Brownian Noise Reduction: Maximizing Privacy Subject to Accuracy Constraints
Abstract
There is a disconnect between how researchers and practitioners handle privacyutility tradeoffs.
Researchers primarily operate from a privacy ﬁrst perspective, setting strict privacy requirements and minimizing risk subject to these constraints.
Practitioners often desire an accuracy ﬁrst perspective, possibly satisﬁed with the greatest privacy they can get subject to obtaining sufﬁciently small error.
Ligett et al.
[2017] have introduced a “noise reduction” algorithm to address the latter perspective.
The authors show that by adding correlated Laplace noise and progressively reducing it on demand, it is possible to produce a sequence of increasingly accurate estimates of a private parameter while only paying a privacy cost for the least noisy iterate released.
In this work, we generalize noise reduction to the setting of Gaussian noise, introducing the Brownian mechanism .
The Brownian mechanism works by ﬁrst adding Gaussian noise of high variance corresponding to the ﬁnal point of a simulated Brownian motion.
Then, at the practitioner’s discretion, noise is gradually decreased by tracing back along the Brownian path to an earlier time.
Our mechanism is more naturally applicable to the common setting of bounded ` 2 -sensitivity, empirically outperforms existing work on common statistical tasks, and provides customizable control of privacy loss over the entire interaction with the practitioner.
We complement our Brownian mechanism with
ReducedAboveThreshold , a generalization of the classical AboveThreshold algorithm that provides adaptive privacy guarantees.
Overall, our results demonstrate that one can meet utility constraints while still maintaining strong levels of privacy.
Introduction
Over the past decade, differential privacy has seen industry-wide adoption as a means of protecting sensitive information [Erlingsson et al., 2014, Greenberg, 2016].
By injecting appropriate amounts of noise, differentially private algorithms allow the computation of population-level quantities of interest while guaranteeing individual-level privacy.
Of the private mechanisms used in industry, those relating to private empirical risk minimization (ERM) are perhaps the most impactful, in part due to their application in machine learning tasks [Abadi et al., 2016, Song et al., 2013].
Researchers have developed many private ERM mechanisms, ranging from least squares minimzation
[Sheffet, 2017, Chaudhuri et al., 2011] to subsampled gradient descent [Abadi et al., 2016, Balle and Wang, 2018, Wang et al., 2019].
Despite this vast literature, most existing results take the same broad approach: they aim to minimize error (statistical risk) subject to strict privacy guarantees.
While this strict adherence to privacy constraints may be necessary in some applications, it often provides weak utility guarantees [Fienberg et al., 2010] and can make some learning tasks impossible
[Dwork et al., 2009].
Industry applications of differential privacy may desire an accuracy ﬁrst perspective, setting desired risk requirements for models used in production.
Privacy may still be a desirable aspect of computation, but it is by no means the only goal; minimizing risk may take center stage.
The main existing approach to this accuracy-oriented perspective on privacy was given by Ligett et al.
These authors introduce a noise reduction mechanism for gradually releasing a private, high-dimensional parameter.
By leveraging a Laplace-based Markov process [Koufogiannis et al., 2017], they construct a mechanism for which the privacy loss of releasing arbitrarily many estimates of a parameter only depends on the privacy loss of the least noisy parameter viewed.
This is in contrast to results about the composition of private algorithms, in which privacy degrades according to the total number of parameters witnessed [Dwork et al., 2010, Kairouz et al., 2015, Murtagh and Vadhan, 2016].
The authors also demonstrate how to privately query the utility of observed parameters on private data by coupling their Laplace-based mechanism with AboveThreshold , a classical differentially private algorithm
[Dwork and Roth, 2014, Lyu et al., 2017].
While the above mechanism provides signiﬁcant privacy loss savings over a baseline method that doubles the privacy loss each round, Laplace noise is unﬁt for many settings in which ` 2 -sensitivity is used for calibrating noise.
Since converting from ` 2 -sensitivity to ` 1 -sensitivity 1 incurs a dimensiondependent cost, it is important to develop a noise reduction technique with Gaussian noise.
Contributions and paper outline.
We introduce the Brownian mechanism , a novel approach for privately releasing a parameter vector subject to accuracy constraints.
The Brownian mechanism adds correlated Gaussian noise to a risk-minimizing parameter through a Brownian motion.
