Composition Theorems for Interactive Differential Privacy
Anonymous Author(s)
AffiliationAddress email
Abstract
An interactive mechanism is an algorithm that stores a data set and answers adaptively chosen queries to it.
The mechanism is called differentially private, if anyadversary cannot distinguish whether a specific individual is in the data set byinteracting with the mechanism.
We study composition properties of differentialprivacy in concurrent compositions.
In this setting, an adversary interacts with kinteractive mechanisms in parallel and can interleave its queries to the mechanismsarbitrarily.
Previously, Vadhan and Wang [2021] proved an optimal concurrentcomposition theorem for pure-differential privacy.
We significantly generalize andextend their results.
Namely, we prove optimal parallel composition properties forseveral major notions of differential privacy in the literature, including approximate DP, Rényi DP, and zero-concentrated DP.
Our results demonstrate that theadversary gains no advantage by interleaving its queries to independently runningmechanisms.
Hence, interactivity is a feature that differential privacy grants us forfree.
Introduction
By now, differential privacy [Dwork et al., 2006b] has been widely accepted as a standard frameworkfor protecting individual privacy when performing data analysis on data sets that may contain sensitiveinformation of individuals (see, e.g., the surveys by Dwork and Roth [2014], Vadhan [2017]).
Let M be an algorithm that runs on a data set x and calculates some information about it.
Roughlyspeaking, M is called differentially private, if the output distribution of A remains nearly identicalwhen we arbitrarily modify a single entry in x .
One essential feature of differential privacy is its composability .
Composition captures the scenariowhere a data analyst runs k differentially private algorithms sequentially, and releases the resultsafterward.
Typically, a composition theorem has the following form: if each of the k algorithmssatisfies differential privacy, then the analyst’s output is still differentially private with moderatelydegraded privacy parameters.
Composition theorems are important for at least two reasons.
First, we might want to performcomputation tasks on the same data set multiple times and still have reasonable control over theprivacy loss.
In this case, composition theorems reveal how the privacy guarantee degrades over time.
More importantly, composition theorems allow us to build more complex and powerful differentiallyprivate algorithms from simple primitives, and argue the privacy guarantee of the combined algorithmin a straightforward way.
There is a rich literature concerning the composition property of differential privacy (see, e.g., Dworket al.
[2006a, 2010], Kairouz et al.
[2015], Murtagh and Vadhan [2018], Bassily et al.
However, most existing composition theorems only consider the scenario where an analyst runs several private algorithms sequentially .
That is, the analyst will only move on to the next algorithmafter finishing their computation with the previous one.
In contrast, many fundamental primitives indifferential privacy are interactive in nature, such as the sparse vector technique [Dwork et al., 2009, Roth and Roughgarden, 2010] and private multiplicative weight updates [Hardt and Rothblum, 2010].
Hence, the interactivity issue appears to be a significant limitation of current composition theorems.
Namely, the data analyst may want to communicate with several interactive mechanisms concurrently ,and interleave its queries to the mechanisms arbitrarily.
A sequential composition theorem completelyfails to capture this scenario.
Also, in practice, deployments of DP algorithms often demand a betterunderstanding of concurrent compositions of interactive mechanisms [Hay et al., 2020].
Recently, Vadhan and Wang [2021] initiated a study of concurrent compositions and proved anoptimal concurrent composition theorem for pure differential privacy.
In this work, we significantlyadvance this research direction by proving optimal concurrent composition theorems for severalpopular notions of differential privacy, including approximate DP, Rényi DP, zero-concentrated DPand truncated concentrated DP.
1.1 Setup
Before we continue, we set up necessary pieces of notation.
We use X and Y to denote the domainof query messages and responses, respectively.
We assume that both X and Y are finite sets.
This assumption is for easing some mathematical manipulation and is not restrictive: all practicalapplications of differential privacy have finite input and output spaces anyway.
For a set S , denote by ∆( S ) the set of all possible distributions supported over S .
We defineinteractive systems below.
Definition 1 (Interactive system) .
An interactive system is a (randomized) algorithm M : ( X ×Y ) ∗ ×
X → ∆( Y ) .
The input to M is an interaction history ( x 1 , y 1 ) , ( x 2 , y 2 ) , . . .
