Differentially private aggregate classifier for multiple databases

Abstract

Embodiments of the invention disclose a system and a method for determining a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, and wherein the differentially private aggregate classifier preserves the differential data privacy of each database. The differentially private aggregate classifier is a combination of the classifiers of the set of databases modified with the noise value corresponding to a smallest database in the set of databases.

Description

FIELD OF THE INVENTION

The invention relates generally to differential data privacy, and more particularly to determining a differentially private aggregate classifier for multiple databases.

BACKGROUND OF THE INVENTION

Data collection provides information for a wide variety of academic, industrial, business, and government purposes. For example, data collection is necessary for sociological studies, market research, and in a census. To maximize the utility of collected data, all data can be amassed and made available for analysis without any privacy controls. Of course, most people and organizations (“privacy principals”) are unwilling to disclose all data, especially when data are easily exchanged and could be accessed by unauthorized persons. Privacy guarantees can improve the willingness of privacy principals to contribute their data, as well as to reduce fraud, identity theft, extortion, and other problems that can arise from sharing data without adequate privacy protection.

A method for preserving privacy is to compute collective results of queries performed over collected data, and disclose such collective results without disclosing the inputs of the participating privacy principals. For example, a medical database might be queried to determine how many people in the database are HIV positive. The total number of people that are HIV positive can be disclosed without disclosing the names of the individuals that are HIV positive. Useful data are thus extracted while ostensibly preserving the privacy of the principals to some extent.

However, adversaries might apply a variety of techniques to predict or narrow down the set of individuals from the medical database who are likely to be HIV positive. For example, an adversary might run another query that asks how many people both have HIV and are not named John Smith. The adversary may then subtract the second query output from the first, and thereby learn the HIV status of John Smith without ever directly asking the database for a name of a privacy principal. With sensitive data, it is useful to provide verifiable privacy guarantees. For example, it would be useful to verifiably guarantee that nothing more can be gleaned about any specific privacy principal than was known at the outset.

Adding noise to a query output can enhance the privacy of the principals. Using the example above, some random number might be added to the disclosed number of HIV positive principals. The noise will decrease the accuracy of the disclosed output, but the corresponding gain in privacy may warrant this loss.

The concept of adding noise to a query result to preserve the privacy of the principals is generally known. One method uses differentially private classifiers for protecting the privacy of individual data instances using added noise. A classifier evaluated over a database is said to satisfy differential privacy if the probability of the classifier producing a particular output is almost the same regardless of the presence or absence of any individual data instance in the database.

However, the conventional differentially private classifiers are determined locally for each database and fail to provide privacy when there is a requirement to use those classifiers over multiple databases. Accordingly, there is a need to determine such a classifier for a set of databases that preserves the differential data privacy of each database.

SUMMARY OF THE INVENTION

Differential privacy provides statistical guarantees that the output of a classifier does not include information about individual data instances. However, in multiparty applications, data for determining a classifier are distributed across several databases, and conventional differential privacy methods do not preserve differential data privacy for multiple contributing parties.

This is because conventional methods are inherently designed for the case where the classifier is determined based on access to the entire data of the database and is modified by the noise value computed over the data to produce differentially private classifier specifically for that data. However, in multiparty applications, it is often impossible to access the data of different database due to security constraints.

Embodiments of the invention are based on a realization that for a set of databases, a differentially private aggregate classifier preserving the differential data privacy of each database can be determined from the classifiers and the noise values of individual databases in the set of databases, without allowing access to the data of the databases.

However, in multiparty applications, adding the noise value to the classifier is no longer straightforward. This is because there is no guarantee that the added noise results in the differential data privacy of each database. For example, the aggregation of all classifiers and the noise values, which would be considered as a logical approach, does not satisfy differential privacy for the combined data.

Embodiments of the invention are based on another realization that a differentially private aggregate classifier can be determined as an aggregation of classifiers of each database modified by a noise value corresponding to a smallest database in the set of databases. The smallest database has the smallest number of entries, wherein a data structure of each entry is the same across all databases. The proof for correctness of this realization is provided in the Appendix.

Accordingly, one embodiment of the invention discloses a method for determining a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure differential data privacy of the database, and wherein the differentially private aggregate classifier preserves the differential data privacy of each database, comprising the steps of: combining classifiers of each database to determine an aggregate classifier; and modifying the aggregate classifier with a noise value corresponding to a smallest database, wherein the smallest database has the smallest number of entries, wherein a data structure of each entry is the same for all databases.

Moreover, various embodiments of the invention determine the differentially private aggregate classifier securely using cryptographic protocols. Those embodiments ensure that the data of each database are not shared with any other party and the differentially private aggregate classifier cannot be reverse engineered to learn about any individual data instances of any database.

Another embodiment discloses a system for determining a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, and wherein the differentially private aggregate classifier preserves the differential data privacy of each database, comprising: means for combining classifiers to determine an aggregate classifier; and means for modifying the aggregate classifier with a noise value corresponding to a smallest database in the set of databases to produce the differentially private aggregate classifier.

Yet another embodiment discloses a computer readable medium storing a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, wherein the differentially private aggregate classifier is a combination of the classifiers of the set of databases modified with the noise value corresponding to a smallest database in the set of databases.

DEFINITIONS

In describing embodiments of the invention, the following definitions are applicable throughout (including above).

