Online differentially private inference in stochastic gradient descent

Online learning involves methods and algorithms designed for making timely inferences and predictions in a real-time environment, where data are collected sequentially rather than being static as in traditional batch learning. By not requiring the simultaneous use of the entire sample pool, online learning alleviates both storage and computation pressures. To date, various statistical methods and algorithms for online estimation and inference have been proposed, including aggregated estimating equations (Lin and Xi, 2011), cumulative estimating equation (Schifano et al., 2016), renewable estimator (Luo and Song, 2020), and stochastic gradient descent (SGD) (Robbins and Monro, 1951; Polyak and Juditsky, 1992; Chen et al., 2020). Alongside online learning, another crucial consideration is the preservation of privacy, especially with the growing availability of streaming data. For example, financial institutions, such as banks and credit card companies, often leverage customer-level data for fraud detection and personalized service offerings, which need to continuously update and refine their models in real-time as new transaction data are collected. This aids not only in monitoring transactions to detect unusual activities but also in designing targeted financial products and promotions (e.g., offering personalized loan rates or credit card rewards based on individual spending patterns); see Maniar et al. (2021); Davidow et al. (2023). However, individual customer data are usually sensitive and irreplaceable, and it is of great importance to prevent the leak of personal information to maintain customer trust and confidence, as well as to help businesses avoid financial losses and reputational damage (Hu et al., 2022; Fainmesser et al., 2023).

In response to the increasing demand for data privacy protection, differential privacy (DP) has emerged as a widely adopted concept (Dwork et al., 2006). It has been successfully applied in numerous fields, including healthcare, financial services, retail, and e-commerce (Dankar and El Emam, 2013; Zhong, 2019; Wang and Tsai, 2022). DP procedures ensure that an adversary cannot determine whether a particular subject is included in the dataset with high probability, thereby providing robust protection for personal information. In the literature, two main models have emerged for DP: the central model, where a trusted third party collects and analyzes data before releasing privatized results, and the local model, where data is randomized before sharing. Several works have focused on designing private algorithms to guarantee DP under the trusted central server setting across various applications, including, but not limited to, machine learning, synthetic data generation, and transfer learning; see Karwa and Slavković (2016); Ponomareva et al. (2023); Li et al. (2024). A significant limitation of the standard central model is the assumption of a trusted data curator with access to the entire dataset. However, in scenarios such as smartphone usage, users may not fully trust the server and prefer not to have their personal information directly stored or updated on any remote central server. In contrast to the central DP, user-level local differential privacy (LDP) does not rely on a trusted data collector, placing the privacy barrier closer to the users, which has seen adoption in practice by several companies that analyze sensitive user data, including Apple (Tang et al., 2017), Google (Erlingsson et al., 2014), and Microsoft (Ding et al., 2017). Recently, there has been growing interest in studying LDP from a statistical perspective, including density estimation (Sart, 2023), mean and median estimation (Duchi et al., 2018), nonparametric estimation problems (Rohde and Steinberger, 2020), and change-point detection (Berrett and Yu, 2021).

The aforementioned methods mainly address the inherent trade-off between privacy protection and efficient statistical inference, focusing on identifying what optimal privacy-preserving mechanisms may look like. The literature on private inference, particularly in quantifying the uncertainty of private estimators, is relatively limited even in offline settings and has recently gained attention in computer science (Karwa and Vadhan, 2018; Wang et al., 2019; Chadha et al., 2021). This issue has also been studied in the statistical literature. Sheffet (2017) provided finite-sample analyses of conservative inference for confidence intervals regarding the coefficients from the least-squares regression. Barrientos et al. (2019) presented algorithms for comparing the sign and significance level of privately computed regression coefficients that satisfy DP. Avella-Medina (2021) introduced the M-estimator approach to conduct DP statistical inference using smooth sensitivity. Alabi and Vadhan (2023) proposed DP hypothesis tests for the multivariate linear regression model. Avella-Medina et al. (2023) investigated optimization-based approaches for Gaussian differentially private M-estimators. Zhao et al. (2024) extended this to objective functions without local strong convexity and smoothness assumptions. Zhang et al. (2024) considered estimation and inference problems in the federated learning setting under DP. Despite these efforts, a significant gap remains in developing a statistically sound approach for conducting statistical inference, such as constructing confidence intervals based on private estimators, particularly in the online setting, where theoretical results for statistical inference are largely lacking. Recently, Liu et al. (2023) proposed a self-normalizing approach to obtain confidence intervals for population quantiles with privacy concerns. However, this method is specifically tailored to population quantiles.

