S HUFFLE P RIVATE S TOCHASTIC C ONVEX O PTIMIZATION
Anonymous authors
Paper under double-blind review
A BSTRACT
In shufﬂe privacy, each user sends a collection of randomized messages to a trusted shufﬂer, the shufﬂer randomly permutes these messages, and the resulting shufﬂed collection of messages must satisfy differential privacy.
Prior work in this model has largely focused on protocols that use a single round of communication to compute algorithmic primitives like means, histograms, and counts.
We present interactive shufﬂe protocols for stochastic convex optimization.
Our protocols rely on a new noninteractive protocol for summing vectors of bounded (cid:96) 2 norm.
By combining this sum subroutine with mini-batch stochastic gradient descent, accelerated gradient descent, and Nesterov’s smoothing method, we obtain loss guarantees for a variety of convex loss functions that signiﬁcantly improve on those of the local model and sometimes match those of the central model.
I NTRODUCTION
In stochastic convex optimization, a learner receives a convex loss function (cid:96) :
Θ × X → R mapping pairs of parameters and data points to losses, and the goal is to use data samples x 1 , . . .
, x n to ﬁnd a parameter θ to minimize population loss E x ∼D [ (cid:96) ( θ, x )] over unknown data distribution D .
The general applicability of this framework has motivated a long line of work studying stochastic convex optimization problems under the constraint of differential privacy (Dwork et al., 2006), which guarantees that the solution found reveals little information about the data used during optimization.
This has led to guarantees for both the central and local models of differential privacy.
Users in central differential privacy must trust a central algorithm operator, while users in local differential privacy need not trust anyone outside their own machine.
These different protections lead to different utility guarantees. When optimizing from n samples over a d -dimensional parameter space with privacy parameter ε , the optimal loss term due to privacy is O ( √ d/ ( εn )) in the central model (Bassily et al., 2013; 2019; Feldman et al., 2020). In the local model, the optimal private loss term is O ( √ d/ ( ε √ n )) for sequentially interactive protocols (Duchi et al., 2013) and a class of compositional fully interactive protocols (Lowy and Razaviyayn, 2021).
A similar utility gap between central and local privacy also appears in many other problems (Kasiviswanathan et al., 2011; Chan et al., 2012; Duchi et al., 2013; Duchi and Rogers, 2019; Joseph et al., 2019).
This has motivated the exploration of models achieving a ﬁner trade-off between privacy and utility.
One such notion of privacy is shufﬂe privacy (Cheu et al., 2019; Erlingsson et al., 2019).
Here, users send randomized messages to a shufﬂer, which permutes the collection of messages before they are viewed by any other party.
In conjunction with work on building shufﬂers via onion routing, multi-party computation, and secure computation enclaves, this simple model has led to a now-substantial body of work on shufﬂe privacy (Bittau et al., 2017; Cheu et al., 2019; Erlingsson et al., 2019; Balle et al., 2019;
Ghazi et al., 2021; Balcer and Cheu, 2020; Feldman et al., 2021; Balcer et al., 2021), including steps toward real-world deployment (Google, 2021).
However, comparatively little is known about shufﬂe private stochastic convex optimization.
1. O UR C ONTRIBUTIONS
We introduce sequentially interactive (each user participates in a single protocol round) and fully interactive ( each user participates in arbitrarily many protocol rounds) variants of the shufﬂe model of differential privacy 1 .
This distinction is useful because, while full interactivity offers the strongest possible asymptotic guarantees, the practical obstacles to making multiple queries to a user over the duration of a protocol (Kairouz et al., 2021b; 2019) make sequentially interactive protocols more realistic.
We construct a noninteractive shufﬂe private protocol for privately computing a sum with bounded (cid:96) 2 sensitivity.
By using multiple messages, our protocol is substantially more accurate than existing results (see Related Work).
We use our (cid:96) 2 summation protocol to derive several new shufﬂe private SCO guarantees (Table 1) via techniques including acceleration, Nesterov’s smoothing method in the sequential interactive model, and noisy gradient descent in the fully interactive model.
[Table]
A DDITIONAL R ELATED W ORK
The vast majority of work on shufﬂe privacy studies the noninteractive model, but a few exceptions exist.
Erlingsson et al.
(2019) and Feldman et al.
(2021) study a variant in which the shufﬂer is a layer that accepts randomizers from the analyst, assigns them randomly to users, and sends the permuted messages back to the analyzer.
Feldman et al.
(2021) also construct a basic protocol for SGD in this model.
This model is similar to other work that achieves shufﬂe privacy guarantees by amplifying the local privacy guarantees of local randomizers (Balle et al., 2019).
Erlingsson et al.
(2020) also studied empirical risk minimization using shufﬂe-ampliﬁed sequentially interactive locally private protocols.
The main difference between that work and ours is that we only require that the view of the shufﬂed outputs across rounds satisﬁes differential privacy, and can therefore avoid relying on ampliﬁcation.
Another exception is the work of Beimel et al.
In their version of shufﬂe privacy, the shufﬂer broadcasts the permuted messages to all parties.
This enables users to participate in key exchange protocols, and Beimel et al.
show that a ﬁrst round of key exchange enables the use of multi-party computation (MPC) to simulate any centrally private algorithm in the second round.
Our results depart from theirs in two ways.
First, we only assume that the shufﬂer sends outputs to the analyzer, not to individual users.
Second, the MPC approach given by Beimel et al.
requires an honest majority.
Without an honest majority, the differential privacy guarantees of their simulation fail.
In contrast, the privacy guarantees of our shufﬂe protocols degrade smoothly with the fraction of honest users, which can be anything larger than an arbitrary constant (see discussion at the end of Section 3.1).
Simultaneous independent work by Tenenbaum et al.
(2021) also studies a sequentially interactive variant of the shufﬂe model in the context of multi-arm bandits.
Their model of sequential interactivity is identical to ours, albeit for a different problem.
Girgis et al.
(2021) provide a fully interactive shufﬂe private protocol for empirical risk minimization (ERM).
In contrast, we provide both sequentially and fully interactive protocols for SCO, which optimizes population rather than empirical loss.
Their (cid:96) 2 summation protocol requires one message from each user, and its second moment guarantee for the average gradient has a 1 /b dependence on batch size b (their Lemma 4).
In contrast, our multi-message protocol obtains a better 1 /b 2 dependence.
This is possible because our multi-message protocol does not rely on privacy ampliﬁcation, and in particular circumvents their single-message lower bound (their Theorem 3).
Concurrent work by Lowy and Razaviyayn (2021) study fully interactive shufﬂe private protocols with SCO guarantees matching ours (Section 4.2).
There are two key differences between their work and ours.
First, they do not provide sequentially interactive protocols.
Second, their fully interactive protocols assume that users can send messages consisting of real vectors.
This assumption is difﬁcult to satisfy in practice (Canonne et al., 2020; Kairouz et al., 2021a).
As a result, our protocols (and most of those in the shufﬂe privacy literature) rely only on discrete messages.
Finally, several shufﬂe private protocols are known for the simpler problem of summing scalars (Cheu et al., 2019; Balle et al., 2019; Ghazi et al., 2019; Balcer and Cheu, 2020) and recent work has studied vector addition in the secure aggregation model (Kairouz et al., 2021a), which assumes the existence of a trusted aggregator that can execute modular arithmetic on messages.
We expand on this work by introducing a shufﬂe private protocol for summing vectors with bounded (cid:96) 2 norm, with noise standard deviation proportional to the (cid:96) 2 sensitivity.
P RELIMINARIES 2. D IFFERENTIAL P RIVACY
Throughout, let X be a data universe, and suppose that each of n users has a single data point from
X .
Two datasets X, X (cid:48) ∈
X n are considered neighbors , denoted X ∼ X (cid:48) , if they differ in the value of at most one user.
Differential privacy is deﬁned with respect to neighboring databases.
Deﬁnition 2.1 (Dwork et al.
An algorithm A satisﬁes ( ε, δ ) -differential privacy if, for every
X ∼ X (cid:48) and every event Z , P A [ A ( X ) ∈ Z
] ≤ e ε · P A [ A ( X (cid:48) ) ∈ Z ] + δ .
Because Deﬁnition 2.1 assumes that the algorithm A has “central” access to compute on the entire raw dataset, we call this central privacy for brevity.
For brevity, we will often use differential privacy and DP interchangeably.
At times, it will also be useful to rephrase DP as a divergence constraint.
Deﬁnition 2.2.
The δ -Approximate Max Divergence between distributions X and Y is
[Equation]
Fact 2.3.
Algorithm A is ( ε, δ ) -DP if and only if, for all X ∼ X (cid:48) , D δ ∞ ( A ( X ) ||A ( X (cid:48) )) ≤ ε .
A key property of DP is closure under post-processing.
Fact 2.4 (Proposition 2.1 (Dwork and Roth, 2014)) .
Fix any function f .
If A is ( ε, δ ) -differentially private, then the composition f ◦ A is also ( ε, δ ) -differentially private.
2. S HUFFLE P RIVACY
In the shufﬂe model (Bittau et al., 2017; Cheu et al., 2019; Erlingsson et al., 2019), we do not require users to trust the operator of A .
Instead, we make the narrower assumption that there is a trusted shufﬂer : users pass messages to the shufﬂer, the shufﬂer permutes them, and the algorithm A operates on the resulting shufﬂed output, thus decoupling messages from the users that sent them.
Deﬁnition 2.5.
A one-round shufﬂe protocol P is speciﬁed by a local randomizer R : X → Y ∗ and analyzer A :
Y ∗ → Z .