A “computer” refers to any apparatus that is capable of accepting a structured input, processing the structured input according to prescribed rules, and producing results of the processing as output. Examples of a computer include a computer; a general-purpose computer; a supercomputer; a mainframe; a super mini-computer; a mini-computer; a workstation; a microcomputer; a server; an interactive television; a hybrid combination of a computer and an interactive television; and application-specific hardware to emulate a computer and/or software. A computer can have a single processor or multiple processors, which can operate in parallel and/or not in parallel. A computer also refers to two or more computers connected together via a network for transmitting or receiving information between the computers. An example of such a computer includes a distributed computer system for processing information via computers linked by a network.

A “central processing unit (CPU)” or a “processor” refers to a computer or a component of a computer that reads and executes software instructions.

A “memory” or a “computer-readable medium” refers to any storage for storing data accessible by a computer. Examples include a magnetic hard disk; a floppy disk; an optical disk, like a CD-ROM or a DVD; a magnetic tape; a memory chip; and a carrier wave used to carry computer-readable electronic data, such as those used in transmitting and receiving e-mail or in accessing a network, and a computer memory, e.g., random-access memory (RAM).

“Software” refers to prescribed rules to operate a computer. Examples of software include software; code segments; instructions; computer programs; and programmed logic. Software of intelligent systems may be capable of self-learning.

A “module” or a “unit” refers to a basic component in a computer that performs a task or part of a task. It can be implemented by either software or hardware.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a method for determining a differentially private aggregate classifier according embodiments of invention;

FIG. 2A is a graph of an exponential distribution of possible noise values;

FIG. 2B is a graph of a normal distribution of possible noise values;

FIG. 2C is a graph of a hybrid distribution of possible noise values; and

FIG. 3 is a block diagram of a method for determining the differentially private aggregate classifier securely according one embodiment of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

As shown in FIG. 1, embodiments of the invention disclose a system and a method 100 for determining a differentially private aggregate classifier 170 for a set of databases 110, such that the differentially private aggregate classifier preserves differential data privacy of each database in the set. The embodiments of the invention can be implemented by a processor 101 including memory and input/output interfaces as known in the art.

Each database 120-130 in the set of databases 110 is associated with a classifier, e.g., the classifiers 121 and 131 and a noise value, e.g., noise values 122 and 132. For example, the databases are denoted as D₁, . . . , D_K, where D_i=(x,y)|_j includes a set of entries x and corresponding binary labels y. The classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy 125 or 135 of the database. The determined locally means that the classifiers and the noise values are determined independently by each owner of the database before or concurrently with the execution of the method 100.

Typically, to ensure the differential privacy, the noise value is determined over the entire data entries of the database in dependence with a size 123 or 133 of the database. As used herein, the size of the database is based on a number of entries. The entry can have any data structure. However the data structure of each entry is the same across all databases. Examples of the entry are a field, a row in a table, a table itself, a file, or another database.

Embodiments of the invention are based on a realization that a differentially private aggregate classifier from the union of the databases D₁∪D₂ . . . ∪D_K can be determined as an aggregation of classifiers of each database modified by a noise value corresponding to the smallest database in the set of databases. The smallest database has the smallest number of entries, wherein a data structure of each entry is the same for all databases. The proof for correctness of this realization is provided in the Appendix A.

Accordingly, one embodiment combines 140 classifiers of each database to determine an aggregate classifier 145. Additionally, the embodiments determines 150 the noise value 155 corresponding to the smallest database. Next, the aggregate classifier 145 is modified 160 with the noise value 155 to produce the differentially private aggregate classifier 170. The differentially private aggregate classifier is published, e.g., stored in a memory 175 or distributed over internet.

Differential Privacy

According to the definition of a differential privacy model, given any two databases D and D′ differing by one element, i.e., adjacent databases, a classifier defined by a randomized query function M is differentially private, if the probability that the function M produces a response S on the database D is similar to the probability that the function M produces the same response S on the database D′. As the query output is almost the same in the presence or absence of an individual entry with high probability, almost nothing can be learned about any individual entry from the output.

The randomized function M with a well-defined probability density P satisfies ε-differential privacy if, for all adjacent databases D and D′ and for any Sεrange(M),

$\begin{array}{cc}\log \frac{P\left(M\left(D\right)=S\right)}{P\left(M\left(D^{\prime }\right)=S\right)}\le \varepsilon .& \left(1\right)\end{array}$

Accordingly, the differentially private classifier guaranties that no additional details about the individual entries can be obtained with certainty from output of the learning algorithm, beyond the a priori background knowledge. Differential privacy provides an ad omnia guarantee as opposed to most other models that provide ad hoc guarantees against a specific set of attacks and adversarial behaviors. By evaluating the differentially private classifier over a large number of entries, an adversary cannot learn the exact form of the data.

FIGS. 2A-2C show noise values along a horizontal axis, and probabilities associated with such noise values on the vertical axis. Thus, a noise value with high probability is more likely of being selected. The distributions all share a beneficial feature of decreasing the probability of a given noise value as the absolute value increases. This allows noisy outputs to be useful, because the probability of an excessively high noise value is unlikely.

FIG. 2A shows an exponential distribution 210 of the noise values. FIG. 2B shows a normal distribution 220 of the noise values. FIG. 2C shows a hybrid distribution 230 of the noise values. The hybrid distribution of FIG. 2C is a normal and exponential distribution, such that a normal distribution defines a portion of the distribution comprising the most probable noise values, i.e., those with a higher probabilities, and an exponential distribution defines a portion of the distribution comprising the least probable noise values, i.e., those with low probabilities, corresponding to larger absolute noise values.

