Stronger Privacy Amplification by Shuffling for Rényi and Approximate Differential Privacy

Errata

The general upper bounds stated in the original version of this paper had an error in the proof. The error occurs in the proof of Lemma 3.5 when $p<\frac{1}{e^{{\varepsilon}_{0}}+1}$. The error affects the theorems and corollaries that use Lemma 3.5 in their proof: Theorem 3.1, Theorem 3.2, Corollary 4.3 and Theorem 5.2.

In this errata we will outline the error, and give updated results:

The general upper bounds Theorem 3.1 and Theorem 3.2, previously stated for any sequence of adaptive local randomizers, hold for a restricted class of local randomizers that contains several important local randomizers. The numerical results in Figure 1, Figure 2, and Figure 3 also hold for this class of local randomizers.

The key lemma showing that the privacy analysis can be reduced to comparing two multinomial distributions, Lemma 3.5, holds with a slightly different decomposition of the local randomizers. Given any specific local randomizer, such a decomposition is guaranteed to exist, and hence this provides a method for numerically computing a privacy amplification by shuffling bound for any local randomizer.

The asymptotic upper bound on the privacy amplification by shuffling in terms of Rényi differential privacy (Corollary 4.3) still holds. The original proof depended on Lemma 3.5, but the same result holds with slightly worse constants using the results from [FMT20].

A slight variant on the upper bound for privacy amplification by shuffling for kRR (Theorem 5.2) holds. The new upper bound no longer exactly matches the lower bound given in Theorem 5.3, although we show that the two bounds are numerically close.

An outline of the error, as well as the updated results stated above can be found in Section 7. The affected theorems are flagged in the main body, although in order to maintain consistency with the original paper, the prose has not been changed. We conjecture that the general results stated in the original paper do hold, although this is left as an open problem in this errata.

Introduction

We consider privacy-preserving data analysis in the federated setting augmented with a shuffler. In this model each client sends a report of their data and these reports are then anonymized and randomly shuffled before being sent to the server. Systems based on this model were first proposed by [BEMMRLRKTS17] as a simple way to improve the privacy of the user data.

The interest in this model was spurred by two works [EFMRTT19, CSUZZ19] demonstrating that shuffling can provably amplify DP guarantees. Specifically, if each of $n$ clients randomizes their data with ${\varepsilon}_{0}$ local DP then the shuffled reports satisfy $({\varepsilon}({\varepsilon}_{0},\delta,n),\delta)$ DP for some ${\varepsilon}({\varepsilon}_{0},\delta,n)\ll{\varepsilon}_{0}$ (when $n$ and $1/\delta$ are sufficiently large). This fact can also be used to analyze models augmented with an aggregator such as PRIO [CGB17] (since the sum of real values provides even less information than shuffled values). In particular, privacy amplification by shuffling was used in Apple’s and Google’s Exposure Notification Privacy-preserving Analytics [AG21]. Since then a number of works have studied privacy amplification by shuffling and the model augmented with a shuffler more generally (e.g. [BBGN19, GGKPV19, GPV19, BKMTT20, BBGN20, GMPV20, CU20, CSUZZ19, BC20, WXDZHHLJ20, EFMRSTT20, FMT20, GDDKS20]).

The key to applications of privacy amplification by shuffling is bounding the resulting privacy parameter ${\varepsilon}$ (as a function of ${\varepsilon}_{0}$, $\delta$ and $n$), especially in the ${\varepsilon}_{0}>1$ regime that is crucial for obtaining sufficiently accurate results in practice. A number of works addressed these bounds although, until recently, known bounds were asymptotically suboptimal [EFMRTT19, BBGN19, BKMTT20] or only applied to the binary randomized response [CSUZZ19]. For a summary of these results see [FMT20, Table 1].

In a recent work, [FMT20] give an asymptotically optimal analysis of privacy amplification by shuffling for $({\varepsilon},\delta)$-DP. They show a more general resultIn their result the inputs are shuffled before applying local randomizers. It is more general since it implies amplification when outputs of identical randomizers are shuffled. In addition, it allows adaptive choice of local randomizers which is necessary for analyzing iterative optimization algorithms such as stochastic gradient descent. that running an adaptive sequence of arbitrary ${\varepsilon}_{0}$-DP local randomizers on a uniformly random permutation of $n$ data items, yields an $({\varepsilon},\delta)$-DP algorithm, where {\varepsilon}=O\mathopen{}\mathclose{{}\left((1-e^{-{\varepsilon}_{0}})\frac{\sqrt{e^{{\varepsilon}_{0}}\ln(1/\delta)}}{\sqrt{n}}}\right). Their result relies on a reduction from analysis of the privacy parameter for general adaptive protocols to analysis of divergence between a fixed pair of distributions on 3 values. In particular, they obtain a way to compute an upper bound on ${\varepsilon}({\varepsilon}_{0},\delta,n)$ numerically leading to numerical bounds that significantly improve on prior work.

One limitation of bounds on the approximate DP parameter ${\varepsilon}({\varepsilon}_{0},\delta,n)$ is that they are not well-suited for analysis of multi-step algorithms common in machine learning. Analysis of such algorithms requires composition whereas composition in terms of $({\varepsilon},\delta)$ parameters typically leads to a $\sqrt{\ln(1/\delta)}$ overhead in the resulting bound. This overhead can be addressed by analyzing the privacy loss in terms of Rényi differential privacy (RDP) [DR16, ACGMMTZ16, Mir17, BS16]. Rényi DP for order $\alpha$ upper bounds the privacy loss using Rényi divergence of order $\alpha$. Crucially, it leads to simple and relatively tight bounds for composition and can be easily converted to approximate DP.

