pr[ P = y ] and Pr[ Q = y ] for brevity.
Now, note that
D α ( P ∥ Q ) ≤ B is equivalent to e D α ( P ∥ Q ) ≤ e B , which is further equivalent to
[Equation]
Consider the measure space M =
( Y , Q ) .
By Holder’s inequality, we have
[Equation]
Moreover, since P ( y ) Q ( y ) is non-negative, it suffices to consider only non-negative h in the supremum above.
Now we are ready to verify the equivalence.
• If Condition 1 holds, we have
[Equation]
Therefore, for every h : Y → R ≥ 0 , it holds that
[Equation]
• On the other hand, if Condition 2 holds, we have
[Equation]
This completes the proof.
The next lemma is Lemma 5.
Reminder of Lemma 5.
Let Y 1 ×
Y 2 be a space.
Consider two distributions P, Q on Y 1 × Y 2 .
Assume supp( P ) =
supp( Q )
=
Y 1 × Y 2 .
Let P 1 , P 2 be the margin of P on Y 1 , Y 2 .
For each y 1 ∈ Y 1 , denote by P 2 | P 1 = y 1 the marginal distribution of y 2 conditioning on y 1 .
Also define the same notation for Q .
Let β ≥ 1 , B ≥ 0 be two reals.
For each y 1 ∈ Y 1 , define
[Equation]
Suppose P ⪯ β e B Q .
Consider the measure spaces ( Y 1 , P 1 ( y 1 ) · ℓ 1 ( y 2 ) 1 /β ) and ( Y 1 , Q 2 ) .
We have
P 1 ℓ 1 /β⪯ β e B Q 1 .
Proof.
Suppose by contradiction that the conclusion of the lemma does not hold.
That is, there is a function g : Y 1 → R ≥ 0 such that
[Equation]
In the following
[Equation]
we show this contradicts with P ⪯ β e B Q .
First off, for each y 1 ∈ Y 1 , by the definition of ℓ 1 ( y 1 )
[Equation]
there is a function f y 1 : Y 2 → R ≥ 0 such that
[Equation]
By scaling f y 1 properly
[Equation]
we can ensure that ∥ f y 1 ∥ P 2 | P 1= y 1 , 1 = ℓ 1 ( y 1 ) 1 /β .
Consequently, we have
[Equation]
Define a new function f : Y 1 × Y 2 → R ≥ 0 as f ( y 1 , y 2 )
=
g ( y 1 ) · f y 1 ( y 2 ) .
Then, we have
[Equation] [Equation]
This contradicts to the assumption that P ⪯ e B Q .
Therefore, we conclude that such function g does not exist and P 1 ℓ 1 /β⪯
[Equation]
A.2.3 Proof of the composition theorem
We prove the following theorem, which is equivalent to Theorem 2.
Theorem 4.
Let M 1 , M 2 be two interactive mechanisms that run on the same data set.
Suppose that
M 1 , M 2 are ( α, ε 1 ) , ( α, ε 2 ) -Rényi
DP, respectively.
Then COMP( M 1 , M 2 ) is ( α, ε 1 + ε 2 ) -Rényi
DP.
Theorem 4 implies Theorem 2 because we can interpret COMP( M 1 , . .
, M k ) as
COMP(COMP( M 1 , . . .
, M k − 1 ) , M k ) and use Theorem 4 inductively.
Now we prove Theorem 4.
Proof.
Suppose without loss of generality that both mechanisms run on a single sensitive input bit b ∈ { 0 , 1 } .
Also suppose that there are 2 T rounds of interactions.
Starting with M 1 , the adversary communicates with two mechanisms alternately.
This is without loss of generality: suppose the adversary A can decide the next query object based previous responses.
Let IT ( A : M 1 , M 2 ) be the transcript of the interaction between A and M 1 , M 2 .
We reduce the interaction to a new protocol where the adversary speaks with two mechanism alternately.
Let A ′ denote a modification of A , defined as follows.
A ′ simulates A while always alternating between two mechanisms.
If the current mechanism is not the one that A wants to speak with, A ′ will send a special “SKIP” query, and the mechanism responds with an “ACK” message.
After this round of interaction, A ′ will switch to interact with the other mechanism, which allows it to continue simulating A .