A differential diameter 240 and privacy parameter ε can be used in calculating each of the distributions in FIGS. 2A-2C. A large differential diameter value widens the distribution, increasing the probability that a larger noise values is used. Conversely, a small differential diameter decreases the likelihood of large noise values. When the privacy parameter is in the denominator of the distribution function, a small value of the privacy parameter ε corresponds to strong privacy and vice versa. The exemplary equations described above are satisfactory, and can be used to construct an infinite variety of distributions that successfully utilize a differential diameter measurement and privacy parameter to create a satisfactory noise distribution. For example, an infinite number of small modifications to the distributions depicted in FIGS. 2A-2C are possible.

Typically, the classifiers are designed to be differentially private by adding a noise value to the weights of the classifier, where the noise value is selected from the distribution described above. Further, parameters of the distribution depend on a degree of desired privacy expressed by the epsilons ε, which usually depends on the size of the database, and on the type of the function of the classifier, e.g., average, or maximum or logarithm function. In one embodiment, the noise values have a Laplace distribution.

Determining Classifiers Locally on Individual Databases

Each database owner P_j uses its database (x, y)|_j to determine the classifier with weights w_j, wherein j is an index of the database. One embodiment uses a regularized logistic regression function l₂ for the classifiers. For example, the classifier can be determined by minimizing the following objective function

$\begin{array}{cc}{w}_j=\underset{w}{\mathrm{argmin}}J\left(w\right)=\underset{w}{\mathrm{argmin}}\frac{1}{n_j}\sum _i\log \left(1+{}^{-y_iw^Tx_i}\right)+\lambda w^Tw,& \left(2\right)\end{array}$

where λ>0 is a regularization parameter, and T is a transpose operator. However, the classifiers are determined Focally for each individual database and no data or information are shared.

Example of Differentially Private Aggregate Classifier

One embodiment of the invention defines the differentially private aggregate classifier w^s 170 according to

$w^s=\frac{1}{K}\sum _jw_j+\eta ,$

where K is a number of the databases in the set of databases, j is the index of the database, and η is a d-dimensional random variable sampled from a Laplace (Lap) distribution scaled with a parameter

$\frac{2}{n_{\left(1\right)}\mathrm{\varepsilon \lambda }},$

n₍₁₎ is the noise value corresponding to the smallest database, i.e., n₍₁₎=min_jn_j, λ is the parameter of the Laplace distribution, and ε is the differential privacy parameter.

The differentially private aggregate classifier w^s incurs only a well-bounded excess risk over training a classifier directly on the union of all data while enabling the parties to maintain their privacy. The noise value η ensures that the classifier w^s satisfies differential privacy, i.e., that individual data instances cannot be discerned from the classifier.

The definition of the noise value η above is not intuitive, but we have proved that differentially private aggregate classifier constructed by aggregating locally trained classifiers is limited by the performance of the individual classifier that has the least number of entries.

Some embodiments of the invention are based on the realization that the owners of the databases P_j cannot simply take their locally trained classifiers w_j, perturb them with a noise vector and publish the perturbed classifiers, because aggregating such classifiers will not give the correct noise value η: Lap(2/(n₍₁₎ελ)) that ensures differential privacy. Also, because individual database owners cannot simply add noise to their classifiers to impose differential privacy for all other classifiers, the actual averaging operation must be performed such that the individual classifiers or the number of entries in each database are not exposed. Accordingly, some embodiments use a secure multiparty computation (SMC) method for interacting with a processor to perform the averaging. The outcome of the method is such that each of the database owners obtains additive shares of the desired differentially private classifier w^s, such that these shares must be added to obtain the differentially private aggregate classifier.

Secure Multiparty Computation (SMC) Method

The embodiments use asymmetric key additively homomorphic encryption. A desirable property of such encryption is that operations performed on ciphertext elements maps into known operations on the same plaintext elements. For an additively homomorphic encryption function ξ(•), that means that for any a and b ξ(a)ξ(b)=ξ(a+b), ξ(a)^b=ξ(ab).

The additively homomorphic encryption is semantically secure, i.e., repeated encryption of the same plaintext will result in different cyphertexts. For the SMC method, encryption keys are considered public and decryption keys are privately owned by the specified database owners.

FIG. 3 shows a block diagram of a method 300 for determining the differentially private aggregate classifier 170 using the SMC method. The method can be performed in a processor 301.

Determining an Obfuscated Index of the Smallest Database

The processor determines 310 an obfuscated index 315 of a smallest database based on permuted indexes 320 resulting from a permutation of indexes of the databases. For example, each database owner, i.e., a party P_j, computes n_j=a_j+b_j, where a_j and b_j are integers representing additive shares of the database lengths n_j for j=1, 2, . . . , K. The K-length vectors of additive shares are defined as a and b, respectively.

The parties P_j mutually agree on a permutation π₁ on the index vector (1, 2, . . . , K). This permutation is unknown to the processor. Then, each party P_j transmits its share a_j to a representative party P_π1(j), and transmits its share b_j to the processor with the index changed according to the permutation. Thus, after this step, the parties have permuted additive shares given by π₁(a) while the processor has permuted additive shares π₁(b).

