Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Private Online Learning against an Adaptive Adversary: Realizable and Agnostic Settings

Bo Li, Wei Wang, Peng Ye

TL;DR

This work studies private online learning for concept classes of finite Littlestone dimension under adaptive adversaries, addressing both realizable and agnostic settings. It delivers a realizable, $(\varepsilon,\delta)$-DP online learner with a logarithmic dependence on the time horizon $T$, albeit with a doubly exponential dependence on the Littlestone dimension $d$, using a lazy-update mechanism and uniform convergence. For the agnostic setting, it provides a DP online learner achieving sublinear regret $\tilde{O}_d(\sqrt{T})$ against adaptive adversaries, via two complementary strategies: batch-sanitization and privately constructed experts, with accompanying improvements for oblivious adversaries. The results extend private online learning beyond the realizable case, demonstrating privacy-preserving learnability for infinite Littlestone classes and connecting private online learning to private online prediction from experts, while leaving open the challenge of reducing dependence on $d$ and achieving proper/private realizability. Overall, the paper advances understanding of the trade-offs between privacy, adaptivity of the adversary, and learning performance in online settings.

Abstract

We revisit the problem of private online learning, in which a learner receives a sequence of $T$ data points and has to respond at each time-step a hypothesis. It is required that the entire stream of output hypotheses should satisfy differential privacy. Prior work of Golowich and Livni [2021] established that every concept class $\mathcal{H}$ with finite Littlestone dimension $d$ is privately online learnable in the realizable setting. In particular, they proposed an algorithm that achieves an $O_{d}(\log T)$ mistake bound against an oblivious adversary. However, their approach yields a suboptimal $\tilde{O}_{d}(\sqrt{T})$ bound against an adaptive adversary. In this work, we present a new algorithm with a mistake bound of $O_{d}(\log T)$ against an adaptive adversary, closing this gap. We further investigate the problem in the agnostic setting, which is more general than the realizable setting as it does not impose any assumptions on the data. We give an algorithm that obtains a sublinear regret of $\tilde{O}_d(\sqrt{T})$ for generic Littlestone classes, demonstrating that they are also privately online learnable in the agnostic setting.

Private Online Learning against an Adaptive Adversary: Realizable and Agnostic Settings

TL;DR

This work studies private online learning for concept classes of finite Littlestone dimension under adaptive adversaries, addressing both realizable and agnostic settings. It delivers a realizable, -DP online learner with a logarithmic dependence on the time horizon , albeit with a doubly exponential dependence on the Littlestone dimension , using a lazy-update mechanism and uniform convergence. For the agnostic setting, it provides a DP online learner achieving sublinear regret against adaptive adversaries, via two complementary strategies: batch-sanitization and privately constructed experts, with accompanying improvements for oblivious adversaries. The results extend private online learning beyond the realizable case, demonstrating privacy-preserving learnability for infinite Littlestone classes and connecting private online learning to private online prediction from experts, while leaving open the challenge of reducing dependence on and achieving proper/private realizability. Overall, the paper advances understanding of the trade-offs between privacy, adaptivity of the adversary, and learning performance in online settings.

Abstract

We revisit the problem of private online learning, in which a learner receives a sequence of data points and has to respond at each time-step a hypothesis. It is required that the entire stream of output hypotheses should satisfy differential privacy. Prior work of Golowich and Livni [2021] established that every concept class with finite Littlestone dimension is privately online learnable in the realizable setting. In particular, they proposed an algorithm that achieves an mistake bound against an oblivious adversary. However, their approach yields a suboptimal bound against an adaptive adversary. In this work, we present a new algorithm with a mistake bound of against an adaptive adversary, closing this gap. We further investigate the problem in the agnostic setting, which is more general than the realizable setting as it does not impose any assumptions on the data. We give an algorithm that obtains a sublinear regret of for generic Littlestone classes, demonstrating that they are also privately online learnable in the agnostic setting.

Paper Structure

This paper contains 28 sections, 42 theorems, 153 equations, 7 algorithms.

Table of Contents

  1. Introduction
  2. Our Contributions
  3. Related Work
  4. Preliminaries
  5. Online Learning
  6. Differential Privacy
  7. Sanitization
  8. Realizable Online Learning
  9. Agnostic Online Learning
  10. A Simple Algorithm Using Sanitization
  11. Online Learning via Privately Constructing Experts
  12. Discussion and Future Work
  13. Additional Preliminaries
  14. PAC Learning
  15. Concentration Inequalities
  16. ...and 13 more sections

Key Result

Theorem 1.1

Let $\mathcal{H}$ be a concept class with Littlestone dimension $d$. In the realizable setting, there exists an $(\varepsilon,\delta)$-differentially private online learner for $\mathcal{H}$ with an expected mistake bound of $O(2^{2^{O(d)}}(\log T + \log (1/\delta)) / \varepsilon)$ against any adapt

Theorems & Definitions (78)

  • Theorem 1.1
  • Theorem 1.2
  • Definition 2.1: Shattered Tree
  • Definition 2.2: Littlestone Dimension
  • Definition 2.3: Differential Privacy
  • Definition 2.4: Differential Privacy with Adaptive Inputs
  • Theorem 2.5: dwork2009complexitydwork2014algorithmic
  • Theorem 2.6: Private Histogram aliakbarpour2024differentially
  • Definition 2.7: blum2013learningbeimel2016private
  • Lemma 2.8: bousquet2020synthetic
  • ...and 68 more