In this paper, we introduce a rigorous LDP framework for online estimation and inference in optimization-based regression problems with streaming data, addressing the challenge of constructing valid confidence intervals for online private inference. Specifically, we propose a fully online, locally private framework for real-time estimation and inference without requiring trusted data collectors. To the best of our knowledge, this is the first time in the literature on online inference problems where the issue of privacy is systematically investigated. The main contributions of this paper are summarized as follows:

1. 1.

   To eliminate the need for trusted data collectors, we design a local differential privacy stochastic gradient descent algorithm (LDP-SGD) for streaming data that requires only one pass over the data. Unlike prior works, our algorithm provides rigorous individual-level data privacy protection in an online manner. Meanwhile, we propose two online private statistical inference procedures. One is to conduct a private plug-in estimator of the asymptotic covariance matrix. The other is the random scaling procedure, bypasses direct estimation of the asymptotic variance by constructing an asymptotically pivotal statistic for valid private inference in real time.

2. 2.

   From a theoretical standpoint, we establish the convergence rates of the proposed online private estimators. In addition, we prove a functional central limit theorem to capture the asymptotic behavior of the whole LDP-SGD path, thereby providing an asymptotically pivotal statistic for valid private inference. These results lay a solid foundation for real-time private decision-making, supported by theoretical guarantees.

3. 3.

   We conduct numerical experiments with simulated data to evaluate the performance of the proposed procedure in various settings, including varying cumulative sample size, different privacy budgets, and various models. Our findings indicate that the proposed procedure is computationally efficient, provides robust privacy guarantees, and significantly reduces data storage costs, all while maintaining high accuracy in estimation and inference. In addition, we apply the proposed method to the the ride-sharing data and the US insurance data to demonstrate how the method can be useful in practice.

The rest of this paper is organized as follows. In Section 2.1, we introduce the key properties of DP. Section 2.2 outlines the problem formulation. In Section 3, we propose our LDP-SGD algorithm and provide its convergence rates. In Section 4, we establish a functional central limit theorem and introduce two online private inference methods: the private plug-in estimator and the random scaling method to construct asymptotically valid private confidence intervals. We evaluate the performance of the proposed procedure through simulation studies in Section 5. In Section 6, we apply the proposed method on two real-world datasets: the Ride-Sharing Data and the US Insurance Data. Ride-sharing data provides fare-related information over time, enabling analysis of market pricing dynamics in the ride-sharing industry. The US Insurance Data includes detailed personal and family information for one million clients, along with their associated insurance fees, offering valuable insights into insurance fee prediction. Discussions are provided in Section 7. Some basic concepts of DP, the detailed description of private batch-means estimator, additional numerical results, and technical details are included in the Supplementary Material.

In this section, we provide some preliminaries. To facilitate understanding, we first introduce the notations used throughout this paper. Let $\stackrel{{\scriptstyle D}}{{\rightarrow}}$ denote convergence in distribution. For a $p$-vector $\bm{a}=(a_{1},\ldots,a_{p})^{\top}\in\mathbb{R}^{p}$, $\|{\mbox{\boldmath${a}$}}\|_{r}=(\sum_{j=1}^{p}|a_{j}|^{r})^{1/r}$ for $r\geq 1$. Define $\Lambda_{1}(\bm{A}),\ldots,\Lambda_{p}(\bm{A})$ as the eigenvalues of a matrix $\bm{A}\in\mathbb{R}^{p\times p}$. Specifically, the largest and smallest eigenvalues are denoted by $\Lambda_{\max}(\bm{A})$ and $\Lambda_{\min}(\bm{A})$, respectively. We use $\|\bm{A}\|$ to denote the matrix operator norm of $\bm{A}$ and $\|\bm{A}\|_{\infty}$ to represent the element-wise $\ell_{\infty}$-norm of $\bm{A}$. For a square positive semi-definite matrix $\bm{D}$, we denote its trace by ${\rm tr}(\bm{D})$. For any two symmetric matrices $\bm{A}$ and $\bm{B}$ of the same dimension, $\bm{A}\preceq\bm{B}$ means that $\bm{B}-\bm{A}$ is a positive semi-definite matrix, while $\bm{A}\succeq\bm{B}$ means that $\bm{A}-\bm{B}$ is a positive semi-definite matrix. Let $\{a_{n}\}$ and $\{b_{n}\}$ be two sequences of positive numbers. Denote $a_{n}\lesssim b_{n}$ if there exists a positive constant $c_{0}$ such that $a_{j}/b_{j}\leq c_{0}$ for all $j\in\mathbb{N}^{+}$, and $a_{n}\asymp b_{n}$ if there exist positive constants $c_{1}$, $c_{2}$ such that $c_{1}\leq a_{j}/b_{j}\leq c_{2}$ for all $j\in\mathbb{N}^{+}$.