Noise is then iteratively stripped by moving adaptively backwards along the random walk until a suitable stopping condition is met, such as meeting a target accuracy on a public dataset.
In Section 3, we deﬁne the
Brownian mechanism and characterize its privacy loss.
Using machinery from martingale theory, we construct privacy boundaries for the Brownian mechanism — upper bounds on privacy loss that hold simultaneously with high probability.
In particular, the failure probability of these bounds does not depend on the number of outcomes observed, overcoming a seeming need for a union bound faced by Ligett et al.
These privacy boundaries yield provable, high-probability bounds on privacy loss under data-dependent stopping conditions.
If private data is used to evaluate risk, then the data-dependent stopping conditions can themselves leak information.
To counter this, we introduce ReducedAboveThreshold in Section 5, a generalization of the classical AboveThreshold algorithm for privately querying accuracy on sensitive data.
We show how to couple ReducedAboveThreshold and the Brownian mechanism so that a data analyst only ever incurs twice the privacy loss they would incur if they had queried accuracy on a public dataset.
This is in contrast to the results in Ligett et al.
[2017], which note that the privacy loss of
AboveThreshold often dominates the privacy loss incurred from using noise reduction.
We empirically evaluate the Brownian mechanism and ReducedAboveThreshold in Section 6, ﬁnding that the Brownian mechanism can offer privacy loss savings over the Laplace noise reduction method introduced by Ligett et al.
In our view, these results demonstrate that the Brownian mechanism is a practical, intuitive mechanism for meeting accuracy requirements in private ERM.
Lastly, we derive other new mechanisms for noise reduction, of independent interest.
We generalize the Laplace process of Koufogiannis et al.
[2017] to continuous time in Section 4, thus making the Laplace noise reduction mechanism of Ligett et al.
[2017] more ﬂexible and adaptive to datadependent privacy levels.
We also brieﬂy mention a noise reduction mechanism for Skellam noise in
Appendix ?? , a discrete distribution used in count queries [Agarwal et al., 2021].
Preliminaries
Differential privacy, privacy loss, and ex-post privacy.
An algorithm A : X ! Y is ( ✏ ,  ) - differentially private if, for any measurable set E ⇢ Y and any neighboring inputs x ⇠ x 0 ,
[Equation]
In the above [Dwork et al., 2006], ⇠ denotes some arbitrary neighboring relation.
Typically x ⇠ xindicates x and x 0 differ in one entry, but any other relation sufﬁces.
While differential privacy has proven itself a mainstay of private computation, condition (1) is too rigid to allow data analysts to achieve a minimum desired accuracy.
In other words, it embraces a privacy ﬁrst perspective, ﬁxing a strict condition in terms of parameters ✏ and  that must be met.
We are interested in the accuracy ﬁrst perspective, setting a target accuracy and correspondingly optimizing privacy parameters.
The above deﬁnition of differential privacy is qualitatively focused on bounding the informationtheoretic quantity of privacy loss [Dwork et al., 2006, 2010, Dwork and Roth, 2014].
Deﬁnition 2.1 ( Privacy Loss ) .
Let A : X ! Y be an algorithm, and ﬁx neighbors x ⇠ x 0 in X .
Let p x and p x 0 be the respective densities of A ( x ) and A ( x 0 ) on the space Y with respect to some reference measure 2 .
Then, the privacy loss between A ( x ) and A ( x 0 ) is the random variable
[Equation]
We think of A ( x ) as the true outcome, and L ( x, x 0 ) measures how much more likely this outcome is under the true input x versus an alternative x 0 .
Privacy loss provides a probabilistic deﬁnition of privacy.
Namely, A is ( ✏ ,  ) -probabilistically differentially private if, for all neighbors x ⇠ x 0 ,
[Equation]
While probabilistic differential privacy is not equivalent to differential privacy [Kasiviswanathan and Smith, 2014], ( ✏ ,  ) -probabilistically differential privacy implies ( ✏ ,  ) -differential privacy.
Probabilistic differential privacy emerged as a means for studying privacy composition, and has been leveraged in proving many results [Kairouz et al., 2015, Murtagh and Vadhan, 2016, Rogers et al., 2016, Whitehouse et al., 2022].
A natural extension of privacy to the accuracy-oriented regime is ex-post privacy, which allows the bound in condition (2) to depend the observed algorithm output.
Deﬁnition 2.2 (Ligett et al.