In an execution of P on X , each user i computes R ( X i ) —possibly using public randomness—and sends the resulting messages y i, 1 , y i, 2 , . . .
to the shufﬂer S .
S reports (cid:126)y to an analyzer, where (cid:126)y is a uniformly random permutation of all user messages.
The ﬁnal output of the protocol is A ( (cid:126)y ) .
We now deﬁne our privacy objective in the shufﬂe model, often shorthanded as “shufﬂe privacy”.
Deﬁnition 2.6 (Cheu et al.
; Erlingsson et al.
P =
( R , A ) is ( ε, δ ) -shufﬂe differentially private if the algorithm ( S ◦ R n )( X ) :
=
S ( R ( X 1 ) , . . .
, R ( X n )) , i.e. the analyzer’s view of the shufﬂed messages, is ( ε, δ ) -differentially private.
The privacy guarantee is only over the internal randomness of the users’ randomizers and the shufﬂer.
A drawback of the preceding deﬁnition of shufﬂe protocols is that it limits communication to one round.
It is not possible, for example, to adjust the randomizer assigned to user i based on the messages reported from user i − 1 .
This is an obstacle to implementing adaptive algorithms like gradient descent.
We therefore extend the shufﬂe model with the following sequentially interactive and fully interactive variants.
Sequential interactivity breaks the data into batches and runs a different shufﬂe protocol on each batch in (possibly adaptive) sequence.
Deﬁnition 2.7.
Let Tr denote the universe of shufﬂe protocol transcripts, and let R denote the universe of randomizers.
A sequentially interactive shufﬂe protocol P consists of initial local randomizer R 0 , analyzer A , and update function U :
Tr → [ n ] × R .
Let Tr t denote the transcript after t rounds of the protocol.
In each round t of P , the analyzer computes ( n t , R t ) =
U ( Tr t − 1 ) , n t new users apply R t to their data points, and S shufﬂes the result and relays it back to A .
At the conclusion of a T -round protocol, the analyzer releases ﬁnal output A ( Tr T ) .
This formalizes the idea that the analyzer looks at the past shufﬂed outputs to determine how many and what kind of randomizers to pass to the next batch of users.
Note that, in a sequentially interactive protocol, each user only participates in one computation.
More generally, we can further allow the analyzer to repeatedly query users.
This leads us to the fully interactive model .
Deﬁnition 2.8.
A fully interactive shufﬂe protocol P is identical to a sequentially interactive shufﬂe protocol, except the update function U :
Tr → 2 [ n ] × R selects an arbitrary subset of users in each round.
In particular, a user may participate in multiple rounds.
The main advantage of full interactivity is that it offers the strongest formal utility guarantees (see
Section 4); the main advantage of sequential interactivity is that it is typically difﬁcult to query a user multiple times in practice (Kairouz et al., 2021b; 2019).
For sequentially and fully interactive shufﬂe protocols, the deﬁnition of privacy is identical: the view of the transcript satisﬁes DP.
The noninteractive deﬁnition is a special case of this general deﬁnition.
Deﬁnition 2.9.
Given shufﬂe protocol P , let M P : X ∗ →
Tr denote the central algorithm that simulates P on an input database and outputs the resulting transcript.
Then P is ( ε, δ ) -shufﬂe differentially private if M P is ( ε, δ ) -differentially private.
2. S TOCHASTIC C ONVEX O PTIMIZATION
Let closed convex Θ ⊂ R d with diameter D be our parameter space.
We always assume loss functions (cid:96) ( θ, x ) that are convex and L -Lipschitz in Θ .
Deﬁnition 2.10.
Loss function (cid:96) :
Θ × X → R is convex in Θ if, for all x ∈ X , for all t ∈ [0 , 1] and θ, θ (cid:48) ∈ Θ , (cid:96) ( tθ + (1 − t ) θ (cid:48) , x ) ≤ t(cid:96)
( θ, x ) + (1 − t ) (cid:96) ( θ (cid:48) , x ) .
(cid:96) is L -Lipschitz in Θ if for all x ∈ X and θ, θ (cid:48)
∈ Θ , | (cid:96) ( θ, x ) − (cid:96) ( θ (cid:48) , x ) | ≤ L (cid:107) θ − θ (cid:48) (cid:107) 2 .
In some cases, we also assume that our loss function (cid:96) is β -smooth and/or λ -strongly convex.
Deﬁnition 2.11.
Loss function (cid:96) :
Θ × X → R is β -smooth over Θ if, for every x ∈ X and for every θ, θ (cid:48) ∈ Θ , (cid:107)∇ (cid:96) ( θ, x ) − ∇ (cid:96) ( θ (cid:48) , x ) (cid:107) 2 ≤ β (cid:107) θ − θ (cid:48) (cid:107) 2 .
(cid:96) is λ -strongly convex in Θ if, for all x ∈ X , for all t ∈ [0 , 1] and θ, θ (
cid:48) ∈ Θ , (cid:96) ( tθ + (1 − t ) θ (cid:48) , x ) ≤ t(cid:96) ( θ, x ) + (1 − t ) (cid:96) ( θ (cid:48) , x ) − λt (1 − t )(cid:107) θ − θ (cid:48) (cid:107) 22 .
Our goal is to minimize population loss.
We will view each user as a sample from D , and our protocols will learn from these samples through repeated interaction with the shufﬂer rather than direct access to the samples.
Deﬁnition 2.12.
Let D be a distribution over X , and let (cid:96) :
Θ × X → R be a loss function.
Then algorithm
A : X ∗ → Θ has population loss E A , D (cid:2) (cid:96) (¯ θ, D ) (cid:3) =
E θ ∼A ( D n ) [ E x ∼D [ (cid:96) ( θ, x )]] .
V ECTOR S UMMATION
In this section, we provide a shufﬂe private protocol P VEC for summing vectors of bounded (cid:96) 2 norm.
This contrasts with existing work, which focuses on (cid:96) 1 sensitivity.
P VEC will be useful for the gradient descent steps of our algorithms in Section 4.
P VEC relies on d invocations of a scalar sum protocol
P 1D , one for each dimension.
We describe this scalar summation subroutine in Section 3.1, then apply it to vector summation in Section 3.2.
Proofs for results in this section appear in Appendix A
3. S CALAR S UM S UBROUTINE
We start with the pseudocode for P 1D , a shufﬂe protocol for summing scalars.
As is generally the case for shufﬂe protocols, the overall protocol decomposes P 1D
=
( R 1D , A 1D ) into randomizer and analyzer components: each user i computes a collection of messages (cid:126)y i ∼ R 1D ( x i ) , the shufﬂer S aggregates and permutes these messages to produce (cid:126)y ∈ { 0 , 1 } ( g + b ) n , and the analyzer takes the result as input for its ﬁnal analysis A 1D ( S ( (cid:126)y )) .
P 1D uses the ﬁxed-point encoding presented by Cheu et al.
and ensures privacy using a generalization of work by Balcer and Cheu (2020).
Algorithm
1: Parameters: Scalar database X
= ( x
, x n ) ∈ [0 , ∆ n ; g, b
; p
/ 2) 2: procedure L OCAL RANDOMIZER R 1D ( x ) 3: Set x ← (cid:98) xg/ ∆ (cid:99) 4:
Sample rounding value η 1 ∼ Ber ( xg/ ∆ − x ) 5:
Set ˆ x ← x + η6:
Sample privacy noise value η 2 ∼ Bin ( b, p ) 7:
Report ˆ x + η 2 copies of 1 and g + b − (ˆ x + η 2 ) copies of8: end procedure 9: procedure A NALYZER
A 1D ( S ( (cid:126)y ) ) 10:
Output estimator ∆ g (( (cid:80) ( g + b ) n i = y i ) − pbn ) 11: end procedure
P 1D ’s privacy guarantee is instance-speciﬁc: for every pair of inputs, we bound the approximate maxdivergence between output distributions as a function of the change in inputs.
Previously proposed by
Chatzikokolakis et al.
(2013), this property will be essential when proving that P VEC is private.
Lemma 3.1.
Fix any number of users n , ε ≤ 1 , and 0 < δ < 1 .
Let g ≥ ∆ √ n , b > 180 g 2 ln(2 /δ )
ε 2 n , and p = 90 g 2 ln(2 /δ ) bε 2 n .
Then 1) for any neighboring databases X ∼ X (cid:48) ∈ [0 , ∆] n that differ on user u , D δ ∞ [Equation]
S [Equation] 1D )
[Equation] S [Equation] (cid:17) , and 2) for any input database
X ∈ [0 , ∆] n , P 1D ( X ) is an unbiased estimate of (cid:80) ni
=1 x i and has variance O ( ∆ 2 ε 2 log 1 δ ) .
We defer the proof to Appendix A. Claim 1 follows ﬁrst from the observation that the adversary’s view is equivalent to the sum of the message bits.
This sum has binomial noise, so we then adapt relevant work from Ghazi et al.
Claim 2 follows as a straightforward calculation.
Lemma 3.1 holds when all n users follow the protocol.
We call these users honest .
It is possible to prove a more general version of Lemma 3.1 whose parameters smoothly degrade with the fraction of honest users (see Appendix A.3).
This robust variant of shufﬂe privacy was originally deﬁned in work by Balcer et al.
and naturally extends to P VEC .
The remaining analysis uses P 1D in a black-box manner.
It is therefore possible to replace it with a lower-communication subroutine for scalar sum (Balle et al., 2019).