The parties P_j generate a key pair (pk, sk) where pk is a public key for homomorphic encryption and sk is the secret decryption key known only to the parties, but not to the processor. The element-wise encryption of a is defined as ξ(a). The parties send ξ(π₁(a))=π₁(ξ(a)) to the processor.

The processor generates a random vector r=(r₁, r₂, . . . , r_K) where the elements r_i are integers selected uniformly at random and are equally likely to be positive or negative. Then, the processor computes ξ(π₁(a_j))ξ(r_j)=ξ(π₁(a_j)+r_j). In vector notation, the processor computes ξ(π₁(a)+r).

Similarly, by subtracting the same random integers in the same order to the received additive shares, the processor obtains π₁(b)−r, selects a permutation π₂ at random and obtains a signal

π₂(ξ(π₁(a)+r))=ξ(π₂(π₁(a)+r)),

and a signal π₂(π₁(b)−r). The processor transmits the signal ξ(π₂(π₁(a)+r)) to the individual parties in the order, e.g., a first element to first party P₁, a second element to a second party P₂, . . . , and K^th element to a party P_K.

Each party decrypts the signal received from the processor, i.e., the parties P₁, P₂, . . . , P_K respectively possess the elements of the vector π₂(π₁(a)+r) while the processor possesses the vector π₂(π₁(b)−r). Because π₁ is unknown to the processor and π₂ is unknown to the parties, the indices in both vectors are obfuscated.

If π₂(π₁(a)+r)=ã and π₂(π₁(b)−r)={tilde over (b)}, then n_i>n_jã_i+{tilde over (b)}_i>ã_j+{tilde over (b)}_jã_i−ã_j>{tilde over (b)}_j−{tilde over (b)}_i.

For each (i, j) pair with i,jε{1, 2, . . . , K}, these comparisons can be solved by any implementation of a secure millionaire protocol. When all the comparisons are done, the processor determines the index {tilde over (j)} 325 such that ã_{{tilde over (j)}}+{tilde over (b)}_{{tilde over (j)}}=min_jn_j. However, the true index corresponding to the smallest dataset is obfuscated.

Selecting Obliviously First Additive Share of Noise Value of Smallest Database

Based on the obfuscated index 315, the processor selects 330 obliviously from additive shares 340 of all noise values a first additive share 335 of a noise value associated with the smallest database. A second additive share 360 of the noise value associated with the smallest database is stored by one or more databases.

For example, the processor constructs an indicator vector u of length K such that u_{{tilde over (j)}}=1 and all other elements are 0. Then the processor permutes the indicator vector to produce a permuted vector π₂⁻¹(u), where π₂⁻¹ inverts π₂. Next, the processor generates a key-pair (pk′, sk′) for additive homomorphic function ζ(•), where only the encryption key pk′ is publicly available to the parties P_j, and transmits ζ(π₂⁻¹(u))=π₂⁻¹(ζ(U)) to the parties P_j.

The parties mutually obtain a permuted vector π₁⁻¹(π₂⁻¹(ζ(u)))=ζ(v) where π₁⁻¹ inverts the permutation π₁ originally applied by the parties P_j and v is the underlying vector. Now that both permutations have been removed, the index of the non-zero element in the indicator vector v corresponds to the true index of the smallest database. However, since the parties P_j cannot decrypt ζ(•), the parties cannot find out this index.

For j=1, . . . , K, party P_j selects the noise value η_j. In one embodiment, the noise value is a d-dimensional noise vector sampled from a Laplace distribution

with parameter

$\frac{2}{n_j\mathrm{\varepsilon \lambda }}.$

In another embodiment, the noise value selected from different distributions. In yet another embodiment, the noise value is predetermined. Then, it obtains a d-dimensional vector ψ_j where for i=1, . . . , d, ψ_j(i)=ζ(v(j))^nj(i)=ζ(v(j)η_j(i)).

All parties P_j compute a d-dimensional noise vector ψ such that, for i=1, . . . , d, ψ(i)=π_jψ_j9i)=π_jζ(v(j)η_j(i))=ζ(Σ_jv(j)η_j(i)).

By construction, the above equation selects only the noise value for the smallest database, while rejecting the noise values for all other databases. This is because has an element with value 1 at the index corresponding to the smallest database and has zeroes everywhere else.

One of the parties, e.g., P₁, generates a d-dimensional random integer noise vector S to produce the first additive share 335 ψ(i)ζ(s(i)) for all i=1, . . . , d, and transmits the first additive share to the processor. Also, the party P₁ stores a second additive share 360 of the noise value, e.g., by computing w₁−Ks wherein w₁ is the classifier of the party. Additionally or alternatively, the second additive share is stored by at multiple databases.

The processor decrypts ψ(i)ζ(s(i)) to obtain η(i)+s(i) for i=1, . . . , d. Accordingly, the processor stores a first additive share of the noise value associated with the smallest database as K(η+s), selected party P₁ stores the second additive share of the noise value and the classifier as w₁−Ks, and all other parties P_j, j=2, . . . , k stores the classifiers w_j.

Obliviously Combining Classifiers, the First and the Second Additive Shares

In various embodiments, the processor and the K database-owning parties execute a secure function evaluation protocol, such that each of the K+1 participants obtains an additive share of the differentially private aggregate classifier Kw^s. In some embodiments, additive shares are generated using a computationally secure protocol. In other embodiments additive shares are generated using an unconditionally secure protocol. The resulting K+1 shares form the differentially private aggregate classifier and are published, e.g., are stored in the memory 175.