, ( x t , y t ) ∈
( X × Y ) ttogether with a query x t +1 .
The output of M is denoted by y t
+1 ∼ M
(( x i , y i ) i ∈ [ t ] , x t +1 ) .
A technicality worth mentioning is that due to the internal memory and randomness of an interactivesystem M , the response of M to the ( t + 1) -th
query might be correlated with its responses toprevious queries.
Although the internal randomness of M is not explicitly stated as a parameter,
Definition 1 captures this correlation by requiring that each query x t +1 to M is attached with theinteraction history ( x 1 , y 1 ) , . . .
, ( x t , y t ) .
This history is sufficient for determining the conditionaldistribution of the response M (( x i , y i ) i ∈
[ t ] , x t +1 ) without specifying the internal randomness andmemory.
We make a distinction between mechanisms and systems.
By “mechanism” we mean a differentiallyprivate algorithm M that holds a sensitive input d and answers queries about it.
When applied to aconcrete input d , M induces an interactive system, denoted by M d .
According to the definition ofdifferential privacy, studying the privacy of a mechanism boils down to studying the pair of systems( M d , M d ′ ) induced by running M on every pair of neighboring inputs ( d, d ′ ) .
For brevity, weusually assume W.L.O.G. that the input only consists of a single bit b ∈ { 0 , 1 } , and we compare thetwo systems M 0 , M 1 induced by M .
Concurrent composition.
We define concurrent composition of interactive systems.
Suppose M 1 , M 2 , . .
, M k are k systems.
The concurrent composition of them is an interactive system COMP( M 1 . . .
M k ) with query domain [ k ] ×X and response domain Y .
An adversary is a (possiblyrandomized) query algorithm A :
([ k ] × X × Y ) ∗ → ∆([ k ] × X ) .
The interaction between A and COMP( M i ) is a stochastic process that runs as follows.
A first 1 computes a pair ( i 1 , x 1 ) ∈ [ k ] × X ,sends a query x 1 to M i 1 and gets the response y 1 .
In the t -th step, A calculates the next pair ( i t , x t )based on the history, sends the t -th query x t to M i t and receives y t .
There is no communication orinteraction between the interactive systems.
Each system M i can only see its own interaction with A .
Let IT ( A : M 1 , . . .
, M k ) denote the random variable recording the transcript of the interaction.
In the special case k = 1 , there is only one system M and the adversary is interacting with it.
Wedefine approximate differential privacy for interactive mechanisms in this case.
Definition 2 (Indistinguishability and ( ε, δ ) -DP) .
Two interactive systems M 0 , M 1 are called ( ε, δ ) -indistinguishable, if for every b ∈ { 0 , 1 } , every adversary A and every collection of transcripts S ⊆ { ( x i , y i ) i ∈
[ T ] } , it holds that
[Equation]
Let M be an interactive mechanism.
M is called ( α, ε ) -approximate differentially private (or( ε, δ ) -DP for short), if for every two neighboring data sets d and d ′ , the systems M d and M d ′ are( ε, δ ) -indistinguishable.
1.2 Differential Privacy in Concurrent Compositions
We study the privacy guarantee under concurrent compositions.
Let M b 1 , . . .
, M bk be k interactivemechanisms, each satisfying ( ε, δ ) -DP.
Consider their concurrent composition COMP( M b 1 . . .
M bk ) .
We want to find out the smallest parameters ε ′ , δ ′ such that COMP( M bi ) satisfies ( ε ′ , δ ′ )
-DP.
In thesequential composition, the adversary A interacts with M i ’s in order and cannot interleave its queries.
In this case, it is known by the advanced composition theorem [Dwork et al., 2010] that IT ( A :
M 01 , . . , M 0 k ) and IT ( A : M 11 , . . .
, M 1 k ) are ( O ( (cid:112) k
log(1 /δ ′ )
ε ) , kδ + δ ′ )
-indistinguishable.
However, in general, the adversary can interleave its queries arbitrarily, and the differential privacyguarantee warranted by COMP( M i ) is less clear.
Vadhan and Wang [2021] were the first to formallystudy this question.
They showed that in the special case δ = 0 , an optimal composition holds for
COMP( M i ) .