However, this improved communication requires a more complicated protocol with an additional subroutine.
Our work focuses on sample complexity guarantees, so we use P 1D for clarity.
Nonetheless, we note that each user sends g + b ≈ ∆ √ n + ∆ 2 log(1 /δ )
/ε 2 bits in P 1D , and the analyzer processes these in time
O (( g + b ) n ) .
Scaling these quantities by d yields guarantees for P VEC in the next subsection.
Moreover, it is possible to remove the communication dependence on ∆ by having users scale down their inputs by ∆ before running P 1D , running P 1D as if ∆ = 1 , and then scaling up the ﬁnal output by ∆ to compensate; this does not affect the overall unbiasedness or variance guarantees.
3. V ECTOR S UM
Below, we present the pseudocode for P VEC , again decomposing into randomizer and analyzer components.
Note that we view the vector (cid:126)y to be the collection of all shufﬂed messages and, since the randomizers labels these messages by coordinate, (cid:126)y j consists of the messages labelled j .
The accompanying guarantee for P VEC appears in Theorem 3.2.
Theorem 3.2.
For any 0 < ε ≤ 1 , 0 < δ < 1 , d, n ∈ N , and ∆ 2 > 0 , there are choices of parameters b, g ∈ N and p ∈ (0 , 1 / 2) for P 1D (Algorithm 3.1) such that, for inputs (cid:126) X = ( (cid:126)x 1 , . . , (cid:126)x n ) of vectors do 4:
Shift i
← ← Output procedure do 11:
Run analyzer on j ’s messages j ← A 1D
Re center: o j ← z j − ∆13: end for 14:
Output the vector of estimates (cid:126)o 15: end procedure with maximum norm || (cid:126)x i || 2 ≤ ∆ 2 , 1) P VEC is ( ε, δ ) -shufﬂe private and, 2) P VEC ( (cid:126)X ) is an unbiased estimate of (cid:80) ni
=1 (cid:126)x i and has bounded variance
E   (cid:13)(cid:13)(cid:13)(cid:13)(cid:13) P VEC ( (cid:126)X ) − n (cid:88) i = (cid:126)x i (cid:13)(cid:13)(cid:13)(cid:13)(cid:13)    = O (cid:18) d ∆ε 2 log 2 d δ (cid:19) .
The proof relies on a variant of advanced composition (Lemma 3.3).
Although the proof follows many of the same steps as prior work, the statement is somewhat nonstandard because it uses the divergence between two speciﬁc algorithm executions, rather than the worst-case divergence of a generic differential privacy guarantee.
Lemma 3.3.
Fix any γ ∈ (0 , 1) and neighboring databases X, X (cid:48)
∈ X n . For all j ∈ [ d ] , suppose algorithm A j : X n → Y use independent random bits and satisﬁes D δ j ∞ ( A j ( X ) ||A j ( X (cid:48) ))
≤ ε j .
Let ε (cid:48)
=
d (cid:88)
j = ε
[Equation]
[Equation]
ε
[Equation]
+ [Equation] (cid:118)(cid:117)(cid:117)(cid:116) log(1 /γ )
d (cid:88)
j = ε 2 j and δ (cid:48) =
d (cid:88)
j = δ j + γ.
Then D δ (cid:48) ∞
( A 1 ( X ) , . . .
, A d ( X ) ||A 1 ( X (cid:48) ) . . . , A d ( X (cid:48) ))
≤ ε (cid:48) .
We also defer the proof of Theorem 3.2 to Appendix A but sketch the outline here.
For any neighboring pair of datasets, the j -th invocation of P 1D by P VEC produces one of two message distributions such that the divergence between them is roughly proportional to the gap in the j -th coordinate of the input.
This is immediate from Lemma 3.1.
The fact that we know a bound on sensitivity allows us to bound the (squared) (cid:96) 2 norm of the vector of divergences.
This norm is implicit within Lemma 3.3, so the target theorem follows by re-scaling of parameters and substitution.
C ONVEX O PTIMIZATION
We now apply P VEC to convex optimization.
Section 4.1 describes shufﬂe protocols that are sequentially interactive and solicit one input from each user.
2 Section 4.2 offers stronger utility guarantees via fully interactive protocols that query users multiple times.
Complete proofs of all results in this section, along with communication and runtime guarantees, appear in Appendix B.
4. S EQUENTIALLY I NTERACTIVE P ROTOCOLS
Our ﬁrst sequentially interactive protocol is a simple instantiation of noisy mini-batch SGD, P SGD .
This baseline algorithm achieves population loss O (cid:16) d 1 / 4 √ εn (cid:17) (Theorem 4.1), which already improves on the locally private guarantee.
However, in a departure from the central and local models, we then show that a still better O (cid:16) d 1 / 3 ( εn ) 2 / 3 (cid:17) loss guarantee is possible (Theorem 4.7) using a more complex algorithm P AGD that smooths the loss function and employs accelerated SGD.
Convex (cid:96) We start with P SGD .
Because P SGD is sequentially interactive, for a ﬁxed number of users n , the batch size b is inversely proportional to the number of iterations T .
As a result, Theorem 4. chooses b to balance the noise added to each gradient step (which decreases with b ) with the number of steps taken (which also decreases with b ).
Algorithm
Require: Number of users n , batch size b , privacy parameter ε, δ , step size η , Lipschitz parameter L 1: Initialize parameter estimate θ
∈ Θ , and set number iterations
2: for
, T do 3:
Compute gradient at θ t − 1 , ¯ g t ← 1 b P VEC ( ∇ θ (cid:96) ( θ t − 1 , x t, 1 ) , · · · , ∇ θ (cid:96) ( θ t − 1 , x t,b ); ε, δ, L ) 4:
Update parameter estimate θ t ← π Θ ( θ t − 1 + η ¯ g t ) 5: end for 6: Output
(cid:80)
= θ t
Theorem 4.1.
Let loss function (cid:96) be convex, L -Lipschitz over a closed convex set Θ ⊂ R d of diameter
D , ¯ θ = 1 T (cid:80) T − 1 t =0 θ t , b = √ d log( d/δ )
[Equation]
, T = n/b , η = εbD L √ T ( εb + √ dL log( d/δ )) , and ε ≤ 1 .
Then P SGD is ( ε, δ ) -shufﬂe private and has population loss
[Equation]
Privacy—for P SGD and our other protocols, which all rely on P VEC —follows from the fact that the
L -Lipschitz assumption ensures that a loss gradient has (cid:96) 2 norm at most L .
The utility proof proceeds by viewing each noisy gradient step as a call to a noisy gradient oracle.
This enables us to use a standard result for gradient oracle SGD.
Lemma 4.2 (Bubeck et al.
Suppose P SGD queries an L G -noisy gradient oracle at each iteration, then its output satisﬁes
[Equation]
In our case, we can bound the noise level L G as a function of our problem and privacy parameters, including the batch size.
We then choose the batch size to minimize the overall loss guarantee.
Convex and smooth (cid:96) Next, we obtain a better loss guarantee than Theorem 4.1 when the loss function is also smooth.
The key insight is that by using acceleration, a better trade-off between noise level and number of iterations is possible.
The resulting algorithm, P AGD , can be seen as a private version of the accelerated stochastic approximation algorithm (AC-SA) of Lan (2012).
Theorem 4.3.
Let (cid:96) be convex, β -smooth, and L -Lipschitz over closed convex set Θ ⊂ R d of diameter
D .
Denote ¯ θ = θ ag t +1 .
Let batch size b = n 3 / 5 d 1 / 5 L 2 / 5 log 2 / 5 ( d/δ )
ε 2 / 5 β 2 / 5 D 2 /, L t = 1 t +
( T + 2) 3 / 2 σD + β ) , α t = 2 t +2 , and ε ≤ 1 .
Then P AGD is ( ε, δ ) -shufﬂe private with population loss
[Equation]
The proof of Theorem 4.3 is similar to that of Theorem 4.1.
The main difference is that we rely on an oracle utility guarantee that is speciﬁc to accelerated gradient descent:
Require: Number of users n , batch size b , privacy parameters ε, δ , Lipchitz parameter L , learning rate sequence { L t } , {
α t } 1: do 3:
Update middle parameter θ md t ← α t θ t + (1 − α t ) θ ag t .
Estimate gradient at θ md t , ¯ g t ← 1 b P VEC (cid:0) ∇ θ (cid:96) ( θ md t , x t, 1 ) , · · · , ∇ θ (cid:96) ( θ md t , x t,b ); ε, δ, L (cid:1) 5:
Update parameter estimate θ t +1 ← arg min θ ∈ Θ (cid:8) (cid:104)
¯ g t , θ − θ t (cid:105)
+ L t 2 (cid:107) θ − θ t (cid:107) 22 (cid:9) 6:
Update aggregated parameter estimate θ ag t
+1 ← α t θ t +
+ (1 − α t ) θ ag t 7: end for 8: Output θ ag T +
Lemma 4.4 (Theorem 2 (Lan, 2012)) .
Suppose P AGD receives a noisy gradient oracle with variance (at most) σ in each iteration.
Taking L t = 1 t +1 (( T + 2)
3 / 2 σD + β ) , α t = 2 t +2 , then the expected error of P AGD can be bounded as
[Equation]
Smoothing for convex non-smooth (cid:96) Perhaps surprisingly, when the target loss function is convex and non-smooth, the SGD approach of algorithm P SGD is suboptimal.
We improve the convergence rate by combining the accelerated gradient descent method P AGD with Nesterov’s smoothing technique.