Bounds on RDP parameters of privacy amplification by shuffling were first given by [EFMRTT19]. Their bound is asymptotically optimal for ${\varepsilon}_{0}<1$, but for ${\varepsilon}\geq 1$, their bound of $O(\alpha e^{6{\varepsilon}_{0}}/n)$ on RDP of order $\alpha$ is suboptimal. [GDDKS20] improved the bound to $O(\alpha e^{2{\varepsilon}_{0}}/n)$ (albeit in a rather limited range of $\alpha$) and also prove a lower bound of $\Omega(\alpha e^{{\varepsilon}_{0}}/n)$. Numerically, the strongest bounds on RDP are given in [FMT20] who also demonstrate the advantages of RDP-based bounds for composition (of shuffled outputs). Another numerical approach to composition for shuffled outputs is given in [KHH21]. Their bounds rely on the Fourier accountant [KJH20] and the reduction from [FMT20].

We improve the existing bounds in two, largely independent, ways.

Our first contribution is an asymptotically tight upper bound on the Rényi DP of shuffled outputs of $n$ local randomizers. Specifically, we show that for $\alpha\leq c_{0}\frac{n}{{\varepsilon}_{0}e^{\varepsilon}_{0}}$ (for some fixed constant $c_{0}>0$) and ${\varepsilon}_{0}>1$, the RDP parameter of order $\alpha$ is $O(\alpha\frac{e^{{\varepsilon}_{0}}}{n})$. This improves on the results in [GDDKS20] both in terms of the bound and in terms of the range of $\alpha$ as they only prove their bound of $O(\alpha e^{2{\varepsilon}_{0}}/n)$ for $\alpha\leq c_{1}(\frac{n}{e^{5{\varepsilon}_{0}}})^{1/4}$. In particular, their bound can only be used for ${\varepsilon}_{0}\leq\ln(n)/5$, whereas our bound is non-trivial for ${\varepsilon}_{0}\leq\ln(n)-\ln\ln(n)$. Bounds on higher order $\alpha$’s are necessary for converting the RDP bounds to approximate DP bounds with relatively small $\delta$. We also note that for $\alpha>\frac{n{\varepsilon}_{0}}{e^{{\varepsilon}_{0}}}$, $\alpha\frac{e^{{\varepsilon}_{0}}}{n}>{\varepsilon}_{0}$ and thus our bound applies to almost the entire range of $\alpha$ where the bound $O(\alpha\frac{e^{{\varepsilon}_{0}}}{n})$ is non-trivial.

Our proof relies on a general conversion from truncated Gaussian tail bounds of the privacy loss random variable to a bound on Rényi privacy loss that might be useful in other contexts. Previously such conversion was only known for pure DP [Mir17, BS16]. We apply this general conversion to the asymptotically optimal bounds for approximate DP that we derive. We remark that for the purpose of obtaining asymptotically optimal bounds we can also apply this conversion to the bounds in [FMT20]. See Section 4 for more details.

Our second contribution is a new, stronger analysis of privacy amplification by shuffling. We follow the basic approach from [FMT20] which reduces the divergence between distribution on the outputs of an adaptive application of $n$ local ${\varepsilon}_{0}$-DP randomizers on two datasets that differ in a single element to analysis of the divergence between a fixed pair of distributions on 3 values. Informally, the reduction in [FMT20] shows that an LDP randomizer on any input can be seen as producing the output of the randomizer on either of the inputs on which the datasets differ with some probability. Thus running the randomizer on inputs that are identical in both datasets can be seen as outputting a random number of samples from the output distribution of the randomizer on the elements on which the datasets differ (referred to as “clones”).

At a high level we rely on more delicate analysis that instead of “cloning” the entire output distributions on differing elements only clones the part of those distributions where the distributions actually differ. This analysis improves the probability of producing a “clone” from $1/(2e^{{\varepsilon}_{0}})$ to $1/(1+e^{{\varepsilon}_{0}})$. For ${\varepsilon}_{0}>1$ this leads to a roughly factor 2 improvement in the expected number of “clones” which translates to roughly factor $\sqrt{2}$ improvement in the resulting bound (or allowing a factor 2 more steps of an algorithm for the same overall privacy budget). For comparison, we note that the gap between the known numerical upper and lower bounds is typically less than a factor 2 and our improvement closes most of this gap (see Figure 1(a)).

Our reduction has the property that it can exploit additional structure in the local randomizer to give improved bounds. In particular, for the standard $k$-randomized response (or $k$-RR) randomizer our reduction leads to a tight bound. We note that [FMT20] also give a reduction that can exploit the additional structure present in $k$-RR. However their analysis requires a separate reduction for this case and does not lead to a tight bound.

Preliminaries

Differential privacy (DP) is a stability notion for randomized algorithms. Intuitively, an algorithm is differentially private if the distribution on outputs doesn’t change too much when a single individual changes their data. There are several ways to formalize the notion of closeness of distributions that are commonly used to define variants of DP. The most popular are the hockey-stick divergence, used to define $({\varepsilon},\delta)$-differential privacy, and the Rényi divergence, used to define $(\rho(\alpha),\alpha)$-Rényi differential privacy (RDP).

The hockey-stick divergence between two random variables $P$ and $Q$ is defined by:

where we use the notation $P$ and $Q$ to refer to both the random variables and their probability density functions. We say that $P$ and $Q$ are $({\varepsilon},\delta)$-indistinguishable if $\max\{D_{e^{{\varepsilon}}}(P\|Q),D_{e^{{\varepsilon}}}(Q\|P)\}\leq\delta$.

For two random variables $P$ and $Q$, the Rényi divergence of $P$ and $Q$ of order $\alpha>1$ is

The hockey-stick divergence and the Rényi divergence share several important properties that make them appropriate distance measures for measuring privacy. The data processing inequality is considered a hallmark of distance measures used for measuring privacy. It states that the privacy guarantee can not be degraded by further analysis of the output of a private mechanism. All the commonly used notions of privacy satisfy the post-processing inequality, including $D_{e^{{\varepsilon}}}$ and $D^{\alpha}$.

