Data Augmentation MCMC for Bayesian Inference from Privatized Data
Abstract
Differentially private mechanisms protect privacy by introducing additional randomness into the data.
Restricting access to only the privatized data makes it challenging to perform valid statistical inference on parameters underlying the confidential data.
Specifically, the likelihood function of the privatized data requires integrating over the large space of confidential databases and is typically intractable.
For Bayesian analysis, this results in a posterior distribution that is doubly intractable, rendering traditional MCMC techniques inapplicable.
We propose an MCMC framework to perform Bayesian inference from the privatized data, which is applicable to a wide range of statistical models and privacy mechanisms.
Our MCMC algorithm augments the model parameters with the unobserved confidential data, and alternately updates each one. For the potentially challenging step of updating the confidential data, we propose a generic approach that exploits the privacy guarantee of the mechanism to ensure efficiency.
We give results on the computational complexity, acceptance rate, and mixing properties of our MCMC.
We illustrate the efficacy and applicability of our methods on a naïve-Bayes log-linear model and on a linear regression model.
Introduction
Motivation.
Differential privacy [Dwork et al., 2006] presents a formal mathematical framework to protect the confidentiality of individuals and businesses in aggregate data products.
It is the state-of-the-art standard for statistical disclosure limitation (SDL), and has become widely adopted by curators of large-scale scientific, commercial and official databases.
Differentially private data products are produced by probabilistic mechanisms that carry proven privacy guarantees.
Generally speaking, these mechanisms work by introducing carefully designed random noise into the query of interest, which is an otherwise deterministic function of the underlying database.
The privatization of data products through noise infusion poses a challenge to statistical analysis in the downstream.
Statistical estimators are typically complex functions of the data.
If instead of the confidential data, the analyst only has access to a probabilistically processed version of them, how can they maintain the statistical validity of the resulting inference?
A crucial statistical advantage of differentially private mechanisms over traditional SDL counterparts, such as swapping [Dalenius, 1977], is that their probabilistic design is publicly known.
This knowledge allows the data analyst to, at least in theory, accurately account for the privatization mechanism and conduct reliable uncertainty quantification.
Nevertheless, it remains a substantial computational challenge to incorporate the privacy procedure into the statistical analysis.
The challenge is a wide-spread and varied one, as the extra layer of privacy protection calls for the revision of a wide range of existing statistical methodologies that previously operate on the original, non-privatized data, most of which are neither low-dimensional nor simply structured.
This is the challenge we address in this work, in which we develop a general computational framework for practitioners to obtain valid statistical inference based on privatized data.
Related literature.
Current inferential strategies for privatized data fall into two broad categories.
One invokes traditional statistical asymptotics to approximate the sampling distribution of a differentially private statistic, on the grounds that the privacy noise is often asymptotically negligible compared to errors due to sampling [e.g. Smith, 2011, Cai et al., 2021].
These approximations are often inaccurate for finite sample sizes [Wang et al., 2018] and call for specific handling to incorporate the privacy mechanism [e.g. Gaboardi et al., 2016, Wang et al., 2015, Gaboardi and Rogers, 2018].
The second category recognizes (as Section 2 will explain) that the marginal likelihood of the model parameters in (3) is central to the problem of inference from privatized data.
The marginal likelihood/marginal posterior distribution requires a potentially high-dimensional integral over the space of unobserved confidential databases, and one that is analytically tractable only in a few, simple settings [e.g., Awan and Slavkovi ´ c, 2018, 2020].
Typically, one must resort to either approximating it or sampling from it using Monte Carlo methods.
Markov chain Monte Carlo (MCMC) techniques have been proposed for specific privacy mechanisms and data generating models.
Karwa et al.
[2017] propose an MCMC procedure for inference on exponential random graph models, Bernstein and Sheldon [2018, 2019] devise MCMC methods designed to handle the low-dimensional latent sufficient statistics from exponential family models and linear regression, and Schein et al.
[2019] design an MCMC algorithm for the Poisson factorization model when data are locally privatized under the double geometric mechanism.
Gong [2022] shows that for certain differentially private statistics, approximate Bayesian computation (ABC) can give samples that are exact with respect to the marginal likelihood and the Bayesian posterior.
In addition, when the statistical model for the confidential data is fully parametric, the parametric bootstrap may be used to produce inference accompanied by uncertainty quantification with better accuracy than asymptotic approximation [e.g.
Gaboardi et al., 2016, Ferrando et al., 2022].
Variational Bayesian analysis [Karwa et al., 2016] is another alternative which invokes a non-asymptotic approximation to the posterior distribution.
These solutions are either approximations or hold only for specific settings.
Our contribution.
We develop a general-purpose MCMC framework to perform Bayesian inference on the model parameters underlying the privatized data.
Our framework allows us to overcome the intractable marginal likelihood resulting from privatization, and is applicable to a wide range of statistical models and privacy mechanisms.
The resulting MCMC algorithms are exact , in that they target the posterior distribution precisely, without involving any approximation.
Our approach allows data analysts to leverage existing inferential tools designed for non-private data.
It can be viewed as a flexible, user-friendly wrapper that migrates existing MCMC algorithms for non-private data to the setting of privatized data access, requiring no further algorithm design or tuning.
The sampler, formally a Metropolis-within-Gibbs sampler, is presented in Algorithm 1.
It is general-purpose, requiring only that the analyst can 1) sample from the statistical model for the confidential data and 2) can evaluate the probability density of the noise induced by the privacy mechanism.
The algorithm augments the model parameters with the unobserved confidential data, and alternately updates each one conditioned on the other.
While the imputation of an entire unobserved database might appear daunting, we demonstrate how knowledge of the privacy mechanism can be exploited to confer performance guarantees to the proposed MCMC algorithm.
We provide theoretical results for the computational complexity, Metropolis-Hastings acceptance rate, and mixing properties.
In particular, the higher the privacy, the more rapid is our algorithm’s exploration of the parameter space.