That is, if we can prove an ( ε ′ , δ ′ )
upper bound on the privacy parameter for sequentialcompositions of M b 1 , . .
, M bk , then the concurrent composition COMP( M i ) also enjoys the same( ε ′ , δ ′ )
-DP.
Vadhan and Wang [2021] also considered the case δ >
(i.e., approximate DP).
However, for thiscase, they only showed an upper bound on ε ′ , δ ′ that is inferior to the basic composition in thesequential setting.
It was asked as an open question in Vadhan and Wang [2021] whether the optimalcomposition theorem for approximate DP still holds in the concurrent composition.
Besides pure and approximate DP, there are also other notions of differential privacy that areextensively studied in the literature.
A non-exhaustive list includes Rényi DP [Mironov, 2017],concentrated DP [Dwork and Rothblum, 2016, Bun and Steinke, 2016, Bun et al., 2018], Gaussian
DP and f -DP [Dong et al., 2022] etc.
Compared with the standard notion of ( ε, δ ) -approximate DP,these variants of DP either allow for a simplified analysis of private algorithms or give sharper boundsof privacy guarantee.
In the sequential composition, the composition property of these variants hasbeen well understood.
It is also interesting to extend these composition theorems to the concurrentcomposition, thereby expanding the potential applicability of these DP notions.
Our Results
In this work, we give an affirmative answer to the open question mentioned above.
Moreover, ourresult confirms that several major differential privacy definitions in the literature enjoy the samecomposition guarantee in the concurrent composition, just as they do in the sequential composition.
Approximate differential privacy.
( ε, δ ) -DP is arguably the most widely studied notion of differential privacy and is deemed the “standard” definition of DP.
As our first main result, we show anoptimal concurrent composition theorem for approximate DP.
Theorem 1.
Let M 1 , . . .
, M k be k interactive mechanisms that run on the same data set.
Supposethat each mechanism M i satisfies ( ε i , δ i ) -DP.
Then COMP( M 1 . . .
M k ) is ( ε ′ , δ ′ )
-DP, where ε ′ , δ ′are given by the optimal (sequential) composition theorem [Kairouz et al., 2015, Murtagh and Vadhan,2018].
In particular, when the privacy parameter for each mechanism is the same ( ε, δ ) , their concurrentcomposition satisfies O ( (cid:112) k log(1 /δ ′ )
ε, δ ′ + kδ )
-DP for all δ ′ ∈ (0 , 1) .
Rényi differential privacy.
Rényi differential privacy was first defined by Mironov [2017].
We recallits definition.
Definition 3 (Rényi divergence and differential privacy) .
Let P, Q be two distributions supportedover X .
For each α > 1 , define the Rényi divergence of order α of P from Q as
[Equation]
Two interactive systems are called ( α, ε ) -Rényi close, if for every adversary A and every b ∈ { 0 , 1 } ,it holds that
[Equation]
Let M be a mechanism.
M is called ( α, ε ) -Rényi differentially private (or ( α, ε ) -RDP for short), iffor every two neighboring data sets d and d ′ , the systems M d and M d ′ are ( α, ε ) -Rényi close.
A main advantage of Rényi DP is that it has a natural and simple composition.
In the sequentialsetting, it is known that if two mechanisms M 1 , M 2 are ( α, ε 1 ) and ( α, ε 2 ) -RDP, respectively, thenthe composition of M 1 and M 2 is ( α, ε 1 + ε 2 ) -RDP.
Our next theorem generalizes this result to theconcurrent composition.
Theorem 2.
Let M 1 , . . .
, M k be k interactive mechanisms that run on the same data set.
Supposethat each mechanism M i is ( α, ε i ) -RDP.
Then COMP( M 1 . . .
M k ) is ( α, (cid:80) ki
[-=
-]=1 ε i ) -RDP.
One implication of Theorem 2 is that the zero-concentrated differential privacy by Bun and Steinke[2016] and the truncated concentrated differential privacy by Bun et al.
[2018] also compose nicelyunder the concurrent composition.
We state the corollary below, and prove it in Appendix forcompleteness.
Corollary 1.
Let M 1 , . . .