In particular, for a non-smooth loss function, we approximate it with a smooth function by exploiting Moreau-Yosida regularization.
We then optimize the smooth function via P AGD .
This is not the ﬁrst application of Moreau-Yosida regularization in the private optimization literature (Bassily et al., 2019), but we depart from past work by combining it with acceleration to attain a better guarantee.
We start by recalling the notion of the β -Moreau envelope, using the language of Bassily et al.
Deﬁnition 4.5.
For β > 0 and convex f : θ → R d , the β -Moreau envelope f β : θ → R d of f is
[Equation]
The following properties of the β -Moreau envelope will be useful.
Lemma 4.6 (Nesterov (2005)) .
Let f : θ → R d be a convex function, and deﬁne the proximal operator prox f
( θ ) =
arg min θ (cid:48) ∈ Θ (cid:0)
f ( θ (cid:48) )
+ 12 (cid:107) θ − θ (cid:48) (cid:107) 22 (cid:1) .
For β > 0 :
f β is convex, 2 L -Lipschitz and β -smooth.
∀ θ ∈ Θ , ∇ f β ( θ ) =
β ( θ − prox f/β ( θ )) .
∀ θ ∈ Θ , f β ( θ ) ≤ f ( θ ) ≤ f β ( θ )
+ L 2 2 β .
Informally, we use Lemma 4.6 as follows.
First, claim 1 enables us to optimize f β using P AGD .
Inside P AGD , we use claim 2 to compute the desired gradients of f β and obtain a loss guarantee for f β using Theorem 4.3.
Finally, claim 3 bounds the change in loss between f β and the true function f as a function of β .
We then choose β to minimize the overall loss guarantee.
Theorem 4.7.
Let (cid:96) be convex and L -Lipschitz over a closed convex set Θ ⊂ R d of diameter D and ε ≤ 1 .
Then combining P AGD with the above smoothing method yields an ( ε, δ ) -shufﬂe private algorithm with population loss
[Equation]
Strongly convex function When the function is strongly convex, we use a folklore reduction from the convex setting: start from arbitrary point θ 0 ∈ Θ , and apply a convex optimization algorithm k
= O (log log n ) times, where the j -th ( j ∈ [ k ] ) application uses the output from previous phase as the initial point and n j = n/k samples.
In the strongly convex but possibly non-smooth case, we apply the smoothing version of P AGD used in Theorem 4.7.
In the strongly convex and smooth case, we apply the version of P AGD used in Theorem 4.3.
A similar approach appears in the work of Feldman et al.
(2020); the adaptation for our setting requires, among other modiﬁcations, a more careful analysis of the optimization trajectory.
Theorem 4.8.
Let (cid:96) be λ -strongly convex and L -Lipschitz over a closed convex set Θ ⊂ R d of diameter D and ε ≤ 1 .
Then combining P AGD with the reduction above yields an ( ε, δ ) -shufﬂe private algorithm with population loss
[Equation]
If the loss function is also β -smooth
[Equation]
then the population loss can be improved to
[Equation]
4. F ULLY I NTERACTIVE P ROTOCOL
We conclude with fully interactive protocols, which allow a user to participate in multiple shufﬂes.
In this expanded setting, a version of P SGD obtains loss guarantees that match those of the central model of DP, up to logarithmic factors.
The pseudocode of our protocol P GD is shown in Algorithm 5.
For strongly convex functions, we further divide users into disjoint groups and apply a fully interactive protocol P GD to each group in sequence, using the parameter estimate learned from one group as the initial parameter estimate for the next.
Algorithm
Require: Number of users n , privacy parameters ε, δ , Lipschitz parameter L , number of iterations
T , step size η 1: Initialize parameter estimate θ 0 ←2: for t = 1 , 2 ,
. . , T do 3:
Compute the gradient at θ t ,
[Equation]
Compute and store the parameter θ t +
Θ ( θ t + η g t ) 5: end for
: Output ﬁnal
Theorem 4.9.
Let (cid:96) be convex and L -Lipschitz over a closed convex set Θ ⊂ R d of diameter D and ε ≤ 1 .
Then the protocol P GD is ( ε, δ ) -shufﬂe private with population loss
[Equation]
If (cid:96) is λ -strongly convex, we can further improve the population loss to
[Equation]
Details appear at the end of Appendix B; since the algorithm and analysis combines previouslydiscussed components, we sketch them here.
The analysis employs the same Moreau envelope approach used in Theorem 4.7.
However, unlike in the analysis of Theorem 4.7, we no longer require acceleration.
Advanced composition and an appropriate setting of the parameters completes the result.
For strongly convex function, we need to further split users into log log n disjoint groups and apply
P GD to these disjoint groups of users in sequence.
A P ROOFS FOR S UM
The goal of this section is to prove Lemma 3.1 and Theorem 3.2.
A. P ROOFS FOR S CALAR S UM
We ﬁrst state a technical lemma that follows from a mild modiﬁcation of the analysis done by Ghazi et al.
Lemma A.1.
For any function f : X n → Z and parameters p ∈ (0 , 1 / 2] and m ∈ N , let
M m,p,f : X n → Z be the algorithm that samples η ∼ Bin ( m, p ) and returns f ( X ) + η .
For any t ∈ N , X ∼ X (cid:48) such that | f ( X ) − f
( X (cid:48) )
| ≤ t , and α ∈ (0 , 1) where αmp ≥ 2 t ,
[Equation]
where ε = | f
( X ) − f
( X (cid:48) )
| ln 1+ α 1 − α and δ = 2 exp( − α 2 mp/ 10) .
Proof.
Fix any set of integers Z .
We will show that
[Equation]
which is equivalent to the divergence bound.
For any integer i , we use the notation Z − i to denote the set { z − i | z ∈ Z } .
Then
[Equation]
The last inequality holds for any set Q .
Our speciﬁc Q is
[Equation]
Recall that we supposed | f ( X ) − f ( X (cid:48) )
| ≤ t ≤ αmp 2 .
The following fact comes from Lemma 4.
in Ghazi et al.
(2021): for any k ∈ [ − t, t ] ,
[Equation]
Then by substitution,
[Equation]
With Lemma A.1 in hand, we now turn to proving our main result for scalar sum, Lemma 3.1.
Lemma A.2 (Restatement of Lemma 3.1) .
Fix any number of users n , ε ≤ 1 , and 0 < δ < 1 .
Let g ≥ ∆ √ n , b > 180 g 2 ln(2 /δ )
ε 2 n , and p = 90 g 2 ln(2 /δ ) bε 2 n .
Then 1) for any neighboring databases
X ∼ X (cid:48) ∈ [0 , ∆] n that differ on user u , D
[Equation]
, and 2) for any input database X ∈ [0 , ∆] n , the P 1D ( X ) is an unbiased estimate of (cid:80) ni
=1 x i and has variance O (∆ + ∆ 2 ε 2 log 1 δ ) .
Proof.
We ﬁrst prove item 1.
On input X , the shufﬂer produces a uniformly random permutation of the ( g + b ) n bits y 1 , . . .
y ( g + b ) n .
For each user i , let z i be the sum of the messages sent by user i , z i = (cid:80) g
+ b j =1 (cid:126)y i,j .
Then the random variable for permutations of y 1 , . . .
y ( g + b ) n can also be viewed as a post-processing of the random variable Z = (cid:80) ni
=
z i .
Let Z (cid:48) be the analogue of Z for input database X (cid:48) , differing in user u .
Then by the data-processing inequality, it sufﬁces to prove
D
[Equation]
/ ∆) .
By the deﬁnition of R 1D , Z is distributed as ˆ x u + (cid:80) i (cid:54) =
u ˆ x u + Bin ( bn, p ) while Z (cid:48) is distributed as ˆ x (cid:48)
u
+ (cid:80) i (cid:54) =
u ˆ x u + Bin ( bn, p ) .
We have therefore reduced the analysis to that of the binomial mechanism.
Our next step is to justify that Lemma A.1 applies to our construction.
Speciﬁcally, we must identify α, m, t and show p < 1 / 2 , | ˆ x u − ˆ x (cid:48) u | ≤ t , and αmp ≥ 2 t .
We set m = bn , t = g , and α = ε/ 3 g Our assumption on b implies that p < 1 / 2 .
And the fact that ˆ x i , ˆ x (cid:48)
i both lie in the interval [0 , g ] implies | ˆ x
i − ˆ x (cid:48)
i | ≤ g = t .
So it remains to prove αmp ≥ 2 t :
[Equation]
Next, we derive the target bound on the divergence.
Via Lemma A.1, we have that
[Equation]
where
[Equation]
and
[Equation] [Equation]
[Equation]
ε
[Equation]
) =
δ.
Moving to item 2, observe that the sum of the messages produced by user i is x i + η 1 + η 2 .
Since ηwas drawn from Ber ( x i g/ ∆ − x i ) , E [ η 1 ]
= x i g/ ∆ − x i and Var [ η 1 ] ≤ 1 / 4 since any Bernoulli random variable has variance ≤ 1 / 4 .
Meanwhile, η 2 is a sample from Bin ( b, p ) so E [ η 2 ] = bp and
Var [ η 2 ] = bp (1 − p ) ≤ bp .
Recall our deﬁnition above of z i = (cid:80) b + g j =1 (cid:126)y i,j .
Then E [ z i ] =
x i g/ ∆+ bp and, by the independence of η 1 and η 2 , Var [ z i ] ≤ 1 / 4 + bp .