A distance measure $D:\Delta(\mathcal{S})\times\Delta(\mathcal{S})\to[0,\infty]$ on the space of probability distributions satisfies the data processing inequality if for all distributions $P$ and $Q$ in $\Delta(\mathcal{S})$ and (possibly randomized) functions $f:\mathcal{S}\to\mathcal{S^{\prime}}$,

There are also several differential trust models of DP. We will be primarily interested in the shuffle model, but let us first introduce the more common central model and local model. In the central model [DMNS06], the data of the individuals is held by the curator. The curator is trusted to analyse the data and enforce the privacy constraint. In the local model, formally introduced in [KLNRS08], each individual (or client) randomizes their data before sending it to data curator (or server). This means that individuals are not required to trust the curator. The central model requires a high level of trust, but allows for significantly more accurate algorithms. Since it requires less trust, most deployment of DP in industry use the local DP model [EPK14, App17, DKY17, EFMRSTT20].

We say that two databases are neighboring if they differ on the data of a single individual. We’ll define the trust models with respect to the hockey-stick divergence, but note that the definitions for Rényi DP only differ in the choice of distance measure.

An algorithm $\mathcal{A}:\mathcal{D}^{n}\to\mathcal{S}$ is $({\varepsilon},\delta)$-differentially private if for all neighboring databases $X$ and $X^{\prime}$, $\mathcal{A}(X)$ and $\mathcal{A}(X^{\prime})$ are $({\varepsilon},\delta)$-indistinguishable.

In local DP, users interact with the server and send outputs of randomized algorithm. In the fully adaptive case, they can communicate with the server in an arbitrary order with adaptive interaction. Formally, a protocol satisfies local $({\varepsilon},\delta)$-DP if the transcripts of the interaction on any two pairs of neighbouring datasets are $({\varepsilon},\delta)$-indistinguishable. In this paper, we will only be considering the adaptive, single round model, where each user sends a single report to the server. In this setting, the condition on transcripts reduces to each user interacting with the server using a mechanism that is $(\epsilon,\delta)$-differentially private with respect that that users data. We call such mechanisms for the local reports of a user local randomizers.

An algorithm $\mathcal{R}\colon\mathcal{D}\to\mathcal{S}$ is $({\varepsilon},\delta)$-DP local randomizer if for all pairs $x,x^{\prime}\in\mathcal{D}$, $\mathcal{R}(x)$ and $\mathcal{R}(x^{\prime})$ are $({\varepsilon},\delta)$-indistinguishable.

Formally, an adaptive single pass $({\varepsilon},\delta)$-DP local protocol can be described by a sequence of local randomizers $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$, where $\mathcal{D}$ is the data domain, $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$ and the $i$-th user returns $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{i})$. We require that the local randomizer $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ be $({\varepsilon},\delta)$-DP for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$.

In all models, if $\delta=0$ then we will refer to an algorithm as ${\varepsilon}$-differentially private. Further, we will occasionally refer to $\delta=0$ as pure differentially private and $\delta>0$ as approximate DP.

Stronger Analysis of Privacy Amplification by Shuffling

In this section, we present a new reduction from analyzing the privacy guarantee of shuffling an adaptive series of local randomizers to analyzing the privacy guarantee of shuffling the output of a simple non-adaptive local algorithm with three outputs. Our reduction improves upon that of [FMT20], resulting in tighter numerical bounds for privacy amplification by shuffling for both approximate and Rényi DP. Specifically, we show that there exists two families of multinomial distributions P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right) and P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right) such that for any two neighbouring datasets $X_{0}$ and $X_{1}$, and any adaptive series of ${\varepsilon}_{0}$-local randomizers, there exists a post-processing function $f$ and $p\in[0,1/(e^{{\varepsilon}_{0}}+1)]$ such that f(P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right)) and f(P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right)) are identically distributed to the output of the shuffled mechanism on $X_{0}$ and $X_{1}$, respectively. As a result, the privacy loss of the general adaptive setting of shuffling is no worse than the divergence between P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right) and P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right).

Let use begin by formally defining the distributions P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right) and P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right). For any $p\in[0,1/(e^{{\varepsilon}_{0}}+1)]$, define random variables $Y_{p}$, $Y_{1,p}^{0}$ and $Y_{1,p}^{1}$ as follows

The following theorem is our improved general upper bound.

Errata: The error in the proof of Lemma 3.5 affects this theorem. It holds for a restricted class of local randomizers (see Theorem 7.1). The replacement for Lemma 3.5 (Lemma 7.3) implies a bound that depends on a particular local randomizer. For a domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a permutation $\pi$ uniformly at random, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Let $X_{0}$ and $X_{1}$ be two arbitrary neighboring datasets in $\mathcal{D}^{n}$. Then for any distance measure $D$ that satisfies the data processing inequality,

The similarity between $Q_{b}({\varepsilon}_{0})$ and P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},1/(e^{{\varepsilon}_{0}}+1)}\right) means that we can immediately obtain an analytic bound that improves on [FMT20] by a factor of about $\sqrt{2}$.

Errata: The error in the proof of Lemma 3.5 affects this theorem. It holds for a restricted class of local randomizers. This theorem with slightly worse constants appears in [FMT22]. For any domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a uniform random permutation $\pi$ over $[n]$, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Then for any $\delta\in$ such that ${\varepsilon}_{0}\leq\ln(\frac{n}{8\ln(2/\delta)}-1)$, $\mathcal{A}_{\rm s}$ is $({\varepsilon},\delta)$-DP, where

The proof of Theorem 3.1 relies on the following lemma that converts any ${\varepsilon}_{0}$-DP local randomizer to one where for each output, the probability of the output takes one of two extremal values.