We also identify a common structure present in many popular privacy mechanisms, which we term record additivity .
The record additivity of a privacy mechanism ensures that each round of our sampler has the same order of run-time as that of many non-private samplers.
We illustrate the efficacy and applicability of our methods on a privatized naïve-Bayes log-linear model and a linear regression model with clamped and privatized input.
Problem Setup
Let x = ( x 1 , . . .
, x n ) ∈ X n denote the confidential database, containing n records.
We assume these records are independent and identically distributed (i.i.d.) draws from a statistical model f ( · | θ ) , though this can be relaxed.
The goal of the analyst is to conduct statistical inference on the unknown model parameter θ ∈ Θ .
A Bayesian analyst represents a priori beliefs about θ with a prior probability distribution p ( θ ) , and seeks to compute a posterior distribution p ( θ | x ) ∝ p ( θ ) f ( x | θ ) that updates their beliefs in light of the observations x .
In many modern applications, this posterior distribution is intractable, and it is common for analysts to represent it using samples drawn via some
MCMC algorithm.
In this work, we will assume access to such a posterior sampling method:
Assumption 1.
The analyst has available a Markov kernel that targets p ( θ | x ) ∝ p ( θ ) f ( x | θ ) , the posterior distribution over the model parameters given the confidential database x .
Differential privacy.
Our work here focuses on the following departure from the usual Bayesian setting: instead of observing the database x , we observe a privatized data product or query, denoted as s dp .
The quantity s dp is typically of much lower dimensionality that the database x , and is probabilistically generated based on data x through a privacy mechanism , written as η ( · | x ) .
The privacy mechanism η is said to be ϵ - differentially private ( ϵ -DP)
[Dwork et al., 2006] if for all values of s dp , and for all ‘neighboring’ databases ( x, x ′ ) ∈
X n × X n differing by one record (denoted by d ( x, x ′ ) ≤ 1 ), the probability ratio is bounded:
[Equation]
The parameter ϵ is called the privacy loss budget , and controls how informative s dp is about x .
Large values of ϵ guarantee less privacy, while ϵ = 0 corresponds to perfect privacy.
A simple and widely used ϵ -differentially private mechanism is the Laplace mechanism : for a deterministic query s : X n → R m , the privatized query is defined as s dp = s ( x ) + u , where u = ( u 1 , . . .
, u m ) are i.i.d.
Laplace variables.
The scale parameter of the Laplace distribution is inversely proportional to ϵ (more privacy requires more noise), and directly proportional to ∆ ( s ) =
max ( x,x ′ ) ∈
X n × X n ; d ( x,x ′ ) ≤ 1 ∥ s ( x ) − s ( x ′ )
∥ 1 , the ℓ 1 (global) sensitivity of s (the more sensitive the confidential query is to changes in one record of the database, the more noise we need).
Our methodology requires that the privacy mechanism η is known and can be evaluated.
This is true of ϵ - (or pure ) DP, as well as common variants such as ( ϵ, δ ) - (or approximate ) DP, zero-concentrated
DP (zCDP)
[Dwork and Rothblum, 2016, Bun and Steinke, 2016], and Gaussian -DP
[Dong et al., 2021].
To ensure computational efficiency, we make the following additional assumption.
Assumption 2 (Record Additivity) .
The privacy mechanism can be written in the form η
( s dp | x )
=
g ( s dp , (cid:80) ni
=1 t i ( x i , s dp )) for some known and tractable functions g, t 1 , . . . , t n .
We refer to privacy mechanisms that satisfy Assumption 2 as record-additive .
An implication of record additivity is that after changing one record in x , we do not have to scan the entire database to reevaluate η .
This is satisfied by many commonly used mechanisms, two important examples being: 1) mechanisms that add data-independent noise to a query of the form s = (cid:80) n i =
1 s i ( x i ) , such as the sample mean, sample variance-covariance, and sufficient statistics of an exponential family distribution (see Sections 4 and 5 for examples), and 2) mechanisms designed to optimize empirical risk functions of the form u ( x, s dp ) =
(cid:80) ni
=1 u i ( x i , s dp ) , such as the exponential mechanism [McSherry and Talwar, 2007], K -norm gradient mechanism [Reimherr and Awan, 2019], objective perturbation [Chaudhuri et al., 2011, Kifer et al., 2012], and functional mechanism [Zhang et al., 2012].
Doubly intractable Bayesian inference from privatized data.
Without access to the confidential database x , and given only the privatized query s dp , the Bayesian analyst is now concerned with the following posterior distribution:
[Equation]
Here, p ( s dp | θ ) is the marginal likelihood of θ , integrating over all possible confidential databases:
[Equation]
The marginal likelihood contributes all the information that is available in the privatized observation s dp about the parameter θ , and is the foundation to statistical inference using privatized statistics
[Williams and McSherry, 2010].
The posterior distribution (2) reveals that the inferential uncertainty about the parameter θ consists of three contributing sources: 1) prior uncertainty as encoded in p ( θ ) , 2) sampling (or modeling) uncertainty of the confidential database as reflected in f , and 3) uncertainty due to privacy as induced by the probabilistic mechanism η .
We now come to the core challenge to address in this work: the marginal likelihood in (3) calls for an integral over the entire space of possible input databases x ∈ X n .
This is usually computationally challenging, especially if the privacy mechanism is not a function of a low-dimensional sufficient statistic.
If the integral underlying the marginal likelihood is intractable, then p ( s dp | θ ) cannot be analytically evaluated.
This makes the corresponding posterior distribution p
( θ | s dp ) of (2) doubly intractable [Murray et al., 2012] in the sense that it cannot be analytically evaluated even up to a normalizing constant.
Thus, traditional MCMC techniques are inapplicable and inference strategies devised for privatized statistics must tame this possibly high-dimensional integration problem.
