Online Local Differential Private Quantile Inference via Self-normalization

The concept of DP only imposes constraints on the output distribution of an algorithm $\mathcal{A}$, rather than placing restrictions on the credibility of the entity running the algorithm or protecting the internal states of $\mathcal{A}$. The existence of the curator who has access to the raw data set is why this approach is known as ”Central” DP. The curator simplifies the algorithm design and often leads to an asymptotically negligible loss of accuracy from privacy protection (Cai et al., 2021).

Despite the varying definitions of LDP due to the level of interactions, all of them depend on the following concept called $(\epsilon,\delta)$-randomizer.

The definition of randomizer is mathematically a special case of the central DP. The main difference between the central and local DP is the role of the curator, which is further determined by the level of interactions allowed. In LDP, the curator coordinates interactions between $n$ users, each of whom holds their own private information $X_{i}$. In each round of interaction, the curator selects a user and assigns them a randomizer $R_{t}$. If the $(\epsilon,\delta)$ parameters are allowed by the experiment setting, the user will run the randomizer on their private information and release the output to the curator.

The level of interactions can vary from full-interactive, where the curator can choose the randomizer and the next user based on all previous interactions, to sequential (also called one-shot) interactive, where the curator is not allowed to pick one user twice but is still able to adaptively picking the next the user-randomizer pairs based on all previous interactions, to non-interactive, where adaptivity is forbidden, and all user-randomizer pairs must be determined before any information is collected. If the curator is further forbidden from varying the randomizer $R$ and tracking back outputs to a specific user, it will lead to another interesting setting called shuffle-DP (Cheu et al., 2019).

In this paper, we employ the following notations. $\mathbf{1}_{\left\{\cdot\right\}}$ is the indicator function and $[a]$ denotes the largest integer that does not exceed $a$. $\mathcal{O}$ (or ${\scriptstyle{\mathcal{O}}}$) denotes a sequence of real numbers of a certain order. For instance, ${\scriptstyle{\mathcal{O}}}(n^{-1/2})$ means a smaller order than $n^{-1/2}$, and by $\mathcal{O}_{a.s.}$ (or ${\scriptstyle{\mathcal{O}}}_{a.s.}$) almost surely $\mathcal{O}$ (or ${\scriptstyle{\mathcal{O}}}$). For sequences $a_{n}$ and $b_{n}$, denote $a_{n}\asymp b_{n}$ if there exist positive contants $c$ and $C$ such that $cb_{n}\leq a_{n}\leq Cb_{n}$. The symbol $\xrightarrow{d}$ means weak convergence or converge in distribution.

Let $x_{1},\dots,x_{n},\dots$ be independently and identically distributed(i.i.d.) random variables defined on $\mathbb{R}$ representing private information of each user, with target quantile $\tau$ and corresponding true value $Q$, i.e., $\mathbb{P}(x_{i}\leq Q)=\tau$. To ensure the uniqueness of quantiles, we assume the $x_{i}$’s are continuous random variables, with positive density on the target quantile. In practice, we can perturb the data by a small amount of additive data-independent noise to remove atoms in the distribution as is in (Gillenwater et al., 2021).

The design of the local randomizer is crucial for LDP mechanisms as it must properly choose the inquiry to the user in order to maximize the gathering of information related to the estimation of the target quantile without violating privacy conditions. The population quantiles can be considered as a minimizer of the check loss function:

In the non-DP case, a known solution is the use of stochastic gradient descent, as outlined in (Joseph & Bhatnagar, 2015). It is important to note that for each point, the gradient it contributes is purely determined by the binary variable representing whether the value is greater than $\theta$ or not. This motivates us to modify the stochastic gradient descent process by adding a local randomization process, resulting in the Algorithm 1 and 2 outlined below:

In Algorithm 1, generating randomness of $v$ before the if-condition fork may seem wasteful, but it prevents side-channel attacks such as inferring the true value based on the timing of response (Coppens et al., 2009; Lawson, 2009). Algorithm 2 collects random responses and generates the next inquiry accordingly. Therefore, Algorithm 2 satisfies the definition of sequential interactive local DP.