Let A : X ! Y be an algorithm and E : Y ! R  0 a function.
We say A is ( E ,  ) -ex-post private if, for any neighboring inputs x ⇠ x 0 , we have
[Equation]
While any algorithm is trivially ex-post private with E ( A ( x )) : = 1 , the goal is to make E ( A ( x )) as small as possible.
We describe theoretical tools for obtaining ex-post privacy guarantees in Section 3, and empirically compute the ex-post privacy distributions of various mechanisms in Section 6.
Background on Noise Reduction.
Heuristically, a noise reduction mechanism allows a data analyst to view multiple, increasingly accurate estimates of a risk minimizing parameter while only paying an ex-post privacy cost for the least noisy iterate observed.
More formally, let M : X ! Y 1 be any algorithm mapping databases to sequences of outputs.
The indices of the sequence denote the rounds of interaction, with smaller indices indicating greater noise.
Let M n : X ! Y give the n th element of the sequence and M 1: n : X ! Y n the ﬁrst n elements.
Deﬁnition 2.3 ( Noise Reduction Mechanism ) .
We say M : X ! Y 1 is a noise reduction mecha- nism if, for any n  1 and any neighboring datasets x ⇠ x 0 , we have
[Equation]
where L 1: n ( x, x 0 ) denotes the privacy loss between M 1: n ( x ) and M 1: n ( x 0 ) and L n ( x, x 0 ) is the privacy loss between M n ( x ) and M n ( x 0 ) .
The only noise reduction mechanism in the literature uses a Markov process with Laplace marginals [Koufogiannis et al., 2017] to gradually release a sensitive parameter [Ligett et al., 2017].
As originally presented, this Laplace Noise Reduction mechanism is nonadaptive, requiring a data analyst to ﬁx a ﬁnite sequence of privacy parameters ( ✏ n ) n 2 [ K ] in advance.
Instead of presenting this method as background, we describe it in Section 4, in which we construct an adaptive generalization of this mechanism.
We then leverage this generalization as a subroutine in ReducedAboveThreshold , a generalization of AboveThreshold with adaptive privacy guarantees.
Background on Brownian Motion.
We now provide a brief background on Brownian motion, perhaps the best-known example of a continuous time stochastic process [Le Gall, 2016].
Deﬁnition 2.4.
A continuous time real-valued process ( B t ) t  0 is called a standard Brownian motion if (1) B 0 = 0 , (2) ( B t ) t  0 has continuous sample paths, (3) ( B t ) has independent increments, i.e.
B t + s  B s is independent of B s for all s, t  0 , and (4) B t ⇠ N (0 , t ) for all t  0 .
We say a process ( B t ) t  0 is a d -dimensional standard Brownian motion if each coordinate process is an independent standard Brownian motion.
We use many properties of Brownian motion to construct the Brownian mechanism and analyze its privacy loss in Section 3.
One important property of Brownian motion is that it is a continuous time martingale.
This property allow us to use time-uniform supermartingale concentration to characterize and bound the privacy loss of the Brownian mechanism at data-dependent stopping times [Howard et al., 2020, 2021].
We do not go into detail about martingale concentration in this background section, but rather defer it to Appendix A. Additionally, ( B t ) t  0 is a Markov process.
This tells us that if we inspect the Brownian motion at times 0  t 1 < t 2 < · · · < t n , then B t 2 , . . .
, B t n can be viewed as a randomized post-processing of B t 1 that does not depend on B s for any s < t 1 .
This property allows us to show that the privacy loss of the Brownian mechanism — which adds noise to a parameter via a Brownian motion — only depends on the least noisy parameter observed.
The Brownian Mechanism: a Gaussian Noise Reduction Mechanism
The Brownian mechanism works by simulating a Brownian motion starting at some multivariate parameter; this parameter should be thought of as the risk-minimizing output if there were no privacy constraints.
The data analyst ﬁrst observes the random walk at some large time.
Then, if so desired, the analyst “rewinds” time to an earlier point on the Brownian path, reducing noise to obtain a more accurate estimate.
Due to the Markovian nature of Brownian motion, the analyst will only pay a privacy cost proportional to variance of the random walk at the earliest inspected time.
In what follows, when we refer to a sequence ( T n ) n  1 of time functions , we mean a sequence of functions
T n : ( R d ) n  1 ! R  0 such that, for all n and  1: n 2 ( R d ) n , [Equation]
Deﬁnition 3.1.