Data Augmentation MCMC for Inference from Privatized Data
In this paper, we present a simple, efficient, and general data augmentation MCMC [Tanner and
Wong, 1987, Van Dyk and Meng, 2001] framework, allowing practitioners to perform valid Bayesian inference on a wide-range of data models and privacy mechanisms.
Our approach is to augment the
MCMC state space with the latent confidential database x , so that the stationary distribution is the joint posterior distribution
[Equation]
Marginally, the θ samples produced by such an algorithm follow the posterior p ( θ | s dp ) in (2).
Our sampler is exact , targeting the marginal posterior distribution p ( θ | s dp ) without any approximation error, despite the fact that the marginal likelihood (3) is intractable.
Our approach of imputing the latent confidential database x is motivated by two factors: 1) we wish our algorithm to be general-purpose , applicable to a wide range of models and privacy mechanisms, and 2) we wish our algorithm to inherit guarantees on mixing performance from guarantees of the privacy mechanism.
Towards these ends, we do not assume any specific form of the underlying model of x and the privacy mechanism beyond Assumptions 1 and 2 respectively.
In this light, our contribution can be viewed as a flexible wrapper that allows existing MCMC algorithms for models of the confidential data to be extended to settings where the data is now protected by some privacy mechanism.
Though imputing the confidential dataset might appear to present a significant challenge, we show that properties of the mechanism can be exploited to give performance guarantees on our sampling scheme, and show that it has a runtime of the same order as the non-private sampler.
In what follows, we outline our proposed MCMC algorithm, derive guarantees on the runtime and acceptance rate of the algorithm, and provide mild conditions for the proposed samplers to be ergodic, as well as additional conditions for our sampler to achieve geometric rates of convergence.
3.1 A Privacy-Aware Metropolis-within-Gibbs Sampler
Our approach to sample from the joint posterior distribution p ( θ, x | s dp ) is through a sequence of alternating Gibbs updates.
Let ( x ( t ) , θ ( t ) ) denote the state of the Gibbs sampler at the t -th iterations.
Each iteration of the Gibbs sampler entails two steps:
( Step 1 ) sample θ ( t +1) from p ( · | x ( t ) , s dp ) , and ( Step 2 ) sample x ( t +1) from
p
( · | θ ( t +1) , s dp )
The conditional distribution in Step 1 simplifies as p ( θ | x ( t ) , s dp ) =
p ( θ | x ( t ) ) , highlighting why dataaugmentation is useful: this conditional distribution is independent of the privacy mechanism, and we can use existing sampling algorithms (Assumption 1) for the confidential data.
We note that with the exception of a few models, such as simple models with conjugate priors, it is usually not possible to directly sample from p ( θ | x ) .
Assumption 1 however only requires that we can conditionally simulate a new value of θ from a Markov kernel that has p ( θ | x ( t ) ) as its stationary distribution.
Our overall
Gibbs sampler then becomes a Metropolis-within-Gibbs sampler [Gilks et al., 1995], that nevertheless targets the joint posterior p ( θ, x | s dp ) .
Step 2 is the data-augmentation step, and connects the statistical model and the privacy mechanism on x .
Again, we cannot expect to produce a conditionally independent sample of the latent database from p ( x | θ, s dp ) , as this is model and mechanism dependent.
Instead, we take the much more tractable approach of cycling through the elements of latent database x , sequentially updating x one element of a time.
Writing x − i =
( x 1 , . .
, x i − 1 , x i +1 , . . .
, x n ) to denote the vector x excluding the i th element, step 2 then consists of the sequence of updates p ( x 1 | θ, x − 1 , s dp ) , p ( x 2 | θ, x − 2 , s dp ) , . .
, p ( x n | θ, x − n , s dp ) .
The complete sweep can be viewed as a dependent update of the latent database x that targets the conditional distribution p ( x | θ, s dp ) .
Before we specify our complete sampler in Algorithm 1, we first address the following questions: (Q1)
What is the performance loss from updating x one element at a time, rather than jointly? , and (Q2)
How can we efficiently carry out the conditional updates p ( x i | θ, x − i , s dp ) , i = 1 , . . . , n ?
Q1 concerns whether the dependence of x i given ( x − i , s dp ) is so strong as to impede efficient exploration of the X n -space and cause poor mixing.
Here we note that the privacy mechanism limits the change in the likelihood η
( s dp | x ) when one element of x is changed, and therefore limits the coupling between x i and x − i .
This suggests a Gibbs sweep through the latent database x will not suffer from poor mixing.
Conditional update of p ( θ | x ) using the kernel from Assumption 1. 2.
For each i = 1 , 2 , . . .
, sequentially update x i | x − i , θ, s dp .
(a) Propose x ⋆i ∼ f ( · | θ ) .
(b) Update t ( x ⋆ , s dp ) =
t ( x, s dp ) − t
i
( x i , s dp ) + t i ( x ⋆i , s dp ) according to Assumption
(c) Accept the proposed state with probability α
( x ⋆i | x i , x − i , θ ) given by:
[Equation]
Q2 recognizes that the conditionals p ( x i | θ, s dp , x − i ) are model- and mechanism-specific, and simulating from these is challenging in most settings.
For this, we take the following simple approach in
Algorithm 1: at each step, we propose x i from the model f
( x | θ ) , and accept it with the appropriate
Metropolis-Hastings acceptance probability (5).
Observe that our choice of proposal distribution is independent of the privacy mechanism, and ignores the privatized data s dp as well as all other elements x − i .
Despite being simple and general-purpose, we show in Proposition 3.1 that for ϵ − DP, we can lower-bound the acceptance probability of proposals produced this way by exp( − ϵ ) .
This lower bound is key to efficiency: despite the unconstrained nature of the proposal distribution, we can guarantee a minimum acceptance probability.
These two facts suggest our sampler will explore the space of databases relatively quickly.
Proposition 3.1.
For a pure ϵ -DP privacy mechanism η , the acceptance probability α from Equation (5) satisfies α ( x ⋆i | x i , x − i , θ ) ≥ exp( − ϵ ) , for all θ, x − i , x i , x ∗ i .
The privacy loss budget ϵ is usually understood to be a small constant, which privacy experts recommend be between .
01 and 1 [Dwork, 2011].
When ϵ = 1 , Proposition 3.1 ensures that the acceptance rate in Algorithm 1 is no less than 36 .
7% , and as ϵ approaches zero, the bound on the acceptance rate approaches one.
Intuitively, this is because as ϵ decreases, the distribution of the privatized data s dp depends less and less on any individual element of the database.
The simplicity of our approach arises through a decoupling of the data model from the privacy mechanism: the former is used to update θ and propose x i ’s, while the latter is used to calculate the acceptance probabilities.
The next result formalizes the computational efficiency of our approach.
Specifically, for any record-additive mechanism, one iteration of our algorithm requires O ( n ) operations, where n is the size of the latent database.
Essentially, this arises because of Assumption 2, which allows the acceptance probability in (5) to be calculated in O (1) time.
Proposition 3.2.
The Gibbs sampler described in Algorithm 1 requires O ( n ) number of operations to update the full latent database according to p ( x | θ, s dp ) .
Note that even without privacy, one round of an MCMC procedure typically takes O ( n ) time.
This is because updating θ given the confidential data requires computing the data likelihood f ( x | θ ) =
(cid:81) ni
=1 f ( x i | θ ) , an O ( n ) operation in general.
Thus, as a result of the mild and typical condition that η is record-additive, our MCMC procedure enjoys the same order of runtime as the original MCMC algorithm for confidential data.
The previous two results are key to understanding the efficiency of our approach.
In the next section we formally establish geometric ergodicity of the sampler in Theorem 3.3 and 3.4.
Computational complexity.
The i.i.d.
assumption on the records ensures that step 2a of Algorithmtake O (1) time, though this assumption can easily be weakened.
Assumption 2 allows steps 2b and 2c to also takes O (1) time.
Overall, step 2 of our algorithm then takes O ( n ) (rather than O ( n 2 ) ) time as stated in Proposition 3.2.
This matches the typical per-iteration cost of samplers for the non-private posterior distribution required in step 1.
Thus, the overall cost of an iteration of our MCMC sampler is O ( n ) , which is typical when dealing with datasets of size n .
3.2 Ergodicity of the Privacy-Aware Sampler
Ergodicity ensures the MCMC chain converges to the posterior distribution in total variation distance.
[Tierney, 1994], which is essential for an MCMC sampler to consistently estimate functionals of the posterior distribution.
In Theorem 3.3, we provide mild and sufficient conditions for our proposed
Metropolis-within-Gibbs sampler to be ergodic.
Theorem 3.3.
Under conditions A1 - A3 below, the Metropolis-within-Gibbs sampler of Algorithmon the joint space ( X n × Θ) is ergodic and it admits p ( x, θ | s dp ) as the unique limiting distribution.
A1.
The prior distribution is proper and p ( θ ) > 0 for all θ in Θ
= { θ | f
θ ( x ) > 0 for some x } .
A2.
The model is such that the set { x : f ( x | θ ) > 0 } does not depend on θ.
A3.
The privacy mechanism satisfies η ( s dp | x ) > 0 for all x ∈ X n .
We prove this in the supplementary material by verifying invariance, aperiodicity, and irreducibility.
Conditions A1-A3 concern model specification, prior specification, and privacy noise.
These mild assumptions are typically true and are easy to verify.
While there are some mechanisms, such as the release-one-at-random mechanism, which satisfy approximate-DP but which violate A3 [Barber and
Duchi, 2014], most privacy mechanisms of interest satisfy A3.
It is easy to verify that if η satisfies ϵ -DP, zero-concentrated DP, or Gaussian-DP, then property A3 is guaranteed.
Next, we establish conditions for Algorithm 1 to be geometrically ergodic [Rosenthal, 1995, Roberts and Rosenthal, 1998].
A chain is said to be geometrically ergodic if its total variation distance to the target has a geometrically decaying upper bound.
Geometric ergodicity is a desirable property since it provides a rate on convergence to the stationary distribution, guaranteeing central limit theorems, and allowing for the computation of asymptotically valid standard errors.
For simplicity, we focus on the situation where one can directly sample from the conditional posterior p ( θ | x ) .
This is an important and common case, relevant when either θ is low-dimensional or where one can place conjugate priors on θ .
Both applications we present in this work, a log-linear model in
Section 4, and a linear regression model in Section 5, fall under this setting.
Theorem 3.4.
Assume that in step 1 of Algorithm 1, one can directly sample from p ( θ | x ) .
Under
A1-A3 of Theorem 3.3, the resulting ( x, θ ) chain, as well as the marginal chains, are geometrically ergodic if η satisfies ϵ -DP
and there exists 0 < a ≤ b < ∞ such that a ≤ f ( x | θ ) ≤ b ∀ θ, x.
To prove Theorem 3.4, we verify the drift and minorization conditions for component-wise Gibbs samplers in Theorem 8 of [Johnson et al., 2013].
See the supplementary material for details.
Unsurprisingly, geometric ergodicity requires stronger assumptions than just ergodicity.
The first assumption concerning the ability to sample directly from p ( θ | x ) can be avoided, but for the sake of clarity we do not try to relax it, since we are mostly concerned with the interface with the privacy mechanism.
The second assumption on the boundedness of the likelihood is stronger, but also typical.
A common way to achieve bounded likelihoods is to require the sample space X (and typically also Θ ) to be bounded.
In many real-world settings, such bounds exist, even if they may be very loose.
Naïve Bayes Log-Linear Model
Log-linear models are often used to model categorical data, a popular instance being the naïve Bayes classifier.
Following Karwa et al.
[2016], we consider the following model: x = ( x 1 , . . .