The following algorithm can be used when estimations and confidence intervals are required. These values are not calculated at every step to minimize computational expenses.

The use of dichotomous inquiry in data privacy brings multiple advantages. One benefit is the reduced communication cost, as it only takes one bit to respond. Additionally, the binary response can make full use of the DP budget, as opposed to methods such as the Laplace mechanism, which may provide unnecessary privacy guarantees beyond $\epsilon$-DP, as outlined in Theorem 3 in (Balle et al., 2018) and Theorem 2.1 in (Liu et al., 2022).

Furthermore, people tend to be more comfortable answering dichotomous questions compared to open-ended ones (Brown et al., 1996) as they present a choice between two options and may be perceived as less threatening than open-ended questions, which require more detailed and nuanced responses. In addition, the binary approach is easy to understand for users. With the proper choice of truthful response rate $r$, the algorithm known as the random response can be easily simulated through coin flips or dice rolls, allowing users to understand it fully and are able to ”run” it without the help of electronic devices. This is in contrast to a DP mechanism involving the usage of random distribution on real numbers. Due to the finite nature of the computer, the imperfection of floating-point arithmetic leads to serious risks with effective exploits. For more information, please refer to (Mironov, 2012; Jin et al., 2021; Haney et al., 2022).

Before discussing the specific characteristics of our estimator, we will first demonstrate its performance through a sample trajectory. The experiment is conducted with a truthful response rate with $r=0.5$, which means half of the responses are purely random. The objective is to estimate the median from i.i.d. samples. The true underlying distribution is a standard normal distribution.

It can be seen that from Figure 1, the proposed estimator converges to the true value, and both infeasible and proposed confidence intervals, defined later, contain the true value at a slightly larger sample size. Also, the proposed confidence intervals are highly competitive with the infeasible one in width. Refer to Figure 5 and 6 for convergence trajectories under different initialization or target quantiles.

Next, we show the LDP property of our algorithm:

The algorithm presented in Algorithm 2 adaptively selects the next randomizer, determined by the parameter $q$ in Algorithm 1, based on its internal state $q_{n}$. However, it never revisits previous users. As a result, Algorithm 2 satisfies sequential interactive $(\epsilon,0)$-LDP, where $\epsilon=\log\left((1+r)/(1-r)\right)$ (equivalently, $r=(e^{\epsilon}-1)/(e^{\epsilon}+1)=\tanh\left(\epsilon/2\right)$).

Throughout the remainder of this paper, we will use the truthful response rate $r$ to represent the privacy budget, as opposed to the more standard $\epsilon$. This choice is made for the following reasons:

In the context of LDP, it is crucial to ensure understanding and acceptance by end-users who may not possess expertise in the field. The truthful response rate, denoted by $r$, has a more intuitive interpretation. Additionally, $r$ appears in multiple results presented in this paper, and maintaining this form allows for a more direct presentation. If necessary, the results can be easily converted by replacing all instances of $r$ with $\tanh\left(\frac{\epsilon}{2}\right)$. For a conversion table, please refer to Table 5.

To discuss the asymptotic properties of estimator $Q_{n}$, we rewrite it as a recursive equation. Let $\{U_{n}\}$ and $\{V_{n}\}$ be the i.i.d. Bernoulli sequences with

For $q_{0}\in\mathbb{R}$,

where the step size $\{d_{n}\}_{n=1}^{\infty}$ , satisfies

The step size $d_{n}$ is vital for the convergence of $q_{n}$, but it has a relatively minor effect on $Q_{n}$. The following theorem guarantees consistency:

In particular, if $d_{n}\asymp a/n^{\beta}$, for some constant $a>0$ and $\beta\in(1/2,1)$, then $\gamma_{n}\asymp n^{\gamma}$ for some $\gamma<\beta-1/2$, and for the sake of simplicity, we will set the step sizes as $d_{n}\asymp a/n^{\beta}$.