Extending this over all n users yields E [
[Equation]
ni =
z i ] =
g ∆ (cid:80) ni
=1 x i + bnp
and
Var [ (cid:80) ni
=
z i ] ≤ n/ 4 + bnp .
A 1D shifts and rescales this quantity, so its ﬁnal output is unbiased
E
[Equation]
and, by our assumption
that g ≥ ∆ √ n and choice of p ,
Var
[Equation]
A. P ROOFS FOR V ECTOR S UM
Having completed our analysis of P 1D , we now turn to P VEC .
The ﬁrst step in this direction is proving the following variant of advanced composition:
Lemma A.3 (Restatement of Lemma 3.3) .
Fix any γ ∈ (0 , 1) and neighboring databases X, X (cid:48) ∈
X n .
For all j ∈ [ d ] , suppose algorithm A j : X n → Y use independent random bits and satisﬁes
D δ j ∞ ( A j ( X ) ||A j ( X (cid:48) ))
≤ ε j .
Let ε [Equation]
(1 /γ ) d (cid:88)
j = ε 2 j and δ (cid:48) =
d (cid:88)
j = δ j + γ.
Then D δ (cid:48) ∞
( A 1 ( X ) , . . .
, A d ( X ) ||A 1 ( X (cid:48) ) . . . , A d ( X (cid:48) ))
≤ ε (cid:48) .
Our proof follows the steps in (Dwork et al., 2010b; Asi et al., 2019) with some minor adaptations.
We provide the detailed proof for completeness.
We ﬁrst provide some useful deﬁnitions.
Deﬁnition A.4.
Given random variables Y and Z , the KL Divergence between Y and Z is
[Equation]
The Max Divergence between Y and Z is
[Equation]
The total variation distance between Y and Z is
[Equation]
The following lemma relating these notions comes from Dwork and Roth (2014).
Lemma A.5 (Lemma 3.17 and 3.18 (Dwork and Roth, 2014)) .
Given random variables Y and Z ,
We have both D δ ∞ ( Y || Z ) ≤ ε and D δ ∞ ( Z || Y ) ≤ ε if and only if there exists random variables Y (cid:48) , Z (cid:48) such that ∆( Y, Y (cid:48) ) ≤ δ/ ( e ε + 1) and ∆( Z, Z (cid:48) )
≤ δ/ ( e ε + 1) , and D ∞ ( Y (cid:48)
|| Z (cid:48) ) ≤ ε , and D ∞ ( Z (cid:48)
|| Y (cid:48) )
≤ ε .
If D ∞ ( Y || Z ) ≤ ε and D ∞ ( Z || Y ) ≤ ε , then D ( Y || Z ) ≤ ε ( e ε − 1) .
For the ﬁrst claim, Dwork and Roth (2014) only explicitly proves that D ∞ ( Y (cid:48)
|| Z (cid:48) ) ≤ ε , but their construction of Y (cid:48) and Z (cid:48) also implies D ∞ ( Z (cid:48)
|| Y (cid:48) )
≤ ε .
We now have the tools to prove our variant of advanced composition, Lemma A.3.
Proof of Lemma A.3.
For any neighboring datasets X and X (cid:48) , let Y =
( Y 1 , Y 2 , . . .
, Y d ) and Z =
( Z 1 , Z 2 , . .
, Z d ) denote the outcomes of running A 1 , . . .
, A d on X, X (cid:48) respectively.
By Fact 2.3 and the ﬁrst part of Lemma A.5, there exist random variables Y (cid:48) =
( Y (cid:48) 1 , . . .
, Y (cid:48) d ) and Z (cid:48) =
( Z (cid:48) 1 , . . .
, Z (cid:48) d ) such that, for any j ∈ [ d ] , the following four inequalities hold: (i) ∆( Y j , Y (cid:48) j ) ≤ δ j / ( e ε j + 1) , (ii) ∆( Z j , Z (cid:48)
j ) ≤ δ j / ( e ε j + 1) , (iii) D ∞ ( Y (cid:48)
j || Z (cid:48)
j ) ≤ ε j , and (iv) D ∞ ( Z (cid:48)
j || Y (cid:48) j ) ≤ ε j .
Then ∆( Y, Y (cid:48) ) , ∆( Z, Z (cid:48) )
≤ d (cid:88)
j = δ j e ε j + 1 <  d (cid:88)
j = δ j .
Consider the outcome set B = { v ∈ R d : Pr[ Y (cid:48)
= v ] ≥ e ε (cid:48)
Pr[ Z (cid:48)
= v ] } .
It remains to prove
Pr[ Y (cid:48) ∈ B ] ≤ γ .
For any ﬁxed realization v = ( v 1 , . .
. , v d ) ∈ R d , we have log (cid:18)
Pr[ Y (cid:48)
= v ]
Pr[ Z (cid:48)
= v ] (cid:19) =
d (cid:88)
j = log (cid:32)
Pr[ Y (cid:48)
j = v j ]
Pr[ Z (cid:48)
j = v j ] (cid:33) (cid:44) d (cid:88)
j = c j where the ﬁrst step follows from independence and the last step deﬁnes c j .
Since D ∞ ( Y (cid:48)
j || Z (cid:48)
j ) ≤ ε j and D ∞ ( Z (cid:48)
j || Y (cid:48) j ) ≤ ε j , we know that | c j | ≤ ε j , and by the second part of Lemma A.
[Equation]
Thus we have
[Equation]
by a Chernoff-Hoeffding bound.
Tracing back, P [ Y (cid:48) ∈ B ] ≤ γ implies D γ ∞
[Equation]
Y (cid:48)
|| Z (cid:48) ) ≤ ε (cid:48) .
Our previous bounds on ∆( Y, Y (cid:48) ) and ∆( Z, Z (cid:48) ) then give D (cid:80) dj
=
δ j + γ ∞
[Equation]
Finally, we can now prove Theorem 3.2, our primary guarantee for vector summation.
Theorem A.6 (Restatement of Theorem 3.2) .
For any 0 < ε ≤ 1 , 0 < δ < 1 , d, n ∈ N , and ∆ 2 > 0 , there are choices of parameters b, g ∈ N and p ∈ (0 , 1 / 2) for P 1D (Algorithm 3.1) such that, for inputs (cid:126)X = ( (cid:126)x 1 , . . .
, (cid:126)x n ) of vectors with maximum norm || (cid:126)x i || 2 ≤ ∆ 2 , 1) P VEC is ( ε, δ ) -shufﬂe private and, 2) P VEC ( (cid:126)X ) is an unbiased estimate of (cid:80) ni
=1 (cid:126)x i and has bounded variance
E
[Equation]
Proof.
We set g = max(2∆ 2 √ n, √ d ) .
We will choose b, p later in the proof.
Fix neighboring databases of vectors (cid:126)X and (cid:126)X (cid:48) .
We assume without loss of generality that the databases differ only in the ﬁrst user, (cid:126)x 1 (cid:54) =
(cid:126)x (cid:48) 1 .
Then the (cid:96) 2 sensitivity is (cid:13)(cid:13)(cid:13)(cid:13)(cid:13) n (cid:88) i =
[Equation]
i − n (cid:88) i =
[Equation]
=
[Equation]
− (cid:126)x (cid:48)
[Equation]
(cid:107) 2 ≤ 2∆ 2 . From our deﬁnition of (cid:126)w i,j in line 4 of the pseudocode for P VEC and the fact that (cid:107) (cid:126)x i (cid:107) 2 ≤ ∆ 2 , (cid:126)w i,j ≥
and (cid:126)w i,j ≤ (cid:107) (cid:126)x i (cid:107) ∞ + ∆ 2 ≤ (cid:107) (cid:126)x i (cid:107) 2 + ∆ 2 ≤ 2∆ 2 .
This means the sensitivity of the value of (cid:126)w i,j is 2∆ 2 .
For each coordinate j ∈ [ d ] , we use a j to denote the absolute difference in the j -th coordinate,
[Equation]
Let γ, ˆ δ = δ/ ( d + 1) and ˆ ε = ε/ 18 (cid:112) log(1 /γ ) .
Because g ≥ 2∆ 2 √ n , we may use Lemma 3.1 to set b, p such that
[Equation]
where we use W j to denote ( w 1 ,j , . .
. , w n,j ) and the last step deﬁnes ε j .
Notice that
[Equation]
The ﬁnal inequality comes from the fact that g ≥ √ d .
By our choices of ˆ ε , γ , and ˆ δ , we apply Lemma 3.3 to conclude that
[Equation]
[Equation]
(cid:88)
[Equation]
(cid:118)(cid:117)(cid:117)(cid:116)
[Equation]
[Equation]
γ ) d (cid:88) j
[Equation]
ε
[Equation]
( ε
[Equation]
small)
[Equation]
(Via (3)) ≤ ε (Choice of ˆ ε ) which is precisely ( ε, δ ) -differential privacy by Fact 2.3.
The estimator produced by P VEC is unbiased because each invocation of P 1D yields unbiased estimates.
And we have, by linearity and the variance bound of P 1D ,
[Equation]
The theorem statement follows by substitution.
A. R OBUST P RIVACY OF S UM
We now discuss the robustness of our privacy guarantees, as mentioned at the end of Section 3.1.
In more detail, we slightly generalize the privacy analysis of P 1D to account for the case where a γ fraction of the users are honest.
Because P 1D is used as a building block for the other protocols we describe, this robustness carries over.
We ﬁrst present the deﬁnition of robust shufﬂe privacy originally given by Balcer et al.
Deﬁnition A.7 (Balcer et al.
Fix γ ∈ (0 , 1] .