, M k are k interactive mechanisms that run on the same data set.
Supposethat each mechanism M i is η i -zCDP (resp.
( ρ i , ω ) -tCDP).
Then COMP( M 1 . . .
M k ) is ( (cid:80) i η i )
-zCDP (resp.
( (cid:80) i ρ i , ω ) -tCDP).
Theorem 1, 2 and Corollary 1 provide compelling evidence that the adversary gains no advantage byinterleaving its queries to independently running mechanisms.
Consequently, interactivity can beviewed as a feature that differential privacy grants us for free.
Concurrent and independent work.
Concurrently to our work, a recent work by Vadhan and Zhang[2022] proves optimal concurrent composition theorems for all standard variants of DP, includingapproximate DP, Rényi DP, concentrated DP considered in this work, as well as f -DP [Dong et al. However, we remark that our techniques are very different than theirs. In particular, our prooffor approximate DP is arguably more elementary: we do not need to work through f -DP as theirproof does.
Besides, our proof comes with several interesting technical ingredients that might be ofindependent interests.
This includes a structural result for interactive mechanisms (Theorem 3), aswell as a dual perspective to reason about Rényi divergences (Lemma 4).
Implications of Our Results
In this section, we discuss implications of our results, and demonstrate how they offer more than thesequential composition theorems.
Designing new algorithms.
The optimal concurrent composition theorem makes it possible to designnew differentially private algorithm that involves running several building blocks concurrently.
Asone motivating example, consider the Sparse Vector Technique (SVT).
The standard SVT (as in
Dwork and Roth [2014]) and its variants have been studied extensively in the literature.
In particular,it was observed by Lyu et al.
[2017], Zhu and Wang [2020] that one can add noise to the thresholdonly once , and then use the noisy threshold to answer c > 1 “meaningful” queries (namely, afterreporting each meaningful query, the SVT algorithm does NOT refresh the noisy threshold).
It wasargued in [Lyu et al., 2017, Zhu and Wang, 2020] that this variant of SVT can offer a higher accuracywhile consuming the same amount of privacy budget, both theoretically and empirically.
However, this variant of SVT has received relatively less attention in literature.
We think one reasonis that it is unclear what happens if we compose this SVT with other mechanisms.
In particular, thestandard SVT refreshes its threshold after answering each “meaningful” query, which allows oneto decompose the algorithm into c pieces of smaller SVT algorithms, and then compose with othermechanisms via the sequential computation.
In contrast, the variants by Lyu et al.
[2017], Zhu and
Wang [2020] work by answering each “meaningful query” using the same noisy threshold, which donot seem to admit such a decomposition.
This makes this variant less appealing: in most applications,people want to use SVT as a supporting subroutine for other algorithms.
Therefore, it is crucial tounderstand the (concurrent) composition behavior of SVT with other mechanisms.
Now, with the new concurrent composition theorem, we can plug this variant of SVT in any algorithm,and argue the privacy guarantee of the whole computation by black-box applying Theorems 1 and 2(depending on whether we are working with ( ε, δ ) -DP or RDP).
To illustrate the idea, in Appendix, weapply Theorem 1 to analyze a simple algorithm: private “Guess-and-Check” with the aforementionedvariant of SVT as a subroutine.
We hope our example can motivate people to design more powerfulalgorithms by concurrently composing simple building blocks.
Practical Implication.
Besides the theoretical interests, our theorem has implications for practicaldeployments of interactive DP mechanisms.
For one example, suppose there is a data center that holdsthe private information of individuals and offers data analysts access to the database (interactively anddifferentially-privately).
Without knowing the concurrent composition theorem, it might be possiblethat some k > 1 analysts can collude by coordinating their (interactive) queries to the database andextracting much more sensitive information.
Our result refutes the possibility of such an attack.
In particular, suppose each data analyst has only an ( ε, δ ) -DP amount of privacy “quota”.
Then,even if they collude and spend their privacy budget in whatever way, their computation result is still( O ( (cid:112) k log(1 /δ ′ ) ε ) , kδ + δ ′ )
-DP with respect to the private database.
Proof of Main Results
In this section, we show the proof of our results.
We start with a very brief proof overview.