Let f : X ! R d be a function and ( T n ) n  1 a sequence of time functions.
Let ( B t ) t  0 be a standard d -dimensional Brownian motion.
The Brownian mechanism associated with f and ( T n ) n  1 is the algorithm BM : X ! ( R d ) 1 given by
[Equation]
where we set T n ( x ) : = T n
[Equation]
with T 1 ( x ) being constant.
We have chosen T n ( x ) as indexing notation to denote dependence on x , even if this is only through observed parameters.
In the context of ERM, one can think of f as computing a risk minimizing parameter associated with a private dataset x 2 X .
The data analyst uses T n along with the ﬁrst n  1 iterates to determine how far to rewind time to obtain the n th iterate.
Due to the Markovian nature of
Brownian motion, we get the following lemma.
We include a proof in Appendix B for completeness.
Lemma 3.2.
Let x ⇠ x 0 be neighbors.
For any n  1 , let L BM1: n ( x, x 0 ) denote the privacy loss between BM 1: n ( x ) and BM 1: n ( x 0 ) and L BM n ( x, x 0 )
the privacy loss between BM n ( x ) and BM n ( x 0 ) .
Then,
[Equation]
Lemma 3.2 just tells us that the Brownian mechanism is a noise reduction mechanism, i.e. that the privacy lost by viewing the ﬁrst n iterates is exactly the privacy lost by viewing the n th iterate in isolation.
Thus, we can identify L BM1: n ( x, x 0 ) with L BM n ( x, x 0 ) going forward.
The Brownian mechanism, as deﬁned above, produces an inﬁnite sequence of parameters.
In practice, a data analyst will only view ﬁnitely many iterates, stopping when some utility condition has been met or a minimum privacy level is reached.
We introduce stopping functions to model how a data analyst adaptively interacts with noise reduction mechanisms.
Deﬁnition 3.3 ( Stopping Function ) .
Let M : X ! Y 1 be a noise reduction mechanism.
For x 2 X , let ( F n ( x )) n 2 N be the ﬁltration given by F n ( x ) :
=  ( M i ( x ) : i  n ) .
3 A function N :
Y 1 ! N is called a stopping function if for any x 2 X , N ( x ) :
= N ( M ( x )) is a stopping time with respect to ( F n ( x )) n  1 .
A stopping function
N is a rule used to decide when to stop viewing parameters that only depends on the observed iterates of the noise reduction mechanism.
N could heuristically be “stop at the ﬁrst time a parameter achieves an accuracy of 95% on a held-out dataset.”
If a data analyst uses a stopping function alongside BM , per Deﬁnition 2.3, the privacy loss accrued upon stopping is L BM N ( x ) ( x, x 0 ) .
Recall from Figure 1 and equation (3) that the later iterations of BM correspond to smaller noise variances, meaning that T n is a decreasing sequence in the number of iterations n .
Further, the ﬁltration F deﬁned above is quite different from the usual ﬁltrations considered for
Brownian motions. In some cases, an analyst may want the stopping function to depend on the underlying private dataset through more than just the released parameters, e.g. they may want their rule to be “stop at the ﬁrst time a parameter achieves an accuracy of 95% on the private dataset.”
In this case, additional privacy may be lost due to observing N ( x ) .
We detail how to handle this more subtle case in Section 5.
The following theorem characterizes the privacy loss of the Brownian mechanism.
Theorem 3.4.
Let BM be the Brownian mechanism associated with ( T n ) n  1 and a function f .
For neighbors x ⇠ x 0 , the privacy loss between BM 1: n ( x ) and BM 1: n ( x 0 ) is given by
[Equation]
where ( W t ) t  0 is a standard, univariate Brownian motion.
Suppose f has ` 2 -sensitivity at most  2 .
Then, letting a + := max(0 , a ) , we have
[Equation]
Theorem 3.4 also holds when a deterministic time n is replaced by N ( x ) , where N is a stopping function.
The above theorem can be viewed as a process-level equivalent of the well-known fact that the privacy loss of the Gaussian mechanism has an uncentered Gaussian distribution [Balle and Wang, 2018].
We prove the Theorem 3.4 in Appendix B. Given the clean characterization of privacy loss above, we now show how to construct high-probability, time-uniform privacy loss bounds.
