随着机器学习算法在关键决策过程中的敏感数据上部署，它们也是私人和公平的越来越重要的。在本文中，我们表明，当数据具有长尾结构时，不可能构建既私有的学习算法，又无法对少数族裔亚人群产生更高的准确性。我们进一步表明，即使有严格的隐私要求，放松的整体准确性也会导致良好的公平性。为了证实我们在实践中的理论结果，我们使用各种综合，视觉〜（\ cifar和celeba）以及表格〜（法学院）数据集和学习算法提供了一组广泛的实验结果。

State-of-the-art results on image recognition tasks are achieved using over-parameterized learning algorithms that (nearly) perfectly fit the training set and are known to fit well even random labels. This tendency to memorize the labels of the training data is not explained by existing theoretical analyses. Memorization of the training data also presents significant privacy risks when the training data contains sensitive personal information and thus it is important to understand whether such memorization is necessary for accurate learning.We provide the first conceptual explanation and a theoretical model for this phenomenon. Specifically, we demonstrate that for natural data distributions memorization of labels is necessary for achieving closeto-optimal generalization error. Crucially, even labels of outliers and noisy labels need to be memorized. The model is motivated and supported by the results of several recent empirical works. In our model, data is sampled from a mixture of subpopulations and our results show that memorization is necessary whenever the distribution of subpopulation frequencies is long-tailed. Image and text data is known to be long-tailed and therefore our results establish a formal link between these empirical phenomena. Our results allow to quantify the cost of limiting memorization in learning and explain the disparate effects that privacy and model compression have on different subgroups.

Machine learning models are often susceptible to adversarial perturbations of their inputs. Even small perturbations can cause state-of-the-art classifiers with high "standard" accuracy to produce an incorrect prediction with high confidence. To better understand this phenomenon, we study adversarially robust learning from the viewpoint of generalization. We show that already in a simple natural data model, the sample complexity of robust learning can be significantly larger than that of "standard" learning. This gap is information theoretic and holds irrespective of the training algorithm or the model family. We complement our theoretical results with experiments on popular image classification datasets and show that a similar gap exists here as well. We postulate that the difficulty of training robust classifiers stems, at least partially, from this inherently larger sample complexity.

在监督的学习中，已经表明，在许多情况下，数据中的标签噪声可以插值而不会受到测试准确性的处罚。我们表明，插值标签噪声会引起对抗性脆弱性，并证明了第一个定理显示标签噪声和对抗性风险在数据分布方面的依赖性。我们的结果几乎是尖锐的，而没有考虑学习算法的电感偏差。我们还表明，感应偏置使标签噪声的效果更强。

最大信息系数（MIC）是一个强大的统计量，可以识别变量之间的依赖性。但是，它可以应用于敏感数据，并且发布可能会泄漏私人信息。作为解决方案，我们提出算法以提供差异隐私的方式近似麦克风。我们表明，经典拉普拉斯机制的自然应用产生的精度不足。因此，我们介绍了MICT统计量，这是一种新的MIC近似值，与差异隐私更加兼容。我们证明MICS是麦克风的一致估计器，我们提供了两个差异性私有版本。我们对各种真实和合成数据集进行实验。结果表明，私人微统计数据极大地超过了拉普拉斯机制的直接应用。此外，对现实世界数据集的实验显示出准确性，当样本量至少适中时可用。

尽管过度参数化的模型已经在许多机器学习任务上表现出成功，但与培训不同的测试分布的准确性可能会下降。这种准确性下降仍然限制了在野外应用机器学习的限制。同时，重要的加权是一种处理分配转移的传统技术，已被证明在经验和理论上对过度参数化模型的影响较小甚至没有影响。在本文中，我们提出了重要的回火来改善决策界限，并为过度参数化模型取得更好的结果。从理论上讲，我们证明在标签移位和虚假相关设置下，组温度的选择可能不同。同时，我们还证明正确选择的温度可以解脱出少数群体崩溃的分类不平衡。从经验上讲，我们使用重要性回火来实现最严重的小组分类任务的最新结果。