A protocol P =
( R , A ) is ( ε, δ, γ ) -robustly shufﬂe differentially private if, for all n ∈ N and γ (cid:48) ≥ γ , the algorithm S◦R γ (cid:48) n is ( ε, δ ) -differentially private.
In other words, P guarantees ( ε, δ ) -shufﬂe privacy whenever at least a γ fraction of users follow the protocol.
Although the above deﬁnition only explicitly handles drop-out attacks by 1 − γ malicious users, this is without loss of generality: any messages sent to the shufﬂer from the malicious users constitute a post-processing of S ◦ R γn .
Now, we show that reducing the number of participants in P 1D loosens the bound on the divergence in a smooth fashion.
Because P 1D is the building block of our other protocols, they inherit its robustness.
The statement requires γ ≥ 1 / 3 , but this constant is arbitrary; changing it to a different value will only inﬂuence the lower bound on g .
Claim A.8.
Fix any γ ∈ [1 / 3 , 1] , any number of users n , ε ≤ 1 , and 0 < δ < 1 .
If g ≥ 3 , b > 180 · g 2 ε 2 n ln 2 δ , and p = 90 · g 2 bε 2 n ln 2 δ then, for any neighboring databases X ∼ X (cid:48) ∈ [0 , ∆] n that differ on user u ,
[Equation]
This implies P 1D satisﬁes ( O ( ε/γ ) , δ, γ ) -robust shufﬂe privacy.
Proof.
The proof proceeds almost identically with that of Item 2 in Lemma 3.1.
The key change is that privacy noise is now drawn from Bin ( γbn, p ) .
This means we take m = γbn .
We again set t = g
but now α = ε/ 3 γg .
Note that α < 1 / 3 because ε ≤ 1 and γg > 3 γ > 1 .
As before, our assumption on b implies that p < 1 /
and we have | ˆ x u − ˆ x (cid:48)
u | ≤ g = t .
So it remains to prove αmp ≥ 2 t in order to apply Lemma A.1:
[Equation]
Now we derive the target bound on the divergence.
Via Lemma A.1, we have that
[Equation]
where
[Equation]
( α small)
[Equation]
Discretization)
[Equation]
and
[Equation]
This concludes the proof.
When we replace ε in the proof of Theorem 3.2 with ε/γ , we can invoke Claim A.8 to derive the following statement about the robust shufﬂe privacy of P VEC .
Corollary A.9.
For any 0 < ε ≤ 1 , 0 < δ < 1 , d, n ∈ N , and ∆ 2 > 0 , there are choices of parameters b, g ∈ N and p ∈ (0 , 1 / 2) for P 1D (Algorithm 3.1) such that, for inputs (cid:126)X = ( (cid:126)x 1 , . . .
, (cid:126)x n ) of vectors with maximum norm || (cid:126)x i || 2 ≤ ∆ 2 and any γ ∈ [1 / 3 , 1] , P VEC is ( ε/γ, δ, γ ) -robustly shufﬂe private
Because P VEC serves as a primitive for our optimization protocols, each round of those protocols ensures privacy in the face of two-thirds corruptions.
For comparison, the generic construction by
Beimel et al.
(2020) is able to simulate arbitrary centrally private algorithms but requires an honest majority.
B P ROOFS FOR S ECTIONB. P ROOFS FOR S ECTION 4.
We start by proving the guarantee for P SGD , Theorem 4.1.
The ﬁrst step is to formally deﬁne the gradient oracle setup that will be necessary for several of our results.
Deﬁnition B.1.
Given function (cid:96) over Θ ⊂ R d , we say G : Θ → R d is an L G -noisy gradient oracle for (cid:96) if for every θ ∈ Θ , (1) E G [ G ( θ )] ∈ ∂(cid:96)
( θ ) , and (2) E G (cid:104)
||
G ( θ ) ||
(cid:105) ≤ L 2 G .
Furthermore, we say the gradient oracle G has variance at most σ 2 if E G (cid:2) (cid:107) G ( θ ) − E G [ G ( θ )]
(cid:107) 22 (cid:3) ≤ σ 2 .
The following lemma is standard for (noisy) stochastic gradient descent.
Lemma B.2 (Restatement of Lemma 4.2) .
Suppose P SGD queries an L G -noisy gradient oracle at each iteration, then its output satisﬁes
[Equation]
We now have the tools to prove Theorem 4.1.
Proof of Theorem 4.1.
The privacy guarantee follows directly from the privacy guarantee of the vector summation protocol (see Theorem 3.2), and the fact that the algorithm queries each user at most once.
For the accuracy guarantee, our algorithm directly optimizes the excess population loss.
For each time step t ∈ { 0 , 1 , . . .
, T − 1 } , we write the gradient ¯ g t = 1 b (cid:80) bi =1 ∇ θ (cid:96) ( θ t − 1 , x t,i ) + Z t .
By
Theorem 3.2, we know that
[Equation]
b
[Equation]
Z
[Equation]
and
E
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)
[Equation]
[Equation]
where the second equality uses the independence of the data and noise, and the inequality follows from (cid:96) being L -Lipschitz and Theorem 3.2.
The gradient ¯ g t therefore qualiﬁes as a noisy gradient oracle call with
[Equation]
By Lemma 4.2 and the fact that there are n/b iterations, we get
[Equation]
The ﬁnal step uses our choice of b =
[Equation]
Next, we prove the guarantee for P AGD , Theorem 4.3.
Proof of Theorem 4.3.
The privacy guarantee follows directly from the privacy guarantee of the vector summation protocol (see Theorem 3.2), and the fact that the algorithm queries each user at most once, and the remaining computation is post-processing.
We now prove the accuracy guarantee.
For any iteration t ∈ [ T ] , let Z t be the noise introduced by the summation protocol P VEC and let ¯ g t = 1 b (cid:80) bi =1 ∇ θ (cid:96) ( θ t − 1 , x t,i ) + Z t .
We ﬁrst bound the variance:
[Equation]
=
[Equation]
The second equality comes from the fact that the data and noise are independent, the fourth equality uses the independence of x t, 1 , · · · , x t,b and (5) follows from Theorem
[Equation]
Next, we use the following result from Lan (2012).
Lemma B.3 (Restatement of Lemma 4.4) .
Suppose P AGD receives a noisy gradient oracle with variance (at most) σ 2 in each iteration.
Taking L t = 1 t +1 (( T + 2)
3 / 2 σD + β ) , α t = 2 t +2 , then the population loss of P AGD can be bounded as
[Equation]
Dσ √
T (cid:19) .
In our case, we have σ 2 =
L 2 b + dL 2 log 2 ( d/δ ) b 2 εso that
E
[Equation]
The ﬁrst step follows from Lemma 4.4, and the second step comes from Eq.
In the last step, we substitute b = n 3 / 5 d 1 / 5 L 2 / 5 log 2 / 5 ( d/δ ) ε 2 / 5 β 2 / 5 D 2 /.
Next, we prove our improved guarantee for convex losses by combining P AGD and smoothing (Theorem 4.7).
Proof of Theorem 4.7.
We directly optimize the loss function (cid:96) β with P AGD .
P AGD only requires the gradient ∇ (cid:96) β ( θ md t , x ) ( t ∈ [ T ] ).
By the second item in Lemma 4.6, this can be obtained by computing β ( θ md t − prox (cid:96)/β ( θ md t )) .
Moreover, since (cid:96) β is 2 L -Lipschitz, P AGD still guarantees ( ε, δ ) -differential privacy with a constant scaling of the noise.
For accuracy, we have that
[Equation]
The ﬁrst step follows from the third item in Lemma 4.6, the second step follows from the guarantee of P AGD (Theorem 4.3) and the fact that (cid:96) β is β -smooth, and the last step comes from our choice of β =
[Equation]
Finally, we prove Theorem 4.8, which applies to strongly convex (cid:96) and is the ﬁnal result about sequentially interactive protocols.
Proof of Theorem 4.8.
The privacy guarantee follows from the previously-proven privacy guarantee for P AGD and the fact that we split the users into disjoint subsets.
The rest of the proof focuses on the population loss.
We begin with the non-smooth setting.
The high level idea for this case is that both the population loss and the distance to optimal solution shrink in each iteration.
By recursively applying the shufﬂe private convex algorithm and solving the recursion, one can get improved convergence rate.
Let ¯ θ
i be the output of the i -th phase and θ ∗ = arg min θ ∈ Θ (cid:96) ( θ, D ) .
Denote D 2 i = E (cid:2) (cid:107) ¯ θ i − θ ∗ (cid:107) 22 (cid:3) and ∆ i
=
E (cid:2) (cid:96) (¯ θ i , D ) − (cid:96) ( θ (cid:63) , D ) (cid:3) .
Due to the λ -strong convexity, we have D 2 i ≤ 2∆ i λ .
Since the guarantee of Theorem 4.7 uses D as a bound on the distance between the starting point and optimum, we have
[Equation]
Here C is an universal constant, and the last step deﬁnes E .
Hence, one has
[Equation]
We know that ∆ 1 ≤ 2 L 2 /λ (due to strong convexity), E 2 ≥ 2 L 2 /λn (due to deﬁnition), and therefore, ∆ 1 /E 2 ≤ O ( n ) .
Hence, after k = O (log log n ) phases, we have ∆ k /E 2 ≤ 2 , and the population loss is
[Equation]
This completes the proof for the non-smooth setting.
Turning to the setting where (cid:96) is also β -smooth, let A = d 2 / 5 β 1 /
[Equation] [Equation]
[Equation] [Equation]
Then our algorithm guarantees
[Equation]
for some constant C > 1 .