We deﬁne privacy boundaries , which map the variance of BM to high-probability bounds on privacy loss.
Deﬁnition 3.5.
A function : R [-≥ 
-] 0 !
R  0 is a  -privacy boundary for the Brownian mechanism associated with time functions ( T n ) n  1 if for any neighboring datasets x ⇠ x 0 , we have
[Equation]
Since the privacy loss of BM is a deterministic function of a Brownian motion, we can apply results from martingale theory to construct general families of privacy boundaries.
Theorem 3.6.
Assume the same setup as in Theorem 3.4.
Let  > 0 and f be a function with ` 2 -sensitivity  2 .
The following classes of functions form  -privacy boundaries.
(Mixture boundary)
For any ⇢ > 0 , M ⇢ given by
[Equation]
(Linear boundary)
For any a, b > 0 such that 2 ab = log(1 /  ) , La,b given by
[Equation]
We prove Theorem 3.6 in Appendix B.
In the same appendix, we plot the boundaries in Figure 4.
Privacy boundaries serve a dual purpose for the Brownian mechanism.
First, since time-uniform concentration bounds are valid at arbitrary data-dependent times, that need not be stopping times with respect to the standard forward Brownian Motion ﬁltration [Howard et al., 2021], privacy boundaries provide ex-post privacy guarantees.
Second, in many settings, it may be more natural for a data analyst to adaptively specify target privacy levels instead of noise levels.
This is, for instance, the case in our experiments in Section 6.
By inverting privacy boundaries, data analysts can compute the proper amount of noise to remove at each step to meet target privacy levels.
We make the above precise in Corollary 3.7.
In what follows, when we refer to a sequence ( E n ) n of privacy functions , we mean a sequence of functions E n : ( R d ) n  1 ! R  0 such that, for all n and  1: n 2 ( R d ) n , E n +1 (  1: n )  E n (  1: n  1 ) .
Corollary 3.7.
Let N be a stopping function, as in Deﬁnition 3.3.
If is a  -privacy boundary for
BM , we have
[Equation]
i.e. the algorithm BM 1: N ( · ) ( · ) is  ( T N ( · ) ( · )) ,   -ex post private, where ( · ) denotes a positional argument for an input x 2 X .
Further, let ( E n ) n  1 be a sequence of privacy functions, and deﬁne
[Equation]
Then BM 1: N ( · ) ( · ) is ( E N ( · ) ( · ) ,  ) -ex post private, where E n ( x ) is deﬁned analogously to T n ( x ) .
Again, N should be thought of as a stopping rule based on parameter accuracy.
E n should be thought of as a rule for choosing the n th privacy parameter given BM 1: n  1 ( x ) .
An Adaptive, Continuous-Time Extension of Laplace Noise Reduction
Here, we generalize the original noise reduction mechanism of Ligett et al.
[2017], which will be used as a subroutine in Algorithm 1 in the following section.
We ﬁrst describe the original Laplace-based
Markov process of Koufogiannis et al.
Fix any positive integer K and any ﬁnite, increasing sequence of times ( t n ) n 2 [ K ] .
Let ( ⇣ n ) Kn =
be the d -dimensional process given by ⇣ 0 = 0 and [Equation] with probability [Equation]
otherwise [Equation] [Equation] Koufogiannis et al.
[2017] show that ⇣ n ⇠ Lap( t n ) and that ( ⇣ n ) Kn =0 is Markovian.
Ligett et al.
[2017] use the above process to construct a noise reduction mechanism.
Namely, they deﬁne the the Laplace Noise Reduction mechanism associated with f : X !
R d and ( t n ) n 2 [ K ] to be the algorithm LNR : X ! ( R d ) K given by LNR( x ) :
= ( f ( x ) + ⇣ K , . . .
, f ( x ) + ⇣ 1 ) .
If t n :=  1 / ✏ n , then releasing n th component LNR n ( x ) in isolation is equivalent to running the classical Laplace mechanism with privacy level ✏ n .
We now extend the process ( ⇣ n ) n 2 [ K ] to a continuous time process with the same ﬁnite-dimensional distributions.
Let ⌘ > 0 be arbitrary, and let ( P t ) t  ⌘ be an inhomogeneous Poisson process with intensity function  ( t ) :
= 2 t .
