Privately Releasing Conjunctions and the Statistical Query Barrier

Abstract

Suppose we would like to know all answers to a set of statistical queries C on a data set up to small error, but we can only access the data itself using statistical queries. A trivial solution is to exhaustively ask all queries in C. Can we do any better?1. We show that the number of statistical queries necessary and sufficient for this task is-up to polynomial factors-equal to the agnostic learning complexity of C in Kearns' statistical query (SQ) model. This gives a complete answer to the question when running time is not a concern.2. We then show that the problem can be solved efficiently (allowing arbitrary error on a small fraction of queries) whenever the answers to C can be described by a submodular function. This includes many natural concept classes, such as graph cuts and Boolean disjunctions and conjunctions.While interesting from a learning theoretic point of view, our main applications are in privacypreserving data analysis: Here, our second result leads to an algorithm that efficiently releases differentially private answers to all Boolean conjunctions with 1% average error. This presents significant progress on a key open problem in privacy-preserving data analysis. Our first result on the other hand gives unconditional lower bounds on any differentially private algorithm that admits a (potentially nonprivacy-preserving) implementation using only statistical queries. Not only our algorithms, but also most known private algorithms can be implemented using only statistical queries, and hence are constrained by these lower bounds. Our result therefore isolates the complexity of agnostic learning in the SQ-model as a new barrier in the design of differentially private algorithms.

Randomized Response Schemes, Privacy and Usefulness

“…We would like to stress that SQ-learnability is a quite influential model with rich relations to other concepts in machine learning theory like, for instance, margin complexity or evolvability [20,7]. The results in this paper (and previous ones [14,4,10]) show that these concepts are of high relevance in the field of Differential Privacy too, so as to establish a strong connection between these two fields.…”

“…The crucial question is whether one can still extract useful information fromD. This general problem is addressed by a series of prior works (see for example [4,10]), which focus on a worst-case scenario, namely asking that, for all possible choices of the database D, the answers provided by the scheme are close (in probability) to the "correct" ones. It turns out that the family of queries for which this goal can be achieved is quite limited (see Section 2.4 for further details).…”

Distributed Private Heavy Hitters

“…In this paper, we focus on the local or fully distributed model, introduced by [KLN + 08]. There has been little work in this more restrictive model-the problems of learning [KLN + 08] and query release [GHRU11] in the local model are well understood 1 , but only up to polynomial factors that do not imply tight bounds for the heavy hitters problem. The twoparty setting (which is intermediate between the centralized and fully distributed setting), in which the data is divided between two databases without a trusted central administrator, was considered by [MMP + 10].…”

The Privacy of the Analyst and the Power of the State

“…In a "second wave" of differentially private algorithms, initiated in [11] (see also [12], [13], [14], [15], [16], [17]), the responses to the different queries depend on other queries, either because the queries are handled as a batch [11], [14], [17], or because the algorithm explicitly maintains state [13], [15]. The benefit of these "second wave" algorithms is their ability to provide answers to truly huge numbers of queries, even exponential in the number of rows in the database (whereas the known stateless mechanisms can only handle up to a sub-quadratic number of queries).…”