, x K ) is the input feature-vector , with each x k taking values in { 1 , 2 , . .
, J k } , and y is the output class taking values in { 1 , 2 , . . .
, I } .
Each input-output pair ( x, y ) forms one record in our confidential database, the entire database consisting of N i.i.d.
copies of ( x, y ) .
The naïve Bayes classifier assumes that P ( x | y ) =
(cid:81)
Kk =1 P ( x k | y ) , the model parameters being p kij
= P ( x k = j | y = i ) and p i =
P ( y = i ) .
The sufficient statistics of this model are n kij =
#( y = i, x k = j ) , which count the number of class-feature co-occurrences.
This will form our confidential query s , which we privatize by adding Laplace noise to each of the n kij .
The resulting quantity s dp , consisting of the noisy counts m kij = n kij + L ijk , is what we release.
When L ijk i.i.d. ∼ Laplace(0 , 2 K/ϵ ) , the output s dp satisfies ϵ -DP.
Placing a Dirichlet(2 , . .
, 2) on all parameter vectors, our goal is to obtain the marginal posterior distribution of p, p ki − | s dp .
While Karwa et al.
[2016] approximate this private posterior distribution using variational Bayes methods, our MCMC procedure is able to target the exact private posterior distribution.
Simulation setup.
We perform several simulation experiments where we apply our MCMC samplers to the log-linear model described above.
For the simulation, we set N = 100 (number of records),
I = 5 (number of classes), K = 5 (number of features), and J k = 3 for all k = 1 , . .
, K (possible values for each feature).
We evaluate our sampler for privacy levels corresponding to ϵ ∈ { . 1 , .
Posterior mean.
We generate one non-private dataset from the model, and hold it fixed.
We then create 100 private queries s dp at each ϵ value, and for each s dp we run Algorithm 1 foriterations.
We discard the first 5000 iterations as burn-in.
Finally, for each chain, we calculate the posterior mean.
Figure 1a plots the 100 different posterior means for each ϵ -value for the parameters
p i =
P ( Y = i ) for i = 1 , . .
In this plot, the solid horizontal lines indicate the non-private posterior means, and the dashed horizonal lines indicate the prior means for each parameter.
We see that as ϵ approaches zero, the posterior mean approaches the prior mean, reflecting the intuition that we learn less from the data as the privacy budget gets smaller.
On the other hand, as ϵ increases, we see that the private posterior mean approaches the non-private posterior mean, which reflects the fact that as ϵ grows, we learn approximately the same from the data as if there were no privacy mechanism.
[Figure] [Figure]
Acceptance rate.
Using the same simulation setup as for the posterior mean, we calculate the average and minimum acceptance rate of Step 2 in Algorithm 1.
Since the privacy mechanism satisfies ϵ -DP, we know that exp( − ϵ ) is a lower bound on these acceptance rates.
In Figure 1b, we confirm this bound, and see that the average acceptance rate is significantly higher than this lower bound.
This suggests that the chain mixes even faster than indicated by Proposition 3.1.
Coverage of credible intervals.
For the next experiment, we sample a set of parameters from the prior, and hold this fixed.
Then for each ϵ value, we produce 100 non-private datasets ( n kij ) , one private dataset ( m kij ) for each non-private one, and then run a chain for 10,000 iterations discarding the first 5000 iterations for burn-in.
From each chain, we produce a 90% credible interval for each p i
= P ( Y = i ) , and calculate the empirical coverage which is reported in Table 1.
[Table]
At a sample size of only N = 100 , we do not expect the coverage of the credible intervals to match the nominal level of 90% , but we see in Table 1 that most of the coverage values are above .
Notable exceptions are the coverage of p 4 when ϵ is small.
This may be because when ϵ is small, the private posterior is approximately equal to the prior, which is centered at . 2 ; however p 4 is significantly further from .
2 than the other parameters, which may explain why the coverage is low in this case.
Linear Regression
Next, we consider ordinary linear regression with n subjects and p predictors.
We write x 0 for the matrix of predictors excluding the intercept columns, x = (1 , x 0 ) for the matrix including the intercept, and y for the vector of outcomes.
We model the explanatory variables x 0 as x i 0 i.i.d.
∼
N p ( m, Σ) for i = 1 , . . . , n = 100 , with y | x given by N n ( xβ, σ 2 I n ) .
Here I n is the n × n identity matrix and N n denotes the n -dimentional multivariate Normal distribution.
The parameters of interest are β , the ( p + 1) − dimension vector of regression coefficients, with σ, m and Σ assumed known.
We use independent N (0 , 2 2 ) priors for the components of β .
To achieve ϵ -DP via the Laplace mechanism, we require a finite global sensitivity.
To achieve this, standard practice in the DP literature is to bound each predictor and response variable in a data-independent fashion.
The bounds chosen by the privacy expert are [ a i , b i ] for each instance of x i 0 and [ a y , b y ] for the entries of y , and these values are shared with the analyst.
Definition 5.1.
For a real value z , and a ≤ b , define the clamp function [ z ] ba :
=
min { max { z, a } , b } .
If z is a vector of length d , we use the same notation to apply an entry-wise clamp:
[ z ] ba :=
([ z 1 ] ba , [ z 2 ] ba , . .
, [ z d ] ba ) ⊤ .
Before adding noise for privacy, we first clamp the predictors and response, and then normalize them to take values in [ − 1 , 1] : (cid:101) x i 0 :=
( b i − a i ) − 1 2([ x i 0 ]
b i a i − a i ) − 1 and (cid:101)
y :
= ( b y − a y ) − 1 2([ y ] b y a y − a y ) − 1 .
Call (cid:101) x :=
[1 , (cid:101) x 1 0 , (cid:101) x 20 , . . .
, (cid:101) x p 0 ] and s :=
( (cid:101) x ⊤ (cid:101) y, (cid:101) y ⊤ (cid:101) y, (cid:101) x ⊤ (cid:101) x ) .