For n  1 , let T n := inf { t  ⌘ : P t  n } be the n th jump of ( P t ) t  ⌘ and set
T 0 := ⌘ .
Noting that P t must be a nonnegative integer, deﬁne the process ( Z t ) t  ⌘ by
[Equation]
It is immediate that ( Z t ) t  ⌘ is Markovian.
We show in Appendix D that Z t ⇠ Lap( t ) .
With ( Z t ) t  ⌘ , one can make LNR fully adaptive, meaning that the times ( t n ) n 2 [ K ] at which it is invoked need not be prespeciﬁed, and can depend on the underlying input database x by using time functions.
Deﬁnition 4.1.
Let f : X ! R d be a function and ( T n ) n  1 a sequence of time functions.
Let ( Z t ) t  ⌘ be the process deﬁned in Equation (5) .
The Laplace noise reduction mechanism associated with f and ( T n ) n  1 is the algorithm LNR : X ! ( R d ) 1 given by
[Equation]
where again T n ( x ) :
= T n ( f ( x ) + Z T 1 ( x ) , . . . ,
f ( x ) + Z T n  1 ( x ) ) .
If the analyst would prefer instead to specify privacy functions ( E n ) n  1 , they can do so by leveraging the corresponding time functions T n ( x ) :
=  1 / E n ( x ) , where E n ( x ) is deﬁned analogously to
T n ( x ) .
We leverage LNR in our experiments in Section 6 and the process ( Z t ) t  0 as a subroutine in constructing ReducedAboveThreshold .
LNR admits the following trivial ex-post privacy guarantee.
Proposition 4.2.
Let LNR be associated with ( T n ) n  1 and a function f with ` 1 -sensitivity  1 .
If N is stopping function, the algorithm LNR 1: N ( · ) ( · ) is (  1 /T N ( · ) ( · ) , 0)
-ex post private.
Skellam Noise Reduction.
Last, we brieﬂy discuss how to generate a noise reduction mechanism for Skellam noise [Agarwal et al., 2021].
Recall that a random variable X has a Skellam distribution with parameters  1 and  2 if X = d Y 1  Y 2 , where Y 1 ⇠ Poisson(  1 ) and Y 2 ⇠ Poisson(  2 ) are independent Laplace random variables. For succinctness, we write X ⇠ Skell (  1 ,  2 ) . Let ( P 1 ( t )) t  0 and ( P 2 ( t ))
t  0 be two independent, homogeneous Poisson process with rates  1 and  2 respectively.
Observe that the continuous time process ( X t ) t  0 given by X t := P 1 ( t )  P 2 ( t ) is clearly Markovian, has independent increments, and has X t ⇠ Skell( t  1 , t  2 ) .
Thus, ( X t ) t  0 can be used to deﬁne a Skellam noise reduction mechanism by releasing ( f ( x ) + X T n ( x ) )
n  1 for some sequence of time functions ( T n ) n  1 .
Privately Checking if Accuracy is Above a Threshold
In Section 3 we presented the Brownian mechanism, characterized its privacy loss, and showed how to obtain ex-post privacy guarantees for arbitrary stopping functions.
In particular, these stopping functions could be based on the accuracy of the observed iterates on public held-out data.
However, one may desire to privately check the accuracy of observed iterates on the dataset x 2 X .
Ligett et al.
[2017] were able to accomplish this goal by coupling LNR with AboveThreshold , a classical algorithm for privately answering threshold queries [Dwork and Roth, 2014].
In the context of ERM, AboveThreshold iteratively checks if the empirical risk of each parameter is below a target threshold, stopping at the ﬁrst such occurrence.
The downside to AboveThreshold is that it requires a preﬁxed privacy level.
In empirical studies, Ligett et al.
[2017] found this ﬁxed privacy cost dominated the ex-post privacy guarantees, showing little beneﬁt to using noise reduction.
Below, we construct ReducedAboveThreshold , a generalization of AboveThreshold which provides ex-post privacy guarantees.
We show how to couple BM with ReducedAboveThreshold to obtain tighter ex-post privacy guarantees than coupling with AboveThreshold would permit.
In particular, if BM is run using parameters ( ✏ n ) n  1 and ReducedAboveThreshold indicates the N th parameter obtains sufﬁciently high accuracy, the privacy loss of the net procedure will be at most 2 ✏ N — only twice the privacy loss that would be accrued by testing on public data. Algorithm
Require:
Algorithm Alg : X !
