聚合时序数据，如流量流和站点占用，在跨时占据人口中的统计数据。这些数据可以对理解给定人群的趋势来说可能是深切的，但也构成了重大隐私风险，可能揭示了谁在哪里才能在哪里。产生满足差分隐私（DP）的标准定义的数据系列的私有版本是由于单个参与者可以在序列上具有大量的挑战：如果个体可以贡献到每次步骤，则添加剂噪声量需要满足隐私，随着采样的时间次数，线性增加。因此，如果信号跨越持续时间长或过采样，则必须添加过多的噪声，淹没潜在的趋势。但是，在许多应用中，个人实际上无法参加每次步骤。当这种情况是这种情况时，我们观察到，可以通过回顾和/或过滤时间来减少单个参与者（灵敏度）的影响，同时仍会满足隐私要求。使用小说分析，我们表现出敏感性的显着降低，并提出了相应的隐私机制。我们用现实世界和合成时间序列数据展示了这些技术的实用益处。

我们考虑一个顺序设置，其中使用单个数据集用于执行自适应选择的分析，同时确保每个参与者的差别隐私丢失不超过预先指定的隐私预算。此问题的标准方法依赖于限制所有个人对所有个人的隐私损失的最坏情况估计，以及每个单一分析的所有可能的数据值。然而，在许多情况下，这种方法过于保守，特别是对于“典型”数据点，通过参与大部分分析产生很少的隐私损失。在这项工作中，我们基于每个分析中每个人的个性化隐私损失估计的价值，给出了更严格的隐私损失会计的方法。实现我们设计R \'enyi差异隐私的过滤器。过滤器是一种工具，可确保具有自适应选择的隐私参数的组合算法序列的隐私参数不超过预先预算。我们的过滤器比以往的$（\ epsilon，\ delta）$ - rogers等人的差别隐私更简单且更紧密。我们将结果应用于对嘈杂渐变下降的分析，并显示个性化会计可以实用，易于实施，并且只能使隐私式权衡更紧密。

最大信息系数（MIC）是一个强大的统计量，可以识别变量之间的依赖性。但是，它可以应用于敏感数据，并且发布可能会泄漏私人信息。作为解决方案，我们提出算法以提供差异隐私的方式近似麦克风。我们表明，经典拉普拉斯机制的自然应用产生的精度不足。因此，我们介绍了MICT统计量，这是一种新的MIC近似值，与差异隐私更加兼容。我们证明MICS是麦克风的一致估计器，我们提供了两个差异性私有版本。我们对各种真实和合成数据集进行实验。结果表明，私人微统计数据极大地超过了拉普拉斯机制的直接应用。此外，对现实世界数据集的实验显示出准确性，当样本量至少适中时可用。

差异隐私通常使用比理论更大的隐私参数应用于理想的理想。已经提出了宽大隐私参数的各种非正式理由。在这项工作中，我们考虑了部分差异隐私（DP），该隐私允许以每个属性为基础量化隐私保证。在此框架中，我们研究了几个基本数据分析和学习任务，并设计了其每个属性隐私参数的算法，其较小的人（即所有属性）的最佳隐私参数比最佳的隐私参数。

除了近年来数据收集和分析技术的快速开发外，还越来越强调需要解决与此类数据使用相关的信息泄漏。为此，隐私文献中的许多工作都致力于保护个人用户和数据贡献者。但是，某些情况需要不同的数据机密性概念，涉及数据集记录的全局属性。这样的信息保护概念尤其适用于业务和组织数据，在这些数据中，全球财产可能反映商业秘密或人口统计数据，如果不当行为可能是有害的。最新关于财产推断攻击的工作还显示了数据分析算法如何容易泄漏数据的这些全局性能，从而强调了开发可以保护此类信息的机制的重要性。在这项工作中，我们演示了如何应用分发隐私框架来形式化保护数据集的全球属性的问题。鉴于此框架，我们研究了一些提供数据机密性概念的机制及其权衡。我们分析了这些机制在各种数据假设下提供的理论保护保证，然后对几个数据分析任务进行实施并经验评估这些机制。我们的实验结果表明，我们的机制确实可以降低实用性推理攻击的有效性，同时提供的实用性大大超过了原油差异的隐私基线。因此，我们的工作为保护数据集的全球性质的理论支持机制提供了基础。