Effect of the Invention

The embodiments of the invention determine differentially private aggregate classifier to ensure differential privacy of multiple databases. This invention is based on the realization that, to achieve multiparty differential privacy, it is sufficient to select the stochastic component based on the size of the smallest database. Some embodiments further recognize that because of this realization the selection of the noise value can be securely performed via the SMC method.

However, unlike conventional methods, the embodiments do not use SMC to construct a classifier. Therefore, our embodiments are significantly less complex than any SMC method to compute the classifier on the combined data.

It is to be understood that various other adaptations and modifications can be made within the spirit and scope of the invention. Therefore, it is the object of the appended claims to cover all such variations and modifications as come within the true spirit and scope of the invention.

APPENDIX A

Theoretical Proof for Differential Privacy in a Multiparty Setting

It is sufficient to select the stochastic component based on the size of the smallest database. Below, a theoretical proof is given that this is indeed the case.

Proof of Differential Privacy

We show that the perturbed aggregate classifier in this invention satisfies differential privacy. We use the following bound on the sensitivity of the regularized regression classifier:

Theorem 1 Given a set of n data instances lying in a ball of radius 1, the sensitivity of regularized logistic regression function is at most

$\frac{2}{n\lambda }.$

If w¹ and w₂ are function (classifiers) trained on adjacent databases of size n with regularization parameter λ,

${w_1-w_2}_1\le \frac{2}{n\lambda }$

This bound has been proved by Kamalika Chaudhuri and Claire Monteleoni in Privacy-preserving logistic regression. Neural Information Processing Systems, pages 289-296, 2008 and is incorporated herein by reference. To show that the perturbed function or classifier in our invention satisfies differential privacy, proceed as follows:

Theorem 2 The classifier w³ preserves ε-differential privacy. For any two adjacent databases D and D′,

$\log \frac{P\left(w^sD\right)}{P\left(w^sD^{\prime }\right)}\le \varepsilon .$

Proof Consider the case where one instance of the training database D is changed to result in an adjacent database D′. This would imply a change in one element in the training database of one party and thereby a change in the corresponding learned vector w_j^δ. Assuming that the change is in the database of the party P_j, the change in the learned vector is only going to be in w_j; let denote the new classifier by w_j′. In Theorem 1, we bound the sensitivity of w_j as

${w_j-w_{j^{\prime }}}_1\le \frac{2}{n_j\mathrm{\varepsilon \lambda }}.$

Considering that we learn the same vector w^x using either the training databases D and D′, we have

$\begin{array}{c}\frac{P\left({\hat{w}}^sD\right)}{P\left({\hat{w}}^sD^{\prime }\right)}=\frac{P\left({\hat{w}}_j+\eta D\right)}{P\left({\hat{w}}_j^{\prime }+\eta D^{\prime }\right)}\\ =\frac{\exp \left[\frac{n_{\left(1\right)}\mathrm{\varepsilon \lambda }}{2}{{\hat{w}}_j}_1\right]}{\exp \left[\frac{n_{\left(1\right)}\mathrm{\varepsilon \lambda }}{2}{{\hat{w}}_j^{\prime }}_1\right]}\\ \le \exp \left[\frac{n_{\left(1\right)}\mathrm{\epsilon \lambda }}{2}{{\hat{w}}_j-{\hat{w}}_j^{\prime }}_1\right]\\ \le \exp \left[\frac{n_{\left(1\right)}\mathrm{\epsilon \lambda }}{2}\frac{2}{n_j\lambda }\right]\\ \le \exp \left[\frac{n_{\left(1\right)}}{n_j}\epsilon \right]\\ \le \exp \left(\epsilon \right),\end{array}$

by the definition of function sensitivity. Similarly, we can lower bound the ratio by exp(−ε)

Analysis of Excess Error

As expected, adding a perturbation noise term introduces an error in the function evaluation. For functions used as classifiers, this error is called as excess error or excess risk. It is the price paid for differential privacy. For a differentially private classifier to be useful, it is desired that the excess risk is small. In other words, it is desirable that adding noise does not deteriorate the classification performance by too much.

In the following discussion, we consider how much excess error is introduced when using the perturbed aggregate classifier w^S in this invention (satisfying differential privacy) as opposed to the non-private unperturbed classifier w^x trained on the entire training data. We also consider how much excess error is introduced with respect to the (non-private) unperturbed aggregate classifier w.

We first establish a bound on the l₂ norm of the difference between the aggregate classifier w and the classifier trained over the entire training, data. To prove the hound we apply the following Lemma

Lemma 1 Let G(w) and g(w) be two differentiable, convex functions of w. If w₁=arg min_wG(w) and w₂=arg min_wG(w)+g(w), then

$w_1-w_2\le \frac{g_1}{G_2}$

whereg₁=max_w∥∇g(w)∥ and G₂=min_vmin_wv^T∇²G(w)v for any unit vector vεR^d.

Lemma 1 is obtained from Kamalika Chaudhuri and Claire Monteiconi in Privacy-preserving logistic regression. Neural Information Processing Systems, pages 289-296, 2008 and is incorporated herein by reference. First, consider the following theorem bounding the excess risk between the non-private unperturbed aggregate classifier w and the non-private classifier w^x tuned on the entire database.