We prove Theorem 1 by a reduction to the sequential composition of k (approximate) randomized responsemechanisms.
This generalizes the idea developed by Vadhan and Wang [2021].
To prove Theorem 2,we take a completely different approach, and our technique offers new tools to analyze Rényi DP.
Namely, we propose an alternative characterization of Rényi divergence (Lemma 4), which allows fora fine-grained account of the privacy loss in the complex interaction involving multiple mechanisms.
The characterization of Rényi divergence might find itself useful in other applications.
Notation.
Let P, Q be two distributions supported over X .
For a real η > 0 , we say that P ≥ ηQ , iffor every S ⊆ X , it holds that
[Equation]
Furthermore, we say P ≡ Q , if P and Q are identically distributed.
4.1 Approximate Differential Privacy
To prove Theorem 1, we follow the approach by Vadhan and Wang [2021], where they showed thatone can simulate two ( ε, 0) -indistinguishable interactive systems by post-processing a randomizedresponse mechanism.
This simulation enables them to reduce the concurrent composition to asequential composition, and the optimal composition theorem follows.
It was asked as an openquestion in Vadhan and Wang [2021] whether the same simulation can be carried out for approximate
DP.
We answer this question affirmatively.
Review of the Vadhan-Wang approach.
It would be instructive to review the proof by Vadhan and
Wang [2021] first.
Let M 0 , M 1 be the pair of systems by running the private mechanism on a pair ofneighboring data sets.
The adversary A interacts with M b for some b ∈ { 0 , 1 } and wants to find outthe value of b .
An intuitive yet delicate fact due to Vadhan and Wang [2021] is that, if M 0 and M 1are ( ε, 0) -indistinguishable, then there exist two systems N 0 , N 1 such that, for every adversary A ,the distribution of IT
( A : M b ) is identical to e ε 1+ ε IT ( A : N b ) + 1
+ e ε IT
( A : N 1 − b ) .
This enablesone to simulate the many-round interaction between A and M b by running a one-round randomizedresponse mechanism.
In more detail, let RR bε denote the standard randomized response mechanism, defined as follows.
RR bε only accepts one query.
On the query, RR bε ignores the query message, returns b with probabilitye ε 1+ e ε , and returns 1 − b otherwise.
We modify A to a new adversary A ′ :
A ′ first sends a query to
RR b ε and receives a bit b ′ .
Then A ′ simulates the interaction between A and N b ′ , and outputs thetranscript (i.e., IT ( A : N b ′ ) ).
Let Output ( A ′ : RR bε ) denote the output distribution of A ′ wheninteracting with RR bε .
It is clear that
[Equation]
Therefore, A ′ simulates the interaction between A , M b faithfully, by a single query to RR bε .
Now, suppose the adversary A is interacting with k mechanisms M b 1 , . .
, M bk in parallel.
Foreach i ∈
[ k ] , assuming that M 0 i and M 1 i are ( ε i , 0) -indistinguishable, there is a decompositionof M 0 i , M 1 i by some N
i and N 1 i .
Again, we modify A to a new mechanism A ′ .
A ′ first queries
RR bε i , i ∈ [ k ] in order, and receives k bits b ′ 1 , . . .
, b ′ k .
Then A ′ simulates the interaction between Aand ( N b ′ i i ) i ∈
[ k ] and outputs the transcript.
One can show that
[Equation]
Note that the left hand side of (2) can be simulated by the sequential composition of k randomizedresponse mechanisms.
Invoking the optimal composition theorem for sequential composition [Kairouzet al., 2015, Murtagh and Vadhan, 2018] concludes the proof.
Extension to approximate DP.
Now, if M 0 and M 1 are ( ε, δ ) -indistinguishable with δ > 0 ,there might not be a nice decomposition of M b into e ε 1+ e ε N b + [Equation]
N 1 − b . Still, it is plausible toconjecture that there is a decomposition of M 0 , M 1 with four systems N 0 , N 1 , E 0 , E 1 such that foreach b ∈ { 0 , 1 } ,
[Equation]
Our main technical result in this subsection proves the existence of such a decomposition.
Theorem 3.
Two systems M 0 , M 1 are ( ε, δ ) -indistinguishable, if and only if there are four systems
N 0 , N 1 , E 0 , E 1 satisfying the following: for every adversary A and b ∈ { 0 , 1 } , it holds that
[Equation]
Theorem 3 implies Theorem 1 by a similar reduction to (approximate) random response.
Forcompleteness, we include a proof in Appendix.
We prove Theorem 3 by establishing a series of lemmas.
In the following, we state these lemmas andexplain their intuition.
We defer the formal proof to Appendix.
Lemma 1.
Suppose M 0 , M 1 are ( ε, δ ) -indistinguishable.
There are two systems E 0 , E 1 satisfyingthe following.
• For every adversary A and b ∈ { 0 , 1 } , it holds that IT ( A : M b ) ≥ δ · IT ( A : E b ) .•
For every adversary A , every set of transcripts S ⊆ { ( x i , y i ) i ∈
[ T ] } and b ∈ { 0 , 1 } , it holdsthat
[Equation]
Roughly, Lemma 1 says that there are two systems E 0 , E 1 that capture the low-probability “badbehavior” of M 0 , M 1 .
It is the primary technical contribution of this section.
Lemma 2.
Suppose M , E are two systems such that for every adversary A , it holds that IT ( A :
M ) ≥ δ IT
( A : E ) .
Then there is a system N such that for every adversary A , it holds that
IT ( A :
[Equation]
) ≡ δ IT ( A : E ) + (1 − δ ) IT ( A : N ) . For intuition, suppose P, Q are two distributions such that P ≥ δQ . Then one can easily find adistribution Q ′ such that P ≡ δQ + (1 − δ ) Q ′ .
The proof of Lemma 2 extends this simple idea.
Lemma 3 (Vadhan and Wang [2021]) .
Suppose N 0 , N 1 are ( ε, 0) -indistinguishable.
Then there aretwo systems N 0 ′ , N 1 ′ such that for every adversary A , it holds that
[Equation]
Wrap-up.
We can conclude the proof for Theorem 3 now.
The “if” direction is obvious: theexistence of a decomposition satisfying (4) implies that M 0 , M 1 are ( ε, δ ) -indistinguishable.
Forthe other direction, we start by constructing E 0 , E 1 using Lemma 1.
Then we construct N 0 , N 1by Lemma 2.
Lemma 1 and 2 together ensure that N 0 and N 1 are ( ε, 0) -indistinguishable, whichenables us to invoke Lemma 3 and decompose N 0 , N 1 into N 0 ′ , N 1 ′ .
( E 0 , E 1 , N 0 ′ , N 1 ′ ) forms thefinal decomposition.
It is straightforward to verify that they satisfy (4).
4.2 Rényi Differential Privacy
Our result for Rényi differential privacy (Theorem 2) takes a completely different approach.
An intuition.
Let M 1 be an ( α, ε ) -Rényi DP mechanism.
Intuitively, ( α, ε ) -Rényi
DP means that
M 1 has ε unit of privacy budget and can distribute it to T queries.
Viewing the privacy budget as aform of “deposit”, we hope to argue that two or more independently running mechanisms spend theirdeposit independently, and an adversary cannot trigger any mechanism to spend more privacy budgetthan it holds by interacting with other mechanisms.
However, unlike some intuitive and easy-to-measure resources such as time and energy, the notion ofprivacy loss looks somewhat illusive.
Even worse, we need to reason about this elusive resource ina stochastic process consisting of interactions with multiple systems.
It was not clear how one canquantify the privacy loss in such an interactive and complex process.
Nonetheless, we manage to finda new approach to do so.
A new characterization for Rényi DP.
We introduce a new characterization of Rényi divergencebased on Hölder’s inequality and duality.
That is, we prove
Lemma 4 (An alternative characterization of Rényi divergence) .
Suppose P, Q are two distributionssupported over Y .
For every α > 1 and B ≥ 0 , let β = αα − 1 be the Hölder conjugate of α .
Thefollowing statements are equivalent.
• D α ( P ∥ Q ) ≤ B .•
For every function h : Y → R ≥ 0 , it holds that E y ∼ P [ h ( y )] ≤ e B ( α − 1)
α E y ∼ Q [ h ( y ) β ] 1 /β .