聚类是数据分析中的一个根本问题。在差别私有聚类中，目标是识别$ k $群集中心，而不披露各个数据点的信息。尽管研究进展显着，但问题抵制了实际解决方案。在这项工作中，我们的目的是提供简单的可实现的差异私有聚类算法，当数据“简单”时，提供实用程序，例如，当簇之间存在显着的分离时。我们提出了一个框架，允许我们将非私有聚类算法应用于简单的实例，并私下结合结果。在高斯混合的某些情况下，我们能够改善样本复杂性界限，并获得$ k $ -means。我们与合成数据的实证评估补充了我们的理论分析。

The ''Propose-Test-Release'' (PTR) framework is a classic recipe for designing differentially private (DP) algorithms that are data-adaptive, i.e. those that add less noise when the input dataset is nice. We extend PTR to a more general setting by privately testing data-dependent privacy losses rather than local sensitivity, hence making it applicable beyond the standard noise-adding mechanisms, e.g. to queries with unbounded or undefined sensitivity. We demonstrate the versatility of generalized PTR using private linear regression as a case study. Additionally, we apply our algorithm to solve an open problem from ''Private Aggregation of Teacher Ensembles (PATE)'' -- privately releasing the entire model with a delicate data-dependent analysis.

我们考虑如何私下分享客观扰动，使用每个实例差异隐私（PDP）所产生的个性化隐私损失。标准差异隐私（DP）为我们提供了一个最坏的绑定，可能是相对于固定数据集的特定个人的隐私丢失的数量级。PDP框架对目标个人的隐私保障提供了更细粒度的分析，但每个实例隐私损失本身可能是敏感数据的函数。在本文中，我们分析了通过客观扰动释放私人经验风险最小化器的每案隐私丧失，并提出一组私下和准确地公布PDP损失的方法，没有额外的隐私费用。

Differentially private algorithms for common metric aggregation tasks, such as clustering or averaging, often have limited practicality due to their complexity or to the large number of data points that is required for accurate results. We propose a simple and practical tool, $\mathsf{FriendlyCore}$, that takes a set of points ${\cal D}$ from an unrestricted (pseudo) metric space as input. When ${\cal D}$ has effective diameter $r$, $\mathsf{FriendlyCore}$ returns a "stable" subset ${\cal C} \subseteq {\cal D}$ that includes all points, except possibly few outliers, and is {\em certified} to have diameter $r$. $\mathsf{FriendlyCore}$ can be used to preprocess the input before privately aggregating it, potentially simplifying the aggregation or boosting its accuracy. Surprisingly, $\mathsf{FriendlyCore}$ is light-weight with no dependence on the dimension. We empirically demonstrate its advantages in boosting the accuracy of mean estimation and clustering tasks such as $k$-means and $k$-GMM, outperforming tailored methods.

We study fine-grained error bounds for differentially private algorithms for counting under continual observation. Our main insight is that the matrix mechanism when using lower-triangular matrices can be used in the continual observation model. More specifically, we give an explicit factorization for the counting matrix $M_\mathsf{count}$ and upper bound the error explicitly. We also give a fine-grained analysis, specifying the exact constant in the upper bound. Our analysis is based on upper and lower bounds of the {\em completely bounded norm} (cb-norm) of $M_\mathsf{count}$. Along the way, we improve the best-known bound of 28 years by Mathias (SIAM Journal on Matrix Analysis and Applications, 1993) on the cb-norm of $M_\mathsf{count}$ for a large range of the dimension of $M_\mathsf{count}$. Furthermore, we are the first to give concrete error bounds for various problems under continual observation such as binary counting, maintaining a histogram, releasing an approximately cut-preserving synthetic graph, many graph-based statistics, and substring and episode counting. Finally, we note that our result can be used to get a fine-grained error bound for non-interactive local learning {and the first lower bounds on the additive error for $(\epsilon,\delta)$-differentially-private counting under continual observation.} Subsequent to this work, Henzinger et al. (SODA2023) showed that our factorization also achieves fine-grained mean-squared error.

作为标准本地模型和中央模型之间的中间信任模型，差异隐私的洗牌模型已引起了人们的极大兴趣[EFMRTT19；CSUZZ19]。该模型的关键结果是，随机洗牌本地随机数据放大了差异隐私保证。这种放大意味着对数据匿名贡献的系统提供了更大的隐私保证[BEMMRLRKTS17]。在这项工作中，我们通过在理论和数字上逐渐改造结果来改善最新隐私放大的状态。我们的第一个贡献是对LDP Randomizers洗牌输出的R \'enyi差异隐私参数的首次渐近最佳分析。我们的第二个贡献是通过改组对隐私放大的新分析。该分析改进了[FMT20]的技术，并导致所有参数设置中的数值范围更紧密。