Y 1 , parameter ✏ max > 0 , threshold ⌧ , database x 2 X , utility u : Y ⇥ X ! R where u (  , · ) is  -sensitive 8  , privacy functions ( E n ) n  1 with E n  ✏ max 8 n .
for n  1 do ✏ n := E n (Alg 1: n  1 ( x )) , T n := 2  / ✏ n ⇣ n := Z T n , where ( Z t ) t  ⌘ in Eq.
(5) deﬁnes the LNR mechanism with ⌘ := 2  / ✏ max .
⇠ n ⇠ Lap ⇣ 4  ✏ n ⌘ if u (Alg n ( x ) , x ) + ⇠ n  ⌧ + ⇣ n then
Print 1 and HALT else
Print⌧ should be seen as a target accuracy, Alg as a mechanism for releasing a parameter (e.g. BM , LNR ), and u as evaluating the accuracy of Alg n ( x ) on x . ✏ max is an arbitrarily large constant, representing the minimum level of privacy required, used to prevent the user from examining ( Z t ) at arbitrarily small times.
The above generalizes to sequences of thresholds ( ⌧ n ) n  1 and sequences ( u n ) n  1 of functions u n : Y n ⇥ X !
R that are  -sensitive in their second argument, but the added generality yields only marginal beneﬁts.
When
E n = ✏ for all n , Algorithm 1 recovers AboveThreshold as a special case.
The intuition behind ReducedAboveThreshold is that by gradually removing Laplace noise from the threshold, a data analyst can ensure that privacy of the whole procedure only depends on the magnitude of Laplace noise added when the algorithm halts.
The following characterizes the privacy loss of Algorithm 1.
Theorem 5.1.
For any n  1 and neighboring datasets x ⇠ x 0 , let L Alg1: n ( x, x 0 ) denote the privacy between Alg 1: n ( x ) and Alg 1: n ( x 0 ) .
For any x 2 X , deﬁne N ( x ) to be the ﬁrst round where ReducedAboveThreshold run on input x [Equation] 1, that is
[Equation]
Then, the privacy loss between ReducedAboveThreshold( x ) and ReducedAboveThreshold( x 0 ) , denoted L RAT ( x, x 0 ) , is bounded by
[Equation]
We prove Theorem 5.1 in Appendix C, where we also provide a utility guarantee for
ReducedAboveThreshold .
This utility guarantee, much like the utility guarantee for
AboveThreshold , is in practice weak as it derives from a union bound.
Using Theorem 5.1, we can simply choose Alg = BM as a means of adaptively generating parameters.
The following corollary, which follows immediately from the above theorem, provides the ex-post privacy guarantees of combining ReducedAboveThreshold and BM .
Corollary 5.2.
Let BM be the Brownian mechanism associated with a function f , decreasing time functions ( T n ) n  1 , and a a  -privacy boundary .
Let ReducedAboveThreshold be run with privacy functions ( ( T n )) n  1 , threshold ⌧ , and algorithm BM .
Then, ReducedAboveThreshold is  2 ( T N ( · ) ( · )) ,   -ex post private.
Experiments
Choice of tasks: We compare the performance of BM and LNR on the tasks of regularized logistic regression via output perturbation [Chaudhuri et al., 2011] and ridge regression via covariance perturbation [Smith et al., 2017].
4 For logistic regression, we leveraged the KDD-99 dataset [KDD, 1999] with d = 38 features, predicting whether network events can be classiﬁed as “normal" or “malicious".
For ridge regression, we used the Twitter dataset [Kawala et al., 2013] with d =
[Figure]
[Figure]
features to predict log-popularity of posts. In each case, we ran our experiments on n = 10 ,randomly sub-sampled data points.
In order to guarantee bounded sensitivity, we normalized each data point to have unit ` 2 norm.
We note that this aspect differs from the experimentation conducted by Ligett et al.
[2017], who normalized by the maximum ` 2 norm, a non-private operation.
Experiments: For each task, we conducted two experiments.
We discuss the speciﬁc parameter settings for these experiments in Appendix E.
In the ﬁrst experiment, we plotted guaranteed (in the case of LNR ) or high-probability (in the case of BM ) privacy loss on the x-axis against average loss (either logistic or ridge) on the y-axis.
We conduct such a comparison as probability 1 privacy loss bounds cannot be provided for the Gaussian mechanism.