Theorem 3 Given the aggregate classifier w, the classifier w^x trained over the entire training data and η₍₁₎ is the size of the smallest training database,

${w-w^{*}}_2\le \frac{K-1}{n_{\left(1\right)}\lambda }$

Proof:

We formulate the problem of estimating the individual classifiers w_j and the classifier w^x trained over the entire training data in terms of minimizing the two differentiable and convex functions g(w) and G(w).

$\begin{array}{cc}{\hat{w}}_j=\underset{w}{\mathrm{argmin}}J\left(w,x{}_j,y{}_j\right)=\underset{w}{\mathrm{argmin}}G\left(w\right),\begin{array}{c}{w}^{*}=\underset{w}{\mathrm{argmin}}J\left(w,x,y\right)\\ =\underset{w}{\mathrm{argmin}}L\left(w,x{}_j,y{}_j\right)+\sum _{l\in \left[K\right]-j}L\left(w,x{}_l,y{}_l\right)+\lambda {w}^2\\ =\underset{w}{\mathrm{argmin}}J\left(w,x{}_j,y{}_j\right)+\sum _{l\in \left[K\right]-j}L\left(w,x{}_l,y{}_l\right)\\ =\underset{w}{\mathrm{argmin}}G\left(w\right)+g\left(w\right).\end{array}\nabla g\left(w\right)=\sum _{l\in \left[K\right]-j}\frac{1}{n_l}\sum _{i=1}^{n_i}\frac{-{}^{-y_i{wx_i}_l}}{1+{}^{-y_i{wx_i}_l}}y_ix_i^T,\begin{array}{c}\nabla g\left(w\right)=\sum _l\frac{1}{n_l}\sum _i\frac{-{}^{-y_i{{}_lw^Tx_i}_l}}{1+{}^{-y_i{(w^Tx_i}_l}}y_ix_i^T\\ \le \sum _l\frac{1}{n_l}\sum _i\frac{-{}^{-y_i{{}_lw^Tx_i}_l}}{1+{}^{-y_i{{}_lw^Tx_i}_l}}y_ix_i^T\\ \le \sum _l\frac{1}{n_l},\end{array}g_1=\underset{w}{\max }\nabla g\left(w\right)\le \sum _l\frac{1}{n_l}.& \left(5\right)\\ {\nabla }^2G\left(w\right)=\frac{1}{n_j}\sum _i\frac{{}^{y_i{{}_jw^Tx_i}_j}}{1+{}^{y_i{{}_jw^Tx_i}_j}}x_i{{}_jx_i}_j^T+\lambda 1,G_2\ge \lambda .& \left(6\right)\end{array}$

Substituting the bounds on g₁ and G₂ in Lemma 6.2,

$\begin{array}{cc}\text{?}-\text{?}\le \frac{1}{\lambda }\text{?}\frac{1}{n_l}.\text{?}\text{indicates text missing or illegible when filed}& \left(7\right)\end{array}$

Applying triangle inequality,

$\begin{array}{cc}\text{?}-\text{?}=\frac{1}{K}\sum _j\text{?}-\text{?}=\frac{1}{K}\sum _j\text{?}-K\text{?}=\frac{1}{K}\left(\text{?}-\text{?}\right)+\dots +\left(\text{?}-\text{?}\right)\le \frac{1}{K}\sum _j\text{?}-\text{?}=\frac{1}{K\lambda }\sum _j\sum _{t\in \left[K\right]-j}\frac{1}{n_t}=\frac{K-1}{K\lambda }\sum _j\frac{1}{n_j}\le \frac{K-1}{n_{\left(1\right)}\lambda }.\mathrm{where}n_{\left(1\right)}={\min }_jn_j.\text{?}\text{indicates text missing or illegible when filed}& •\end{array}$

The bound is inversely proportional to the number of instances in the smallest database. This indicates that when the databases are of disparate sizes, w will be a lot different from w^x. The largest possible value for η₍₁₎ is

$\frac{n}{K}$

in which case all parties having an equal amount of training data and w will be closest to w^x. In the one party case for K=1, the bound indicates that norm of the difference would be upper bounded by zero, which is a valid sanity check as the aggregate classifier w is the same as w_x.

We use this result to establish a bound on the empirical risk of the perturbed aggregate classifier w^δ=w+η over the empirical risk of the unperturbed classifier w^x in the following theorem.

Theorem 4 If all data instances x_i lie in a unit ball, with probability at least 1-δ, the empirical regularized excess risk of the perturbed aggregate classifier w^s over the classifier w_s trained over entire training data is

$J\left(w^{*}\right)\le J\left(w^{*}\right)+\frac{{\left(K-1\right)}^2\left(\lambda +1\right)}{2n_{\left(1\right)}^2{\lambda }^2}+\frac{2d^2\left(\lambda +1\right)}{n_{\left(1\right)}^2{\varepsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)+\frac{2d\left(K-1\right)\left(\lambda +1\right)}{n_{\left(1\right)}^2\varepsilon {\lambda }^2}\log \left(\frac{d}{\delta }\right).$

Proof:

We use the Taylor series expansion of the function J to have

J({circumflex over (w)}^x)=J(w^x)+({circumflex over (w)}^x−w^x)^T∇J(w^x)+½({circumflex over (w)}^x−w^x)^T∇²J(w)({circumflex over (w)}^s−w^x)

for some wΕR_d. By definition, VJ(w^x)=0.

Taking l₂ norm Oft both sides and applying Cauchy-Schwarz inequality,

|J({circumflex over (w)}^δ)−J(w^x)|≦½∥{circumflex over (w)}^δ−w^x∥²∥∇²J(w)∥.  (8)

The second gradient of the regularized loss function for logistic regression is

${\nabla }^2J\left(w\right)=\frac{1}{n}\sum _i\frac{\text{?}}{1+\text{?}}x_ix_i^T+\lambda 1=\frac{1}{n}\sum _i\frac{1}{1+{}^{-y_iw^Tx_i}}x_ix_i^T+\lambda 1.$ $\text{?}\text{indicates text missing or illegible when filed}$

Since the logistic function term is always less than one and all x_i lie in a unit ball, ∥∇₂J(w)∥≦λ+1. Substituting, this into Equation 8 and using the fact that J(w^x)≦K(w), ∀wεR^d,

$\begin{array}{cc}J\left(\text{?}\right)\le J\left(\text{?}\right)+\frac{\lambda +1}{2}{\text{?}-\text{?}}^2.\text{?}\text{indicates text missing or illegible when filed}& \left(9\right)\end{array}$

The classifier w^δ is the perturbed aggregate classifier, i.e., w^s=w+η, with the noise term

$\eta \text{:}\mathrm{Lap}\left(\frac{2}{n_{\left(1\right)}\varepsilon \lambda }\right).$

To bound ∥η∥ with probability at least 1−δ, we apply the following Lemma from Kamalika Chaudhuri and Claire Monteleoni in Privacy-preserving logistic regression. Neural Information Processing Systems, pages 289-296, 2008 and is incorporated herein by reference.

Lemma 2 Given a d-dimensional random variable η: Lap(β) i.e.,

$P\left(\eta \right)=\frac{1}{2\beta }\text{?}$ $\text{?}\text{indicates text missing or illegible when filed}$

with probability at least 1−δ, the l₂ norm of the random variable is bounded us

$\eta \le 2d\beta \log \left(\frac{d}{\delta }\right)$

Substituting this into Equation 9, we have

$J\left(\text{?}\right)\le J\left(\text{?}\right)+\frac{1}{2}{\text{?}-\text{?}+\eta }^2=J\left(\text{?}\right)+\frac{\lambda +1}{2}\left[{\text{?}-\text{?}}^2+{\eta }^2+2{\left(\text{?}-\text{?}\right)}^T\eta \right]\le J\left(\text{?}\right)+\frac{\lambda +1}{2}\left[\frac{{\left(K-1\right)}^2}{n_{\left(1\right)}^2{\lambda }^2}+\frac{4\text{?}}{n_{\left(1\right)}^2{\epsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)\right]+\left(\lambda +1\right){\left(\text{?}-\text{?}\right)}^T\eta .\text{?}\text{indicates text missing or illegible when filed}$

Using the Cauchy-Schwarz inequality on the last term,

$\begin{array}{cc}J\left(\text{?}\right)\le J\left(\text{?}\right)+\frac{\lambda +1}{2}\left[\frac{{\left(K-1\right)}^2}{n_{\left(1\right)}^2{\lambda }^2}+\frac{4\text{?}}{n_{\left(1\right)}^2{\epsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)\right]+\left(\lambda +1\right)\text{?}-\text{?}\eta \le J\left(\text{?}\right)+\frac{{\left(K-1\right)}^2\left(\lambda +1\right)}{2n_{\left(1\right)}^2{\lambda }^2}+\frac{2\text{?}\left(\lambda +1\right)}{n_{\left(1\right)}^2{\epsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)+\frac{2d\left(K-1\right)\left(\lambda +1\right)}{n_{\left(1\right)}^2{\mathrm{\epsilon \lambda }}^2}\log \left(\frac{d}{\delta }\right).\text{?}\text{indicates text missing or illegible when filed}& •\end{array}$

The bound suggests an error because of two factors: aggregation and perturbation. The bound increases for smaller values of ε implying a tighter definition of differential privacy, indicating a clear trade-off between privacy and utility. The bound is also inversely proportional to n₍₁₎² implying an increase in excess risk when the parties have training databases of disparate sizes.

In the limiting case ε→∞, we are adding a perturbation term η sampled from a Laplacian distribution of infinitesimally small variance resulting in the perturbed classifier being almost as same as using the unperturbed aggregate classifier w satisfying a very loose definition of differential privacy. With such a value of ε, our bound becomes

$J\left(w\right)\le J\left(\text{?}\right)+\frac{{\left(K-1\right)}^2\left(\lambda +1\right)}{2n_{\left(1\right)}^2{\lambda }^2}.\text{?}\text{indicates text missing or illegible when filed}$

Similar to the analysis of Theorem 3, the excess error in using an aggregate classifier is inversely proportional to the size of the smallest database n₍₁₎ and in the one party case K=1, the bound becomes zero as the aggregate classifier w is the same as w^x.

While the previous theorem gives us a bound on the empirical excess risk over a given training database, it is important to consider a bound on the true excess risk of w^s over w^x. Let us denote the true risk of the classifier w^s by {tilde over (J)}(w^x)=E[J(w^x)] and similarly, the true risk of the classifier w^x by {tilde over (J)}(w^x)=E[J(w^x)].