In this subsection, we introduce an LDP estimator using noisy SGD algorithms within the framework of streaming data. The heightened risk of privacy leakage arises from the numerous data and gradient queries inherent in the SGD algorithm. To facilitate our work, we impose a restriction on the class of estimators and enforce the following uniform boundedness condition.

Condition 1 is satisfied by using either Mallow’s weights (as discussed in Examples 1-3) or gradient clipping. However, as demonstrated in Song et al. (2021); Avella-Medina et al. (2023), gradient clipping is not ideal from a statistical standpoint, as it may result in inconsistent estimators. In Figure 1, we compare the performance of gradient clipping and Mallow’s weights using simulated logistic regression data. The results show that the parameter estimates from gradient clipping exhibit bias that does not shrink toward zero with the sample size, further underscoring our preference for Mallow’s weights, alongside the assumption of a bounded gradient. Meanwhile, Condition 1 implies that the loss function $\rho$ has a known bound on the gradient $\Psi(\bm{\theta},{\mbox{\boldmath${z}$}})$, which ensures that $2B_{0}$ is an upper bound for the global sensitivity of $\Psi(\bm{\theta},{\mbox{\boldmath${z}$}})$. At the $n$th iteration with observed data point ${\mbox{\boldmath${z}$}}_{n}$, $n\geq 1$, we consider the following locally private SGD estimator with the noisy version of the iterates (2.2)

where the final estimate is the averaging estimate denoted by $\bar{{\bm{\theta}}}_{n}=\sum_{i=1}^{n}\hat{\bm{\theta}}_{i}/n$ and $\{\bm{\xi}_{n}\}_{n\geq 1}$ is a sequence of i.i.d. standard $p$-dimensional Gaussian random vectors. Unlike the standard SGD algorithm, the locally private SGD algorithm introduces calibrated noise to the gradient computations at each step of the model parameter update process, ensuring rigorous privacy protection. In particular, taking $B_{0}=0$ in the iterates (2.3) recovers the standard SGD algorithm in (2.2). We call the proposed iterates in (2.3) as the LDP-SGD algorithm. The following proposition shows that our proposed LDP-SGD algorithm is $\max\{\mu_{1},\ldots,\mu_{n}\}$-GDP.

From (2.3), each individual has different privacy budgets $\mu_{n}$, $n\geq 1.$ A special case arises when the proposed estimator reduces to $\mu$-GDP with $\mu=\mu_{1}=\cdots=\mu_{n}$, thereby not considering different privacy budgets for each individual. The techniques needed to handle the cases of varing $\mu_{n}$ are the same as for the case of the common $\mu$. For simplicity, we assume that $\mu=\mu_{1}=\cdots=\mu_{n}$ for each individual.

Strong convexity and smoothness are standard conditions for the convergence analysis of (stochastic) gradient optimization methods. Similar conditions can be found in Vaswani et al. (2022); Zhu et al. (2023). Due to space limitations, several useful properties of strongly convex and smooth functions are provided in Lemma S1 of the Supplementary Material. As stated in Lemma S1, the strong convexity and smoothness of $L({\bm{\theta}})$ imply that $\Lambda_{\min}\{\nabla^{2}L({\bm{\theta}})\}\geq\lambda$ and $\Lambda_{\max}\{\nabla^{2}L({\bm{\theta}})\}\leq\zeta$, respectively.

Condition 3 is a mild requirement on the loss function. As shown in Lemma 3.1 of Chen et al. (2020), Condition 3 holds if the Hessian matrix of $\rho({\bm{\theta}},{\mbox{\boldmath${z}$}})$ is bounded by some random function $H({\mbox{\boldmath${z}$}})$ with a bounded fourth moment. Examples that satisfy this condition include the robust estimation methods for commonly used linear and logistic regressions. With the aforementioned assumptions, we now present the following error bounds on the private SGD iterates.

Theorem 1 provides simplified bounds on the conditional moments of $\hat{\delta}_{n}$, including the first, second, and fourth moments. These results characterize the convergence rate of the last-step estimator $\hat{\bm{\theta}}_{n}$. To illustrate the applicability of our proposed algorithm, we provide several examples below. Our framework, as it turns out, accommodates a wide range of important statistical models.