Let IT ( A ′ :
M 1 , M 2 ) denotes the transcript of the new interaction.
Therefore, for b ∈ { 0 , 1 } , it is easy to establish a bijection between supp( IT ( A ′ :
M b 1 , M b 2 )) and supp( IT ( A : M b 1 , M b 2 )) .
Moreover, the bijection mapping is independent of b 4 .
Therefore, bounding the divergences between IT ( A : M b 1 , M b 2 ) , b ∈ { 0 , 1 } is equivalent to bounding those between IT ( A ′ :
M b 1 , M b 2 ) , b ∈ { 0 , 1 } .
Let Y , Z denote the response domains of M 1 , M 2 respectively.
Also let y 1 , . . .
, y T , z 1 , . . .
, z T denote the lists of responses returned by M 1 and M 2 respectively.
We assume that each response y i , z j contains a copy of the corresponding query message (so that we can recover the whole interaction history just from the responses).
Now, fix A to be an arbitrary adversary.
Let P, Q ∈ ∆(( Y × Z ) T ) denote the output distributions when A interacts with ( M 01 , M 02 ) and ( M 11 , M 12 ) respectively.
Our goal is to prove that
[Equation]
We bound D α ( P ∥ Q ) below.
The bound for D α ( Q ∥ P ) is symmetric.
For a distribution D , we always use D ( x ) to denote Pr
[ D = x ] .
Write y =
( y 1 , . . .
, y T ) where y i denotes the i -th response.
Also write z = ( z 1 , . .
, z T ) and denote yz :=
( y 1 , z 1 , . . .
, y T , z T ) .
By
Lemma 4, it suffices to show that for every h : ( Y × Z ) T → R ≥ 0 , it holds that (cid:88)
[Equation]
where β = αα − 1 is the Hölder conjugate of α .
For each i ∈ [ T ] , let P yi , P zi be the projection of P onto y i , z i .
For each i ∈ [ T ] , let y ≤ i , z ≤ i denote the first i responses from y and z .
Denote ( yz ) ≤ i =
( y 1 , z 1 , . . .
, y i , z i ) .
Then, let P yi | yz <
i denote the distribution of y i conditioning on ( yz ) <
i , and P zi | yz <
i ,y i denote the distribution of z i conditioning on ( yz ) <
i and y i .
Also define the same notation for Q .
Then we write
[Equation]
For every t < T and every y ≤ t , let M 01 | y ≤ t (resp.
M 11 | y ≤ t ) denote the interactive system M(resp.
M 11 ) conditioning on that it has answered y 1 , . . .
, y t to the first t queries.
Formally, for every ( x t +1 , y t +1 ) , . . .
, ( x t ′ , y t ′ ) and x t ′
+1 , define
[Equation]
We also define the same notation for the second mechanism M 2 .
Next, define ℓ t
[Equation]
y ≤
[Equation]
:= exp
[Equation]
sup A
[Equation]
adversary
[Equation]
32) and r t
[Equation]
z
[Equation]
=
[Equation]
By the assumed Rényi DP guarantee, we have that ℓ 0 ( ∅ ) ≤ e ε 1 and r 0 ( ∅ ) ≤ e ε 2 .
We claim the following.
Claim 3.
For each t ≤ T − 1 and y <t , z <t , consider two measures P yt | yz <t ( y ) ℓ t ( y <t ◦ y ) and
Q yt | yz <t ( y ) on the space Y (here ◦ denotes concatenation).
It holds that
[Equation]
A symmetric conclusion holds for P z and z .
Namely
[Equation]
Proof.
Construct an adversary A ′ interacting with M b 1 | y <t as follows.
A ′ starts A with the conditioning that A has gone through the interaction history yz <t .
Then A ′ simulates one step of A and sends a query to M b 1 | y <t .
Upon receiving the response y , A ′ observes y t and switches to run the optimal adversary against M b 1 | y ≤ t provided by (32).
By definition, M b 1 | y <t is ( α, log( ℓ t − 1 ( y <t )))
-Rényi DP.
Applying Lemma 5 on IT ( A ′ , M b 1 | y <t ) completes the proof.
The proof for P zt is similar.
Turning back to (31)
[Equation]
we first deduce that
[Equation]
So far we haven’t utilized Claim 3 yet.