[YB18, Lemma IV.4] If $\mathcal{R}:\mathcal{D}\to\mathcal{S}$ is an ${\varepsilon}$-DP local randomizer, and both $\mathcal{D}$ and $\mathcal{S}$ are finite, then there exists a finite output space $\mathcal{Z}$, a local randomizer $\mathcal{R}^{\prime}:\mathcal{D}\to\mathcal{Z}$, and a post-processing function $\Phi:\mathcal{Z}\to\mathcal{S}$ such that for all $z\in\mathcal{S}$, there exists $p_{z}\in[0,1/(e^{{\varepsilon}_{0}}+1)]$ such that for all $x\in\mathcal{D}$, $\Pr(\mathcal{R}^{\prime}(x)=z)\in\{p_{z},e^{{\varepsilon}_{0}}p_{z}\}$, and $\Phi\circ\mathcal{R^{\prime}}=\mathcal{R}$.

The proof of Lemma 3.3 is contained in the proof of Lemma IV.4 in [YB18]. For clarity we include a proof in Appendix A. A special case of such a lemma was also proved in [KOV14]. This allows us to prove the following corollary expressing randomizer outputs as mixtures of base distributions.

Given any ${\varepsilon}_{0}$-DP local randomizer $\mathcal{R}:\mathcal{D}\to\mathcal{S}$, and any $n+1$ inputs $x_{1}^{0},x_{1}^{1},x_{2},\cdots,x_{n}\in\mathcal{D}$, if $\mathcal{S}$ is finite then there exists $p\in[0,1/(e^{{\varepsilon}_{0}}+1)]$ and distributions $\mathcal{Q}_{1}^{0}$, $\mathcal{Q}_{1}^{1}$, $\mathcal{Q}_{1},\mathcal{Q}_{2},\cdots,\mathcal{Q}_{n}$ such that

Note that restricted to inputs $\{x_{1}^{0},x_{1}^{1},x_{2},\cdots,x_{n}\}$, $\mathcal{R}$ satisfies the constraints of Lemma 3.3 so there exists an ${\varepsilon}_{0}$-DP local randomizer $\mathcal{R}^{\prime}:\mathcal{D}\to\mathcal{Z}$, and post-processing function $\Phi$ such that for $z\in\mathcal{Z}$, there exists $p_{z}\in[0,1/(e^{{\varepsilon}_{0}}+1)]$ such that for all $x\in\{x_{1}^{0},x_{1}^{1},x_{2},\cdots,x_{n}\}$ $\Phi(\mathcal{R^{\prime}}(x))=\mathcal{R}(x)$, and $\Pr(\mathcal{R}^{\prime}(x)=z)\in\{e^{{\varepsilon}_{0}}p_{z},p_{z}\}$.

Let $L=\{z\in\mathcal{Z}\>|\;\Pr(\mathcal{R^{\prime}}(x_{1}^{0})=z)=e^{{\varepsilon}_{0}}p_{z}\text{ and }\Pr(\mathcal{R^{\prime}}(x_{1}^{1})=z)=p_{z}\}$ and $U=\{z\in\mathcal{S}\>|\;\Pr(\mathcal{R^{\prime}}(x_{1}^{0})=z)=p_{z}\text{ and }\Pr(\mathcal{R^{\prime}}(x_{1}^{1})=z)=e^{{\varepsilon}_{0}}p_{z}\}$. Let $M=\mathcal{Z}\backslash(L\cup U)$ and $p=\sum_{z\in L}p_{z}=\sum_{z\in U}p_{z}.$ Note that conditioned on the output lying in $L$, the distributions $\mathcal{R^{\prime}}(x_{1}^{0})$ and $\mathcal{R^{\prime}}(x_{1}^{1})$ are the same. Let $\mathcal{W}_{1}^{0}=\mathcal{R^{\prime}}(x_{1}^{0})|_{L}=\mathcal{R^{\prime}}(x_{1}^{1})|_{L}$. Similarly, let $\mathcal{W}_{1}^{1}=\mathcal{R^{\prime}}(x_{1}^{0})|_{U}=\mathcal{R^{\prime}}(x_{1}^{0})|_{U}$ and $\mathcal{W}_{1}=\mathcal{R^{\prime}}(x_{1}^{0})|_{M}=\mathcal{R^{\prime}}(x_{1}^{1})|_{M}$.Then,

Further, for all $x_{i}\in\{x_{2},\cdots,x_{n}\}$, $\mathcal{R}^{\prime}(x_{i})\geq p\mathcal{W}_{1}^{0}+p\mathcal{W}_{1}^{1}$, so there exists $\mathcal{W}_{i}$ such that

Letting $\mathcal{Q}_{1}^{0}=\Phi(\mathcal{W}_{1}^{0})$, $\mathcal{Q}_{1}^{1}=\Phi(\mathcal{W}_{1}^{1})$, $\mathcal{Q}_{1}=\Phi(\mathcal{W}_{1})$ and for all $i\in\{2,\cdots,n\}$, $\mathcal{Q}_{i}=\Phi(\mathcal{W}_{i})$, we are done. Since we must have $p+e^{{\varepsilon}_{0}}p\leq 1$, $p\in[0,1/(e^{{\varepsilon}_{0}}+1)].$ ∎

We will use $p_{\mathcal{R}}$ to denote the smallest value of $p$ for which $\mathcal{R}$ can be decomposed as in eqns (7), when $X_{0}$ and $X_{1}$ are clear from context. Intuitively, the smaller $p_{\mathcal{R}}$ is, the closer $\mathcal{R}(x_{1}^{0})$ and $\mathcal{R}(x_{1}^{1})$ are, and the more amplification we’ll see when using this local randomizer. We’ll make this formal in Lemma 5.1.