Next, the asymptotic normality will be discussed.

Noticed that the conditions on $\beta$ in Theorem 3.2 and Theorem 3.3 are different. It is possible that $q_{n}$ fails to converge to $Q$, but $Q_{n}$ still enjoys asymptotic normality. Following Theorem 3.3, one constructs the confidence interval of $Q$, if $f_{X}(Q)$ can be obtained or estimated by $\widehat{f_{X}(Q)}$. Denote $z_{1-\alpha}$ as the upper $\alpha-$quantile of standard normal distribution. The infeasible confidence interval with significance level $\alpha$ is:

However, obtaining a consistent estimator $\widehat{f_{X}(Q)}$, such as using non-parametric methods under our differential privacy framework, is not straightforward, since we can only obtain the binary sequence $\mathbf{1}_{x_{n}>q_{n-1}}$ for protecting privacy, and the original data set $x_{1},\dots,x_{n}$ cannot be accessed directly.

An alternative approach to estimate the nuisance parameter $f_{X}(Q)$ is through the use of bootstrap methods to simulate the asymptotic distribution. Traditional bootstrap methods that rely on re-sampling are not suitable for the stochastic gradient descent method because of failing to recover the special dependence structure defined in (1).

Recently, (Fang et al., 2018) proposed online bootstrap confidence intervals for stochastic gradient descent, which involve recursively updating randomly perturbed stochastic estimates. Although this approach performs well when there are no constraints on DP, it requires multiple interactions with the users and will therefore blow up the privacy budget.

To overcome the difficulties above, we propose a novel inference procedure of quantiles under the LDP framework via self-normalization, which will avoid estimating the nuisance parameter $f_{X}(Q)$. We hope to construct an estimator that is proportional to the nuisance parameters. To approach that, we will first establish further theoretical properties of the proposed estimator $Q_{n}$. Define the process $S_{[nt]}=\sum_{i=1}^{[nt]}q_{i}$, $t\in[0,1]$.

Noticed that Theorem 3.3 is the special case in Theorem 3.4 when $t=1$. Then, following Theorem 3.4, we define the self-normalizer:

By the continuous mapping theorem, we can derive:

where the asymptotical distribution $\mathcal{S}$ is not associated with any unknown parameters, and its quantile can be computed by Monte Carlo simulation. Therefore, we have constructed an asymptotical pivotal quantity. Denote $\mathcal{U}_{1-\alpha}$ the $1-\alpha$ quantile of $\mathcal{S}$, the $1-\alpha$ self-normalized confidence interval of $Q$ is constructed by:

As noted by (Shao, 2015), the distribution of $\mathcal{S}$ has a heavier tail than that of the standard normal distribution, which is analogous to the heavier tail of $t-$distribution compared to the standard normal distribution, resulting in a wider but not conservative corresponding confidence interval. However, the average width of the confidence interval constructed through self-normalization is not excessively large when compared to the infeasible confidence interval, as demonstrated by numerical experiments in Figure 1. Furthermore, the construction of an asymptotic pivotal quantity is not unique. See Appendix B for examples of other possibilities.

Whether there are theoretical advantages between the different constructions of self-normalizer is still open to discussion, but according to (Lee et al., 2022), the proposed self-normalizer can be computed in a fully online fashion and is computationally efficient, as outlined in Algorithm 2 and 3. The algorithm only needs to store a single integer $n$ and four float numbers: $v_{n}^{a},v_{n}^{b},q_{n},Q_{n}$ and conduct only a dozen of arithmetic operations.