解决机器学习模型的公平关注是朝着实际采用现实世界自动化系统中的至关重要的一步。尽管已经开发了许多方法来从数据培训公平模型，但对这些方法对数据损坏的鲁棒性知之甚少。在这项工作中，我们考虑在最坏情况下的数据操作下进行公平意识学习。我们表明，在某些情况下，对手可能会迫使任何学习者返回过度偏见的分类器，无论样本量如何，有或没有降解的准确性，并且多余的偏见的强度会增加数据中数据不足的受保护组的学习问题，而数据中有代表性不足的组。我们还证明，我们的硬度结果紧密到不断的因素。为此，我们研究了两种自然学习算法，以优化准确性和公平性，并表明这些算法在损坏比和较大数据限制中受保护的群体频率方面享有订单最佳的保证。

We establish a simple connection between robust and differentially-private algorithms: private mechanisms which perform well with very high probability are automatically robust in the sense that they retain accuracy even if a constant fraction of the samples they receive are adversarially corrupted. Since optimal mechanisms typically achieve these high success probabilities, our results imply that optimal private mechanisms for many basic statistics problems are robust. We investigate the consequences of this observation for both algorithms and computational complexity across different statistical problems. Assuming the Brennan-Bresler secret-leakage planted clique conjecture, we demonstrate a fundamental tradeoff between computational efficiency, privacy leakage, and success probability for sparse mean estimation. Private algorithms which match this tradeoff are not yet known -- we achieve that (up to polylogarithmic factors) in a polynomially-large range of parameters via the Sum-of-Squares method. To establish an information-computation gap for private sparse mean estimation, we also design new (exponential-time) mechanisms using fewer samples than efficient algorithms must use. Finally, we give evidence for privacy-induced information-computation gaps for several other statistics and learning problems, including PAC learning parity functions and estimation of the mean of a multivariate Gaussian.

Concentrated differential privacy" was recently introduced by Dwork and Rothblum as a relaxation of differential privacy, which permits sharper analyses of many privacy-preserving computations. We present an alternative formulation of the concept of concentrated differential privacy in terms of the Rényi divergence between the distributions obtained by running an algorithm on neighboring inputs. With this reformulation in hand, we prove sharper quantitative results, establish lower bounds, and raise a few new questions. We also unify this approach with approximate differential privacy by giving an appropriate definition of "approximate concentrated differential privacy."

我们给出了第一个多项式算法来估计$ d $ -variate概率分布的平均值，从$ \ tilde {o}（d）$独立的样本受到纯粹的差异隐私的界限。此问题的现有算法无论是呈指数运行时间，需要$ \ OMEGA（D ^ {1.5}）$样本，或仅满足较弱的集中或近似差分隐私条件。特别地，所有先前的多项式算法都需要$ d ^ {1+ \ omega（1）} $ samples，以保证“加密”高概率，1-2 ^ { - d ^ {\ omega（1） $，虽然我们的算法保留$ \ tilde {o}（d）$ SAMPS复杂性即使在此严格设置中也是如此。我们的主要技术是使用强大的方块方法（SOS）来设计差异私有算法的新方法。算法的证据是在高维算法统计数据中的许多近期作品中的一个关键主题 - 显然需要指数运行时间，但可以通过低度方块证明可以捕获其分析可以自动变成多项式 - 时间算法具有相同的可证明担保。我们展示了私有算法的类似证据现象：工作型指数机制的实例显然需要指数时间，但可以用低度SOS样张分析的指数时间，可以自动转换为多项式差异私有算法。我们证明了捕获这种现象的元定理，我们希望在私人算法设计中广泛使用。我们的技术还在高维度之间绘制了差异私有和强大统计数据之间的新连接。特别是通过我们的校验算法镜头来看，几次研究的SOS证明在近期作品中的算法稳健统计中直接产生了我们差异私有平均估计算法的关键组成部分。

We study the best-arm identification problem in multi-armed bandits with stochastic, potentially private rewards, when the goal is to identify the arm with the highest quantile at a fixed, prescribed level. First, we propose a (non-private) successive elimination algorithm for strictly optimal best-arm identification, we show that our algorithm is $\delta$-PAC and we characterize its sample complexity. Further, we provide a lower bound on the expected number of pulls, showing that the proposed algorithm is essentially optimal up to logarithmic factors. Both upper and lower complexity bounds depend on a special definition of the associated suboptimality gap, designed in particular for the quantile bandit problem, as we show when the gap approaches zero, best-arm identification is impossible. Second, motivated by applications where the rewards are private, we provide a differentially private successive elimination algorithm whose sample complexity is finite even for distributions with infinite support-size, and we characterize its sample complexity. Our algorithms do not require prior knowledge of either the suboptimality gap or other statistical information related to the bandit problem at hand.