The s is the summary statistic to which we will add noise for privacy.
The ℓ 1 sensitivity of s (ignoring duplicate entries of (cid:101) x ⊤ (cid:101) x , and the constant entry ( (cid:101) x ⊤ (cid:101) x ) 1 , 1 ) is ∆ =
p 2 + 3 p + 3 .
To satisfy ϵ -DP, we add independent Laplace(0 , ∆ /ϵ ) noise to each of the d = 12 ( p + 1)( p + 2)
+ ( p + 1) unique entries of x , which gives our final private summary s dp .
We notice that s is an additive function and each individual’s contribution to s is t ( x i , y i ) =
((˜ x i )
⊤ ˜ y
i , ˜ y 2 i , (˜ x i )
⊤ ˜ x i ) .
This mechanism producing s dp is record-additive.
Simulation setup.
Our experiments focus on posterior inference about β based on S dp .
For simplicity, we fix other parameters σ 2 , m, Σ at the true data generating parameters (reported in the supplementary materials).
When they are unknown, the posterior distributions of these parameters can be estimated by our Gibbs sampler as well.
Confidential predictors and responses are clamped with bounds b =and a = − 10 .
Given a confidential database ( x, y ) , the posterior distribution of β is multivariate
Normal and can be sampled directly with a runtime linear in n .
Posterior mean.
We generate one confidential dataset ( x, y ) and hold it fixed.
At each ϵ value, we create 100 private outputs s dp and run Gibbs samplers for 10,000 iterations targeting the posterior β | s dp , discarding the first 5000 iterations.
We plot the 100 different posterior means of β in Figure 2.
In this plot, the solid horizontal lines indicate posterior means given confidential data ( x, y ) , which we do not expect to fully recover due to clamping.
The posterior quantities display the same trend with respect to change in privacy level as observed in Figure 1b.
The other experiments from Section 4 were also run on this linear regression model, and produced similar results.
Simulation details, plots and discussion are in the supplementary materials.
[Figure]
Discussion
We proposed a novel, but simple sampling procedure for parameter inference models where one only has access to privatized data.
Our approach is an MCMC sampler that targets the posterior distribution p ( θ | s dp ) , and which leverages existing samplers for the non-private posterior p ( θ | x ) , as well as the structure of the privacy mechanism.
The result is a simple wrapper for practitioners to obtain valid statistical inference from privatized data using the same models for the unobserved confidential data.
As a side product, our algorithm also produces multiple copies of the confidential database from the posterior p ( x | s dp ) .
These posterior predictive draws could be useful when one is interested in inferring properties of x as well.
Although we did not discuss this, our data augmentation scheme can also potentially enable frequentist analysis through the Monte Carlo expectation-maximization algorithm.
We acknowledge some limitations of present work.
First, we point out that strong assumptions such as bounded parameter space Θ and sample space X are required to establish geometric ergodicity of the Gibbs sampler in Theorem 3.4.
They mostly reflect the current state of MCMC mixing results, and can likely be relaxed, at the cost of a more complex theorem statement and proof.
Second, our current proposal for updating x i | x − i , θ, s dp only tailors to the model f
( · | θ )
and it is not customized for s dp yet.
In the future, we might be able to design algorithms that also incorporate the privatized output s dp in these proposals.
Third, we point out while our method exploits privacy to control the correlation between the components of x , it is still susceptible to correlation between x and θ .
This can potentially cause poor mixing in practice, despite geometric convergence rate.
While in simple problems, this can be fixed by reparameterization, we plan to develop MCMC algorithms for this setting in follow-up studies.
A similar potential issue is that, as a wrapper, our algorithm may be inefficient when the chosen sampler for p ( θ | x ) does not mix well, especially in some high-dimensional settings.
We emphasize though that our method is intended for settings where there currently exists efficient samplers for p ( θ | x ) , and when this is not the case, alternative approaches may be needed.
Finally, while the proposed algorithm converges so long as the privacy mechanism η is known, irrespective of the specific privacy guarantee, we point out that for alternative versions of DP (such as zCDP), the acceptance probability results in Proposition 3.1 may no longer hold, as this result depends on the ϵ -DP guarantee.
Developing alternatives to Proposition 3.1 for different privacy definitions is another goal of future work.
Acknowledgments and Disclosure of Funding
R. Gong is supported in part by the National Science Foundation grant DMS-1916002, V. Rao by the
National Science Foundation grants RI-1816499 and DMS-1812197, and J. Awan by the National
Science Foundation grant SES-2150615.
SStatement on Societal Impacts
We do not foresee direct negative societal impact from the current work.
Admittedly, our method is based on imputing the confidential database which privacy mechanisms seek to protect.
We can assure the reader that such imputations are based on formally differentially private data products and hence do not violate differential privacy.
Also, one may argue that our work is catalytic to enhancing the ‘disclosure risk’ of individuals, i.e. an adversary might be able to make accurate posterior inference about an individual if the adversary has highly informative and correct prior and modeling information to begin with.
Granted, no existing privacy frameworks can guard against this.
SProofs in Section 3.
Proposition 3.1.
For a pure ϵ -DP privacy mechanism η , the acceptance probability α from Equation (5) satisfies α ( x ⋆i | x i , x − i , θ ) ≥ exp( − ϵ ) , for all θ, x − i , x i , x ∗ i .
Proof.
Step 2a of Algorithm 1 proposes a new state x
⋆i for the i-th record x i according to the model f ( · | θ ) .
Notice that the proposed latent database x ⋆ =
( x ⋆i , x − i ) and the current latent database x
= ( x i , x − i ) differ in only one entry.
Then, the probability of accepting a proposed state x ⋆i is α ( x ⋆i | x i , x − i , θ )
=
min ( η ϵ ( s dp | x ⋆ ) /η
ϵ ( s dp | x ) , 1) .
This ratio compares two adjacent databases x ⋆ and x . ϵ -DP guarantees that the probability ratio of any output is within exp( ± ϵ ) for adjacent databases by Equation (1).