In this subsection, we will discuss the optimality of the proposed algorithm. To generalize the setting, we consider all binary random response-based sequential interactive mechanisms. The random response mechanism can be written as the following $K:\{0,1\}\rightarrow\{0,1\}$:

Let $\{T_{1},\cdots,T_{n}\}$ be a collection of binary query functions, which means $T_{i}(x)=\mathbf{1}_{x\in C_{i}}$, for some subset $C\subset\mathbb{R}$. In the sequential interactive LDP setting, the curator will generate its output based on the transcript $\{\{K\circ T_{1}(x_{1}),\cdots,K\circ T_{n}(x_{n})\},\{C_{1},\cdots,C_{n}\}\}$ and the choice of $C_{i}$ may depend on the transcript up to this point:$\{\{K\circ T_{1}(x_{1}),\cdots,K\circ T_{i-1}(x_{i-1})\},\{C_{1},\cdots,C_{i-1}\}\}$. Notice that the Algorithm 1 is a special case where $C_{i}=\{z:z\geq q_{i-1}\}$, and $q_{i-1}$ is given by

We aim to determine a lower bound for the estimation variance. Therefore, any lower bounds derived under specific conditions also serve as a general lower bound for the estimation variance. To demonstrate this, we will present a pair of distributions with distinct medians that are, to the best of our knowledge, the most indistinguishable given randomized binary queries.

Define:

Let $\epsilon=\log\left[(e^{\frac{1}{\sqrt{n}}}(r+1)+r-1)/(e^{\frac{1}{\sqrt{n}}}(r-1)+r+1)\right]$. Simple computation yields that for any $(a,b)\in\{0,1\}^{2}$

Interestingly, if we consider the truth $H\in\{H_{0},H_{1}\}$ as a data set containing only one data point, (5) shows that $K\circ T_{i}$ is $1/\sqrt{n}$-DP. Notice that the transcript is a $n$-fold adaptive composition (Kairouz et al., 2015) of $1/\sqrt{n}$-DP mechanisms. By Theorem 8 (Dong et al., 2021a), the transcript and all post-processing of it (Proposition 4; (Dong et al., 2021a)) asymptotically satisfies the Gaussian Differential Privacy condition with $\mu=1$ (or briefly $1$-GDP).

We will now examine the limit on the best possible variance imposed by the $1$-GDP condition. Denote the estimator of median as $\hat{\theta}_{n}$. First, we will consider asymptotically normal, unbiased, shift-invariant estimators of the median. By restricting our discussion to unbiased, shift-invariant estimators, we ensure that no estimator has an unfair advantage by favoring specific values. Under the null hypothesis, for the standard deviation $\sigma_{n}$ of $\hat{\theta}_{n}$, one has that

and under the alternative hypothesis,

The $1$-GDP condition implies that for sufficiently large $n$, $\epsilon_{n}/\sigma_{n}\leq 1$ ( see Appendix C.3). By plugging in the values $\epsilon_{n}=(r\sqrt{n})^{-1}+\mathcal{O}(n^{-3/2})$ and $1/2=f(F^{-1}(1/2))$, we deduce that:

which gives us an asymptotic lower bound of the variance: $(4r^{2}nf^{2}(F^{-1}(1/2)))^{-1}$. This lower bound matches the asymptotic variance obtained in Theorem 3.3, showing the optimality of our approach. Although most estimators we are interested in have an asymptotically normal distribution, we wish to generalize the minimal variance result to other families as the theorem below.

The minimal variance result can be attributed to two factors. In Appendix C.3, we demonstrate that asymptotic GDP imposes a condition on the variance of estimators that follow a normal distribution. This condition serves as a lower bound for $1$-GDP estimators, without relying on any specific mechanism assumption. Secondly, the relaxation from the assumption of normality to milder conditions on the function $G$ is a consequence of Theorem 1.2 in (Dong et al., 2021b). This theorem establishes that among all $\mu$-GDP estimators satisfying the aforementioned conditions, the variance is lower bounded by $1/\mu^{2}$. This lower bound is attainable when the underlying distribution is normal.