Not All Learnable Distribution Classes are Privately Learnable
Mark Bun, Gautam Kamath, Argyris Mouzakis, Vikrant Singhal
TL;DR
This work demonstrates a fundamental limit: not every learnable class of distributions is privately learnable under approximate differential privacy. By constructing a trapdoor distribution class built as a shared-parameter mixture, the authors show there exists an algorithm that can learn up to a constant TV error from a constant number of samples, yet any $(\varepsilon,\delta)$-DP learner achieving the same accuracy requires infinitely many samples as the dimension grows. The core technique is a reduction from private mean estimation of binary product distributions to density estimation over the class $\mathcal{H}_{\frac{\alpha}{2},d}$, leveraging a two-component mixture where the first component serves as a key to reveal the full parameter vector. This establishes a sharp separation between non-private learnability and private learnability, providing a concrete counterexample to Ashtiani's conjecture and highlighting intrinsic limits of private distribution learning with approximate DP.
Abstract
We give an example of a class of distributions that is learnable up to constant error in total variation distance with a finite number of samples, but not learnable under $(\varepsilon, δ)$-differential privacy with the same target error. This weakly refutes a conjecture of Ashtiani.