Proposition 3.2.
The Gibbs sampler described in Algorithm 1 requires O ( n ) number of operations to update the full latent database according to p ( x | θ, s dp ) .
Proof.
We prove that each update for x i | x − i , θ, s dp is O (1) and hence the full sweep for the latent database x | θ, s dp is O ( n ) .
Given current state ( x, θ ) , in Step 2a, the method proposes from x ⋆i ∼ f ( · | θ ) independent of other entries x − i and the current state x
i ; the runtime of this local proposal step does not depend on n .
Since η ( s dp | x ) is record-additive (Assumption 2), then t ( x ⋆ , s dp ) can be computed in O (1) time by t ( x ⋆ , s dp )
=
t ( x, s dp ) − t
i
( x i , s dp ) + t i ( x ⋆i , s dp ) of
Step 2b.
The density evaluations in Step 2c are also O (1) .
Overall, to update all x i , i = 1 , 2 , . . .
, n , the runtime is O ( n ) .
SProofs in Section 3. S-3.1 Ergodicity
In Algorithm 2, we first present a Metropolis-within-Gibbs sampler that is more general than
Algorithm 1.
We prove its ergodicity in Theorem S-3.1, which implies Theorem 3.3.
The Metropolis-within-Gibbs sampler in Algorithm 2 consists of alternating Metropolis-Hastings steps targeting p ( θ | x, s dp ) =
p ( θ | x ) and p ( x | θ, s dp ) .
In Assumption 1 we have assumed that a Markov kernel for p ( θ | x ) exists.
A typical kernel involves first proposing from some distribution q θ ( θ | x ) and then accepting or rejecting the proposed state an appropriate probability.
The data-augmentation steps consist of the sequence of updates p ( x i | x − i , θ, s dp ) , for i = 1 , 2 , . . . , n .
Algorithm 1 suggests using the proposal x ⋆i ∼ f ( · | θ ) independent of current state x .
In this more general sampler, described in algorithm 2, we use proposals q x ( x ⋆i | x i , x − i , θ, s dp ) that can depend on current states of x and θ , as well as the private query s dp .
Notice that since latent records are exchangeable in both f ( x | θ ) and η ( s dp | x ) , respectively by the i.i.d. model assumption and by record-additivity, it is sufficient to use the same kernel q x for all x i .
Theorem S-3.1.
Under conditions A1 - A4 below, the Gibbs sampler of Algorithm 2 on the joint space ( X n × R p ) is ergodic and it admits π ( x, θ ) as the unique limiting distribution.
A1.
The prior distribution is proper and π 0 ( θ ) > 0 for all θ in Θ
= { θ | f
θ ( x ) > 0 for some x } .
[Equation] [Equation]
A2.
The model is such that the set { x : f ( x | θ ) > 0 } does not depend on θ.
A3.
The privacy mechanism satisfies η ( s dp | x ) > 0 for all x ∈ X n .
A4.
From a valid current state, the proposal kernels satisfies (a) q θ ( θ ⋆ | x, θ ) > 0 for all θ ⋆ ∈ Θ , and (b) q x ( x ⋆i | x i , x − i , θ, s dp ) > 0 for all x ⋆i with f ( x ⋆i , x − i | θ ) >
Proof.
It is sufficient to show that the chain is π -invariant, aperiodic and π -irreducible
[Tierney, 1994].
The Metropolis-within-Gibbs sampler is aperiodic by construction, since some proposals can be rejected.
It is also π -invariant because it is composed of kernels that satisfy detailed balance with respect to π .
Irreducibility means that, informally, every set A with π ( A ) > 0 can be reached by the Gibbs sampler from any starting point within finitely many steps.
We first prove irreducibility for n = 1 and generalize this to a sample size of n ≥ 2 .
Suppose A ⊂ X 1 × Θ with π ( A ) > 0 and suppose the current state of the Gibbs chain is ( x (0) , θ (0) ) .
For any state ( x, θ ) ∈
A we have q ( θ | x (0) , x (0) )
q ( x | x (0) , θ, s dp ) > 0 by A4.
The acceptance ratios are also positive by A1-A4.
As a result
[Equation]
So when n = 1 , we can reach A from any starting point in one iteration of the Gibbs sampler.
For n ≥ 2 , we can reach the set A in at most n steps: the first iteration moves x 1 and θ into A , and subsequent steps moves other x i ’s into A while keeping all previous x j ’s inside A by rejecting proposals leaving A .
A4 details conditions on the proposal distributions to ensure ergodicity of Algorithm 2.
It can be relaxed so long as π -irreducibility is satisfied.
Also, A4a should be viewed as a condition implied by the validility of a kernel targeting p ( θ | x ) from Assumption 1 and, therefore, is not an additional assumption.
Importantly, conditions in A4 are mild because they cover common proposal distributions; Gaussian random walk on θ for A4a and the independent Metropolis proposals f
( · | θ ) for A4b are such examples.
In Algorithm 1, we use the kernel q x ( x ⋆i | x i , x − i , θ, s dp ) =
f ( x | θ ) , which satisfies f ( x ⋆ | θ ) > 0 by A2.
Hence Theorem S-3.1 implies Theorem 3.3.
S-3.2 Geometric ergodicity of Algorithm
Theorem 3.4.
Assume that in step 1 of Algorithm 1, one can directly sample from p ( θ | x ) .
Under
A1-A3 of Theorem 3.3, the resulting ( x, θ ) chain, as well as the marginal chains, are geometrically ergodic if η satisfies ϵ -DP
and there exists 0 < a ≤ b < ∞ such that a ≤ f ( x | θ ) ≤ b ∀ θ, x.
Proof of Theorem 3.4.
The assumption of a ≤ f ( x | θ ) ≤ b leads to the inequality
[Equation]
since p ( θ ) is a proper prior by A1 of algorithm 1.