Theorem 5 If all training data instances x_i lie in a unit ball, with probability at least 1−δ, the true excess risk of the perturbed aggregate classifier w^x over the classifier w^x trained over entire training data is

$\tilde{J}\left(\text{?}\right)\le \tilde{J}\left(\text{?}\right)+\frac{2{\left(K-1\right)}^2\left(\lambda +1\right)}{2n_{\left(1\right)}^2{\lambda }^2}+\frac{4d^2\left(\lambda +1\right)}{n_{\left(1\right)}^2{\varepsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)+\frac{4d\left(K-1\right)\left(\lambda +1\right)}{n_{\left(1\right)}^2\varepsilon {\lambda }^2}\log \left(\frac{d}{\delta }\right)+\frac{16}{\lambda n}\left[32+\log \left(\frac{1}{\delta }\right)\right].\text{?}\text{indicates text missing or illegible when filed}$

Proof:

Let w^r be the classifier minimizing {tilde over (J)}(w). By rearranging the terms,

{tilde over (J)}(w^x)={tilde over (J)}(w^x)+[{tilde over (J)}(w^s)−{tilde over (J)}(w^r)]+[{tilde over (J)}(w^r)−{tilde over (J)}(w^x)]≦{tilde over (J)}(w^x)+[{tilde over (J)}(w^x)−{tilde over (J)}(w^r)].

To proceed, we first need a bound between the true excess risk of any classifier as an expression of bound on the regularized empirical risk for that classifier and the classifier minimizing the regularized empirical risk. With probability at least 1−δ,

$\begin{array}{cc}J\left(\text{?}\right)-J\left(\text{?}\right)\le 2\left[J\left(\text{?}\right)-J\left(\text{?}\right)\right]+\frac{16}{\lambda n}\left[32+\log \left(\frac{1}{\delta }\right)\right].\text{?}\text{indicates text missing or illegible when filed}& \left(10\right)\end{array}$

Substituting the bound from Theorem 4,

$\begin{array}{cc}J\left(\text{?}\right)-J\left(\text{?}\right)\le \frac{2{\left(K-1\right)}^2\left(\lambda +1\right)}{2n_{\left(1\right)}^2{\lambda }^2}+\frac{4d^2\left(\lambda +1\right)}{n_{\left(1\right)}^2{\varepsilon }^2{\lambda }^2}{\log }^2\left(\frac{d}{\delta }\right)& \left(11\right)\\ +\frac{4d\left(K-1\right)\left(\lambda +1\right)}{n_{\left(1\right)}^2\varepsilon {\lambda }^2}\log \left(\frac{d}{\delta }\right)+\frac{16}{\lambda n}\left[32+\log \left(\frac{1}{\delta }\right)\right].\text{?}\text{indicates text missing or illegible when filed}& \left(12\right)\end{array}$

Substituting this bound into Equation 10 gives us a bound on the true excess risk of the classifier w^x over the classifier w^x.

Claims

1. A method for determining a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, and wherein the differentially private aggregate classifier preserves the differential data privacy of each database, comprising the steps of: combining classifiers to determine an aggregate classifier; andmodifying the aggregate classifier with a noise value corresponding to a smallest database in the set of databases to produce the differentially private aggregate classifier, wherein the steps of the method are performed by a processor.

2. The method of claim 1, wherein the smallest database has a smallest number of entries, wherein data structures of the entries are identical for all databases.

3. The method of claim 1, further comprising: determining an obfuscated index of the smallest database resulting from a permutation of indexes of the databases;selecting obliviously, from additive shares of all noise values, a first additive share of a noise value associated with the smallest database based on the obfuscated index, wherein a second additive share is stored in one or more databases; anddetermining the differentially private aggregate classifier by obliviously combining each classifier, the first and the second additive shares of the noise value.

4. The method of claim 1, wherein the noise value is distributed according to a Laplace distribution.

5. The method of claim 1, wherein the noise value for each database is determined based on a size of the database.

6. The method of claim 1 wherein the classifier is a binary logistic regression classifier.

7. The method of claim 6, wherein the classifier is a multiclass classifier constructed from a combination of binary logistic regression classifiers.

8. The method of claim 3 wherein the determining of the differentially private classifier is performed by a cryptographic protocol.

9. The method of claim 3 wherein the determining of the differentially private classifier is performed by a secret sharing protocol.

10. A system for determining a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, and wherein the differentially private aggregate classifier preserves the differential data privacy of each database, comprising: means for combining classifiers to determine an aggregate classifier; andmeans for modifying the aggregate classifier with a noise value corresponding to a smallest database in the set of databases to produce the differentially private aggregate classifier.

11. The system of claim 10, wherein the smallest database has a smallest number of entries, wherein data structures of the entries are identical for all databases.

12. The system of claim 10, further comprising: means for determining an obfuscated index of the smallest database resulting from a permutation of indexes of the databases;means for selecting obliviously, from additive shares of all noise values, a first additive share of a noise value associated with the smallest database based on the obfuscated index, wherein a second additive share is stored in one or more databases; andmeans for determining the differentially private aggregate classifier by obliviously combining each classifier, the first and the second additive shares of the noise value.

13. The system of claim 10, wherein the noise value is distributed according to a Laplace distribution.

14. The system of claim 10, wherein the noise value for each database is determined based on a size of the database.

15. A computer readable medium storing a differentially private aggregate classifier for a set of databases, wherein each database in the set of databases is associated with a classifier and a noise value, wherein the classifier and the noise value are determined locally for each database, such that a combination of the classifier and the noise value ensure a differential data privacy of the database, wherein the differentially private aggregate classifier is a combination of the classifiers of the set of databases modified with the noise value corresponding to a smallest database in the set of databases.