First, suppose there exists i ∈
[ k ] such that ∆ i is already small, i.e.
[Equation]
Then we claim ∆ t ≤ 2 10 C 4 (cid:16) L 2 λn i + A 5 / 2 λ 3 / 2 n
i (cid:17) holds for all t ≥ i .
We divide into cases.
Case 1.
Suppose L 2 λn i ≤
A 5 / 2 λ 3 / 2 n 2 i .
Then we have
[Equation]
The ﬁrst step follows from Eq.
(6), n i = n i +
= n/k , the second step follows our assumption.
Case 2.
Suppose L 2 λn i ≥
A 5 / 2 λ 3 / 2 n 2 i .
Then we have ∆ i +1 ≤
[Equation]
The ﬁrst step follows from Eq.
(6), n i = n i +
= n/k , the second step follows our assumption.
Next, suppose ∆ i ≤ T =
2 10 C 4 (cid:16) L 2 λn i + A 5 / 2 λ 3 / 2 n
i (cid:17) , then we claim that ∆ i +1 is decreasing, i.e., ∆ i +1 ≤ ∆ i .
Suppose this does not hold, since we have one of the following should hold
[Equation]
We argue this can not happens, since the former one implies ∆ i ≤ 2 5 C 5 / 2 A 5 / 2 λ 3 / 2 n 2 i and the later implies ∆ i ≤ 2 4 C
Lλn i .
Combining the above argument, we know that ∆ i is decreasing, until it goes below a threshold T , and after that, the value ∆ i will always below such the threshold T .
Now, suppose after k
=
O (log log n ) iterations, ∆ k is still above the threshold T , then we know { ∆ i } i ∈ [ k ] is decreasing and we divide the algorithmic procedure into two phases.
In the ﬁrst phase, we have L √ ∆ i √ λn ≤ A ∆ 3 / 5 i λ 3 / 5 n 4 / 5 i , this happens when ∆ i ≥ L 10 λ
A 10 n 3 i , and the algorithm satisﬁes
[Equation]
i .
For the second phase, we have L √ ∆ i √ λn ≥ A ∆ 3 / 5 i λ 3 / 5 n 4 /
and this happens when this happens when ∆ i ≤
L 10 λ
A 10 n 3 i , and the algorithm satisﬁes
[Equation]
We know one of the two phases will run for more than Ω(log log n ) iterations.
Suppose the former case holds, i.e., ∆ i +1 ≤ 4 C A ∆ 3 / 5 i λ 3 / 5 n 4 / 5 i .
Let E =
[Equation] [Equation]
3 / 5 n
[Equation]
5 i
[Equation]
≤
[Equation]
n
[Equation]
i .
Then, we have
[Equation]
It is easy to verify that ∆ 1 /E ≤ poly ( n ) , and therefore, after Ω(log log n ) iterations, we know that ∆ i will drop below O ( E ) = 2 5 C 5 / 2 A 5 / 2 λ 3 / 2 n 2 i ≤ T .
When later case holds, i.e., ∆ i +1 ≤ 4 C L √ ∆ i √ λn i .
Let E = 16 C 2 L 2 λn i , then we know that
[Equation]
[Equation]
It is easy to verify that ∆ 1 /E ≤ poly ( n ) , and therefore, after Ω(log log n ) iterations, we know that ∆ i will drop below O ( E )
=
16 C 2 L 2 λn i ≤ T .
In summary, taking k = Ω(log log n ) , we know that
[Equation]
This concludes the proof.
B. P ROOFS FOR S ECTION 4.
We now turn to proofs for our fully interactive protocol, P GD .
The ﬁrst step will be proving
Lemma B.6, which provides a privacy and population loss guarantee for P GD when the loss function (cid:96) is smooth.
We will later combine this analysis for smooth losses with the smoothing trick used in the previous section to obtain guarantees for non-smooth losses.
Since P GD passes the training data more than once and does not directly optimize the excess population loss, the proof of Lemma B. proceeds by bounding the empirical loss and the generalization error separately.
First, we recall a result bounding empirical loss.
Lemma B.4 (Bubeck et al.
Let (cid:96) be convex and L -Lipschitz over closed convex set Θ ⊂ R d of diameter D .
Let σ 2 denote the variance of the privacy noise in the gradient update step of P GD .
For any set of data points S and η > 0 , the output of P GD satisﬁes
[Equation]
Next, we bound generalization error.
Lemma B.5 (Lemma 3.4 (Bassily et al., 2019)) .
Suppose (cid:96) is convex, L -Lipschitz, and β -smooth over closed convex set Θ ⊂ R d of diameter D and η ≤ 2 β .
Then P GD is α -uniformly stable with α
=
L 2 Tηn .
In other words, it satisﬁes
[Equation]
With these two tools
[Equation]
we can state and prove Lemma B.
Lemma B.6.
Let (cid:96) be convex, L -Lipschitz, and β -smooth over a closed convex set Θ ⊂ R d of diameter D .
Then P GD is ( ε, δ ) -shufﬂe private with population loss
[Equation]
Proof.
For the privacy guarantee, since each iteration guarantees (
[Equation]
privacy, and the algorithm runs for T iterations in total, advanced composition implies ( ε, δ ) -shufﬂe privacy overall.
We now focus on the loss guarantee.
First, by Lemma B.4, the empirical loss satisﬁes
[Equation]
where the second step follows from L 2 G ≤ L 2 + O ( dTL 2 log 3 ( nd/δ ) n 2 ε) (see Eq.
Moreover, by
Lemma B.5, we know the generalization error is most L 2 Tηn .
Hence, for S ∼ D n ,
[Equation]
The second step follows from Lemma B.5 and Lemma 4.2.
Especially, we take expectation over
S ∼ D n in Lemma 4.2.
The last step follows by taking η = DL √ T and T = min { n,
[Equation]
nd
[Equation]
We use δ (cid:28) 1 /n for the ﬁnal statement.
We can now prove Theorem 4.9.
As done previously, we use Moreau envelope smoothing to apply the guarantee of Lemma B.6.
For the strongly convex case, we apply the same reduction to the convex case as used by Feldman et al.
Proof of Theorem 4.9.
The privacy guarantees are inherited from Lemma B.6.
We employ Moreau envelope smoothing, as described in Lemma 4.6 and used earlier in the proof of Theorem 4.7, to construct (cid:96) β with β = LD min (cid:16) √ n, εn d 1 / 2 log 3 / 2 ( nd/δ ) (cid:17) .
Optimizing (cid:96)
[Equation]
yields
[Equation]
The ﬁrst step follows from the third item in Lemma 4.6, and the second step follows from Lemma B. and the deﬁnition of β .
For strongly convex losses, we use the same reduction as (Feldman et al., 2020).
Lemma B.7 (Theorem 5.1 in (Feldman et al., 2020)) .
Suppose for any loss function that is convex and L -Lipschitz over a closed convex set Θ ⊂ R d of diameter D , there is an ( ε, δ ) -differentially private algorithm that achieves excess population loss of order
[Equation]
Then for any λ -strongly convex, L -Lipschitz loss function, there is an ( ε, δ )
-differentially
private algorithm that achieves excess population loss of order
[Equation]
We note that this reduction works for the fully interactive model and keeps the privacy guarantee.
In particular, one can divide users into the same set of groups as (Feldman et al., 2020) and apply P GD sequentially to these groups.
By taking ρ = [Equation] log 3 / 2 ( nd/δ ) , we get the desired guarantee for strongly convex functions.
B. SCO C OMMUNICATION AND R UNTIME
Recall from the discussion at the end of Section 3.1 that, with the scaling by ∆ trick, each user sends
O ( d [ √ n + log(1 /δ ) /ε 2 ]) bits in each n -user invocation of P VEC , and the analyzer processes these in time
O ( dn [ √ n + log(1 /δ ) /ε 2 ]) .
Communication and runtime guarantees each for SCO algorithm then follow as simple corollaries based on the number of rounds and the batch size in each round.
Corollary B.8.
In the algorithm described in Theorem 4.1, each user sends O ( d [ √ b + log(1 /δ )
/ε 2 ]) bits and the total runtime is
[Equation]
Corollary B.9.
In the algorithm described in Theorem 4.3, each user sends O ( d [ √ b + log(1 /δ )
/ε 2 ]) bits and the total runtime is
[Equation]
Corollary B.10.
In the algorithm described in Theorem 4.7, each user sends O ( d [ √ b +log(1 /δ )
/ε 2 ]) bits and the total runtime is
[Equation]
Note that the preceding corollary omits the time complexity of the smoothing step.
A short discussion of doing this efﬁciently appears in Section 4 of the work of Bassily et al.
Corollary B.11.
In the algorithm described in Theorem 4.9, each user sends
[Equation]
bits in total, and the total runtime is
[Equation]
C P AN PRIVATE CONVEX OPTIMIZATION
Finally, we turn to pan-privacy, where we assume users/data arrive in a stream, and the goal is to guarantee differential privacy against a single intrusion into the stream-processing algorithm’s internal state.
We formalize the model and provide deﬁnition in Section C.1, and provide algorithms in Section C.2.
Pan-privacy was introduced by Dwork et al.
(2010a); we use the presentation given by Amin et al.
(2020) and Balcer et al.
C. M ODELS AND DEFINITION
Our focus will be on online algorithms.
They receive raw data one element at a time in a stream.
At each step in the stream, the algorithm receives a data point, updates its internal state based on this data point, and then proceeds to the next element.