我们考虑使用迷你批量梯度进行差异隐私（DP）的培训模型。现有的最先进的差异私有随机梯度下降（DP-SGD）需要通过采样或洗机来获得最佳隐私/准确性/计算权衡的隐私放大。不幸的是，在重要的实际情况下，精确采样和洗牌的精确要求可能很难获得，特别是联邦学习（FL）。我们设计和分析跟随 - 正规的领导者（DP-FTRL）的DP变体，其比较（理论上和经验地）与放大的DP-SGD相比，同时允许更灵活的数据访问模式。DP-FTRL不使用任何形式的隐私放大。该代码可在https://github.com/google-Research/federated/tree/master/dp_ftrl和https://github.com/google-reesearch/dp-ftrl处获得。

我们呈现渐近最优的$（\ epsilon，\ delta）$差异私有机制，用于回答多个，自适应的$ \ delta $ -sursitive查询，解决Steinke和Ullman的猜想[2020]。我们的算法具有显着的优点，即它向每个查询增加独立的有界噪声，从而提供绝对误差。此外，我们在自适应数据分析中应用了我们的算法，获得了使用有限样本对某些基础分布的多个查询的改进保证。数值计算表明，界限噪声机制在许多标准设置中优于高斯机制。

在共享数据的统计学习和分析中，在联合学习和元学习等平台上越来越广泛地采用，有两个主要问题：隐私和鲁棒性。每个参与的个人都应该能够贡献，而不会担心泄露一个人的敏感信息。与此同时，系统应该在恶意参与者的存在中插入损坏的数据。最近的算法在学习中，学习共享数据专注于这些威胁中的一个，使系统容易受到另一个威胁。我们弥合了这个差距，以获得估计意思的规范问题。样品。我们介绍了素数，这是第一算法，实现了各种分布的隐私和鲁棒性。我们通过新颖的指数时间算法进一步补充了这一结果，提高了素数的样本复杂性，实现了近最优保证并匹配（非鲁棒）私有平均估计的已知下限。这证明没有额外的统计成本同时保证隐私和稳健性。

我们考虑对跨用户设备分发的私人数据培训模型。为了确保隐私，我们添加了设备的噪声并使用安全的聚合，以便仅向服务器揭示嘈杂的总和。我们提出了一个综合的端到端系统，该系统适当地离散数据并在执行安全聚合之前添加离散的高斯噪声。我们为离散高斯人的总和提供了新的隐私分析，并仔细分析了数据量化和模块化求和算术的影响。我们的理论保证突出了沟通，隐私和准确性之间的复杂张力。我们广泛的实验结果表明，我们的解决方案基本上能够将准确性与中央差分隐私相匹配，而每个值的精度少于16位。

We consider the problem of continually releasing an estimate of the population mean of a stream of samples that is user-level differentially private (DP). At each time instant, a user contributes a sample, and the users can arrive in arbitrary order. Until now these requirements of continual release and user-level privacy were considered in isolation. But, in practice, both these requirements come together as the users often contribute data repeatedly and multiple queries are made. We provide an algorithm that outputs a mean estimate at every time instant $t$ such that the overall release is user-level $\varepsilon$-DP and has the following error guarantee: Denoting by $M_t$ the maximum number of samples contributed by a user, as long as $\tilde{\Omega}(1/\varepsilon)$ users have $M_t/2$ samples each, the error at time $t$ is $\tilde{O}(1/\sqrt{t}+\sqrt{M}_t/t\varepsilon)$. This is a universal error guarantee which is valid for all arrival patterns of the users. Furthermore, it (almost) matches the existing lower bounds for the single-release setting at all time instants when users have contributed equal number of samples.

Deep neural networks have strong capabilities of memorizing the underlying training data, which can be a serious privacy concern. An effective solution to this problem is to train models with differential privacy, which provides rigorous privacy guarantees by injecting random noise to the gradients. This paper focuses on the scenario where sensitive data are distributed among multiple participants, who jointly train a model through federated learning (FL), using both secure multiparty computation (MPC) to ensure the confidentiality of each gradient update, and differential privacy to avoid data leakage in the resulting model. A major challenge in this setting is that common mechanisms for enforcing DP in deep learning, which inject real-valued noise, are fundamentally incompatible with MPC, which exchanges finite-field integers among the participants. Consequently, most existing DP mechanisms require rather high noise levels, leading to poor model utility. Motivated by this, we propose Skellam mixture mechanism (SMM), an approach to enforce DP on models built via FL. Compared to existing methods, SMM eliminates the assumption that the input gradients must be integer-valued, and, thus, reduces the amount of noise injected to preserve DP. Further, SMM allows tight privacy accounting due to the nice composition and sub-sampling properties of the Skellam distribution, which are key to accurate deep learning with DP. The theoretical analysis of SMM is highly non-trivial, especially considering (i) the complicated math of differentially private deep learning in general and (ii) the fact that the mixture of two Skellam distributions is rather complex, and to our knowledge, has not been studied in the DP literature. Extensive experiments on various practical settings demonstrate that SMM consistently and significantly outperforms existing solutions in terms of the utility of the resulting model.