Note that if we let α → ∞ , then Lemma 4 converges to a characterization of pure-DP.
That is, D ∞ ( P ∥ Q ) ≤ B if and only if Pr[ P = y ] ≤ e B Pr[ Q = y ] for every y ∈ Y .
Lemma 4 provides a convenient tool to reason about the privacy loss in an interactive environmentconsisting of multiple rounds.
Intuitively, this is because Condition 2 in the statement above is moreamenable to a “hybrid argument”.
However, to quantify the privacy loss during an interaction, westill need to find a way to track the privacy loss.
Measure theory setup.
Before we continue, it would be more convenient to switch to a measuretheoretic language.
Consider two measures P, Q on a space Y ( P and Q are not necessarily probabilitymeasures), we say that P is β -dominated by Q , denoted by P ⪯ β Q , if for every measurable functionf : Y → R ≥ 0 , it holds that
[Equation]
When Y is a finite set, the integral coincides with an equivalent summation.
i.e.,
[Equation]
We will use integral and summation interchangeably.
In this notation, Lemma 4 can be equivalently stated as D α ( P ∥ Q ) ≤ B if and only if P is βdominated by e B Q for β = α α − 1 .
The following lemma is essential for us.
Lemma 5.
Let Y 1 ×Y 2 be a space.
Consider two distributions P, Q on Y 1 ×Y 2 .
Assume supp( P ) =
supp( Q ) =
Y 1 ×Y 2 .
Let P 1 , P 2 be the margin of P on Y 1 , Y 2 .
For each y 1 ∈ Y 1 , denote by P 2 | P 1 =
y 1the marginal distribution of y 2 conditioning on y 1 .
Also define the same notation for Q .
Let β ≥ 1 , B ≥ 0 be two reals.
Let α = ββ − 1 .
For each y 1 ∈ Y 1 , define
[Equation]
Suppose P ⪯ β e B Q .
Consider the measure spaces ( Y 1 , P 1 ( y 1 ) · ℓ 1 ( y 2 ) 1 /β ) and ( Y 1 , Q 2 ) .
We have
P 1 ℓ 1 /β⪯ β e B Q 1 .
Intuitively, the function ℓ ( y 1 ) serves as the role of “privacy budget monitor”.
To see this, fix anadversary A and think of ( y 1 , y 2 ) as the responses of the system to the adversary 2 .
After observingy 1 , the adversary wants to distinguish between two conditional distributions P 2 | P 1 = y 1 and Q 2 | Q 1 = y 1 .[-
-]
309 At this moment, ℓ ( y 1 ) shows up as an upper bound of “extra information” that the adversary canextract by utilizing their second query.
Alternatively, ℓ ( y 1 ) quantifies the amount of the remainingprivacy budget the mechanism has after outputting y 1 .
On average, the function ℓ 1 ( y 1 ) provides afine-grained control of the privacy loss in the sense that P 1 ℓ 1 /β⪯ β e B Q 1 .
Proof for a 3 -round toy example.
We are ready to describe the proof for Theorem 2.
To illustratethe idea, we prove a toy case here and defer the full proof to Appendix.
The proof for the toy caseincludes all the important ideas.
Extending it to a full proof is straightforward.
We describe the toy scenario now.
Suppose there are two mechanisms M 1 , M 2 that run on asensitive input bit b ∈ { 0 , 1 } .
The interaction consists of 3 rounds.
The adversary
A communicateswith M 1 , M 2 , M 1 in order, and outputs the response ( y 1 , y 2 , y 3 ) .
For brevity, we assume thateach response y i contains a copy of the query message x i , so that we recover the whole transcript(( x 1 , y 1 ) , ( x 2 , y 2 ) , ( x 3 , y 3 )) only from the responses.
Let P, Q ∈ ∆( Y × Y × Y ) be the output distribution when A interacts with ( M 01 , M 02 ) and( M 11 , M 12 ) , respectively.
Suppose M 1 , M 2 are ( α, ε 1 ) , ( α, ε 2 ) -Rényi
DP respectively.
Our goal isto prove that
[Equation]
We bound D α ( P ∥ Q ) below.
The bound for D α ( Q ∥ P ) is symmetric.