Errata: there is an error in the proof of this lemma when $p<1/(e^{{\varepsilon}_{0}}+1)$. An alternative version appears in Lemma 7.3. For a domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$, and $\mathcal{S}^{(i)}$ is finite for all $i$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a permutation $\pi$ uniformly at random, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Let $X_{0}$ and $X_{1}$ be two arbitrary neighboring datasets in $\mathcal{D}^{n}$ and $p^{*}\in[0,1/(e^{{\varepsilon}_{0}}+1)]$ be such that with respect to $X_{0}$ and $X_{1}$, $p_{\mathcal{R}^{(i)}(z_{1:i-1})}\leq p^{*}$ for all $i\in[n]$ and $z_{1:i-1}$. Then there exists a post-processing function $f$ such that $\mathcal{A}_{\rm s}(X_{0})$ is distributed identically to f(P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*}}\right)) and $\mathcal{A}_{\rm s}(X_{1})$ is distributed identically to f(P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*}}\right)).

Let $X_{0}=\{x_{1}^{0},x_{2},\cdots,x_{n}\}$ and $X_{1}=\{x_{1}^{1},x_{2},\cdots,x_{n}\}$ be two neighbouring datasets in $\mathcal{D}^{n}$. As in the proof of [FMT20, Lemma 3.3], the proof relies on a decomposition of the algorithm that shuffles the data and then applies the local randomizers, to an algorithm in which each client first reports which component of the mixture it will sample from, then applies shuffling to these reports and finally applies a post-processing step in which randomizers are applied according to the shuffled mixture component indices. The key difference between the proofs is that the behaviour of user 1 is more complicated, resulting in a more complicated post-processing function.

A description of the post-processing function is given in Algorithm 1. We claim that for $b\in\{0,1\}$, f(P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*}}\right))\stackrel{{\scriptstyle d}}{{=}}\mathcal{A}_{\rm s}(X_{b}). The key observation is that by assumption we have decompositions such that for all $t\in[n]$, $z_{1:t-1}$, there exists $p_{t}\stackrel{{\scriptstyle def}}{{=}}p_{\mathcal{R}^{(t)}(z_{1:t-1})}\in[0,p^{*}]$ such that:

Formally, define random variables $Y_{p}$, ${Y_{1}^{0}}_{p}$ and ${Y_{1}^{1}}_{p}$ as in eqn (1). Given a dataset $X_{b}$ for $b\in\{0,1\}$ we generate a sample from P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*}}\right) as follows. Client number one (holding the first element of the dataset) reports a sample from ${Y_{1}^{b}}_{p^{*}}$. Clients $2,\ldots,n$ each report an independent sample from $Y_{p^{*}}$. We then count the total number of 0s and 1s. Note that a vector containing a permutation of the users responses contains no more information than simply the number of 0s and 1s, so we can consider these two representations as equivalent. This is why in Algorithm 1, we can immediately turn the sample $(n_{0},n_{1})$ into a vector $y$ of 0s, 1s and 2s.

The mixture coefficients of the random variables $\mathcal{R}^{(i)}$ do not necessarily match those of ${Y_{1}^{0}}_{p^{*}},{Y_{1}^{1}}_{p^{*}}$ and $Y_{p^{*}}$. However, for any $p<p^{*}$ we can define a post-processing function $g(\cdot,p)$ such that $g({Y_{1}^{0}}_{p^{*}},p)={Y_{1}^{0}}_{p},g({Y_{1}^{1}}_{p^{*}},p)={Y_{1}^{0}}_{p}$ and $g(Y_{p^{*}},p)=Y_{p}$. This function is given by $g(0,p)=0$ with probability $p/p^{*}$ and 2 otherwise, $g(1,p)=1$ with probability $p/p^{*}$ and 2 otherwise, $g(2,p)=2.$

Let $y\in\{0,1,2\}^{n}$ be a permutation of the local reports given by $Y_{1,p^{*}}^{b}$ and $n-1$ copies of $Y_{p^{*}}$; recall that this is equivalent to a sample from P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*}}\right). Given the hidden permutation $\pi$, we can generate a sample from $\mathcal{A}_{\rm s}(X_{b})$ by sequentially transforming $y_{t}^{\prime}=g(y_{t},p_{\mathcal{R}^{(t)}(z_{1:t-1})})$ to obtain the correct mixture components, then sampling from the corresponding mixture component. The difficulty then lies in the fact that conditioned on a particular instantiation $y=v$, the permutation $\pi|_{y=v}$ is not independent of $b$.

where the second equality follows since there are $\binom{n-1}{n_{K}-1}$ possible choices for $K$ that include 1, and each has probability $(1-e^{{\varepsilon}_{0}}p-p)(1-2p)^{n_{K}-1}(2p)^{n-n_{K}}$, and there are $\binom{n-1}{n_{K}}$ choices for $K$ that do not include 1, and each has probability $(e^{{\varepsilon}_{0}}p+p)(1-2p)^{n_{K}}(2p)^{n-1-n_{K}}$. Any ordering of the users in $K$ is equally likely, so we can choose a random assignment. Now that we have an assignment for $K$, we can sample from the correct mixture components as desired. ∎

Theorem 3.1 is now a direct corollary of Lemma 3.5 and the data processing inequality since Corollary 3.4 implies we can always take $p^{*}=1/(e^{{\varepsilon}_{0}}+1)$.

Lemma 3.5 actually indicates that we can obtain better bounds for specific classes of local randomizers. An example of a family of local randomizers with a smaller $p^{*}$ is $k$- randomized response. In Appendix 5, we show that we can obtain tight privacy amplification by shuffling bounds for kRR directly from Lemma 3.5.

Asymptotically Optimal Bound for Rényi DP

Our bound relies on a general way to convert bounds on approximate DP for a range of $\delta$’s to a bound on RDP parameters for a certain range of moments $\alpha$. We use this general conversion together with the bounds on privacy amplification by shuffling given in Theorem 3.2 to derive our asymptotically optimal bound for RDP. We note that an asymptotically optimal bound is also implied by our conversion applied to the approximate DP bounds on privacy amplification by shuffling in [FMT20].

We start by stating our general conversion from approximate DP bounds to RDP. Previously such a conversion was proved only for pure differential privacy. Specifically, it is known that ${\varepsilon}$-DP implies $(\alpha{\varepsilon}^{2}/2,\alpha)$-RDP [Mir17, BS16]. We prove the claim under a condition on the tail of the privacy loss random variable that is essentially equivalent to approximate DP but is easier to work with.

Let $P$ and $Q$ be probability distributions over the same domain $X$ such that for some $\sigma>0,\delta_{\min}\geq 0$ and ${\varepsilon}_{0}>0$, for all $\delta>\delta_{\min}$, we have that:

and for all $x$, \mathopen{}\mathclose{{}\left|\ln\mathopen{}\mathclose{{}\left(\frac{P(x)}{Q(x)}}\right)}\right|\leq{\varepsilon}_{0}. Then, for all $\alpha\geq 1$,

In particular, if $\delta_{\min}=0$ then, for all $\alpha>1$, $D^{\alpha}(P\|Q)\leq\frac{2\alpha^{2}\sigma^{2}}{\alpha-1}$. Further, if $\delta_{\min}\leq e^{-\alpha{\varepsilon}_{0}}\cdot\alpha^{2}\sigma^{2}/4$ then, for all $\alpha>1$,

Let $Z$ be a random variable such that for every $t>0$,

Let $Z(x)$ denote \ln\mathopen{}\mathclose{{}\left(\frac{P(x)}{Q(x)}}\right). Then, by the assumptions, for all $0<t<\sigma\sqrt{\ln(1/\delta_{\min})}$, we have that:

In addition, for all $x\in X$, $|Z(x)|\leq{\varepsilon}_{0}$.

For ${\varepsilon}_{\max}=\sigma\sqrt{\ln(1/\delta_{\min})}$, we denote by $Z^{\prime}(x)$, $Z(x)$ truncated to the interval $[-{\varepsilon}_{\max},{\varepsilon}_{\max}]$, that is $Z^{\prime}(x)=\max\{-{\varepsilon}_{\max},\min\{{\varepsilon}_{\max},Z(x)\}\}$. We note that now, for all $t>0$, we have that:

By Lemma 4.2 we have that, for all $\alpha>0$,

where we used the fact that $\mbox{KL}(Q\|P)$ is always non-negative. This shows the first part of the claim. Now if $\delta_{\min}\leq e^{-\alpha{\varepsilon}_{0}}\cdot\alpha^{2}\sigma^{2}/4$ then

where we used that for $a\geq 0$ and any $b$, $e^{a}+b=e^{a}(1+b/e^{a})\leq e^{a}(1+b)\leq e^{a}e^{b}=e^{a+b}$. By definition of $D^{\alpha}$, we now have that $D^{\alpha}(P\|Q)\leq\frac{3\alpha^{2}\sigma^{2}}{\alpha-1}$. ∎

We note that, for $\alpha\geq 2$, $\frac{\alpha}{\alpha-1}\leq 2$. Thus, for $\alpha\geq 2$, $D^{\alpha}(P\|Q)\leq 6\alpha\sigma^{2}$ and for $\alpha\in$ we can simply upper-bound $D^{\alpha}(P\|Q)\leq D^{2}(P\|Q)\leq 12\sigma^{2}$.

The tail bound in the condition of Theorem 4.1 is somewhat stronger than what is implied by $(\sqrt{\ln(1/\delta)}\cdot\sigma,2\delta)$-DP. However, $D_{e^{\varepsilon}}(P\|Q)\leq\delta$ and $D_{e^{\varepsilon}}(Q\|P)\leq\delta$ imply that $\Pr[|\ln(\frac{P}{Q})|\geq 2{\varepsilon}]\leq 2\delta/(e^{2{\varepsilon}}-e^{\varepsilon})\leq 2\delta/\epsilon$ [CKS20, Lemma 9]. Thus the conversion can be applied to $(\sqrt{\ln(1/\delta)}\cdot\sigma,2\delta)$-DP with small adjustements in the final bounds. For our application we bypass the need to convert from the hockey-stick divergence to the tail bound by directly proving a bound on the tail of privacy loss random variable in Lemma A.4 (which also implies Theorem 3.2). This gives us the following corollary (the proof can be found in Appendix B).

Errata: the proof of this theorem was affected by the error in the proof of Lemma 3.5. However, the theorem still holds with a slightly different constant by using results from [FMT22]. See Corollary 7.2 for the updated constants. For any domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a uniform random permutation $\pi$ over $[n]$, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Then there exists a constant $c$ such that for any $\alpha<\frac{n}{16{\varepsilon}_{0}e^{\varepsilon}_{0}}$, $\mathcal{A}_{\rm s}$ is $(\alpha\rho,\alpha)$-RDP, where

In particular, for ${\varepsilon}_{0}\geq 1$,$\rho\leq\frac{ce^{{\varepsilon}_{0}}}{n}$.

Improved Bounds for Specific Randomizers

In Section 3 we focused on a general amplification by shuffling bound that holds for all sets of local randomizers. Lemma 3.5 actually indicates that we can obtain better bounds for specific classes of local randomizers. Namely, when $p$ as defined in Lemma 3.5 is less than $1/(e^{{\varepsilon}_{0}}+1)$. The following lemma makes explicit the fact that the smaller $p^{*}$ is, the more amplification we can obtain. Given two random variables $X$ and $Y$, we will use the notation $X\stackrel{{\scriptstyle d}}{{=}}Y$ to denote that $X$ and $Y$ have the same distribution. That is if $X$ is a random variable over a finite space $\mathcal{S}$ and $Y$ is a random variable over a finite space $\mathcal{S}^{\prime}$ then $X\stackrel{{\scriptstyle d}}{{=}}Y$ if there exists a invertible mapping $g$ such that for all $s\in\mathcal{S}$, $\Pr(X=s)=\Pr(Y=g(s))$.