The only way the algorithm “remembers” past elements is through its internal state.
The formal deﬁnition we use is below.
Deﬁnition C.1.
An online algorithm Q is deﬁned by an internal algorithm Q I and an output algorithm Q O .
Q processes a stream of elements through repeated application of Q I :
X × I → I , which (with randomness) maps a stream element and internal state to an internal state.
At the end of the stream, Q publishes a ﬁnal output by executing Q O on its ﬁnal internal state.
As in the case of datasets, we say that two streams X and X (cid:48) are neighbors if they differ in at most one element.
Pan-privacy requires the algorithm’s internal state and output to be differentially private with regard to neighboring streams.
Deﬁnition C.2 (Dwork et al.
(2010a); Amin et al.
Given an online algorithm Q , let Q I ( X ) denote its internal state after processing stream X , and let X ≤ t be the ﬁrst t elements of X .
We say
Q is ( ε, δ ) -pan-private if, for every pair of neighboring streams X and X (cid:48) , every time t and every set of internal state, output state pairs T ⊂ I × O ,
[Equation]
When δ = 0 , we say Q is ε -pan-private .
C. A LGORITHMS
Due to the structural similarity between sequential shufﬂe privacy and pan-privacy, all the results developed in Section 4.1 have pan-private counterparts [Equation]
Theorem C.3.
Suppose a convex loss function (cid:96) is L -Lipschitz over a closed convex set Θ ⊂ R d , then there exists an algorithm with output ¯ θ that guarantees ( ε, δ ) -pan privacy, and: (1) When the loss function is non-smooth, then the population loss satisﬁes
[Equation]
(2) When the loss function is β -smooth, then the population loss satisﬁes
[Equation]
(3) When the loss function is λ -strongly convex, then the population loss satisﬁes
[Equation]
(4) When the loss function is λ -strongly convex and β -smooth then the the population loss satisﬁes
[Equation]
Proof.
We analyze the pseudocode presented in Algorithm 6.
Although it does not explicitly obey the syntax of an online algorithm given in Deﬁnition C.1, it is straightforward to see that the internal state is the tuple ( θ t , θ ag t , θ md t , g t ) and an update to g t occurs when any data point is read.
The updates to the θ variables also occur after the last data point of a batch is read.
We ﬁrst prove Algorithm 6 is ( ε, δ ) -pan private.
Lemma C.4.
For 0 < ε, δ < 1 , Algorithm 6 is ( ε, δ ) -pan-private.
Require: Batch size b , privacy parameter ε , stream length n , learning rate sequence { L t } , {
α t } 1: Initialize noise parameter ζ 2 ← 8 L 2 log(2 /δ )
b 2 ε2: Initialize parameter estimate θ ag 1 = θ 1 ∈ Θ , and set number of iterations T = (cid:98) n/b (cid:99) 3: for t = 1 , 2 , . . .
, T do 4:
Draw fresh noise Z t ← N (cid:0) 0 , ζ 2 I d (cid:1) 5:
Initialize gradient estimate ¯ g t ← Z t 6: for i = 1 , 2 , . . .
, b do 7:
Update gradient estimate ¯ g t ← ¯ g t + 1 b ∇ θ (cid:96) ( θ md t , x t,i ) 8: end for 9: ¯ g t ← ¯ g t + N (cid:0) 0 , ζ 2 I d (cid:1) 10:
Update parameter estimate θ t +1 ← arg min θ ∈ Θ (cid:8) (cid:104)
¯ g t , θ − θ t (cid:105)
+ L t 2 (cid:107) θ − θ t (cid:107) 22 (cid:9) 11:
Update aggregated parameter estimate θ ag t
+1 ← α t θ t +
+ (1 − α t ) θ ag t 12:
Update middle parameter estimate θ md t +1 ← α t θ t +
+ (1 − α t ) θ ag t .
13: end for 14: Output θ ag T +
Proof.
Let t ∗ (resp.
i ∗ ) be the batch number (resp.
position within the batch) where the adversary intrudes.
We will show that
[Equation]
where the (cid:48) indicates variables generated from an execution on neighboring stream X (cid:48) .
For neighboring streams X, X (cid:48) , let t denote the batch number and let i denote the number of the sample within the batch where the two streams differ.
We will perform case analysis around t .
Case 1 : t ∗ < t .
Here, the tuple ( θ t ∗ , θ ag t ∗ , θ md t ∗ , g t ∗ ) is identically distributed with ( θ (cid:48) t ∗ , θ ag t ∗ (cid:48) , θ md t ∗ (cid:48) , g (cid:48) t ∗ ) which means we only need to prove D δ ∞ ( θ ag T +
|| θ ag T +1 (cid:48) )
≤ ε .
Observe that θ ag T +1 (resp.
θ ag T +1 (cid:48) ) is a post-processing of ( θ t , θ ag t , θ md t , g t ) (resp.
( θ (cid:48) t , θ ag t (cid:48) , θ md t (cid:48) , g (cid:48) t ) ), which means that we only need to bound D δ ∞ ( θ t , θ ag t , θ md t , g t || θ (cid:48) t , θ ag t (cid:48) , θ md t (cid:48) , g (cid:48) t ) .
Furthermore, the parameter estimates are generated from a post-processing of the gradient updates, it sufﬁces to bound
D δ ∞ ( g t || g (cid:48) t ) after line 9.
Recall the Gaussian mechanism:
Lemma C.5.
For ε < 1 and function f : A n → B d on size- n databases with (cid:96) 2 -sensitivity
[Equation]
outputting
[Equation]
where I d is the d -dimensional identity matrix, is ( ε, δ ) -centrally private.
For a proof, refer to Theorem A.1 in the survey of Dwork and Roth (Dwork and Roth, 2014).
Since (cid:96) is L -Lipschitz in θ , for any x we have ||(cid:53)
θ (cid:96) ( · , x ) || 2 ≤ L .
Thus
[Equation]
Thus if we deﬁne f ( x t, 1 , . . . , x t,b ) = 1 b (cid:80) bi =1 (cid:53) θ (cid:96) ( θ t , x t,i ) , we get ∆ 2 ( f ) ≤ 2 Lb .
By Lemma C.5, it follows that our addition of Z t ∼ N (cid:16) 0 , 8 L 2 log(2 /δ )
b 2 ε(cid:17) noise guarantees ( ε, δ ) -privacy
Case 2: t ∗ = t .
We break into more cases around i ∗ .
When i ≤ i ∗ < b , the adversary only observes a change to the gradient (line 7).
Speciﬁcally, the tuple ( θ t ∗ , θ ag t ∗ , θ md t ∗ , θ ag T +1 ) is identically distributed with ( θ (cid:48) t ∗ , θ ag t ∗ (cid:48) , θ md t ∗ (cid:48) , θ ag T +1 (cid:48) ) which means it sufﬁces to prove D δ ∞ ( g t || g (cid:48) t ) ≤ ε after line 7.
This follows from the privacy of the Gaussian mechanism.
When i ≤ b = i ∗ , observe that the parameter updates are post-processing of the gradient update.
We again use the privacy of the Gaussian mechanism.
When i ∗ < i , we re-use the arguments from Case 1.
The noise from line 9 provide privacy.
Case 3:
[Equation]
Observe that θ ag T +1 (resp.
θ ag T +1 (cid:48) ) is a post-processing of (
[Equation] [Equation]
, θ
[Equation]
, g
[Equation]
(resp.
( θ (cid:48) t ∗ , θ ag
[Equation]
(cid:48) , θ md t
[Equation]
(cid:48) , g (cid:48) t ∗ ) ), which means that we only need to bound
D
[Equation]
[Equation]
[Equation] [Equation]
md
[Equation]
[Equation]
[Equation]
(cid:48) , θ md
[Equation]
(cid:48) , g (cid:48) t ∗ ) .
But the random variables in question are obtained by post-processing ( θ t , θ ag t , θ md t , g t ) and ( θ (cid:48) t , θ ag t (cid:48) , θ md t (cid:48) , g (cid:48) t ) .
We use the same line of reasoning as Case 1 to bound the divergence.
The main tool for our utility guarantees is bounding the variance of the noise added for privacy, analogous to the variance guarantee of Theorem 3.2.
Once we have that result, the remaining analyses are essentially unchanged from their shufﬂe counterparts, apart from slightly different choices for parameters b and β , which are straightforward algebraic consequences of the different variance guarantee.
As a result, we only bound the variance.
For each time step t ∈ [ T ] , the gradient ¯ g t = 1 b (cid:80) bi =1 ∇ θ
(cid:96) ( θ t − 1 , x t,i ) + Z t,a + Z t , b , where
Z t,a , Z t,b ∼ N (cid:0) 0 , ζ 2 I d (cid:1) .
It is clearly an unbiased estimator and the variance satisﬁes
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[-b E x t ∼D (cid:104) (cid:107)∇ (cid:96) ( θ t − 1 , x t ) − E x [ ∇ (cid:96) ( θ t − 1 , x )] (cid:107) 
 (cid:105) + E (cid:2) (cid:107)-][Table]
[Equation]
[Table]
[Equation] [Table] [Equation] The ﬁrst step follows from the fact that the noise Z t,a , Z t,b is independent of the data x t, 1 , · · · , x t,b , and the second step follows from the independence of x t, 1 , · · · , x t,b .
The last step follows from
Z t,a , Z t,b ∼ N (cid:0) 0 , ζ 2 I d (cid:1) and ζ 2 ← 8 L 2 log(2 /δ )
b 2 ε.