我们介绍了一个普遍的框架，用于表征差异隐私保证的统计估算问题的统计效率。我们的框架，我们呼叫高维建议 - 试验释放（HPTR），在三个重要组件上建立：指数机制，强大的统计和提议 - 试验释放机制。将所有这些粘在一起是恢复力的概念，这是强大的统计估计的核心。弹性指导算法的设计，灵敏度分析和试验步骤的成功概率分析。关键识别是，如果我们设计了一种仅通过一维鲁棒统计数据访问数据的指数机制，则可以大大减少所产生的本地灵敏度。使用弹性，我们可以提供紧密的本地敏感界限。这些紧张界限在几个案例中容易转化为近乎最佳的实用程序。我们给出了将HPTR应用于统计估计问题的给定实例的一般配方，并在平均估计，线性回归，协方差估计和主成分分析的规范问题上证明了它。我们介绍了一般的公用事业分析技术，证明了HPTR几乎在文献中研究的若干场景下实现了最佳的样本复杂性。

Learned classifiers should often possess certain invariance properties meant to encourage fairness, robustness, or out-of-distribution generalization. However, multiple recent works empirically demonstrate that common invariance-inducing regularizers are ineffective in the over-parameterized regime, in which classifiers perfectly fit (i.e. interpolate) the training data. This suggests that the phenomenon of ``benign overfitting," in which models generalize well despite interpolating, might not favorably extend to settings in which robustness or fairness are desirable. In this work we provide a theoretical justification for these observations. We prove that -- even in the simplest of settings -- any interpolating learning rule (with arbitrarily small margin) will not satisfy these invariance properties. We then propose and analyze an algorithm that -- in the same setting -- successfully learns a non-interpolating classifier that is provably invariant. We validate our theoretical observations on simulated data and the Waterbirds dataset.

It is widely believed that given the same labeling budget, active learning algorithms like uncertainty sampling achieve better predictive performance than passive learning (i.e. uniform sampling), albeit at a higher computational cost. Recent empirical evidence suggests that this added cost might be in vain, as uncertainty sampling can sometimes perform even worse than passive learning. While existing works offer different explanations in the low-dimensional regime, this paper shows that the underlying mechanism is entirely different in high dimensions: we prove for logistic regression that passive learning outperforms uncertainty sampling even for noiseless data and when using the uncertainty of the Bayes optimal classifier. Insights from our proof indicate that this high-dimensional phenomenon is exacerbated when the separation between the classes is small. We corroborate this intuition with experiments on 20 high-dimensional datasets spanning a diverse range of applications, from finance and histology to chemistry and computer vision.

Hawkes流程最近从机器学习社区中引起了人们对建模事件序列数据的多功能性的越来越多的关注。尽管它们具有丰富的历史可以追溯到几十年前，但其某些属性（例如用于学习参数的样本复杂性和释放差异化私有版本的样本复杂性）尚未得到彻底的分析。在这项工作中，我们研究了具有背景强度$ \ mu $和激发功能$ \ alpha e^{ - \ beta t} $的标准霍克斯进程。我们提供$ \ mu $和$ \ alpha $的非私人和差异私人估计器，并在两种设置中获得样本复杂性结果以量化隐私成本。我们的分析利用了霍克斯过程的强大混合特性和经典的中央限制定理的结果，结果较弱的随机变量。我们在合成数据集和真实数据集上验证了我们的理论发现。

A flexible method is developed to construct a confidence interval for the frequency of a queried object in a very large data set, based on a much smaller sketch of the data. The approach requires no knowledge of the data distribution or of the details of the sketching algorithm; instead, it constructs provably valid frequentist confidence intervals for random queries using a conformal inference approach. After achieving marginal coverage for random queries under the assumption of data exchangeability, the proposed method is extended to provide stronger inferences accounting for possibly heterogeneous frequencies of different random queries, redundant queries, and distribution shifts. While the presented methods are broadly applicable, this paper focuses on use cases involving the count-min sketch algorithm and a non-linear variation thereof, to facilitate comparison to prior work. In particular, the developed methods are compared empirically to frequentist and Bayesian alternatives, through simulations and experiments with data sets of SARS-CoV-2 DNA sequences and classic English literature.

In this work, we give efficient algorithms for privately estimating a Gaussian distribution in both pure and approximate differential privacy (DP) models with optimal dependence on the dimension in the sample complexity. In the pure DP setting, we give an efficient algorithm that estimates an unknown $d$-dimensional Gaussian distribution up to an arbitrary tiny total variation error using $\widetilde{O}(d^2 \log \kappa)$ samples while tolerating a constant fraction of adversarial outliers. Here, $\kappa$ is the condition number of the target covariance matrix. The sample bound matches best non-private estimators in the dependence on the dimension (up to a polylogarithmic factor). We prove a new lower bound on differentially private covariance estimation to show that the dependence on the condition number $\kappa$ in the above sample bound is also tight. Prior to our work, only identifiability results (yielding inefficient super-polynomial time algorithms) were known for the problem. In the approximate DP setting, we give an efficient algorithm to estimate an unknown Gaussian distribution up to an arbitrarily tiny total variation error using $\widetilde{O}(d^2)$ samples while tolerating a constant fraction of adversarial outliers. Prior to our work, all efficient approximate DP algorithms incurred a super-quadratic sample cost or were not outlier-robust. For the special case of mean estimation, our algorithm achieves the optimal sample complexity of $\widetilde O(d)$, improving on a $\widetilde O(d^{1.5})$ bound from prior work. Our pure DP algorithm relies on a recursive private preconditioning subroutine that utilizes the recent work on private mean estimation [Hopkins et al., 2022]. Our approximate DP algorithms are based on a substantial upgrade of the method of stabilizing convex relaxations introduced in [Kothari et al., 2022].

深度神经网络（DNNS）铰接对大型数据集的可用性的最新成功;但是，对此类数据集的培训经常为敏感培训信息构成隐私风险。在本文中，我们的目标是探讨生成模型和梯度稀疏性的力量，并提出了一种可扩展的隐私保留生成模型数据标准。与标准展示隐私保留框架相比，允许教师对一维预测进行投票，在高维梯度向量上投票在隐私保存方面具有挑战性。随着需要尺寸减少技术，我们需要在（1）之间的改进之间导航精致的权衡空间，并进行SGD收敛的放缓。为了解决这一点，我们利用通信高效学习，并通过将顶-K压缩与相应的噪声注入机构相结合，提出一种新的噪声压缩和聚集方法TopAGG。理论上，我们证明了DataLens框架保证了其生成数据的差异隐私，并提供了其收敛性的分析。为了展示DataLens的实际使用情况，我们对不同数据集进行广泛的实验，包括Mnist，Fashion-Mnist和高维Celeba，并且我们表明，DataLens显着优于其他基线DP生成模型。此外，我们改进了所提出的Topagg方法，该方法是DP SGD培训的主要构建块之一，并表明它能够在大多数情况下实现比最先进的DP SGD方法更高的效用案件。我们的代码在HTTPS://github.com/ai-secure/datalens公开提供。

我们提出并分析了算法，以解决用户级差分隐私约束下的一系列学习任务。用户级DP仅保证只保证个人样本的隐私，而是保护用户的整个贡献（$ M \ GE 1 $ Samples），而不是对信息泄漏提供更严格但更现实的保护。我们表明，对于高维平均估计，具有平稳损失，随机凸优化和学习假设类别的经验风险最小化，具有有限度量熵，隐私成本随着用户提供的$ O（1 / \ SQRT {M}）$减少更多样本。相比之下，在增加用户数量$ N $时，隐私成本以较快的价格降低（1 / n）$率。我们将这些结果与下界相提并论，显示了我们算法的最低限度估计和随机凸优化的算法。我们的算法依赖于私有平均估计的新颖技术，其任意维度与误差缩放为浓度半径$ \ tai $的分布而不是整个范围。

构建差异私有（DP）估计器需要得出观察结果的最大影响，如果在输入数据或估计器上没有外源性界限，这可能很困难，尤其是在高维度设置中。本文表明，在这方面，统计深度（即半空间深度和回归深度）的标准概念在这方面尤其有利，这在于单个观察值的最大影响很容易分析，并且该值通常很低。这用于使用这两个统计深度概念的最大值来激励新的近似DP位置和回归估计器。还提供了近似DP回归估计器的更高效的变体。此外，为了避免要求用户对估计和/或观察结果指定先验界限，描述了这些DP机制的变体，即满足随机差异隐私（RDP），这是Hall，Wasserman和Wasserman和Wasserman和Wasserman提供的差异隐私的放松Rinaldo（2013）。我们还提供了此处提出的两种DP回归方法的模拟。当样本量至少为100-200或隐私性损失预算足够高时，提出的估计器似乎相对于现有的DP回归方法表现出色。