Uniformity Testing under User-Level Local Privacy

TL;DR

This work addresses uniformity (identity) testing under user-level local differential privacy, where $n$ users each contribute $m$ i.i.d. samples from a distribution on a domain of size $k$. The authors develop non-adaptive testing protocols that are nearly optimal in sample complexity, using two main strategies: (i) public-coin domain compression that reduces the problem to a 1-bit bias test, and (ii) a Hadamard-matrix based private-coin framework that handles small and large $m$ via complementary tests and a generalized product-testing reduction. They present both asymmetric and symmetric private testers, achieving per-user communication as low as $O( ext{log }k)$ bits and overall sample complexities that scale as roughly ${k^{3/2}}/{(m α^2 ε^2)}$ (up to log factors) in the symmetric private regime, with matching lower bounds for the 1-bit, symmetric setting when $m=1$. The work also introduces a compression lemma enabling multi-sample batches to be treated as a single-bit privatized signal, and analyzes the trade-offs between symmetry, bandwidth, and privacy under the user-level privacy model. Taken together, these results establish substantial gains over naïve compositions and reveal phase transitions in complexity as $m$ and $oldsymbol{ε}$ vary, informing practical deployment of privacy-preserving distribution testing.

Abstract

We initiate the study of distribution testing under \emph{user-level} local differential privacy, where each of $n$ users contributes $m$ samples from the unknown underlying distribution. This setting, albeit very natural, is significantly more challenging that the usual locally private setting, as for the same parameter $\varepsilon$ the privacy guarantee must now apply to a full batch of $m$ data points. While some recent work consider distribution \emph{learning} in this user-level setting, nothing was known for even the most fundamental testing task, uniformity testing (and its generalization, identity testing). We address this gap, by providing (nearly) sample-optimal user-level LDP algorithms for uniformity and identity testing. Motivated by practical considerations, our main focus is on the private-coin, symmetric setting, which does not require users to share a common random seed nor to have been assigned a globally unique identifier.

Figures (1)

• Figure 1: Graphical representation of user-level local differential privacy. Each user holds ${\textcolor{pink!60!black}{m}}$ samples of some unknown distribution $\mathbf{p}$, and must be guaranteed privacy of all ${\textcolor{pink!60!black}{m}}$ samples at once. As pictured, each user sends a single private message to the server, which must somehow carry information about all of their samples.

Theorems & Definitions (41)

• Theorem 1.1: See \ref{['thm:pubcoin:ldp:1bit']}
• Theorem 1.2: Informal version of \ref{['thm:private:symmetric:combined:testing']}
• Proposition 1
• Lemma 1: Informal statement of \ref{['lemma:epluribusunum']}
• Definition 1: Local Differential Privacy KLNRS:11Warner:65
• Lemma 2: Cantelli's inequality
• Lemma 3
• Theorem 3.1: LDP 1-bit asymmetric public coin uniformity testing
• proof : Proof (Detailed sketch)
• Lemma 4: Domain Compression CanonneTopicsDT2022