This proof proceeds by verifying the drift and minorization conditions of the marginal Markov transition kernel on X according to Theorem 8 of Johnson et al.
We first present a full proof for n =
and then generalize the arguments to n ≥ 2 .
In this proof, we abbreviate η ( s dp | x ) as η ( x ) .
Recall that the probability of accepting proposed state x
⋆ is α ( x ⋆ | x, θ )
= min (cid:16) 1 , η ( x ⋆ ) η ( x ) (cid:17) .
The probability of accepting any proposal from the current state is α ( x, θ ) =
(cid:82) α
( x ⋆ | x, θ ) f
( x ⋆ | θ ) dx ⋆ .
Let K ( x ′ | x, θ ) denote the Markov transition kernel with respect to the proposal x ⋆ ∼ f
( · | θ ) , and let K ( x ′ | x ) = (cid:82) K ( x ′ | x, θ ) p ( θ | x ) dθ be the marginal kernel, which integrates out the exact θ update from p ( θ | x ) .
We have
[Equation]
where δ x ( x ′ ) is the Dirac-delta function.
Then the marginal transition kernel satisfies
[Equation]
since a ( x ′ | x, θ ) ≥ exp( − ϵ )
according to Proposition 3.1.
As a result, we have
[Equation]
Equation (S1) is sufficient for a minorization condition K ( x ′ | x ) ≥ a 2 b − 1 exp( − ϵ ) to hold on x ′ ∈ X since p ( θ ) is proper.
To establish a drift condition, let w : X → R > 0 be integrable with v = (cid:82) w ( x ) dx < ∞ .
Then we have the conditional expectation
[Equation]
Using f ( x | θ ) ≤ b , we can show that
[Equation]
which is the drift condition.
Combining Equations (S1) and (S2), we invoke Theorem 8 of Johnson et al.
[2013] to establish geometric ergodicity of the Gibbs sampler.
When n ≥ 2 , the proof shall proceed by denoting K ( x ′ | x, θ ) as the Markov transition kernel on x, x ′ ∈ X n and similarly for K ( x ′ | x ) .
The drift condition becomes K X [ w ( x )] ≤ b n v + w ( x ) and minorization condition becomes K ( x ′ | x ) ≤ ( a 2 b − 1 exp( − ϵ )) n .
S-
Log-linear
: More Details
Our full model, along with conjugate priors is given in the following equation array: prior
[Equation]
data model
[Equation]
privacy noise
[Equation]
privatized output
[Equation]
SLinear Regression: More Details and Results
Data generating parameters.
Our experiments use continuous predictors X 0 , which we model as X i 0 i.i.d.
∼ N p ( m, Σ) .
We choose Σ
= I n .
We simulate m i i.i.d.
∼ N (0 , 1) and hold it fixed at m = (0 . 9 , − 1 . 17) .
Conjugate prior distribution.
Our experiments fix σ 2 at the data generating value of σ 2 = 2 .
Given prior β ∼ N p
+
(0 , τ 2 I p +1 ) , the posterior distribution β | σ 2 , x, y is multivariate Normal with covariance matrix Σ n = ( x ⊤ x/σ 2 + I p +1 /τ 2 ) − 1 and mean vector µ n = Σ n ( x ⊤ y ) /σ
The prior for β is β i i.i.d.
∼ N (0 , τ 2 = 2 2 ) .
The effect of clamping.
We view clamping as part of the privacy mechanism.
The clamping step first truncates x and y values into a fixed range, and then performs data-independent location-scale transformation so that all values of ˜ x and ˜ y are in the range [ − 1 , 1] .
Although with conjugate priors the confidential data posterior p ( θ | x, y ) is tractable, the clamped data posterior p ( θ | ˜ x, ˜ y )
no longer enjoys conjugacy and is now intractable.
Since the clamping parameters are known, to sample from the clamped data posterior, one can design data-augmentation MCMC algorithms to impute truncated values.
Such an imputation algorithm might take O ( n ) per iteration.
We also highlight that as ϵ → ∞ , in which case privacy noise approaches zero, the posterior p ( θ | s dp ) approaches p ( θ | ˜ x, ˜ y ) .
Acceptance rate.
In Section 5, we report the posterior means of β, β 1 and β 2 given s dp produced from the same fixed latent database ( x, y ) , with different privacy levels.
We also report the acceptance rate of p ( x i | x − θ , θ, s dp ) updates in each iteration of the Gibbs samplers.
Recall that for each s dp , we run the Gibbs sampler for 10000 iterations and discard the first half for burn-in.
From Figure S1, we can see that the empirical acceptance rate of the IM proposals is much higher than the lower bound of Proposition 3.1.
Posterior credible intervals.
We repeat the credible interval experiment on log-linear models.
First we sample one β parameter from the prior, and hold this fixed.
Then for each ϵ value, we produce 100 confidential databases ( x, y ) and one private s dp for each non-private one, and then run a chain for 10,000 iterations targeting β | s dp .
After burn-in, from each chain, we produce a 90% credible interval for each β 0 , β 1 and β 2 .
We then calculate the empirical coverage which is reported in Table 1.
While at n = 100 , we do not expect the frequentist coverage of the credible intervals to exactly match the nominal level of .9, note that most of the values are close to or above .9.
The coverage on βis lower than 90%, which might be due to the true parameter being furthest from the prior mean of 0.
Another explanation is that data quality loss from truncation and location-scale transformations during the clamping procedure can not be fully recovered by our inference procedure.
[Figure] [Figure]
[Figure]
epsilon a cc ep t an c e r a t e bound low mean
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
SStatement on Computing Resources
We ran the experiments on an internal cluster.
We used a server with a pair of 64-core AMD Epyc 7662 ‘Rome’ processors and with 256GB of RAM.
We ran each MCMC chain for 10000 iterations and a typical chain takes approximately 330 seconds for linear regression and approximatelyseconds for the log-linear model.