Computational Differential Privacy from Lattice-Based Cryptography

Abstract

The emerging technologies for large scale data analysis raise new challenges to the security and privacy of sensitive user data. In this work we investigate the problem of private statistical analysis of time-series data in the distributed and semi-honest setting. In particular, we study some properties of Private Stream Aggregation (PSA), first introduced by Shi et al. 2011. This is a computationally secure protocol for the collection and aggregation of data in a distributed network and has a very small communication cost. In the non-adaptive query model, a secure PSA scheme can be built upon any key-homomorphic weak pseudo-random function as shown by Valovich 2017, yielding security guarantees in the standard model which is in contrast to Shi et. al. We show that every mechanism which preserves pǫ, δq-differential privacy in effect preserves computational pǫ, δq-differential privacy when it is executed through a secure PSA scheme. Furthermore, we introduce a novel perturbation mechanism based on the symmetric Skellam distribution that is suited for preserving differential privacy in the distributed setting, and find that its performances in terms of privacy and accuracy are comparable to those of previous solutions. On the other hand, we leverage its specific properties to construct a computationally efficient prospective post-quantum protocol for differentially private time-series data analysis in the distributed model. The security of this protocol is based on the hardness of a new variant of the Decisional Learning with Errors (DLWE) problem. In this variant the errors are taken from the symmetric Skellam distribution. We show that this new variant is hard based on the hardness of the standard Learning with Errors (LWE) problem where the errors are taken from the discrete Gaussian distribution. Thus, we provide a variant of the LWE problem that is hard based on conjecturally hard lattice problems and uses a discrete error distribution that is similar to the continuous Gaussian distribution in that it is closed under convolution. A consequent feature of the constructed prospective post-quantum protocol is the use of the same noise for security and for differential privacy. ‹ This is the full version of [38].

Towards Sparse Federated Analytics: Location Heatmaps under Distributed Differential Privacy with Secure Aggregation

“…The combination of SecAgg and distributed DP in the context of federated analytics is far less studied. Indeed, the majority of existing works ignore the scalability, finite precision, and modular arithmetic challenges associated with SecAgg [36,51,53]. This is especially constraining at low SecAgg bit-widths (e.g., in settings where communication efficiency and scalability are critical).…”

The Skellam Mechanism for Differentially Private Federated Learning

“…The Skellam mechanism was first introduced in [49] for the scalar case. As our goal is to apply the Skellam mechanism in the learning context, we have to address the following challenges.…”

“…(1) Tight privacy compositions: Learning algorithms are iterative in nature and require the application of the DP mechanism many times (often > 1000). The current direct approximate DP analysis in [49] can be combined with advanced composition (AC) theorems [28,22] but that leads to poor privacy-accuracy trade-offs (see Fig. 1).…”

“…(2) Privacy analysis for multi-dimensional queries: In learning algorithms, the differentially private queries are multi-dimensional (where the dimension equals the number of model parameters, typically ≥ 10 6 ). Using composition theorems lead to poor accuracy-privacy trade-offs and a direct extension of approximate DP guarantee [49] for the multi-dimensional case leads to a strong dependence on 1 sensitivity which is prohibitively large in high dimensions. (3) Data discretization: The gradients are naturally continuous vectors but we would like to apply an integer based mechanism.…”

“…Fig. 1 shows this comparison, highlighting the competitiveness of the Skellam mechanism and the problem of combining the direct analysis of [49] with advanced composition (AC) theorems. When d > 1, there are combinatorially many Z D,D 's that need to be considered, even when the 2 sensitivity of f (D) is bounded.…”