Denote
[Equation]
Applying Claim 3 on (34) for P zT − 1 yields that
[Equation]
We proceed to apply Claim 3 on (35) for P yT − 1 , P zT − 2 , P yT − 2 . . .
, P z 1 , P y 1 in order.
We can get
[Equation]
This shows that P ⪯ e ε 1 + ε 2 Q , which consequently implies that D α ( P ∥ Q ) ≤ ε 1 + ε 2 .
Similarly, we can bound D α ( Q ∥ P ) ≤ ε 1 + ε 2 .
Combining two bounds together completes the proof.
A.3 Proof for Concentrated DP
In this section, we prove Corollary 1.
We recall the definition of zero-concentrated DP and truncated concentrated DP.
Definition 4 (zero-concentrated differential privacy, Bun and Steinke [2016]) .
Let ρ > 0 be a real and M be a mechanism.
M is called ρ -zero-concentrated DP (or ρ -zCDP for short), if for every α ∈ (1 , + ∞ ) , M is ( α, α · ρ ) -RDP.
Definition 5 (truncated concentrated differential privacy Bun et al.
Let ρ > 0 , ω > 1 be two reals, and M be a mechanism.
M is called ( ρ, ω ) -truncated DP (or ( ρ, ω ) -tCDP), if for every α ∈ (1 , ω ) , M is ( α, α · ρ ) -RDP.
We are ready to prove Corollary 1 below.
Proof.
We first prove for zCDP.
Suppose M 1 , . . .
, M k are k interactive mechanisms, where for each i ∈ [ k ] , M i is ρ i -zCDP.
By definition, we know that M i is ( α, αρ i ) -RDP for every α > 1 .
By
Theorem 2, we know that COMP( M 1 , . . .
, M k ) satisfies ( α, α ( (cid:80) i ρ i ))
-RDP.
Since this argument holds for every α > 1 , we conclude that COMP( M 1 , . . .
, M k ) satisfies ( (cid:80) i ρ i ) -zCDP.
The proof for tCDP is similar.
Fix ω > 1 .
Again let M 1 , . . .
, M k are k interactive mechanisms, where for each i ∈ [ k ] , M i is ( ρ i , ω ) -tCDP.
Then, for every α ∈ (1 , ω ) , we know that M i is ( α, αρ i ) -
RDP by definition.
Theorem 2 then shows that COMP( M 1 , . . .
, M k ) satisfies ( α, α ( (cid:80) i ρ i ))
-RDP.
Since the argument holds for every α ∈ (1 , ω ) , we conclude that COMP( M 1 , . . .
, M k ) satisfies ( (cid:80) i ρ i , ω ) -tCDP.
B A Motivating Example of Concurrent Composition
To demonstrate the power of concurrent composition, in this section, we use Theorem 1 to analyze a simple private “Guess-and-Check” algorithm.
We remark that this is a rather preliminary application: the weaker concurrent composition theorem by Vadhan and Wang [2021] is sufficient to do the job.
However, the main purpose of this section is to highlight the importance of concurrent composition, and hopefully inspire researchers to design more sophisticated algorithms.
Setup.
Now we describe the problem.
The private algorithm holds a sensitive data set X .
The user keeps issuing queries to the algorithm, where each query consists of a 1 -Lipschitz function f
i and a guess τ i ∈ R for the value of f i ( X ) .
The algorithm’s job is to verify if f i ( X )
≈
τ i .
If it is the case, the algorithm reports “PASS” and continues to the next query.
Otherwise, the algorithm reports “WRONG” and a value v i that is approximately equal to f i ( X ) (i.e., the algorithm not only declares the invalidity of the user’s guess, but also provides a correct estimation for f i ( X ) ).
We consider the following algorithm.
Algorithm
Input: Private dataset X .
Error tolerance parameter E > 0 .
Privacy-related parameters c ≥ 1 , ε ∈ (0 , 1) .
1 Program: ρ ← Lap (cid:0) 1 ε (cid:1) //
Note that this noise has standard deviation ≈ 1 ε for i = 1 , 2 , . .
, do
Receive the next query ( f i , τ i ) γ i ← Lap( c/ε ) if | f i ( X ) − τ i | + γ i ≥ E
+ ρ then v i ← f i ( X )
+ Lap( c/ε )
Report (WRONG , v i ) t ← t + if t = c then
HALT the algorithm.
else
Return PASS
Discussions.
Algorithm 1 is parameterized by an error tolerance parameter E > 0 and two privacy parameters c ≥ 1 , ε ∈ (0 , 1) .
Roughly speaking, it can process queries until identifying at least c queries whose guesses deviate from the true value by at least (roughly) E .
It works by (concurrently) composing a variant of the sparse vector technique by Lyu et al.
[2017] with the standard Laplace noise-adding mechanism.
The main advantage of the Lyu et al.
[2017] SVT is that it only adds noise to the threshold once (Line 2 of algorithm 1), using a much smaller noise, which makes the SVT algorithm more accurate.
Since the utility guarantee of the algorithm is not the focus of this work, we omit more discussions here and refer interested readers to [Lyu et al., 2017, Zhu and Wang, 2020] for more detail.
We consider the privacy guarantee of Algorithm 1.
In fact, without the concurrent composition framework, it is not clear whether or not Algorithm 1 is really private!
If we replace Line 7 of the algorithm by v i ← 0 , then the algorithm is indeed (3 ε, 0) -private, because it is just a faithful implementation of the Lyu et al.
SVT.
However, in Algorithm 1, the algorithm reports a correct estimation v i for each inaccurate guess, which implies that the future query to the algorithm may depend on v i , and thus on the private data set X .
In this case, the original analysis from [Lyu et al., 2017] does not hold anymore.
Analyzing the privacy.
While it is not hard to prove the privacy property of Algorithm 1 by examining the proof of Lyu et al.
[2017] carefully and applying some modifications, here we show that Algorithm 1 admits a fairly straightforward privacy proof under the concurrent composition framework, using the privacy theorem by Lyu et al.
[2017] as a black box.
We do the analysis now.
First, we have the following lemma from [Lyu et al., 2017].
Lemma 6 (Theorem 2 in Lyu et al.
Consider replacing Line 7 of Algorithm 1 with v i ← 0 .
The resulting algorithm is (3 ε, 0) -DP.
The following fact is well known.
Lemma 7 (Laplace mechanism) .
Consider the following algorithm: given a list of c adaptively chosen, 1 -Lipschitz queries ( g 1 , · · · , g c ) , answer each query with g i ( X ) + Lap( c/ε ) .
The algorithm is ( ε, 0) -DP.
Combining Lemmas 6 and 7 under the concurrent composition framework directly yields the following result.
Theorem 5.
Algorithm 1 is (4 ε, 0) -DP.
Proof.
Consider simulating Algorithm 1 by concurrently composing two algorithms
A 1 , A 2 .
Ais just a modification of Algorithm 1 where we replace Line 7 in Algorithm 1 with v i ← 0 .
By
Lemma 6, A 1 is (3 ε, 0) -DP.
A 2 accepts at most c 1 -Lipschitz query.
For each query g i , A 2 responds with g i ( X )+Lap( c/ε ) .
By Lemma 7, A 2 is ( ε, 0) -DP.
By Theorem 1, COMP( A 1 , A 2 ) is (4 ε, 0) -DP.
We now describe how to simulate Algorithm 1 with COMP( A 1 , A 2 ) .
For each query ( f i , τ i ) to
Algorithm 1, we first feed it into A 1 and observe the outcome.
We pass this query if the outcome is PASS .
Otherwise, the outcome must be (WRONG , 0) .
We then query A 2 with f i to get an estimation f
i + Lap( c/ε ) , and think of this estimation as the “ v i ” returned by Algorithm 1.
In this way, it is easy to see that we faithfully simulate Algorithm 1 by interacting with COMP( A 1 , A 2 ) .
Since COMP( A 1 , A 2 ) is (4 ε, 0) -DP, Algorithm 1 must be (4 ε, 0) -DP also.
This completes the proof.
Remark 2.
Finally, we remark that a similar private “Guess-and-Check” algorithm was also proposed and analyzed by Zhu and Wang [2020], where the authors also considered using a version of SVT without refreshing the threshold after answering each “meaningful” query.
Therefore, their algorithm is also subject to the concurrent composition issue, which seems to be overlooked in the original analysis of Zhu and Wang [2020].
Since they were working with Rényi DP, our Theoremprovides a remedy to this issue easily.