In this work, we give efficient algorithms for privately estimating a Gaussian distribution in both pure and approximate differential privacy (DP) models with optimal dependence on the dimension in the sample complexity. In the pure DP setting, we give an efficient algorithm that estimates an unknown $d$-dimensional Gaussian distribution up to an arbitrary tiny total variation error using $\widetilde{O}(d^2 \log \kappa)$ samples while tolerating a constant fraction of adversarial outliers. Here, $\kappa$ is the condition number of the target covariance matrix. The sample bound matches best non-private estimators in the dependence on the dimension (up to a polylogarithmic factor). We prove a new lower bound on differentially private covariance estimation to show that the dependence on the condition number $\kappa$ in the above sample bound is also tight. Prior to our work, only identifiability results (yielding inefficient super-polynomial time algorithms) were known for the problem. In the approximate DP setting, we give an efficient algorithm to estimate an unknown Gaussian distribution up to an arbitrarily tiny total variation error using $\widetilde{O}(d^2)$ samples while tolerating a constant fraction of adversarial outliers. Prior to our work, all efficient approximate DP algorithms incurred a super-quadratic sample cost or were not outlier-robust. For the special case of mean estimation, our algorithm achieves the optimal sample complexity of $\widetilde O(d)$, improving on a $\widetilde O(d^{1.5})$ bound from prior work. Our pure DP algorithm relies on a recursive private preconditioning subroutine that utilizes the recent work on private mean estimation [Hopkins et al., 2022]. Our approximate DP algorithms are based on a substantial upgrade of the method of stabilizing convex relaxations introduced in [Kothari et al., 2022].

提出测试释放（PTR）是一个差异隐私框架，可符合局部功能的敏感性，而不是其全球敏感性。该框架通常用于以差异性私有方式释放强大的统计数据，例如中位数或修剪平均值。尽管PTR是十年前引入的常见框架，但在诸如Robust SGD之类的应用程序中使用它，我们需要许多自适应鲁棒的查询是具有挑战性的。这主要是由于缺乏Renyi差异隐私（RDP）分析，这是一种瞬间的私人深度学习方法的基础。在这项工作中，我们概括了标准PTR，并在目标函数界定全局灵敏度时得出了第一个RDP。我们证明，与直接分析的$（\ eps，\ delta）$ -DP相比，我们的RDP绑定的PTR可以得出更严格的DP保证。我们还得出了亚采样下PTR的算法特异性隐私扩增。我们表明，我们的界限比一般的上限和接近下限的界限要紧密得多。我们的RDP界限可以为PTR的许多自适应运行的组成而更严格的隐私损失计算。作为我们的分析的应用，我们表明PTR和我们的理论结果可用于设计私人变体，用于拜占庭强大的训练算法，这些变体使用可靠的统计数据用于梯度聚集。我们对不同数据集和体系结构的标签，功能和梯度损坏的设置进行实验。我们表明，与基线相比，基于PTR的私人和强大的培训算法可显着改善该实用性。

Privacy noise may negate the benefits of using adaptive optimizers in differentially private model training. Prior works typically address this issue by using auxiliary information (e.g., public data) to boost the effectiveness of adaptive optimization. In this work, we explore techniques to estimate and efficiently adapt to gradient geometry in private adaptive optimization without auxiliary data. Motivated by the observation that adaptive methods can tolerate stale preconditioners, we propose differentially private adaptive training with delayed preconditioners (DP^2), a simple method that constructs delayed but less noisy preconditioners to better realize the benefits of adaptivity. Theoretically, we provide convergence guarantees for our method for both convex and non-convex problems, and analyze trade-offs between delay and privacy noise reduction. Empirically, we explore DP^2 across several real-world datasets, demonstrating that it can improve convergence speed by as much as 4x relative to non-adaptive baselines and match the performance of state-of-the-art optimization methods that require auxiliary data.