Likewise, adding a probability  of minimally improves privacy loss for the Laplace mechanism.
We computed the average loss curve for each mechanism over 1,000 trials, and have included point-wise valid 95% conﬁdence intervals.
In the second experiment, we plotted the empirical privacy loss distributions for BM and LNR under the stopping conditions of loss being at most 0.41 for logistic regression and 0.025 for ridge regression.
For each mechanism, we evaluated this empirical distribution using three approaches for testing empirical loss: treating the training data as a held-out dataset, using AboveThreshold , and using our mechanism, ReducedAboveThreshold .
In AboveThreshold , we set the privacy parameter to be ﬁxed at ✏ = 0 .
In ReducedAboveThreshold , we took the sequence of privacy parameters to be the same as the sequence of privacy parameters used by BM and LNR .
We once again computed these empirical distributions over 1,000 runs of each mechanism.
Findings:
The ﬁndings of the two experiments are summarized in Figure 2 and Figure 3.
For both tasks, BM obtains signiﬁcant improvements in loss over LNR near the privacy loss level that was optimized for.
For both tasks, the privacy loss distribution for BM has lower median privacy loss than that of LNR .
In addition, the privacy loss distribution for BM is more tightly concentrated around the median, indicating more consistent performance.
The privacy loss distribution for LNR has a heavy tail, demonstrating that many runs do not attain the target loss until high privacy loss costs are incurred.
Comparing ReducedAboveThreshold and AboveThreshold , we see that the privacy loss distribution for ReducedAboveThreshold has higher variance than that of AboveThreshold .
However, ReducedAboveThreshold attains a signiﬁcantly lower median level of privacy loss when coupled with BM .
This latter point reﬂects the observations of Ligett et al.
[2017], who note that when AboveThreshold is used to determine stopping conditions on private data, it contributes the bulk of the privacy loss to the empirical distributions.
On the other hand, our ﬁgures demonstrate that
ReducedAboveThreshold results in a more mild privacy loss at target stopping conditions.
Conclusion
In this paper, we constructed the Brownian mechanism ( BM ), a novel approach to noise reduction that adds noise to a hidden parameter via a Brownian motion.
We not only precisely characterized the privacy loss of the Brownian mechanism, but also bounded it through applying machinery from continuous time martingale theory.
We then demonstrated how the utility of the iterates produced by
BM can be assessed on private data via ReducedAboveThreshold , a generalization of the classical
AboveThreshold algorithm.
This was itself accomplished by a continuous-time generalization of the original Laplace noise reduction ( LNR ) mechanism.
Last, we empirically demonstrated that BM outperforms LNR on common statistical tasks, such as regularized logistic and ridge regression.
We comment on several limitations and open problems related to our work.
We considered noise reduction mechanisms in the setting of one-shot privacy, in which only a single mechanism is run on private data.
Traditional composition results, such as those for ﬁxed privacy parameters [Dwork et al., 2010, Kairouz et al., 2015, Murtagh and Vadhan, 2016] or adaptively selected parameters [Rogers et al., 2016, Feldman and Zrnic, 2021, Whitehouse et al., 2022] are not directly applicable to algorithms satisfying ex-post privacy; additional machinery needs to be developed to handle composition in this case.
A naive approach to composition is possible, which involves summing the ex-post privacy guarantees of composed algorithms and summing the corresponding  ’s, but we expect this approach to be loose.
Finally, noise reduction is currently only applicable to output perturbation methods; it remains open to see how to combine noise reduction with other prominent methods for private computation, such as objective perturbation.
Acknowledgements
AR acknowledges support from NSF DMS 1916320 and an ARL IoBT CRA grant.
Research reported in this paper was sponsored in part by the DEVCOM Army Research Laboratory under
Cooperative Agreement W911NF-17-2-0196 (ARL IoBT CRA).
The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the ofﬁcial policies, either expressed or implied, of the Army Research Laboratory or the U.S. Government.
The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein.
ZSW and JW were supported in part by the NSF CNS2120667, a CyLab 2021 grant, a Google Faculty
Research Award, and a Mozilla Research Grant.
JW acknowledges support from NSF GRFP grants DGE1745016 and DGE2140739.
[-X T y are both 2 . 0 , and the corresponding (cid:96) 1 -sensitivities for releasing these quantities are 2 . 
-]