In this subsection, we introduce two online inference methods, distinguished by the availability of second-order information from the loss function. One is the online private plug-in approach that directly uses the Hessian information and the other is the random scaling that utilizes only the information from the path of our proposed LDP-SGD iteration in (2.3). In addition to these two methods, we also consider a private batch-means estimator that utilizes the iterations generated by the LDP-SGD algorithm to estimate the asymptotic covariance. The detailed construction of this estimator, along with a comparative discussion of its theoretical properties relative to the above two methods, is provided in the Supplementary Material.

To elucidate these methods, we first examine the asymptotic behavior of the entire LDP-SGD path rather than its simple average $\bar{\bm{\theta}}_{n}$. Specifically, we present the functional central limit theorem, which shows that the standardized partial-sum process converges in distribution to a rescaled Brownian motion.

The result derived from this theorem is stronger than the asymptotic normality of the proposed private estimator $\bar{\bm{\theta}}_{n}$ under the stated assumptions. In particular, by applying the continuous mapping theorem to Theorem 2, we are able to directly establish the following corollary.

In contrast to the covariance matrix of the non-private estimator in (2.2), the additional term $(4B_{0}^{2}/\mu^{2}){{\mbox{\boldmath${I}$}}}$ in the covariance matrix of Corollary 1 represents the “cost of privacy” for our proposed LDP-SGD algorithm.

In this section, we perform simulations to examine the finite-sample performance of the proposed algorithms, focusing on the coverage probabilities and lengths of confidence intervals. The methods under evaluation include the private plug-in (PPI), private batch-means (PBM), and private random scaling (PRS). As a benchmark, we also compute the non-private counterpart with plug-in (PI), batch-means (BM), and random scaling (RS). Due to space limitations, we only present the empirical performance of proposed algorithms under linear regression in our main manuscript. The results for logistic and robust expectile regressions are provided in the Supplementary Material.

In this simulation, we randomly generate a sequence of $n$ samples $\{(\bm{x}_{n}^{\top},y_{n})^{\top}\}_{n=1,2,\ldots}$ from the linear regression: $y_{n}=\bm{x}_{n}^{\top}\bm{\theta}_{0}+\varepsilon_{n}$, where the random noise $\varepsilon_{n}$ is i.i.d. from $\mathcal{N}\left(0,0.5^{2}\right)$ and $\bm{x}_{n}=(1,\bm{s}^{\top}_{n})^{\top}$ denotes the covariates, with $\bm{s}_{n}$ following a multivariate normal distribution $\mathcal{N}\left(\bm{0},\bm{\Sigma}\right)$ with two types of $\bm{\Sigma}$ structure, identity covariance $\bm{\Sigma}=\bm{I}_{p}$ and correlated covariance $\bm{\Sigma}=\{0.5^{|j-k|}\}_{j,k=1,\ldots,p}$. We consider a total sample size of $200,000$ arriving sequentially. For this model, the true coefficient $\bm{\theta}_{0}=({\theta}_{00},\theta_{01},\ldots,\theta_{0p})^{\top}=\bm{1}_{p+1}$ is a ($p+1$)-dimensional vector that includes the intercept term $\theta_{00}$. The corresponding loss function and its gradient sensitivity are outlined in Example 1 with a step size decay rate of $\alpha=0.51$. For the identity covariance matrix, we vary the parameter dimensions $p=3,5,10$ across different privacy budgets $\mu=1,2$. A smaller privacy budget corresponds to stronger privacy protection. In addition, we set the truncation parameter $c=1.345$ as used in the Huber loss and choose $M\asymp n^{0.25}$ for the batch-means estimators, as suggested by Chen et al. (2020). This choice aligns with the optimal order $M\asymp n^{(1-\alpha)/2}$ when $\alpha=1/2$. Specifically, we set $M=20$ in our implementation. Owing to space constraints, this section reports only the results for $p=3$. The corresponding results for $p=5$ and $p=10$ are available in the Supplementary Material. For the correlated covariance matrix, we only present results for $p=3$, as similar patterns are observed in higher dimensions, as with the identity covariance matrix case.

The performance of each method is assessed using two criteria: the average empirical coverage probability of the 95% confidence interval (CP), and the average length of the 95% confidence interval (AL). Specifically. let CI_j denote a two-side 95% confidence interval for $\theta_{0j}$, $j=1,\ldots,p$. We then calculate these two criteria across $p$ coefficients as below: