How to Use Heuristics for Differential Privacy

Abstract

We develop theory for using heuristics to solve computationally hard problems in differential privacy. Heuristic approaches have enjoyed tremendous success in machine learning, for which performance can be empirically evaluated. However, privacy guarantees cannot be evaluated empirically, and must be proven -without making heuristic assumptions. We show that learning problems over broad classes of functions -those that have polynomially sized universal identification sets -can be solved privately and efficiently, assuming the existence of a non-private oracle for solving the same problem. Our first algorithm yields a privacy guarantee that is contingent on the correctness of the oracle. We then give a reduction which applies to a class of heuristics which we call certifiable, which allows us to convert oracle-dependent privacy guarantees to worst-case privacy guarantee that hold even when the heuristic standing in for the oracle might fail in adversarial ways. Finally, we consider classes of functions for which both they and their dual classes have small universal identification sets. This includes most classes of simple boolean functions studied in the PAC learning literature, including conjunctions, disjunctions, parities, and discrete halfspaces. We show that there is an efficient algorithm for privately constructing synthetic data for any such class, given a nonprivate learning oracle. This in particular gives the first oracle-efficient algorithm for privately generating synthetic data for contingency tables. The most intriguing question left open by our work is whether or not every problem that can be solved differentially privately can be privately solved with an oracle-efficient algorithm. While we do not resolve this, we give a barrier result that suggests that any generic oracle-efficient reduction must fall outside of a natural class of algorithms (which includes the algorithms given in this paper).1. a private learning algorithm for Q (this corresponds to solving the best response problem for the "query player"), and 2. a no-regret learning algorithm for a dual class of functions Q dual that results from swapping the role of the data element and the query function (this allows the "data player" to obtain a diminishing regret bound in simulated play of the game).

The Role of Interactivity in Local Differential Privacy

“…This is because such protocols are ≈ ε/ √ n differentially private when viewed in the central model of differential privacy (in which the input may be permuted before used in the protocol)[4,21], and hence the distribution on transcripts would be almost unchanged even if the entire dataset was resampled i.i.d. from D [13,28]…”

Differentially Private Query Release Through Adaptive Projection

“…"Dual Query" [15] uses a dual representation of the optimization problem implicitly solved by [29,19,18] to trade off the need to manipulate exponentially large state with the need to solve concisely defined but NP-hard integer programs. The theory of "oracle efficient" synthetic data release was further developed in [26], and [36] give further improvements on oracle efficient algorithms in this dual representation, and promising experimental results. We compare against the algorithm from [36] in our empirical results.…”

Sample-efficient proper PAC learning with approximate differential privacy

“…In the body of work on private learning algorithms, a significant amount of effort has gone into developing algorithms for the private PAC model [KLN `08], namely the setting of differentially private binary classification (see Section 2.1 for a formal definition). Some papers on this fundamental topic include [KLN `08, BBKN14, BNSV15, FX14, BNS14, BDRS18, BNS19, ALMM19, KLM `20, BLM20b,NRW19,Bun20]. A remarkable recent development [ALMM19,BLM20b] in this area is the result that a hypothesis class F of binary classifiers is learnable with approximate differential privacy (Definition 2.2) if and only if it is online learnable, i.e., has finite Littlestone dimension (Definition 2.5).…”