Abstract:Learning problems form an important category of computational tasks that generalizes many of the computations researchers apply to large real-life data sets. We ask, What concept classes can be learned privately, namely, by an algorithm whose output does not depend too heavily on any one input or specific training example? More precisely, we investigate learning algorithms that satisfy differential privacy, a notion that provides strong confidentiality guarantees in contexts where aggregate information is released about a database containing sensitive information about individuals. Our goal is a broad understanding of the resources required for private learning in terms of samples, computation time, and interaction. We demonstrate that, ignoring computational constraints, it is possible to privately agnostically learn any concept class using a sample size approximately logarithmic in the cardinality of the concept class. Therefore, almost anything learnable is learnable privately: specifically, if a concept class is learnable by a (nonprivate) algorithm with polynomial sample complexity and output size, then it can be learned privately using a polynomial number of samples. We also present a computationally efficient private probabilistically approximately correct learner for the class of parity functions. This result dispels the similarity between learning with noise and private learning (both must be robust to small changes in inputs), since parity is thought to be very hard to learn given random classification noise. Local (or randomized response) algorithms are a practical class of private algorithms that have received extensive investigation. We provide a precise characterization of local private learning algorithms. We show that a concept class is learnable by a local algorithm if and only if it is learnable in the statistical query (SQ) model. Therefore, for local private learning algorithms, the similarity to learning with noise is stronger: local learning is equivalent to SQ learning, and SQ algorithms include most known noise-tolerant learning algorithms. Finally, we present a separation between the power of interactive and noninteractive local learning algorithms. Because of the equivalence to SQ learning, this result also separates adaptive and nonadaptive SQ learning.

Is Private Learning Possible with Instance Encoding?

Private Learning with Public Features

Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information

Learning Privately with Labeled and Unlabeled Examples

What Can We Learn Privately?

PEOPL: Characterizing Privately Encoded Open Datasets with Public Labels

Limits of Private Learning with Access to Public Data

Training Private Models That Know What They Don't Know

The Privacy Onion Effect: Memorization is Relative

The Trade-Offs of Private Prediction

Protection Against Reconstruction and Its Applications in Private Federated Learning

On InstaHide, Phase Retrieval, and Sparse Matrix Factorization

Private Everlasting Prediction

AttrLeaks on the Edge: Exploiting Information Leakage from Privacy-Preserving Co-inference

Quantum Privacy-Preserving Perceptron

Can Foundation Models Help Us Achieve Perfect Secrecy?

Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission

Privacy-Preserving Language Model Inference with Instance Obfuscation

Learning in the Dark: Privacy-Preserving Machine Learning using Function Approximation

InstaHide's Sample Complexity When Mixing Two Private Images

Deletion inference, reconstruction, and compliance in machine (un)learning