For any $p,p^{\prime}\in$ and ${\varepsilon}>0$, if $p<p^{\prime}$ then

where $\mathcal{U}_{[k]}$ is the uniform distribution over $[k]$. That is, with probability $\frac{e^{{\varepsilon}_{0}}-1}{e^{{\varepsilon}_{0}}+k-1}$ the true data point is reported, and otherwise a random value is reported.

Let $X_{0}$ and $X_{1}$ be neighbouring datasets. If for all $i\in[n]$, $\mathcal{R}^{(i)}(z_{1:i-1},x)=\texttt{kRR}(f^{(i)}(z_{1:i-1},x))$, then for all $i$, the probability density function of $\mathcal{R}^{(i)}$ only takes on two values $e^{{\varepsilon}_{0}}p$ and $p$ where $p=1/(e^{{\varepsilon}_{0}}+k-1)$. Thus, as in Corollary 3.4, this allows us to show that $p_{\mathcal{R}^{(i)}(z_{1:i-1})}\leq 1/(e^{{\varepsilon}0}+k-1)$ and hence by Lemma 3.5 and the data processing inequality, D(X_{0},X_{1})\leq D(P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right),P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p}\right)) as required. ∎

Numerical Results

In this section, we provide a numerical evaluation of our bound.

In Figure 1(a), This work is the bound from Theorem 3.1 with the hockey-stick divergence computed numerically. We compare to the best numerical amplification bounds from prior work by [FMT20] (FMT’20) FMT’20 was produced using code released by Feldman, McMillan and Talwar at https://github.com/apple/ml-shuffling-amplification. We also compare to the lower bound produced by computing the privacy amplification for the specific local randomizers 2RR (2RR, lower bound) and 3RR (3RR, lower bound). Figure 1(b) compares the bound presented in this work to that of [FMT20]. As expected, our new bound is tighter than those in [FMT20] in every regime. The deviation between the two bounds is largest when ${\varepsilon}_{0}$ is large. As ${\varepsilon}_{0}$ increases, the upper bound presented in this work approaches the lower bound obtained by directly computing the privacy amplification bounds for the specific mechanisms 2RR and 3RR. The peak of the "This work" graph, where the upper bound from this work is furthest from the lower bound occurs exactly at the point when the 3RR lower bound starts dominating the 2RR lower bound. That is, to the left of the peak, 3RR amplifies better than 2RR, and to the right of the peak, 2RR amplifies better than 3RR.

Our experiments running on a 2021 MacBook Pro took 30 minutes for $n=1,000,000$ (in SM), and 20 minutes for $n=1000$. The bulk of this time is spent on computing our lower bounds. The upper bound computation for a fixed ${\varepsilon}_{0}$ and $n=10^{6}$ takes about 1 minute. The lower bound for 2RR similarly runs is about a minute for $n=10^{6}$. The lower bound for 3RR runs in about 3 minutes for $n=10^{4}$, we did not run this algorithm for larger values of $n$.

2 Rényi Differential Privacy

In Figure 2 we show the privacy amplification bound for Rényi differential privacy as a function of $\alpha$. As expected, our bound always improves over [FMT20], and is very close to the lower bound for some settings of $\alpha$.

In Figure 3, we plot the privacy guarantee for $T$ adaptively composed outputs of a shuffler with each shuffler operating on $n$, $\epsilon_{0}$-DP local randomizers. The advanced composition theorem quantifies the privacy guarantee after composing $T$ $(\epsilon,\delta)$-DP algorithms. However, we can obtain tighter privacy guarantees by computing the composition guarantees in terms of RDP, then converting back to approximate DP [ACGMMTZ16]. In Figure 3, we compare two methods for computing the resulting privacy guarantee. This work, via Approximate DP computes the amplification in terms of approximate DP then uses advanced composition [KOV15, Theorem 4.3]. This work, via RDP computes the amplification in terms of RDP, using composition in terms of RDP [Mir17], then converts to Approximate DP [CKS20, Proposition 12]. We also compare to the Rényi composition version of the best known prior bounds [FMT20].

3 k𝑘k-randomised response

In Section 5 we showed that the analysis presented in this paper can obtain tight privacy amplification by shuffling bounds for the specific randomizers kRR. In Figure 5 we can see that the improved bounds for kRR are indeed tighter than the general bound, and the privacy guarantee on the output of the shuffler improves as $k$ increases, as expected. We also compare to the best known bound from prior work [BBGN19].

Errata

Let the set $K$ be as defined in the proof of Lemma 3.5. The problem comes from deciding whether $1\in K$. The proof had assumed that the probability that $1\in K$ only depended on $n_{2}$ and was the same regardless of whether the input was $X_{0}$ or $X_{1}$ since $\Pr(Y_{1,p}^{0}=2)=\Pr(Y_{1,p}^{1}=2)$. However, the probability that $1\in K$ actually also depends on $n_{0}$ and $n_{1}$, whose distribution depends on whether the input database was $X_{0}$ or $X_{1}$. For example, if $n_{0}>n_{1}$, then the probability $1\in K$ is higher if the input is $X_{1}$ than $X_{0}$.

This error does not arise if the local randomizers used always satisfy a decomposition with $p=\frac{1}{e^{{\varepsilon}_{0}}+1}$, since in this setting $Y_{1,p}^{0}$ and $Y_{1,p}^{1}$ never output $2$, and hence this issue never arises.

2 A General Statement for a Restricted Class of Local Randomizers

Let $\mathcal{E}_{{{\varepsilon}_{0}}}$ be the set of all local randomizers that satisfy the decomposition in Corollary 3.4 with $p=\frac{1}{e^{{\varepsilon}_{0}}+1}$. That is, a local randomizer $\mathcal{R}\colon\mathcal{D}\to\mathcal{S}$ is in $\mathcal{E}_{{{\varepsilon}_{0}}}$ if and only if it is an ${\varepsilon}_{0}$-DP local randomizer and for any $n+1$ inputs $x_{1}^{0},x_{1}^{1},x_{2},\ldots,x_{n}\in\mathcal{D}$, there lexists distributions $\mathcal{Q}_{1}^{0}$, $\mathcal{Q}_{1}^{1}$, $\mathcal{Q}_{2},\ldots,\mathcal{Q}_{n}$ such that

Since Lemma 3.5 still holds for this set of local randomizers, the upper bounds in Theorem 3.1, Theorem 3.2 and Corollary 4.3 still hold for local randomizers in this set.