Be Lemma 4, it suffices toshow that for every h :
Y × Y → Y → R ≥ 0 that
[Equation]
where β = αα − 1 is the Hölder conjugate of α .
Let P 1 , P 2 , P 3 be the projection of P onto the threerounds, and let P i |
y <
i denote the distribution of y i conditioning on y 1 , . . .
, y i − 1 .
Also define thesame notation for Q .
Then we write
[Equation]
For every y 1 ∈ Y , let M 01 | y 1 (resp.
M 11 | y 1 ) denote the interactive system M 01 (resp.
M 11 ) conditioning on that it has answered y 1 to the first query (recall we have assumed that y 1 contains x 1 ).
Formally, for every b ∈ { 0 , 1 } , ( x 2 , y 2 ) , . . .
, ( x t , y t ) and x t +1 , define
[Equation]
Next, define
[Equation]
From Lemma [Equation] one can show that P 1 ℓ 1 / [Equation]
⪯ e B Q 1 .
Turning back to (5), we then have
[Equation]
Here, we used inequalities of the form (cid:80) y P ( y ) · h ( y ) ≤ (cid:16) C · (cid:80) y Q ( y ) · h ( y ) β (cid:17) 1 /β three times(they are (8) ⇒ (9) ⇒ (10) and (11) ⇒ (12)).
We use underlines to highlight the “ h ” part of eachstep in the deductions above.(8) ⇒ (9) is the most critical step.
To see this, observe that knowing y 2 does not change the view ofthe first mechanism, because the second query is sent to the independently running mechanism M b 2 .
Therefore, M b 1 | y 1 remains the same after conditioning on both y 1 and y 2 .
Now, note that P 3 | y < 3 (resp.
Q 3 | y < 3 ) exactly describes one round of interaction between the adversary and M 01 | y 1 (resp.
M 11 | y 1 ).
Consequently, the information leaked by y 3 must be subject to the bound (7) and the inequality holds.
Having verified (8) ⇒ (9), the steps (9) ⇒ (10) and (11) ⇒ (12) are straightforward.
Having justified (13) for every measure function h , we conclude that D α ( P ∥ Q ) ≤ e ε 1 + ε 2 .
Asymmetric argument shows that D α ( Q ∥ P ) ≤ e ε 1 + ε 2 .
This completes the proof for the toy example.
Proof sketch for the general case.
The proof for the general case extends the idea above with someminor twists.
By induction, we only need to prove the composition theorem for the case with twomechanisms and many rounds.
An issue worth noting is that A can choose the next query objectbased on previous responses.
However, we can suppose without loss of generality that A alwayscommunicates with mechanisms alternately, by adding a vanilla query x ∗ to the query space.
If thecurrent mechanism is not the one A wishes to speak with, A just sends the vanilla query x ∗ .
Themechanism then returns a fixed response, which does not leak any information.
We refer to Appendixfor the detail of the proof.
Conclusion and Future Directions
In this work, we consider the concurrent composition of interactive mechanisms.
Regarding thegeneral privacy guarantee under the concurrent composition, our result gives optimal compositiontheorems for several popular definitions of differential privacy, including ( ε, δ ) -DP and Rényi DP.
Our work is purely theoretical, and we do not see any negative societal impacts it may cause.
For future directions, we ask whether one can use our composition theorems to design newdifferentially-private algorithms that may involve running several differentially-private mechanismsin parallel.
It is also interesting to explore more practical implications of the concurrent compositionphenomena.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] We included a discussion forfuture directions.(c)
Did you discuss any potential negative societal impacts of your work?
[Yes]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes] The full proofs will
be available in supplementary material.
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[N/A]
(b) Did you specify all the training details (e.g., data splits, hyperparameters,
how they
were chosen)?
[N/A]
(c) Did you report error bars (e
g., with respect to the random seed after running experi-
ments multiple times)?
[N/A]
(d) Did you include the total amount of compute and the type of resources used (e
g., type
[Table]
of GPUs, internal cluster, or cloud provider)?
[N/A]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[N/A]
(b) Did you mention the license of the assets?
[N/A]
(c) Did you include any new assets either in the supplemental material or as a URL?
[N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amountspent on participant compensation?
[N/A]