{"title": "Secure Multi-party Differential Privacy", "book": "Advances in Neural Information Processing Systems", "page_first": 2008, "page_last": 2016, "abstract": "We study the problem of multi-party interactive function computation under differential privacy. In this setting, each party is interested in computing a function on its private bit and all the other parties' bits. The function to be computed can vary from one party to the other. Moreover, there could be a central observer who is interested in computing a separate function on all the parties' bits. Differential privacy ensures that there remains an uncertainty in any party's bit even when given the transcript of interactions and all other parties' bits. Performance at each party is measured via the accuracy of the function to be computed. We allow for an arbitrary cost metric to measure the distortion between the true and the computed function values. Our main result is the optimality of a simple non-interactive protocol: each party randomizes its bit (sufficiently) and shares the privatized version with the other parties. This optimality result is very general: it holds for all types of functions, heterogeneous privacy conditions on the parties, all types of cost metrics, and both average and worst-case (over the inputs) measures of accuracy.", "full_text": "SecureMulti-partyDifferentialPrivacyPeterKairouz1SewoongOh2PramodViswanath11DepartmentofElectrical&ComputerEngineering2DepartmentofIndustrial&EnterpriseSystemsEngineeringUniversityofIllinoisUrbana-ChampaignUrbana,IL61801,USA{kairouz2,swoh,pramodv}@illinois.eduAbstractWestudytheproblemofinteractivefunctioncomputationbymultipleparties,eachpossessingabit,inadifferentialprivacysetting(i.e.,thereremainsanuncer-taintyinanyparty\u2019sbitevenwhengiventhetranscriptofinteractionsandalltheotherparties\u2019bits).Eachpartywantstocomputeafunction,whichcoulddifferfrompartytoparty,andtherecouldbeacentralobserverinterestedincomputingaseparatefunction.Performanceateachpartyismeasuredviatheaccuracyofthefunctiontobecomputed.Weallowforanarbitrarycostmetrictomeasurethedistortionbetweenthetrueandthecomputedfunctionvalues.Ourmainre-sultistheoptimalityofasimplenon-interactiveprotocol:eachpartyrandomizesitsbit(suf\ufb01ciently)andsharestheprivatizedversionwiththeotherparties.Thisoptimalityresultisverygeneral:itholdsforalltypesoffunctions,heterogeneousprivacyconditionsontheparties,alltypesofcostmetrics,andbothaverageandworst-case(overtheinputs)measuresofaccuracy.1IntroductionMulti-partycomputation(MPC)isagenericframeworkwheremultiplepartiessharetheirinforma-tioninaninteractivefashiontowardsthegoalofcomputingsomefunctions,potentiallydifferentateachoftheparties.Inmanysituationsofcommoninterest,thekeychallengeisincomputingthefunctionsasprivatelyaspossible,i.e.,withoutrevealingmuchaboutone\u2019sinformationtotheother(potentiallycolluding)parties.Forinstance,aninteractivevotingsystemaimstocomputethema-jorityof(say,binary)opinionsofeachoftheparties,witheachpartybeingaversetodeclaringtheiropinionpublicly.Anotherexampleinvolvesbankssharing\ufb01nancialriskexposures\u2013thebanksneedtoagreeonquantitiessuchastheovernightlendingratewhichdependsoneachbank\u2019sexposure,whichisaquantitythebanksarenaturallyloathtotruthfullydisclose[1].Acentrallearningtheoryquestioninvolvescharacterizingthefundamentallimitsofinteractiveinformationexchangesuchthatastrong(andsuitablyde\ufb01ned)adversaryonlylearnsaslittleaspossiblewhilestillensuringthatthedesiredfunctionscanbecomputedasaccuratelyaspossible.Onewaytoformulatetheprivacyrequirementistoensurethateachpartylearnsnothingmoreabouttheothers\u2019informationthancanbelearnedfromtheoutputofthefunctioncomputed.Thistopicisstudiedundertherubricofsecurefunctionevaluation(SFE);theSFEformulationhasbeenextensivelystudiedwiththegoalofcharacterizingwhichfunctionscanbesecurelyevalu-ated[39,3,21,11].OnedrawbackofSFEisthatdependingonwhatauxiliaryinformationtheadversarymighthave,disclosingtheexactfunctionoutputmightrevealeachparty\u2019sdata.Forex-ample,considercomputingtheaverageofthedataownedbyalltheparties.EvenifweuseSFE,aparty\u2019sdatacanberecoveredifalltheotherpartiescollaborate.Toensureprotectionoftheprivatedataundersuchastrongadversary,wewanttoimposeastrongerprivacyguaranteeofdifferentialprivacy.Recentbreachesofsensitiveinformationaboutindividualsduetolinkageattacksprove1\fthevulnerabilityofexistingad-hocprivatizationschemes,suchasanonymizationoftherecords.Inlinkageattacks,anadversarymatchesupanonymizedrecordscontainingsensitiveinformationwithpublicrecordsinadifferentdataset.Suchattackshaverevealedthemedicalrecordofaformergov-ernorofMassachusetts[37],thepurchasehistoryofAmazonusers[7],genomicinformation[25],andmovieviewinghistoryofNet\ufb02ixusers[33].Analternativeformulationisdifferentialprivacy,arelativelyrecentformulationthathasreceivedconsiderableattentionasaformalmathematicalnotionofprivacythatprovidesprotectionagainstsuchstrongadversaries(arecentsurveyisavailableat[16]).Thebasicideaistointroduceenoughrandomnessinthecommunicationsothatanadversarypossessingarbitrarysideinformationandaccesstotheentiretranscriptofthecommunicationwillstillhavesomeresidualuncertaintyinidentifyinganyofthebitsoftheparties.Thisprivacyrequirementisstrongenoughthatnon-trivialfunctionswillbecomputedonlywithsomeerror.Thus,thereisagreatneedforunderstandingthefundamentaltradeoffbetweenprivacyandaccuracy,andfordesigningprivatizationmechanismsandcommunicationprotocolsthatachievetheoptimaltradeoffs.Theformulationandstudyofanoptimalframeworkaddressingthistradeoffisthefocusofthispaper.Westudythefollowingproblemofmulti-partycomputationunderdifferentialprivacy:eachpartypossessesasinglebitofinformationandtheinformationbitsarestatisticallyindependent.Eachpartyisinterestedincomputingafunction,whichcoulddifferfrompartytoparty,andtherecouldbeacentralobserver(observingtheentiretranscriptoftheinteractivecommunicationprotocol)interestedincomputingaseparatefunction.Performanceateachpartyandthecentralobserverismeasuredviatheaccuracyofthefunctiontobecomputed.Weallowanarbitrarycostmetrictomeasurethedistortionbetweenthetrueandthecomputedfunctionvalues.Eachpartyimposesadifferentialprivacyconstraintonitsinformationbit(theprivacylevelcouldbedifferentfrompartytoparty)\u2013i.e.,thereremainsanuncertaintyinanyspeci\ufb01cparty\u2019sbiteventoanadversarythathasaccesstothetranscriptofinteractionsandalltheotherparties\u2019bits.Theinteractivecommunicationisachievedviaabroadcastchannelthatallpartiesandthecentralobservercanhear(thismodelingiswithoutlossofgenerality\u2013sincethedifferentialprivacyconstraintprotectsagainstanadversarythatcanlistentotheentiretranscript,thecommunicationbetweenanytwopartiesmightaswellberevealedtoalltheothers).Itisusefultodistinguishbetweentwotypesofcommunicationprotocols:interactiveandnon-interactive.Wesayacommunicationprotocolisnon-interactiveifamessagebroadcastedbyonepartydoesnotdependonthemessagesbroadcastedbyotherparties.Incontrast,interactiveprotocolsallowthemessagesatanystageofthecommunicationtodependonallthepreviousmessages.Ourmainresultistheexactoptimalityofasimplenon-interactiveprotocolintermsofmaximizingaccuracyforanygivenprivacylevel,wheneachpartypossessesonebit:eachpartyrandomizes(suf\ufb01ciently)andpublishesitsownbit.Inotherwords:non-interactiverandomizedresponseisexactlyoptimal.Eachpartyandthecentralobserverthenseparatelycomputetheirrespectivedecisionfunctionstomaximizetheappropriatenotionoftheiraccuracymeasure.Thisoptimalityresultisverygeneral:itholdsforalltypesoffunctions,heterogeneousprivacyconditionsontheparties,alltypesofcostmetrics,andbothaverageandworst-case(overtheinputs)measuresofaccuracy.Finally,theoptimalityresultissimultaneous,intermsofmaximizingaccuracyateachofthepartiesandthecentralobserver.Eachpartyonlyneedstoknowitsowndesiredlevelofprivacy,itsownfunctiontobecomputed,anditsmeasureofaccuracy.Optimaldatareleaseandoptimaldecisionmakingisnaturallyseparated.Thekeytechnicalresultisageometricunderstandingofthespaceofconditionalprobabilitiesofagiventranscript:theinteractivenatureofthecommunicationconstrainsthespacetobearank-1ten-sor(aspecialcaseofEquation(6)in[35]andperhapsimplicitlyusedin[30];thetwo-partyanalogofthisresultisin[29]),whiledifferentialprivacyimposeslinearconstraintsonthesingularvectorsofthistensor.Wecharacterizetheconvexhullofsuchmanifoldsofrank-1tensorsandshowthattheircorner-pointsexactlycorrespondtothetranscriptsthatarisefromanon-interactiverandom-izedresponseprotocol.Thisuniversal(forallfunctionalities)characterizationisthenusedtoarguethatbothaverage-caseandworst-caseaccuraciesaremaximizedbynon-interactiverandomizedre-sponses.2\fTechnically,weprovethatnon-interactiverandomizedresponseistheoptimalsolutionoftherank-constrainedandnon-linearoptimizationof(11).Therankconstraintsonhigherordertensorsarisesfromthenecessaryconditionof(possiblyinteractive)multi-partyprotocols,knownasprotocolcom-patibility(seeSection2fordetails).Tosolvethisnon-standardoptimization,wetransform(11)intoanovellinearprogramof(17)and(20).Thepricewepayistheincreaseddimension,theresult-ingLPisnowin\ufb01nitedimensional.Theideaisthatweintroduceanewvariableforeachpossiblerank-onetensor,andoptimizeoverallofthem.Formulatingutilitymaximizationunderdifferentialprivacyaslinearprogramshasbeenpreviouslystudiedin[32,20,6,23],underthestandardclient-servermodelwherethereisasingledatapub-lisherandasingledataanalyst.Theseapproachesexploitthefactthatboththedifferentialprivacyconstraintsandtheutilitiesarelinearinthematrixrepresentingaprivatizationmechanism.Asimi-lartechniqueoftransforminganon-linearoptimizationproblemintoanin\ufb01nitedimensionalLPhasbeensuccessfullyappliedin[26],whereoptimalprivatizationmechanismsunderlocaldifferentialprivacyhasbeenstudied.Wegeneralizethesetechniquestorank-constrainedoptimizations.Further,perhapssurprisingly,weprovethatthisin\ufb01nitedimensionallinearprogramhasasimpleoptimalsolution,whichwecallrandomizedresponse.Uponreceivingtherandomizedresponses,eachpartycancomputethebestapproximationofitsrespectivefunction.Themaintechnicalinno-vationisinprovingthat(a)theoptimalsolutionofthisLPcorrespondstocornerpointsofaconvexhullofaparticularmanifoldde\ufb01nedbyarank-onetensor(seeLemma6.2inthesupplementaryma-terialfordetails);and(b)therespectivemanifoldhasasimplestructuresuchthatthecornerpointscorrespondtoparticularprotocolsthatwecallrandomizedresponses.Whentheaccuracyismeasuredviaaverageaccuracy,boththeobjectiveandtheconstraintsarelinearanditisnaturaltoexpecttheoptimalsolutiontobeatthecornerpoints(seeEquation(17)).Asurprisingaspectofourmainresultisthattheoptimalsolutionisstillatthecornerpointseventhoughtheworst-caseaccuracyisaconcavefunctionovertheprotocolP(seeEquation(19)).Thisworkfocusesonthescenariowhereeachpartypossessesasinglebitofinformation.Withmultiplebitsofinformationateachoftheparties,theexistenceofadifferentiallyprivateprotocolwitha\ufb01xedaccuracyforanynon-trivialfunctionalityimpliestheexistenceofaprotocolwiththesamelevelofprivacyandsamelevelofaccuracyforaspeci\ufb01cfunctionalitythatonlydependsononebitofeachoftheparties(asin[22]).Thus,ifwecanobtainlowerboundsonaccuracyforfunctionalitiesinvolvingonlyasinglebitateachoftheparties,weobtainlowerboundsonaccuracyforallnon-trivialgeneralfunctionalities.However,non-interactivecommunicationisunlikelytobeexactlyoptimalinthisgeneralcasewhereeachpartypossessesmultiplebitsofinformation,andweprovideafurtherdiscussioninSection4.Wemoveadetaileddiscussionofrelatedwork(Section5)tothesupplementarymaterial,focusingontheproblemformulationnext.2ProblemformulationConsiderthesettingwherewehavekparties,eachwithitsownprivatebinarydataxi\u2208{0,1}generatedindependently.Theindependenceassumptionhereisnecessarybecausewithoutiteachpartycanlearnsomethingaboutothers,whichviolatesdifferentialprivacy,evenwithoutrevealinganyinformation.WediscusspossibleextensionstocorrelatedsourcesinSection4.Differentialprivacyimplicitlyimposesindependenceinamulti-partysetting.Thegoaloftheprivatemulti-partycomputationisforeachpartyi\u2208[k]tocomputeanarbitraryfunctionfi:{0,1}k\u2192Yofinterestbyinteractivelybroadcastingmessages,whilepreservingtheprivacyofeachparty.Theremightbeacentralobserverwholistenstoallthemessagesbeingbroadcasted,andwantstocomputeanotherarbitraryfunctionf0:{0,1}\u2192Y.Thekpartiesarehonestinthesensethatoncetheyagreeonwhatprotocoltofollow,everypartyfollowstherules.Atthesametime,theycanbecurious,andeachpartyneedstoensureotherpartiescannotlearnhisbitwithsuf\ufb01cientcon\ufb01dence.Theprivacyconstraintsherearesimilartothelocaldifferentialprivacysettingstudiedin[13]inthesensethattherearemultipleprivacybarriers,eachoneseparatingeachindividualpartyandtherestoftheworld.However,themaindifferenceisthatweconsidermulti-partycomputation,wheretherearemultiplefunctionstobecomputed,andeachnodemightpossessadifferentfunctiontobecomputed.Letx=[x1,...,xk]\u2208{0,1}kdenotethevectorofkbits,andx\u2212i=[x1,...,xi\u22121,xi+1,...,xk]\u2208{0,1}k\u22121isthevectorofbitsexceptforthei-thbit.Theparties3\fagreeonaninteractiveprotocoltoachievethegoalofmulti-partycomputation.A\u2018transcript\u2019istheoutputoftheprotocol,andisarandominstanceofallbroadcastedmessagesuntilallthecom-municationterminates.Theprobabilitythatatranscript\u03c4isbroadcasted(viaaseriesofinteractivecommunications)whenthedataisxisdenotedbyPx,\u03c4=P(\u03c4|x)forx\u2208{0,1}kandfor\u03c4\u2208T.Then,aprotocolcanberepresentedasamatrixdenotingtheprobabilitydistributionoverasetoftranscriptsTconditionedonx:P=[Px,\u03c4]\u2208[0,1]2k\u00d7|T|.Intheend,eachpartymakesadecisiononwhatthevalueoffunctionfiis,basedonitsownbitxiandthetranscript\u03c4thatwasbroadcasted.Adecisionruleisamappingfromatranscript\u03c4\u2208Tandprivatebitxi\u2208{0,1}toadecisiony\u2208Yrepresentedbyafunction\u02c6fi(\u03c4,xi).Weallowrandomizeddecisionrules,inwhichcase\u02c6fi(\u03c4,xi)canbearandomvariable.Forthecentralobserver,adecisionruleisafunctionofjustthetranscript,denotedbyafunction\u02c6f0(\u03c4).Weconsidertwonotionsofaccuracy:theaverageaccuracyandtheworst-caseaccuracy.Forthei-thparty,consideranaccuracymeasurewi:Y\u00d7Y\u2192R(orequivalentlyanegativecostfunction)suchthatwi(fi(x),\u02c6fi(\u03c4,xi))measurestheaccuracywhenthefunctiontobecomputedisfi(x)andtheapproximationis\u02c6fi(\u03c4,xi).Thentheaverageaccuracyforthisi-thpartyisde\ufb01nedasACCave(P,wi,fi,\u02c6fi)\u226112kXx\u2208{0,1}kE\u02c6fi,Px,\u03c4[wi(fi(x),\u02c6fi(\u03c4,xi))],(1)wheretheexpectationistakenovertherandomtranscript\u03c4distributionasPandalsoanyrandom-nessinthedecisionfunction\u02c6fi.Wewanttoemphasizethattheinputisdeterministic,i.e.weimposenodistributionontheinputdata,andtheexpectationisnotoverthedatasetsx.Comparedtoassum-ingadistributionoverthedata,thisisaweakerassumptiononthedata,andhencemakesourmainresultstronger.Forexample,iftheaccuracymeasureisanindicatorsuchthatwi(y,y0)=I(y=y0),thenACCavemeasurestheaverageprobabilityofgettingthecorrectfunctionoutput.ForagivenprotocolP,ittakes(2k|T|)operationstocomputetheoptimaldecisionrule:f\u2217i,ave(\u03c4,xi)=argmaxy\u2208YXx\u2212i\u2208{0,1}k\u22121Px,\u03c4wi(fi(x),y),(2)foreachi\u2208[k].Thecomputationalcostof(2k|T|)forcomputingtheoptimaldecisionruleisunavoidableingeneral,sincethatistheinherentcomplexityoftheproblem:describingthedistri-butionofthetranscriptrequiresthesamecost.Wewillshowthattheoptimalprotocolrequiresasetoftranscriptsofsize|T|=2k,andthecomputationalcomplexityofthedecisionruleforgeneralafunctionis22k.However,fora\ufb01xedprotocol,thisdecisionruleneedstobecomputedonlyoncebeforeanymessageistransmitted.Further,itisalsopossibleto\ufb01ndaclosedformsolutionforthedecisionrulewhenfhasasimplestructure.OneexampleistheXORfunctionstudiedindetailinSection3,wheretheoptimaldecisionruleisassimpleasevaluatingtheXORofallthereceivedbits,whichrequiresO(k)operations.Whentherearemultiplemaximizersy,wecanchoosearbitrarily,anditfollowsthatthereisnogaininrandomizingthedecisionruleforaverageaccuracy.Similarly,theworst-caseaccuracyisde\ufb01nedasACCwc(P,wi,fi,\u02c6fi)\u2261minx\u2208{0,1}kE\u02c6fi,Px,\u03c4[wi(fi(x),\u02c6fi(\u03c4,xi))].(3)Forworst-caseaccuracy,givenaprotocolP,theoptimaldecisionruleofthei-thpartywithabitxicanbecomputedbysolvingthefollowingconvexprogram:Q(xi)=argmaxQ\u2208R|T|\u00d7|Y|minx\u2212i\u2208{0,1}k\u22121X\u03c4\u2208TXy\u2208YPx,\u03c4wi(fi(x),y)Q\u03c4,y(4)subjecttoXy\u2208YQ\u03c4,y=1,\u2200\u03c4\u2208TandQ\u22650Theoptimal(random)decisionrulef\u2217i,wc(\u03c4,xi)istooutputygiventranscript\u03c4accordingtoP(y|\u03c4,xi)=Q(xi)\u03c4,y.Thiscanbeformulatedasalinearprogramwith(|T||Y|)variablesand(2k+|T|)constraints.Again,itispossibleto\ufb01ndaclosedformsolutionforthedecisionrulewhenfhasasimplestructure:fortheXORfunction,theoptimaldecisionruleisagainevaluating4\ftheXORofallthereceivedbitsrequiringO(k)operations.Foracentralobserver,theaccuracymeasuresarede\ufb01nedsimilarly,andtheoptimaldecisionruleisnowf\u22170,ave(\u03c4)=argmaxy\u2208YXx\u2208{0,1}kPx,\u03c4w0(f0(x),y),(5)andforworst-caseaccuracytheoptimal(random)decisionrulef\u22170,wc(\u03c4)istooutputygiventran-script\u03c4accordingtoP(y|\u03c4)=Q(0)\u03c4,y.SubjecttoPy\u2208YQ\u03c4,y=1,\u2200\u03c4\u2208TandQ\u22650,Q(0)=argmaxQ\u2208R|T|\u00d7|Y|minx\u2208{0,1}kX\u03c4\u2208TXy\u2208YPx,\u03c4w0(f0(x),y)Q\u03c4,y(6)wherew0:Y\u00d7Y\u2192Risthemeasureofaccuracyforthecentralobserver.Privacyismeasuredbydifferentialprivacy[14,15].Sinceweallowheterogeneousprivacycon-straints,weuse\u03b5itodenotethedesiredprivacylevelofthei-thparty.WesayaprotocolPis\u03b5i-differentiallyprivateforthei-thpartyiffori\u2208[k],andallxi,x0i\u2208{0,1},x\u2212i\u2208{0,1}k\u22121,and\u03c4\u2208T,P(\u03c4|xi,x\u2212i)\u2264e\u03b5iP(\u03c4|x0i,x\u2212i).(7)Thisconditionensuresnoadversarycaninfertheprivatedataxiwithhighenoughcon\ufb01dence,nomatterwhatauxiliaryinformationhemighthaveandindependentofhiscomputationalpower.Tolightennotations,welet\u03bbi=e\u03b5iandsayaprotocolis\u03bbi-differentiallyprivateforthei-thparty.Iftheprotocolis\u03bbi-differentiallyprivateforalli\u2208[k],thenwesaythattheprotocolis{\u03bbi}-differentiallyprivateforallparties.Anecessaryconditiononthemulti-partyprotocolsP,whenthebitsaregeneratedindependentofeachother,isprotocolcompatibility[22]:conditionedonthetranscriptoftheprotocol,theinputbitsstayindependentofeachother.Inoursetting,inputbitsaredeterministic,henceindependent.Mathematically,aprotocolPisprotocolcompatibleifeachcolumnP(\u03c4)isarank-onetensor,whenreshapedintoak-thordertensorP(\u03c4)\u2208[0,1]2\u00d72\u00d7...\u00d72,whereP(\u03c4)x1,...,xk=Px,\u03c4.(8)Precisely,thereexistvectorsu(1)...,u(k)suchthatP(\u03c4)=u(1)\u2297\u00b7\u00b7\u00b7\u2297u(k),where\u2297denotesthestandardouter-product,i.e.P(\u03c4)i1,...,ik=u(1)i1\u00d7\u00b7\u00b7\u00b7\u00d7u(k)ik.Thisiscrucialinderivingthemainresults,anditisawell-knownfactinthesecuremulti-partycomputationliterature.Thisfollowsfromthefactthatwhenthebitsaregeneratedindependently,allthebitsarestillindependentconditionedonthetranscript,i.e.P(x|\u03c4)=QiP(xi|\u03c4),whichfollowsimplicitlyfrom[30]anddirectlyfromEquation(6)of[35].Noticethatusingtherank-onetensorrepresentationofeachcolumnoftheprotocolP(\u03c4),wehaveP(\u03c4|xi=0,x\u2212i)/P(\u03c4|xi=1,x\u2212i)=u(i)1/u(i)2.ItfollowsthatPis\u03bbi-differentiallyprivateifandonlyif\u03bb\u22121iu(i)2\u2264u(i)1\u2264\u03bbiu(i)2.Randomizedresponse.Considerthefollowingsimpleprotocolknownastherandomizedresponse,whichisaterm\ufb01rstcoinedby[38]andcommonlyusedinmanyprivatecommunicationsincludingthemulti-partysetting[31].WewillshowinSection3thatthisistheoptimalprotocolforsimulta-neouslymaximizingtheaccuracyofalltheparties.Eachpartybroadcastsarandomizedversionofitsbitdenotedby\u02dcxisuchthat\u02dcxi=(cid:26)xiwithprobability\u03bbi1+\u03bbi,\u00afxiwithprobability11+\u03bbi,(9)where\u00afxiisthelogicalcomplementofxi.Eachtranscriptcanberepresentedbytheoutputoftheprotocol,whichinthiscaseis\u02dcx=[\u02dcx1,...,\u02dcxk]\u2208T,whereT={0,1}kisnowthesetofallbroadcastedbits.Accuracymaximization.Considertheproblemofmaximizingtheaverageaccuracyforacentral-izedobserverwithfunctionf.Uptothescalingof1/2kin(1),theaccuracycanbewrittenasXx\u2208{0,1}kEP[w(f(x),\u02c6f0(\u03c4))]=XxXy\u2208Yw(f0(x),y)|{z},W(y)xX\u03c4\u2208TPx,\u03c4P(\u02c6f0(\u03c4)=y)|{z},Q\u03c4,y,(10)5\fwhere\u02c6f0(\u03c4)denotestherandomizeddecisionuponreceivingthetranscript\u03c4.Inthefollowingwede\ufb01neW(y)x,w(f0(x),y)torepresenttheaccuracymeasureandQ\u03c4,y,P(\u02c6f(\u03c4)=y)torepresentthedecisionrule.Focusingonthissinglecentralobserverforthepurposeofillustration,wewanttodesignprotocolsPx,\u03c4anddecisionrulesQ\u03c4,ythatmaximizetheaboveaccuracy.Further,thisprotocolhastobecompatiblewithinteractivecommunication,satisfyingtherankoneconditiondiscussedabove,andsatisfythedifferentialprivacyconditionin(7).Hence,wecanformulatetheaccuracymaximizationcanbeformulatedasfollows.GivenW(y)x\u2019sintermsofthefunctionf0(\u00b7)tobecomputed,anaccuracymeasurew0(\u00b7,\u00b7),andrequiredprivacylevel\u03bbi\u2019s,wesolvemaximizeP\u2208R2k\u00d7|T|,Q\u2208R|T|\u00d7|Y|Xx,\u2208{0,1}k,y\u2208YW(y)xX\u03c4\u2208TPx,\u03c4Q\u03c4,y,subjecttoPandQarerow-stochasticmatrices,rank(P(\u03c4))=1,\u2200\u03c4\u2208T,P(xi,x\u2212i),\u03c4\u2264\u03bbiP(x0i,x\u2212i),\u03c4,\u2200i\u2208[k],x1,x01,\u2208{0,1},x\u2212i\u2208{0,1}k\u22121,(11)whereP(\u03c4)isde\ufb01nedasak-thordertensorde\ufb01nedfromthe\u03c4-thcolumnofmatrixPasde\ufb01nedinEquation(8).Noticethattherankconstraintisonlyanecessaryconditionforaprotocoltobecompatiblewithinteractivecommunicationschemes,i.e.avalidinteractivecommunicationprotocolimpliestherank-oneconditionbutnotallrank-oneprotocolsarevalidinteractivecommunicationschemes.Therefore,theaboveisarelaxationwithlargerfeasiblesetofprotocols,butitturnsoutthattheoptimalsolutionoftheaboveoptimizationproblemistherandomizedresponse,whichisavalid(non-interactive)communicationprotocol.Hence,thereisnolossinsolvingtheaboverelaxation.Themainchallengeinsolvingthisoptimizationisthatitisarank-constrainedtensoroptimizationwhichisnotoriouslydif\ufb01cult.Sincetherankconstraintisoverak-thordertensor(k-dimensionalarray)withpossiblyk>2,commonapproachesofconvexrelaxationfrom[36]formatrices(whichare2ndordertensors)doesnotapply.Further,wewanttosimultaneouslyapplysimilaroptimiza-tionstoallthepartieswithdifferentfunctionstobecomputed.Weintroduceanoveltransformationoftheaboverank-constrainedoptimizationintoalinearpro-gramin(17)and(20).Thepricewepayisintheincreaseddimensionality:theLPhasanin\ufb01nitedimensionaldecisionvariable.However,combinedwiththegeometricunderstandingofthethemanifoldofrank-1tensors,wecanidentifytheexactoptimalsolution.Weshowinthenextsectionthatgivendesiredlevelofprivacy{\u03bbi}i\u2208[k],thereisasingleuniversalprotocolthatsimultaneouslymaximizestheaccuracyfor(a)allparties;(b)anyfunctionsofinterest;(c)anyaccuracymeasures;and(d)bothworst-caseandaveragecaseaccuracy.Togetherwithoptimaldecisionrulesperformedateachofthereceivingends,thisgivestheexactoptimalmulti-partycomputationscheme.3MainResultWeshow,perhapssurprisingly,thatthesimplerandomizedresponsepresentedin(9)istheoptimalprotocolinaverygeneralsense.Foranydesiredprivacylevel\u03bbi,andarbitraryfunctionfi,foranyaccuracymeasurewi,andanynotionofaccuracy(eitheraverageorworstcase),weshowthattherandomizedresponseisuniversallyoptimal.Theproofofthefollowingtheoremcanbefoundinthesupplementarymaterial.Theorem3.1Lettheoptimaldecisionrulebede\ufb01nedasin(2)fortheaverageaccuracyand(4)fortheworst-caseaccuracy.Then,forany\u03bbi\u22651,anyfunctionfi:{0,1}k\u2192Y,andanyaccuracymeasurewi:Y\u00d7Y\u2192Rfori\u2208[k],therandomizedresponseforgiven\u03bbiwiththeoptimaldecisionfunctionachievesthemaximumaccuracyforthei-thpartyamongall{\u03bbi}-differentiallyprivateinteractiveprotocolsandalldecisionrules.Forthecentralobserver,therandomizedresponsewiththeoptimaldecisionrulede\ufb01nedin(5)and(6)achievesthemaximumaccuracyamongall{\u03bbi}-differentiallyprivateinteractiveprotocolsandalldecisionrulesforanyarbitraryfunctionf0andanymeasureofaccuracyw0.Thisisastronguniversaloptimalityresult.Everypartyandthecentralobservercansimultaneouslyachievetheoptimalaccuracyusingauniversalrandomizedresponse.Eachpartyonlyneedstoknow6\fitsowndesiredlevelofprivacy,itsownfunctiontobecomputed,anditsmeasureofaccuracy.Opti-maldatareleaseandoptimaldecisionmakingarenaturallyseparated.However,itisnotimmediateatallthatanon-interactiveschemesuchastherandomizedresponsewouldachievethemaximumaccuracy.Thefactthatinteractiondoesnothelpiscounter-intuitive,andmightaswellbetrueonlyforthebinarydatascenarioweconsiderinthispaper.Thekeytechnicalinnovationistheconvexgeometryintheproof,whichdoesnotgeneralizetolargeralphabetcase.Onceweknowinteractiondoesnothelp,wecanmakeaneducatedguessthattherandomizedre-sponseshoulddominateoverothernon-interactiveschemes.Thisintuitionfollowsfromthedomi-nanceofrandomizedresponseinthesingle-partysetting,thatwasprovedusingapowerfulopera-tionalinterpretationofdifferentialprivacy\ufb01rstintroducedin[34].Thisintuitioncaninfactbemaderigorous,asweshowinSection7(ofoursupplementalmaterial)withasimpletwo-partyexample.However,wewanttoemphasizethatourmainresultformulti-partycomputationdoesnotfollowfromanyexistinganalysisofrandomizedresponses,inparticularthoseseeminglysimilaranalysesin[26].Thechallengeisinprovingthatinteractiondoesnothelp,whichrequiresthetechnologicalinnovationspresentedinthispaper.Multi-partyXORcomputation.Foragivenfunctionandagivenaccuracymeasure,analyzingtheperformanceoftheoptimalprotocolprovidestheexactnatureoftheprivacy-accuracytradeoff.ConsiderascenariowhereacentralobserverwantstocomputetheXORofallthek-bits,eachofwhichis\u03bb-differentiallyprivate.Inthisspecialcase,wecanapplyourmaintheoremtoanalyzetheaccuracyexactlyinacombinatorialform,andweprovideaproofinSectionA.1.Corollary3.1Considerk-partycomputationforf0(x)=x1\u2295\u00b7\u00b7\u00b7\u2295xk,andtheaccuracymeasureisoneifcorrectandzeroifnot,i.e.w0(0,0)=w0(1,1)=1andw0(0,1)=w0(1,0)=0.Forany{\u03bb}-differentiallyprivateprotocolPandanydecisionrule\u02c6f,theaverageandworst-caseaccuraciesareboundedbyACCave(P,w0,f0,\u02c6f0)\u2264Pbk/2ci=0(cid:0)k2i(cid:1)\u03bbk\u22122i(1+\u03bb)k,ACCwc(P,w0,f0\u02c6f0)\u2264Pbk/2ci=0(cid:0)k2i(cid:1)\u03bbk\u22122i(1+\u03bb)k,andtheequalityisachievedbytherandomizedresponseandoptimaldecisionrulesin(5)and(6).TheoptimaldecisionforbothaccuraciesissimplytooutputtheXORofthereceivedprivatizedbits.Thisisastrictgeneralizationofasimilarresultin[22],whereXORcomputationwasstudiedbutonlyforatwo-partysetting.Inthehighprivacyregime,where\u03b5\u20190(equivalently\u03bb=e\u03b5\u20191),thisimpliesthatACCave=0.5+2\u2212(k+1)\u03b5k+O(\u03b5k+1).TheleadingtermisduetothefactthatweareconsideringanaccuracymeasureofaBooleanfunction.Thesecondtermof2\u2212(k+1)\u03b5kcapturestheeffectthat,weareessentiallyobservingtheXORthroughkconsecutivebinarysymmetricchannelswith\ufb02ippingprobability\u03bb/(1+\u03bb).Hence,theaccuracygetsexponentiallyworseink.Ontheotherhand,ifthosek-partiesareallowedtocollaborate,thentheycancomputetheXORinadvanceandonlytransmittheprivatizedversionoftheXOR,achievingaccuracyof\u03bb/(1+\u03bb)=0.5+(1/4)\u03b52+O(\u03b53).Thisisalwaysbetterthannotcollaborating,whichistheboundinCorollary3.1.4DiscussionInthissection,wediscussafewtopics,eachofwhichisinterestingbutnon-trivialtosolveinanyobviousway.Ourmainresultisgeneralandsharp,butwewanttoaskhowtopushitfurther.Generalizationtomultiplebits.Wheneachpartyownsmultiplebits,itispossiblethatinterac-tiveprotocolsimproveovertherandomizedresponseprotocol.ThisisdiscussedwithexamplesinSection8(inthesupplementarymaterial).Approximatedifferentialprivacy.Acommongeneralizationofdifferentialprivacy,knownastheapproximatedifferentialprivacy,istoallowasmallslackof\u03b4\u22650intheprivacycondition[14,15].Inthemulti-partycontext,aprotocolPis(\u03b5i,\u03b4i)-differentiallyprivateforthei-thpartyifforalli\u2208[k],andallxi,x0i\u2208{0,1},x\u2212i\u2208{0,1}k\u22121,andforallsubsetT\u2286T,P(\u03c4\u2208T|xi,x\u2212i)\u2264e\u03b5iP(\u03c4\u2208T|x0i,x\u2212i)+\u03b4i.(12)7\fItisnaturaltoaskifthelinearprogramming(LP)approachpresentedinthispapercanbeextendedtoidentifytheoptimalmulti-partyprotocolunder{(\u03b5i,\u03b4i)}-differentialprivacy.TheLPformulationsof(17)and(20)heavilyrelyonthefactthatanydifferentiallyprivateprotocolPcanbedecomposedasthecombinationofthematrixSandthe\u03b8(y)\u2019s.SincethedifferentialprivacyconstraintsareinvariantunderscalingofP(y)\u03c4,onecanrepresentthescale-freepatternofthedistributionwithS\u03c4andthescalingwith\u03b8(y)\u03c4.Thisisnolongertruefor{(\u03b5i,\u03b4i)}-differentialprivacy,andtheanalysistechniquedoesnotgeneralize.Correlatedsources.Whenthedataxi\u2019sarecorrelated(e.g.eachpartyobserveanoisyversionofthestateoftheworld),knowingxirevealssomeinformationonotherparties\u2019bits.Ingeneral,revealingcorrelateddatarequirescarefulcoordinationbetweenmultipleparties.Theanalysistech-niquesdevelopedinthispaperdonotgeneralizetocorrelateddata,sincethecrucialrank-onetensorstructureofS(y)\u03c4isnolongerpresent.Extensionstogeneralutilityfunctions.Asurprisingaspectofthemainresultisthateventhoughtheworst-caseaccuracyisaconcavefunctionovertheprotocolP,themaximumisachievedatanextremalpointofthemanifoldofrank-1tensors.Thissuggeststhatthereisadeepergeometricstructureoftheproblem,leadingtopossibleuniversaloptimalityoftherandomizedresponseforabroaderclassofutilityfunctions.Itisaninterestingtasktounderstandthegeometricstructureoftheproblem,andtoaskwhatclassofutilityfunctionsleadtooptimalityoftherandomizedresponse.AcknowledgementThisresearchissupportedinpartbyNSFCISEawardCCF-1422278,NSFSaTCawardCNS-1527754,NSFCMMIawardMES-1450848andNSFENGawardECCS-1232257.References[1]EmmanuelAbbe,AmirKhandani,andWAndrew.Lo.2011.privacy-preservingmethodsforsharing\ufb01nancialriskexposures..TheAmericanEconomicReview,102:65\u201370.[2]AmosBeimel,KobbiNissim,andEranOmri.Distributedprivatedataanalysis:Simultaneouslysolvinghowandwhat.InAdvancesinCryptology\u2013CRYPTO2008,pages451\u2013468.Springer,2008.[3]MichaelBen-Or,Sha\ufb01Goldwasser,andAviWigderson.Completenesstheoremsfornon-cryptographicfault-tolerantdistributedcomputation.InProceedingsofthetwentiethannualACMsymposiumonTheoryofcomputing,pages1\u201310.ACM,1988.[4]D.Blackwell.Equivalentcomparisonsofexperiments.Theannalsofmathematicalstatistics,24(2):265\u2013272,1953.[5]A.Blum,C.Dwork,F.McSherry,andK.Nissim.Practicalprivacy:thesulqframework.InProceedingsofthetwenty-fourthsymposiumonPrinciplesofdatabasesystems,pages128\u2013138.ACM,2005.[6]H.BrennerandK.Nissim.Impossibilityofdifferentiallyprivateuniversallyoptimalmechanisms.InFoundationsofComputerScience,201051stAnnualIEEESymposiumon,pages71\u201380.IEEE,2010.[7]J.A.Calandrino,A.Kilzer,A.Narayanan,E.W.Felten,andV.Shmatikov.\u201dyoumightalsolike:\u201dprivacyrisksofcollaborative\ufb01ltering.InSecurityandPrivacy(SP),2011IEEESymposiumon,pages231\u2013246.IEEE,2011.[8]K.Chaudhuri,A.Sarwate,andK.Sinha.Near-optimaldifferentiallyprivateprincipalcomponents.InAdvancesinNeuralInformationProcessingSystems,pages989\u2013997,2012.[9]K.Chaudhuri,A.D.Sarwate,andK.Sinha.Anear-optimalalgorithmfordifferentially-privateprincipalcomponents.JournalofMachineLearningResearch,14:2905\u20132943,2013.[10]KamalikaChaudhuri,ClaireMonteleoni,andAnandDSarwate.Differentiallyprivateempiricalriskminimization.TheJournalofMachineLearningResearch,12:1069\u20131109,2011.[11]DavidChaum,ClaudeCr\u00b4epeau,andIvanDamgard.Multipartyunconditionallysecureprotocols.InProceedingsofthetwentiethannualACMsymposiumonTheoryofcomputing,pages11\u201319.ACM,1988.[12]T.M.CoverandJ.A.Thomas.Elementsofinformationtheory.JohnWiley&Sons,2012.[13]J.C.Duchi,M.I.Jordan,andM.J.Wainwright.Localprivacyandstatisticalminimaxrates.InFoun-dationsofComputerScience(FOCS),2013IEEE54thAnnualSymposiumon,pages429\u2013438.IEEE,2013.8\f[14]C.Dwork.Differentialprivacy.InAutomata,languagesandprogramming,pages1\u201312.Springer,2006.[15]C.Dwork,F.McSherry,K.Nissim,andA.Smith.Calibratingnoisetosensitivityinprivatedataanalysis.InTheoryofCryptography,pages265\u2013284.Springer,2006.[16]CynthiaDwork.Differentialprivacy:Asurveyofresults.InTheoryandApplicationsofModelsofComputation,pages1\u201319.Springer,2008.[17]CynthiaDwork,KrishnaramKenthapadi,FrankMcSherry,IlyaMironov,andMoniNaor.Ourdata,ourselves:Privacyviadistributednoisegeneration.InAdvancesinCryptology-EUROCRYPT2006,pages486\u2013503.Springer,2006.[18]QuanGengandPramodViswanath.Theoptimalmechanismindifferentialprivacy.arXivpreprintarXiv:1212.1186,2012.[19]QuanGengandPramodViswanath.Theoptimalmechanismindifferentialprivacy:Multidimensionalsetting.arXivpreprintarXiv:1312.0655,2013.[20]A.Ghosh,T.Roughgarden,andM.Sundararajan.Universallyutility-maximizingprivacymechanisms.SIAMJournalonComputing,41(6):1673\u20131693,2012.[21]O.Goldreich,S.Micali,andA.Wigderson.Howtoplayanymentalgame.InProceedingsoftheNineteenthAnnualACMSymposiumonTheoryofComputing,STOC\u201987,pages218\u2013229,NewYork,NY,USA,1987.ACM.[22]V.Goyal,I.Mironov,O.Pandey,andA.Sahai.Accuracy-privacytradeoffsfortwo-partydifferentiallyprivateprotocols.InAdvancesinCryptology\u2013CRYPTO2013,pages298\u2013315.Springer,2013.[23]MangeshGupteandMukundSundararajan.Universallyoptimalprivacymechanismsforminimaxagents.InProceedingsofthetwenty-ninthACMSIGMOD-SIGACT-SIGARTsymposiumonPrinciplesofdatabasesystems,pages135\u2013146.ACM,2010.[24]M.HardtandA.Roth.Beatingrandomizedresponseonincoherentmatrices.InProceedingsoftheforty-fourthannualACMsymposiumonTheoryofcomputing,pages1255\u20131268.ACM,2012.[25]N.Homer,S.Szelinger,M.Redman,D.Duggan,W.Tembe,J.Muehling,J.V.Pearson,D.A.Stephan,S.F.Nelson,andD.W.Craig.Resolvingindividualscontributingtraceamountsofdnatohighlycomplexmixturesusinghigh-densitysnpgenotypingmicroarrays.PLoSgenetics,4(8):e1000167,2008.[26]P.Kairouz,S.Oh,andP.Viswanath.Extremalmechanismsforlocaldifferentialprivacy.InAdvancesinneuralinformationprocessingsystems,2014.[27]M.KapralovandK.Talwar.Ondifferentiallyprivatelowrankapproximation.InProceedingsoftheTwenty-FourthAnnualACM-SIAMSymposiumonDiscreteAlgorithms,pages1395\u20131414.SIAM,2013.[28]ShivaPrasadKasiviswanathan,HominKLee,KobbiNissim,SofyaRaskhodnikova,andAdamSmith.Whatcanwelearnprivately?SIAMJournalonComputing,40(3):793\u2013826,2011.[29]JoeKilian.Moregeneralcompletenesstheoremsforsecuretwo-partycomputation.InProceedingsofthethirty-secondannualACMsymposiumonTheoryofcomputing,pages316\u2013324.ACM,2000.[30]R.K\u00a8unzler,J.M\u00a8uller-Quade,andD.Raub.Securecomputabilityoffunctionsintheitsettingwithdishonestmajorityandapplicationstolong-termsecurity.InTheoryofCryptography,pages238\u2013255.Springer,2009.[31]AndrewMcGregor,IlyaMironov,ToniannPitassi,OmerReingold,KunalTalwar,andSalilVadhan.Thelimitsoftwo-partydifferentialprivacy.InFoundationsofComputerScience(FOCS),201051stAnnualIEEESymposiumon,pages81\u201390.IEEE,2010.[32]F.McSherryandK.Talwar.Mechanismdesignviadifferentialprivacy.InFoundationsofComputerScience,2007.FOCS\u201907.48thAnnualIEEESymposiumon,pages94\u2013103.IEEE,2007.[33]A.NarayananandV.Shmatikov.Robustde-anonymizationoflargesparsedatasets.InSecurityandPrivacy,2008.SP2008.IEEESymposiumon,pages111\u2013125.IEEE,2008.[34]SewoongOhandPramodViswanath.Thecompositiontheoremfordifferentialprivacy.arXivpreprintarXiv:1311.0776,2013.[35]ManojMPrabhakaranandVinodMPrabhakaran.Onsecuremultipartysamplingformorethantwoparties.InInformationTheoryWorkshop(ITW),2012IEEE,pages99\u2013103.IEEE,2012.[36]BenjaminRecht,MaryamFazel,andPabloAParrilo.Guaranteedminimum-ranksolutionsoflinearmatrixequationsvianuclearnormminimization.SIAMreview,52(3):471\u2013501,2010.[37]L.Sweeney.Simpledemographicsoftenidentifypeopleuniquely.Health,671:1\u201334,2000.[38]S.L.Warner.Randomizedresponse:Asurveytechniqueforeliminatingevasiveanswerbias.JournaloftheAmericanStatisticalAssociation,60(309):63\u201369,1965.[39]AndrewCYao.Protocolsforsecurecomputations.In2013IEEE54thAnnualSymposiumonFoundationsofComputerScience,pages160\u2013164.IEEE,1982.9\f", "award": [], "sourceid": 1212, "authors": [{"given_name": "Peter", "family_name": "Kairouz", "institution": "UIUC"}, {"given_name": "Sewoong", "family_name": "Oh", "institution": "UIUC"}, {"given_name": "Pramod", "family_name": "Viswanath", "institution": "UIUC"}]}