For a domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)\in\mathcal{E}_{{{\varepsilon}_{0}}}$ for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a permutation $\pi$ uniformly at random, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Let $X_{0}$ and $X_{1}$ be two arbitrary neighboring datasets in $\mathcal{D}^{n}$. Then for any distance measure $D$ that satisfies the data processing inequality,

Since Theorem 3.2 and Corollary 4.3 are bounds on D\mathopen{}\mathclose{{}\left(P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0}}\right)\Big{\|}P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0}}\right)}\right), the bounds provided in these results hold for the same set-up at Theorem 7.1.

where $x_{1}^{0}=1,x_{1}^{1}=2$ and $x_{2}=3$.

3 Asymptotically Optimal Bound for Rényi DP

Here we restate Corollary 4.3 with the corrected constant (in the condition on $\alpha$) . The proof now relies on the reduction in [FMT20] (which is identical up to a factor of at most 2 to the one claimed in Theorem 3.1). The proof is in Appendix B.

For any domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a uniform random permutation $\pi$ over $[n]$, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Then there exists a constant $c$ such that for any $\alpha<\frac{n}{32{\varepsilon}_{0}e^{\varepsilon}_{0}}$, $\mathcal{A}_{\rm s}$ is $(\alpha\rho,\alpha)$-RDP, where

In particular, for ${\varepsilon}_{0}\geq 1$,$\rho\leq\frac{ce^{{\varepsilon}_{0}}}{n}$.

4 Improved Bounds for Specific Randomizers

Corollary 3.4 states that such a decomposition always exists with $q=0$. With a slight modification to that proof, we can show that such a decomposition always exists with $q\geq e^{-{\varepsilon}}(1-p-e^{{\varepsilon}}p)$. We begin by formally defining the distributions P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p,q}\right) and P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p,q}\right). Define the random variable $Y_{p,q}$

For $b\in\{0,1\}$, to obtain a sample from P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p,q}\right), sample one copy from $Y_{1,p}^{b}$ (as originally defined in eq. (1)) and $n-1$ copies of $Y_{p,q}$, then output $(n_{0},n_{1},n_{2})$ where $n_{0},n_{1}$ and $n_{2}$ are the total number of 0s, 1s and 2s, respectively.

For a domain $\mathcal{D}$, let $\mathcal{R}^{(i)}:\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}\times\mathcal{D}\to\mathcal{S}^{(i)}$ for $i\in[n]$ (where $\mathcal{S}^{(i)}$ is the range space of $\mathcal{R}^{(i)}$, and $\mathcal{S}^{(i)}$ is finite for all $i$) be a sequence of algorithms such that $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ is an ${\varepsilon}_{0}$-DP local randomizer for all values of auxiliary inputs $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$. Let $\mathcal{A}_{\rm s}:\mathcal{D}^{n}\to\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(n)}$ be the algorithm that given a dataset $x_{1:n}\in\mathcal{D}^{n}$, samples a permutation $\pi$ uniformly at random, then sequentially computes $z_{i}=\mathcal{R}^{(i)}(z_{1:i-1},x_{\pi(i)})$ for $i\in[n]$ and outputs $z_{1:n}$. Let $X_{0}$ and $X_{1}$ be two arbitrary neighboring datasets in $\mathcal{D}^{n}$. Let $(p^{*},q^{*})$ be such that for all $i\in[n]$ and $z_{1:i-1}\in\mathcal{S}^{(1)}\times\cdots\times\mathcal{S}^{(i-1)}$, $\mathcal{R}^{(i)}(z_{1:i-1},\cdot)$ satisfies eqn (9) with $(p,q)$ such that $p<p^{*}$ and $q>q^{*}+2(p^{*}-p)$. Then there exists a post-processing function $f$ such that $\mathcal{A}_{\rm s}(X_{0})$ is distributed identically to f(P_{0}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*},q^{*}}\right)) and $\mathcal{A}_{\rm s}(X_{1})$ is distributed identically to f(P_{1}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*},q^{*}}\right)).

The proof of Lemma 7.3 is very similar to the (flawed) proof of Lemma 3.5. The key difference is that we only need to assign identities to users who output “3”, and user 1 never outputs “3”.

Let $X_{0}=\{x_{1}^{0},x_{2},\cdots,x_{n}\}$ and $X_{1}=\{x_{1}^{1},x_{2},\cdots,x_{n}\}$ be two neighbouring datasets in $\mathcal{D}^{n}$. A description of the post-processing function is given in Algorithm 2. We claim that for $b\in\{0,1\}$, f(P_{b}\mathopen{}\mathclose{{}\left({\varepsilon}_{0},p^{*},q^{*}}\right))\stackrel{{\scriptstyle d}}{{=}}\mathcal{A}_{\rm s}(X_{b}). The key observation is that by assumption we have decompositions such that for all $t\in[n]$ and $z_{1:t-1}$, there exists $(p_{\mathcal{R}^{(t)}(z_{1:t-1})},q_{\mathcal{R}^{(t)}(z_{1:t-1})})$ such that $p_{\mathcal{R}^{(t)}(z_{1:t-1})}\leq p^{*}$ and $q_{\mathcal{R}^{(t)}(z_{1:t-1})}\geq q^{*}+2(p^{*}-p_{\mathcal{R}^{(t)}(z_{1:t-1})})$ and letting $p_{t}:=p_{\mathcal{R}^{(t)}(z_{1:t-1})}$ and $q_{t}:=q_{\mathcal{R}^{(t)}(z_{1:t-1})}$: