Exponential Separations in Local Differential Privacy

TL;DR

This paper establishes exponential lower bounds on the sample complexity of locally different private protocols by connecting them to communication complexity, demonstrating significant separations based on interaction rounds.

Contribution

It introduces a general framework linking communication and sample complexity, proving exponential separations for local differential privacy protocols using communication complexity results.

Findings

Exponential sample complexity separation between sequentially and fully interactive protocols.

Exponential separation between k-round and (k+1)-round protocols.

Application of communication complexity bounds to privacy protocol analysis.

Abstract

We prove a general connection between the communication complexity of two-player games and the sample complexity of their multi-player locally private analogues. We use this connection to prove sample complexity lower bounds for locally differentially private protocols as straightforward corollaries of results from communication complexity. In particular, we 1) use a communication lower bound for the hidden layers problem to prove an exponential sample complexity separation between sequentially and fully interactive locally private protocols, and 2) use a communication lower bound for the pointer chasing problem to prove an exponential sample complexity separation between $k$ round and $k+1$ round sequentially interactive locally private protocols, for every $k$.

Equations

$${\mathrm{CC}}_{\gamma }(\mathcal{R})=\underset{\mathcal{A}:\mathcal{A}\text{ computes }\mathcal{R}\text{ with error at most }\gamma }{\min }\mathrm{CC}(\mathcal{A}).$$

$${\mathbb{P}}_{\mathcal{M}}\left[\mathcal{M}(S)\in \Omega \right]\le e^{\epsilon }{\mathbb{P}}_{\mathcal{M}}\left[\mathcal{M}(S^{\prime })\in \Omega \right]+\delta .$$

$${\mathrm{SC}}_{\gamma }(\mathcal{R})=\underset{\mathcal{A}:\mathcal{A}\text{ computes }\mathcal{R}\text{ with error at most }\gamma }{\min }\mathrm{SC}(\mathcal{A}).$$

$$\mathbb{P}\left[\text{Alice input}\right]\cdot \frac{e^{\epsilon }}{e^{\epsilon }+1}+\mathbb{P}\left[\text{Bob input}\right]\cdot \frac{1}{2}=$$

$$=$$

$$p_x=\mathbb{P}\left[\text{agent sends }1\mid \text{agent has Alice’s data }x\right],$$

$$\frac{1}{2}+\frac{p_x}{2{\epsilon }^{\prime }(p_{\min }+p_{\max })}-\frac{1}{4{\epsilon }^{\prime }}=$$

$$\le$$

$$=$$

$$\le$$

$$\frac{1}{2}+\frac{2p_x-p_{\min }-p_{\max }}{4{\epsilon }^{\prime }(p_{\min }+p_{\max })}\ge$$

$$\ge$$

$$\left(\frac{1}{2}+{\epsilon }^{\prime }\right)\left(\frac{1}{2}+\frac{p_x}{2{\epsilon }^{\prime }(p_{\min }+p_{\max })}-\frac{1}{4{\epsilon }^{\prime }}\right)+\left(\frac{1}{2}-{\epsilon }^{\prime }\right)\left(\frac{1}{2}-\frac{p_x}{2{\epsilon }^{\prime }(p_{\min }+p_{\max })}+\frac{1}{4{\epsilon }^{\prime }}\right)=\frac{p_x}{p_{\min }+p_{\max }}.$$

$$\frac{\mathbb{P}\left[\pi (a,f)=z\right]}{\mathbb{P}\left[\pi (b,g)=z\right]}\le \frac{\frac{e^{\epsilon }}{(e^{{\epsilon }^{\prime }}+1{)}^2}}{\frac{1}{(e^{{\epsilon }^{\prime }}+1{)}^2}}\le e^{\epsilon }.$$

$$|y-\bar{y}|\le \frac{\epsilon +2}{\epsilon \sqrt{2}}\sqrt{\ln (4/\beta )/n}.$$

$$\left|\sum _i{y}_i-\frac{y(e^{\epsilon }-1)+n}{e^{\epsilon }+1}\right|\le \sqrt{n\ln (4/\beta )/2}.$$

$$|y-\bar{y}|\le \frac{e^{\epsilon }+1}{e^{\epsilon }-1}\sqrt{\ln (4/\beta )/2n}<\frac{\epsilon +2}{\epsilon \sqrt{2}}\sqrt{\ln (4/\beta )/n}.$$

$$\bar{y}\le \frac{{\epsilon }^{\prime }+2}{{\epsilon }^{\prime }\sqrt{2}}\sqrt{\frac{\ln (2^{4k+3}/\beta )}{n}}<\frac{{\epsilon }^{\prime }+2}{{\epsilon }^{\prime }\sqrt{2}}\sqrt{\frac{(4k+2)+\ln (1/\beta )}{n}}<0.1$$

$$\bar{y}\ge \frac{1}{2}-\sqrt{\frac{\ln (4/\beta )}{2n}}-\frac{{\epsilon }^{\prime }+2}{{\epsilon }^{\prime }\sqrt{2}}\sqrt{\frac{(4k+2)+\ln (1/\beta )}{n}}>0.2$$

$$m>100{\left(\frac{\epsilon +2}{\epsilon \sqrt{2}}\right)}^2(\ln (k\lceil \log (\ell )\rceil )+\ln (2/\beta )),$$

Full text

1 Introduction

A differentially private [17] algorithm must induce similar output distributions given similar input databases. Intuitively, this similarity creates enough uncertainty to hide the presence or absence — and hence ensure the privacy — of any one individual in the dataset. Differential privacy’s mathematical and practical appeal has driven the creation of a large body of work (see Dwork and Roth [16] and  Vadhan [27] for surveys) and increasing industrial and governmental adoption [3, 18, 6, 13, 1]. Here, we focus on the strictly stronger notion of local differential privacy [17, 5, 21]. In local differential privacy, the rows of the size-$n$ database are distributed among $n$ individual users, and the private computation consists of a public interaction between the users that must reveal little about any single datum.

Local differential privacy has been studied in three increasingly general models. In noninteractive protocols, all users publish their messages simultaneously111In this paper, we will still allow some coordination in the form of shared randomness, which only makes our lower bounds stronger.. In sequentially interactive [15] protocols, users publish exactly one message each in sequence, and messages may depend on previously-published messages. The number of rounds in such protocols is necessarily upper bounded by the number of users, $n$, but can be fewer. Fully interactive protocols have no such restrictions. Each user may publish arbitrarily many messages with arbitrary dependencies on other previous messages, and there is no upper bound on the number of rounds. In this paper, we study the relative power of these models.

A natural way to approach this question is through the lens of sample complexity: fixing one statistical estimation problem, how many users $n$ (with data drawn i.i.d. from a fixed but unknown distribution) are necessary for a protocol to solve the problem in each model? It is known that there are problems that require exponentially larger sample complexity in noninteractive protocols than sequentially interactive protocols [21]. Before our work, however, only polynomial separations were known between sequentially and fully interactive protocols [20], and it was conjectured that the power of these two models was indeed polynomially related.

1.1 Our Contributions

First, we prove a general equivalence between the communication complexity of any two-player problem and the sample complexity of a sequentially interactive locally private multi-player analogue of that problem. Informally, we show that the “noise” that must be added to ensure local differential privacy in any sequentially interactive protocol makes it possible to convert it into a two-party protocol over a noisy channel, and vice-versa. In combination with past work relating communication complexity over noisy and noiseless channels [25, 9, 8], this conversion extends to noiseless channels as well.

Theorem 1.1** (Informal version of Theorem 3.8).**

Let $P_{2}$ be a two-player communication problem, let $P_{m}$ be its multi-player analogue, let $\mathrm{CC}_{\gamma}(P_{2})$ be the communication complexity of solving $P_{2}$ with error $\gamma$, and let $\mathrm{SC}_{\gamma}^{\varepsilon,S}(P_{m})$ be the sample complexity of solving $P_{m}$ with error $\gamma$ using a sequentially interactive $\varepsilon$-locally private protocol. Then for any $\varepsilon=O(1)$ and $0<\gamma,\eta=\Omega(1)$ such that $\gamma+\eta<1$, $\mathrm{SC}_{\gamma}^{\varepsilon,S}(P_{m})=\Theta\left(\tfrac{1}{\varepsilon^{2}}\cdot\mathrm{CC}_{\gamma+\eta}(P_{2})\right)$.

This connection enables us to translate existing communication lower bounds into sample complexity lower bounds for locally private protocols. For example, we show an exponential separation in sample complexity between sequentially and fully interactive locally private protocols for the hidden layers problem.

Theorem 1.2** (Informal version of Corollary 4.1.1 and Theorem 4.2).**

Let $k$ be a natural number parameterizing the hidden layers problem and $\varepsilon=O(1)$. Any sequentially interactive $\varepsilon$-locally private protocol solving the hidden layers problem with constant probability requires $\Omega\left(\tfrac{2^{k}}{\varepsilon^{2}}\right)$ samples. However, there exists a fully interactive $\varepsilon$-locally private protocol that solves the hidden layers problem with constant success probability and $O\left(\tfrac{k}{\varepsilon^{2}}\right)$ samples.

Theorem 3.8 provides a tight equivalence between the sample complexity of locally private sequentially interactive protocols, and communication complexity — but the reduction does not preserve the number of rounds of interaction needed. We prove a different variant of Theorem 3.8 that preserves round complexity at the expense of a looser dependence on $\varepsilon$. Using this connection and round-specific communication lower bounds for the pointer chasing problem, we show that for every $k$, there is an exponential separation between $(k-1)$- and $k$- round sequentially interactive protocols.

Theorem 1.3** (Informal version of Corollary 6.2.1 and Theorem 6.3).**

Let $k$ and $\ell$ be natural numbers parameterizing the pointer chasing problem. Any $(k-1)$-round sequentially interactive $\varepsilon$-locally private protocol solving the pointer chasing problem with constant probability requires $\Omega\left(\tfrac{\ell}{e^{\varepsilon}k^{2}}\right)$ samples. However, there exists a $k$-round sequentially interactive $\varepsilon$-locally private protocol that solves pointer chasing with constant success probability and $\tilde{O}\left(\tfrac{k\log(\ell)}{\varepsilon^{2}}\right)$ samples, where $\tilde{O}(\cdot)$ hides logarithmic factors.

The special case of $k=2$ provides another exponential separation between noninteractive and sequentially interactive protocols (such a separation was already known, for a different problem using a custom analysis of Kasiviswanathan et al. [21]). For $k>2$, the result is new and demonstrates that there is an infinite hierarchy of sequentially interactive protocols, characterized by their number of rounds of interactivity, and that there is an exponential separation between each level of the hierarchy.

Finally, for simplicity we state all of our results for pure $\varepsilon$-local privacy. However, for reasonable values of $\delta$ (roughly $\delta=o\left(\tfrac{\varepsilon}{n\log(n)}\right)$) they easily extend to $(\varepsilon,\delta)$-local privacy using the approximate-to-pure transformation described by Bun et al. [10] and Cheu et al. [11].

1.2 Related Work

Kasiviswanathan et al. [21] first separated noninteractive from sequentially interactive locally private protocols. They exhibited a learning problem, masked parity, for which a sequentially interactive locally private protocol requires only $O(\text{poly}\left(d\right))$ samples while any noninteractive locally private protocol requires $2^{\Omega(d)}$ samples. Their result relies on an (up to polynomial terms) equivalence between the number of local randomizer calls made by a locally private protocol and the query complexity of a statistical query (SQ) algorithm. For sequentially interactive protocols, the number of local randomizer calls is equal to the sample complexity. However, this is no longer true for fully interactive protocols, and so their equivalence between the sample complexity of locally private protocols and the query complexity of SQ algorithms fails to extend beyond sequential interactivity. Daniely and Feldman [12] also leveraged this connection to SQ learning to prove similar separations for a different, larger class of problems.

Our results do not rely on this connection to the SQ model. In fact, our exponential separation between the sequential and fully interactive models implies that the connection fails to extend beyond sequential interactivity: there are problems that locally private protocols can solve with polynomial sample complexity, but SQ protocols require exponential query complexity. This re-focuses attention on an important problem that remains open: what can be learned privately in the local model of computation, if full interactivity is allowed?

Duchi et al. [15] first distinguished sequential and full interactivity and developed several lower bound techniques that applied to noninteractive and sequentially interactive protocols. Duchi and Rogers [14] extended some of these techniques to full interactivity, thus establishing the first lower bounds for fully interactive locally private protocols that do not also extend to the centralized model of privacy. However, their results do not separate sequentially interactive protocols from fully interactive protocols.

Joseph et al. [20] characterized the relationship between the sample complexity of fully interactive and sequentially interactive locally private protocols in terms of a parameter called “compositionality”, providing the first separations between full and sequential interactivity. While this characterization is tight in terms of the compositionality parameter, their lower bound viewed as a function of $n$ only shows a sample complexity gap on the order of $\Omega(\sqrt{n})$ between the two models. We prove a separation that is exponential in $n$.

Several other works have also examined interactivity in local differential privacy. Smith et al. [26] showed that convex optimization protocols relying on neighborhood-based oracles (and, in particular, locally private protocols relying on neighborhood-based oracles) require interaction. However, their results are qualitatively different, as they also hold absent any privacy restriction. Acharya et al. [2] showed polynomial separations between noninteractive private- and public-randomness protocols for identity testing (informally, in their formulation public randomness is necessary to coordinate the randomizers employed by different users). We note that our framework assumes public randomness for all noninteractive protocols; this only strengthens our separation.

Finally, our work is not the first to connect differential privacy and two-player communication games. McGregor et al. [23] introduced and studied two-party differential privacy. They showed, roughly, that a two-party differentially private protocol is equivalent to a protocol with low round and communication complexity. This equivalence relies on work relating the compressibility of a protocol to its information cost. In contrast, we work in the more commonly studied $n$-party model of local differential privacy, and our reductions rely on different techniques.

1.3 Organization

Preliminaries from communication complexity and differential privacy appear in Section 2. We prove the equivalence between two-party communication complexity and multi-party locally private sample complexity in Section 3 and use this equivalence to separate sequential and full interactivity in Section 4. A looser round complexity-preserving version of this connection appears in Section 5, and we apply this second connection to show a round-specific separation in Section 6.

2 Preliminaries

We start by recalling preliminaries from two-party communication complexity before moving on to differential privacy and (our notion of) multi-party communication complexity.

2.1 Two-party Setting

Many of our results feature the two-party communication model.

Definition 2.1**.**

In the two-party communication model, one player Alice receives input $x\in\mathcal{X}$, and the other player Bob receives input $y\in\mathcal{Y}$. Alice and Bob want to jointly compute some output $z\in\mathcal{Z}$ such that $(x,y,z)$ satisfies some relation $\mathcal{R}\subset\mathcal{X}\times\mathcal{Y}\times\mathcal{Z}$.

To compute $z$, Alice and Bob coordinate their actions using a protocol.

Definition 2.2**.**

Given a two-party communication model, a protocol $\mathcal{A}$ specifies a binary output function that each player should apply to their data at each time step, as a function of the time step, the transcript of previously released values and any shared randomness.

Note that, by our inclusion of shared randomness, all protocols we consider are “public-coin”. Two salient protocol characteristics are the number of bits that must be exchanged and the likelihood of a “good” outcome.

Definition 2.3**.**

The communication complexity of a protocol $\mathcal{A}$, denoted by $\mathrm{CC}(\mathcal{A})$, is the maximum number of bits exchanged over all inputs $(x,y)$ and all random coins. If on all inputs $x$ and $y$ $\mathbb{P}_{\mathcal{A}}\left[(x,y,z)\not\in\mathcal{R}\right]\leq\gamma$, we say $\mathcal{A}$ computes $\mathcal{R}$ with error at most $\gamma$. The randomized communication complexity with error $\gamma$ of a relation $\mathcal{R}$ is then defined as

[TABLE]

2.2 Differential Privacy

As originally formulated by Dwork et al. [17], we say an algorithm $\mathcal{M}$ satisfies differential privacy if its output distribution is Lipschitz continuous with respect to a neighboring relationship on inputs:

Definition 2.4**.**

Given data universe $\mathcal{X}$, two datasets $S,S^{\prime}\in\mathcal{X}^{n}$ are neighbors if they differ in at most one coordinate. Given $\varepsilon,\delta\geq 0$, a randomized algorithm $\mathcal{M}\colon\mathcal{X}^{n}\to\mathcal{O}$ is $(\varepsilon,\delta)$-differentially private if for every pair of neighboring databases $S$ and $S^{\prime}$ and every event $\Omega\subset\mathcal{O}$

[TABLE]

When $\delta=0$, $\mathcal{M}$ satisfies pure differential privacy. When $\delta>0$, $\mathcal{M}$ satisfies approximate differential privacy.

Differential privacy constrains the output of an algorithm $\mathcal{M}$. However, there is no intermediary between $\mathcal{M}$ and the raw database, so $\mathcal{M}$ must be trusted as a curator of this data. Since $\mathcal{M}$ enjoys this “central” access to all data, the above model of differential privacy is sometimes called “central” differential privacy.

We focus on the more restrictive local model of differential privacy [17, 5, 21]. In this model, $\mathcal{M}$ no longer enjoys privileged access to the entire database, and individuals need not trust any central curator. Instead, we view the size-$n$ database as distributed, row by row, among $n$ individuals. Any computation occurs on privatized outputs from each of the $n$ individuals, and the private computation becomes a public interaction between users. Accordingly, we imitate the interactive transcript-based framework of Joseph et al. [20] and view the computation as an interaction between the $n$ individuals that is coordinated by a protocol $\mathcal{A}$. In each round of this interaction, the protocol $\mathcal{A}$ observes the transcript of interactions so far and selects a set of users and randomizers.

Definition 2.5**.**

An $(\varepsilon,\delta)$-randomizer $R\colon\mathcal{X}\to\mathcal{O}$ is an $(\varepsilon,\delta)$-differentially private function taking a single data point as input.

The users apply the assigned randomizers to their input and publish the output. $\mathcal{A}$ then observes the updated transcript, selects a new users-randomizers pair, and the interaction continues.

Definition 2.6**.**

A transcript $\pi$ is a vector consisting of 5-tuples $(S_{U}^{t},S_{R}^{t},S_{\varepsilon}^{t},S_{\delta}^{t},S_{Y}^{t})$ — encoding the set of users chosen, set of randomizers assigned, set of randomizer privacy parameters, and set of randomized outputs produced — for each round $t$. $\pi_{<t}$ denotes the transcript prefix before round $t$. Letting $S_{\pi}$ denote the collection of all transcripts and $S_{R}$ the collection of all randomizers, a protocol is a function $\mathcal{A}\colon S_{\pi}\to\left(2^{[n]}\times 2^{S_{R}}\times 2^{\mathbb{R}_{\geq 0}}\times 2^{\mathbb{R}_{\geq 0}}\right)\cup\{\perp\}$ mapping transcripts to sets of users, randomizers, and randomizer privacy parameters ($\perp$ is a special character indicating a protocol halt). The length of the transcript, as indexed by $t$, is its round complexity.

This framework leads to a simple definition of local differential privacy: the transcript of a locally differentially private interaction is differentially private in the user inputs.

Definition 2.7**.**

Given $\varepsilon,\delta\geq 0$, randomized protocol $\mathcal{A}$ on (distributed) database $S$ satisfies $(\varepsilon,\delta)$-local differential privacy if the transcript it generates is an $(\varepsilon,\delta)$-differentially private function of $S$.

For brevity, we often shorthand “differentially private” as “private”. In general, we will distinguish between three modes of interactivity in locally private protocols. In noninteractive protocols, users output their communications in a single simultaneous round of communication. In sequentially interactive protocols, interaction occurs in a sequence: users may base their communication on previous messages, but only speak once. Lastly, communication in fully interactive protocols may depend on previous communications, and users may also communicate arbitrarily many times. Illustrations of these models appear in Figure 1.

For brevity, we sometimes omit the phrase “locally private” when discussing these models. In these cases, the privacy of the protocol in question should be clear from context.

2.3 Multi-party Setting

We combine the communication model of Section 2.1 and the notion of local privacy defined in Section 2.2 in a multi-party communication model.

Definition 2.8**.**

In the multi-party communication model there exists an “Alice input” $x\in\mathcal{X}$ and a “Bob input” $y\in\mathcal{Y}$. Each of an unboundedly large number of players receives an independent and uniformly random draw over $\{x,y\}$. The users’ goal is to output $z\in\mathcal{Z}$ such that $(x,y,z)\in\mathcal{R}$.

A protocol is defined as in the local privacy setting (and we will be interested in local privacy as the primary constraint on protocols). As before, we will quantify the likelihood that a protocol achieves a “good” outcome. Unlike before, our metric of interest for a multi-party protocol is its sample complexity.

Definition 2.9**.**

The sample complexity of a protocol $\mathcal{A}$, denoted by $\mathrm{SC}(\mathcal{A})$, is the maximum number of users appearing in the transcript over all inputs $(x,y)$ and all random coins. If on all inputs $x$ and $y$ $\mathbb{P}_{\mathcal{A}}\left[(x,y,z)\not\in\mathcal{R}\right]\leq\gamma$, we say $\mathcal{A}$ computes $\mathcal{R}$ with error at most $\gamma$. The randomized sample complexity with error $\gamma$ of a relation $\mathcal{R}$ is then defined as

[TABLE]

Let $\mathrm{SC}_{\gamma}^{\varepsilon,\text{N}}(\mathcal{R}),\mathrm{SC}_{\gamma}^{\varepsilon,\text{S}}(\mathcal{R})$, and $\mathrm{SC}_{\gamma}^{\varepsilon,\text{F}}(\mathcal{R})$ denote the sample complexities of $\varepsilon$-locally private protocols computing $\mathcal{R}$ with error $\gamma$ under noninteraction, sequential interaction, and full interaction respectively.

Our two-party models are defined by an input pair $(x,y)$, and we deliberately constrain our multi-party models to be defined by a pair $(x,y)$ as well. Thus a given two-party problem on a pair of inputs induces a unique multi-party problem on the same inputs, and vice-versa. We note that multi-party problems as we define them are unusual statistical estimation problems: their primary use for us will be in proving lower bounds.

3 First Reduction: An Equivalence

We now prove an equivalence between a two-party problem’s communication complexity and the induced multi-party problem’s sample complexity for private sequentially interactive protocols. To do so, we first show that the equivalence holds when the two-party communication channel is noisy in a specific way (Section 3.1). Pairing this with existing results relating communication complexity over noisy and non-noisy channels (Section 3.2) completes the result (Section 3.3).

3.1 Noisy Two-party Communication

In the noisy two-party communication model, Alice and Bob may only communicate over a binary symmetric channel.

Definition 3.1**.**

For $\varepsilon\in(0,1/2)$, a binary symmetric channel with crossover probability $\varepsilon$ $\text{BSC}_{\varepsilon}$ correctly transmits a bit $b$ with probability $1/2+\varepsilon$ and transmits $1-b$ with probability $1/2-\varepsilon$. We additionally suppose that the binary symmetric channel has feedback: the sender always sees the received bit.

Let $\mathrm{CC}_{\gamma}^{\varepsilon}(\mathcal{R})$ denote the communication complexity of $\mathcal{R}$ with error $\gamma$ under the additional requirement that communication occurs over $\text{BSC}_{\varepsilon}$. First, we show how to transform two-party protocols over a binary symmetric channel with crossover probability depending on $\varepsilon$ into multi-party protocols.

Lemma 3.1**.**

Let $\mathcal{R}$ be a relation for some communication problem, $\varepsilon\geq 0$, $\varepsilon^{\prime}=\tfrac{e^{\varepsilon}-1}{4(e^{\varepsilon}+1)}$, and $\gamma\in(0,1)$. Then $\mathrm{SC}_{\gamma}^{\varepsilon,\text{S}}(\mathcal{R})=O\left(\mathrm{CC}_{\gamma}^{\varepsilon^{\prime}}(\mathcal{R})\right)$.

Proof.

Let $\mathcal{A}_{2}$ be any protocol for the two-party problem over $\text{BSC}_{\varepsilon^{\prime}}$ computing $\mathcal{R}$ with error $\gamma$. Consider the first bit sent in $\mathcal{A}_{2}$. Without loss of generality, Alice sends this first bit $f(x)$, where $x$ is Alice’s input. Since communication occurs over $\text{BSC}_{\varepsilon}$, with probability $1/2+\varepsilon^{\prime}$ Bob receives $f(x)$, and with probability $1/2-\varepsilon^{\prime}$ Bob receives its negation.

We will use $\mathcal{A}_{2}$ to build a multi-party protocol $\mathcal{A}_{m}$. To simulate this bit, $\mathcal{A}_{m}$ selects a new (previously un-selected) agent, and the new agent takes one of two actions. If the agent has an Alice input $x$, they apply randomized response to $f(x)$: i.e. they send $f(x)$ with probability $\tfrac{e^{\varepsilon}}{e^{\varepsilon}+1}$ and otherwise send $(1-f(x))$. If instead the agent has a Bob input $y$, they send a uniform random bit. Thus the probability that the agent sends $f(x)$ is

[TABLE]

It follows that the first bit of $\mathcal{A}_{m}$ is distributed identically to the first bit of $\mathcal{A}_{2}$. Repeating this process for each bit sent in $\mathcal{A}_{2}$, $\mathcal{A}_{m}$ induces an identical distribution over the bits output, and thus computes $\mathcal{R}$ with error $\gamma$. Since each bit sent in $\mathcal{A}_{2}$ used a new user in $\mathcal{A}_{m}$, $\mathrm{SC}(\mathcal{A}_{m})=O\left(\mathrm{CC}^{\varepsilon^{\prime}}(\mathcal{A}_{2})\right)$. Since randomized response satisfies $\varepsilon$-differential privacy, the sequentially interactive mechanism $\mathcal{A}_{m}$ is $\varepsilon$-differentially private in the local model. ∎

Next, we show how to transform multi-party protocols into two-party protocols over a binary symmetric channel with crossover probability depending (in a slightly different way) on $\varepsilon$.

Lemma 3.2**.**

Let $\mathcal{R}$ be a relation for some communication problem, $0<\varepsilon=O(1)$, $\varepsilon^{\prime}=\tfrac{e^{\varepsilon}-1}{2(e^{\varepsilon}+1)}$, and $\gamma,\eta>0$ such that $\gamma+\eta<1$. Then $\mathrm{CC}_{\gamma+\eta}^{\varepsilon^{\prime}}(\mathcal{R})=O\left(\tfrac{1}{\eta}\cdot\mathrm{SC}_{\gamma}^{\varepsilon,\text{S}}(\mathcal{R})\right)$.

Proof.

Here, we define $\varepsilon^{\prime}=\tfrac{e^{\varepsilon}-1}{2(e^{\varepsilon}+1)}$, which differs from our previous $\varepsilon^{\prime}$ by a factor of 2. Let $\mathcal{A}_{m}$ be any sequentially interactive $\varepsilon$-locally private protocol for a multi-party problem computing $\mathcal{R}$ with error $\gamma$ and sample complexity $n$. By the following result from Bassily and Smith [4], we can transform $\mathcal{A}_{m}$ into a new, functionally equivalent protocol $\mathcal{A}_{m}^{\prime}$ in which each user sends only one bit.

Lemma 3.3** (Theorem 4.1 in Bassily and Smith [4]).**

Given an $\varepsilon$-locally private protocol $\mathcal{A}$ with expected number of randomizer calls $T$, there exists a sequentially interactive $(\varepsilon,0)$-locally private protocol $\mathcal{A}^{\prime}$ with expected number of users $e^{\varepsilon}\cdot T$ where each user sends a single bit (produced by a call to a single $\varepsilon$-local randomizer). Moreover, there exists a deterministic function $f$ on transcripts such that $f(\Pi(\mathcal{A}^{\prime}))=\Pi(\mathcal{A})$, where $\Pi(\cdot)$ denotes a distribution over transcripts induced by a given protocol with randomness is over the protocol and its samples.

The cost is twofold. First, $\mathcal{A}_{m}^{\prime}$ requires $O(n\log(\log(n)))$ bits of public randomness. Second, $\mathcal{A}_{m}^{\prime}$ requires $e^{\varepsilon}n$ users in expectation. By Markov’s inequality, the number of users can be bounded by $\tfrac{e^{\varepsilon}n}{\eta}$ at the cost of an $\eta$ increase in failure probability.

We now transform $\mathcal{A}_{m}^{\prime}$ into a two-player protocol $\mathcal{A}_{2}$. The idea will be to have Alice and Bob simulate $A_{m}^{\prime}$ by randomly partitioning the users from the multi-party protocol between themselves, and each simulating the role of their assigned users. Recall that for multi-party communication problems, users are randomly assigned “Alice” or “Bob” data points, and so this random partition will induce the correct distribution on data elements. Thus, $\mathcal{A}_{2}$ begins with Alice and Bob using their shared public randomness to generate $\tfrac{e^{\varepsilon}n}{\eta}$ coin flips determining who will simulate which agents.

Without loss of generality, suppose Alice simulates the first agent. Let

[TABLE]

and let $p_{\min}=\min_{x\in\mathcal{X}}p_{x}$ and $p_{\max}=\max_{x\in\mathcal{X}}p_{x}$. Alice and Bob take one of two choices depending on $p_{\min}$ and $p_{\max}$.

Case 1: $p_{\min}+p_{\max}\leq 1$. Then Alice sends 1 with probability $\tfrac{1}{2}+\tfrac{p_{x}}{2\varepsilon^{\prime}(p_{\min}+p_{\max})}-\tfrac{1}{4\varepsilon^{\prime}}$ and sends 0 with the remaining probability. Since

[TABLE]

(where both inequalities use the fact that the agent sends output from an $\varepsilon$-local randomizer), and similarly

[TABLE]

these are valid probabilities. Next, as Alice sends the bit over $\text{BSC}_{\varepsilon^{\prime}}$, the probability that the received bit is 1 is

[TABLE]

With probability $p_{\min}+p_{\max}$, Alice and Bob “use” the received bit: that is, they enter this received bit into their transcript and continue the protocol. With probability $1-p_{\min}-p_{\max}$ Alice and Bob instead enter the bit 0 into their transcript (and omit the true received bit from the transcript) and continue. Then $\mathbb{P}\left[\text{enter 1 in transcript}\right]$ (and $\mathbb{P}\left[\text{enter 0 in transcript}\right]$) are identical in both the two-party and multi-party protocols.

Case 2: $p_{\min}+p_{\max}>1$. Then if we define $p_{\min}^{\prime}$ and $p_{\max}^{\prime}$ as $1-p_{\min}$ and $1-p_{\max}$ respectively, we get $p_{\min}^{\prime}+p_{\max}^{\prime}<1$. Let $p_{x}^{\prime}=1-p_{x}$ and have Alice send 0 with probability $\tfrac{1}{2}+\tfrac{p_{x}^{\prime}}{2\varepsilon^{\prime}(p_{\min}^{\prime}+p_{\max}^{\prime})}-\tfrac{1}{4\varepsilon^{\prime}}$, and Alice and Bob “use” the received bit (just as defined in Case 1) with probability $p_{\min}^{\prime}+p_{\max}^{\prime}$. Repeating the analysis from Case 1 for $p_{x}^{\prime}$, $p_{\min}^{\prime}$, and $p_{\max}^{\prime}$ yields that $\mathbb{P}\left[\text{use 0}\right]$ (and $\mathbb{P}\left[\text{use 1}\right]$) are identical in both the two-party and multi-party protocols.

Combining Cases 1 and 2, Alice and Bob produce the same distribution over the first bit of the protocol in $\mathcal{A}_{2}$ and $\mathcal{A}_{m}$. Since we can repeat this process for subsequent bits, by induction the distribution over transcripts (and thus answers) is identical. Therefore $\mathcal{A}_{2}$ also computes $\mathcal{R}$ with error $\gamma$. Moreover, there is a one-to-one correspondence between users in $\mathcal{A}_{m}$ and bits in $\mathcal{A}_{2}$, so by $\varepsilon=O(1)$, $\mathrm{CC}_{\gamma+\eta}^{\varepsilon^{\prime}}(\mathcal{R})=O\left(\tfrac{1}{\eta}\cdot\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})\right)$. ∎

3.2 Relating Noisy and Noiseless Communication

Lemmas 3.1 and 3.2 relate the sample complexity of sequentially interactive $\varepsilon$-locally private multi-party protocols and the communication complexity of two-party protocols over a binary symmetric channel. The remaining step is to relate noisy and noiseless communication complexity. Fortunately, one direction of this relationship follows almost immediately from previous work by Braverman and Mao [8].

Lemma 3.4** (Theorem 3.1 in Braverman and Mao [8]).**

For every protocol $\mathcal{A}$ over $\text{BSC}_{\varepsilon}$ with feedback, there exists a protocol $\mathcal{A}^{\prime}$ over a noiseless channel that simulates $\mathcal{A}$ with $\mkern 1.5mu\overline{\mkern-1.5mu\mathrm{CC}\mkern-1.5mu}\mkern 1.5mu(\mathcal{A}^{\prime})=O\left(\varepsilon^{2}\mathrm{CC}^{\varepsilon}(\mathcal{A})\right)$. Here, $\mkern 1.5mu\overline{\mkern-1.5mu\mathrm{CC}\mkern-1.5mu}\mkern 1.5mu\left(\mathcal{A}^{\prime}\right)$ is the maximum over all inputs $(x,y)$ of the expected number of bits exchanged over the randomness of $\mathcal{A}^{\prime}$.

By Markov’s inequality, we get a high-probability version of their result for our setting.

Lemma 3.5**.**

Let $\mathcal{R}$ be a relation for a two-party communication problem. Then for $\gamma,\eta>0$ where $\gamma+\eta<1$, $\mathrm{CC}_{\gamma+\eta}\left(\mathcal{R}\right)=O\left(\tfrac{\varepsilon^{2}}{\eta}\cdot\mathrm{CC}_{\gamma}^{\varepsilon}(\mathcal{R})\right)$.

It remains to upper bound noisy communication complexity using noiseless communication complexity. Schulman [25] first studied the problem of interactive two-party communication through noisy channels and showed how to simulate a noiseless channel using a binary symmetric channel with small ($<1/240$) crossover probability and a constant blowup in communication complexity. Braverman and Rao [9] then improved this result to binary symmetric channels with crossover probability bounded away from $1/8$ by a constant.

Lemma 3.6** (Simplified Version of Theorem 2 in Braverman and Rao [9]).**

Let $\mathcal{R}$ be a relation for a two-party communication problem, $\gamma\in(0,1)$, and $0<p\leq 1/8-c$ where $c=\Omega(1)$. Then $\mathrm{CC}_{\gamma}^{p}(\mathcal{R})=O\left(\mathrm{CC}_{\gamma}(\mathcal{R})\right)$.

One obstacle remains: Lemma 3.6 requires a channel $C$ with crossover probability bounded away from $1/8$, while our channel $C^{\prime}$ may have crossover probability $\varepsilon$-close to $1/2$. We therefore use a standard amplification argument, replacing each bit over $C$ with $\Theta(1/\varepsilon^{2})$ bits over $C^{\prime}$ and taking the majority as the transmitted bit. This yields Lemma 3.7.

Lemma 3.7**.**

Let $\mathcal{R}$ be a relation for a two-party communication problem. Then $\mathrm{CC}_{\gamma}^{\varepsilon}(\mathcal{R})=O\left(\tfrac{1}{\varepsilon^{2}}\cdot\mathrm{CC}_{\gamma}(\mathcal{R})\right)$.

3.3 Equivalence

The results above come together in the following equivalence.

Theorem 3.8**.**

Let $\mathcal{R}$ be a relation for some communication problem. Then for any $\varepsilon=O(1)$ and $0<\gamma,\eta=\Omega(1)$ such that $\gamma+\eta<1$, $\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})=\Theta\left(\tfrac{1}{\varepsilon^{2}}\cdot\mathrm{CC}_{\gamma+\eta}(\mathcal{R})\right)$.

Proof.

We first show $\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})=O\left(\tfrac{1}{\varepsilon^{2}}\cdot\mathrm{CC}_{\gamma}(\mathcal{R})\right)$. By Lemma 3.1, $\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})=O\left(\mathrm{CC}_{\gamma}^{\varepsilon_{1}}(\mathcal{R})\right)$ where $\varepsilon_{1}=\tfrac{e^{\varepsilon}-1}{4(e^{\varepsilon}+1)}$. Then, by Lemma 3.7, $\mathrm{CC}_{\gamma}^{\varepsilon_{1}}(\mathcal{R})=O\left(\tfrac{1}{\varepsilon_{1}^{2}}\cdot\mathrm{CC}_{\gamma}(\mathcal{R})\right)$. Since $\varepsilon=O(1)$, $\varepsilon_{1}=\Omega(\varepsilon)$, and tracing back yields the claim.

Next, we show $\mathrm{CC}_{\gamma+\eta}(\mathcal{R})=O\left(\varepsilon^{2}\cdot\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})\right)$. Since $\gamma,\eta=\Omega(1)$, by Lemma 3.5 $\mathrm{CC}_{\gamma+\eta}(\mathcal{R})=O\left(\varepsilon_{1}^{2}\cdot\mathrm{CC}_{\gamma+\eta/2}^{\varepsilon_{1}}(\mathcal{R})\right)$ where $\varepsilon_{1}=\tfrac{e^{\varepsilon}-1}{2(e^{\varepsilon}+1)}$. By Lemma 3.2, $\mathrm{CC}_{\gamma+\eta/2}^{\varepsilon_{1}}(\mathcal{R})=O\left(\mathrm{SC}_{\gamma}^{\varepsilon,S}(\mathcal{R})\right)$. Tracing back and using $\varepsilon_{1}=O(\varepsilon)$ implies the claim. ∎

4 Separating Sequential and Full Interactivity

In this section, we use Theorem 3.8 to show that the hidden layers problem is hard for sequentially interactive protocols (Corollary 4.1.1). In contrast, we show that the same problem is “easy” for fully interactive protocols (Theorem 4.2). We start by introducing the problem below.

4.1 Hidden Layers Problem $\mathcal{HL}$

In this section, we formally recap the hidden layers problem that drives our results. While Braverman [7] first proposed this problem, we imitate the presentation of Ganor et al. [19].

The hidden layers problem is parameterized by $k\in\mathbb{N}$ and denoted $\mathcal{HL}(k)$. It features a $2^{4k}$-ary tree $\mathcal{T}$ with directed edges from root to leaves and $2^{rs}+1$ layers where $r=2^{2^{8k}}$ and $s=2^{8k}$. $\mathcal{T}$ thus has a number of layers triply exponential in $k$ and a number of leaves quadruply exponential in $k$. Two players, Alice and Bob, each receive a small amount of information about $\mathcal{T}$. Alice receives $(a,f)$ where $a\in\{0,2,\ldots,2^{rs}-2\}$ indexes an even-numbered layer, and $f$ labels each vertex in layer $a$ of $\mathcal{T}$ with a single outgoing edge. Similarly, Bob receives $(b,g)$ where $b\in\{1,3,\ldots,2^{rs}-1\}$ indexes an odd-numbered layer, and $g$ labels each vertex in layer $b$ with a single outgoing edge. Thus, Alice and Bob each have information about one “hidden layer” of $\mathcal{T}$. Letting $v$ be a leaf of $\mathcal{T}$, we say $v$ is consistent with $(a,f)$ (or $(b,g)$) if the path from the root to $v$ goes through an edge identified by $f$ (or $g$, respectively).

The hidden layers problem is a search problem: Alice and Bob must output the same leaf $v$ consistent with both $(a,f)$ and $(b,g)$. Crucially, many such $v$ exist. If at the end of protocol $\mathcal{A}$ Alice and Bob output different leaves, or at least one of them outputs a leaf not consistent with at least one of $(a,f)$ and $(b,g)$, we say $\mathcal{A}$ errs. A simplified illustration of the hidden layers problem appears in Figure 2.

Ganor et al. [19] proved that the hidden layers problem has high communication complexity. To do so, they constructed a specific distribution $P$ over user inputs for their result. When we want to specify the distribution $P$ over user inputs, we write $\mathcal{HL}(k,P)$.

Lemma 4.1** (Theorem 1 in Ganor et al. [19]).**

There exists constant $k^{\prime}$ and input distribution $P$ for $((a,f),(b,g))$ such that, for every $k\geq k^{\prime}$ and protocol $\mathcal{A}$ with $\mathrm{CC}(\mathcal{A})\leq 2^{k}$, $\mathbb{P}_{P}\left[\mathcal{A}\text{ errs on }\mathcal{HL}(k,P)\right]\geq 1-2^{-k}$.

In particular, Lemma 4.1 implies that $\Omega(2^{k})$ communication is necessary to achieve constant success probability for $\mathcal{HL}(k,P)$. Combining Theorem 3.8 and Lemma 4.1 gives the following corollary.

Corollary 4.1.1**.**

For $\varepsilon=O(1)$ and $\gamma=\Omega(1)$, $\mathrm{SC}_{\gamma}^{\varepsilon,S}\left(\mathcal{HL}(k,P)\right)=\Omega\left(\tfrac{2^{k}}{\varepsilon^{2}}\right)$.

4.2 Fully Interactive Upper Bound for $\mathcal{HL}$

In this section we provide a fully interactive protocol HLSolver that solves $\mathcal{HL}(k)$ with a much better sample complexity. HLSolver works by greedily following a path from the root to a leaf, querying users to guide its path as it descends the tree.

Concretely, starting from the root, at each vertex $v$ encountered, for all $2^{4k}$ children $v_{j}$ of $v$, the analyst “asks” all $n$ users if $(v,v_{j})$ is the labelled edge in that level, recalling that each vertex in a hidden layer specifies a single next edge to follow. To “answer”, each user $x_{i}$ compares the level $\ell$ of vertex $v$ and edge $(v,v_{j})$ to their own data and replies as follows using randomized response. If $x_{i,1}=\ell$ and $(v,v_{j})\in x_{i,2}$, i.e. user $i$’s hidden layer is $\ell$, and $v$ is labelled with the $(v,v_{j})$ edge, then the user “votes yes” and transmits a draw from $\mathsf{Ber}\left(e^{\varepsilon^{\prime}}/(e^{\varepsilon^{\prime}}+1)\right)$, where we write $\varepsilon^{\prime}=\varepsilon/2$ for notational simplicity. Otherwise the user “votes no” and transmits a draw from $\mathsf{Ber}\left(1/(e^{\varepsilon^{\prime}}+1)\right)$. Based on the responses, the protocol then chooses an edge out of $v$ to follow, to obtain the next vertex in the path at level $\ell+1$. When the protocol reaches a leaf, it proposes this leaf as the solution. Pseudocode for HLSolver appears in Section 8.1.

Intuitively, during this process, the selection made by the protocol at any level that does not correspond to a hidden layer is irrelevant: it can follow any outgoing edge and still be on track to correctly solve the problem instance. To argue for correctness, all that is important is that for the two (unknown) levels that correspond to hidden layers, the protocol correctly identifies the correct labeled edge. At each of those levels, the bias induced by randomized response will be enough to identify the correct edge with high probability. While this protocol is run, each user answers a very large (triply exponentially many in $k$) number of queries: but for only one of those queries is their response sampled from $\mathsf{Ber}\left(e^{\varepsilon^{\prime}}/(e^{\varepsilon^{\prime}}+1)\right)$. For all other queries, their response is sampled from $\mathsf{Ber}\left(1/(e^{\varepsilon^{\prime}}+1)\right)$. Hence the privacy loss over the whole protocol is constant, and does not accumulate with the number of queries. In contrast, a similar sequentially interactive protocol would require new users for each of this large number of queries.

Note that an implication of [20] is that any fully interactive protocol that uses $r$ local randomizer calls per user can be converted into a sequentially interactive protocol with an $O(r)$ factor blowup in sample complexity. Consequently, it is necessary that any protocol witnessing an exponential separation between the sample complexities of fully and sequentially interactive protocols must make at least exponentially many queries per user.

Theorem 4.2**.**

HLSolver* is $(\varepsilon,0)$-locally private and has constant success probability on $\mathcal{HL}(k)$ given $n=\Omega\left(\tfrac{k}{\varepsilon^{2}}\right)$ samples.*

Proof.

We first prove privacy. Recall that each user draws one of two samples, $(a,f)$ or $(b,g)$. Accordingly, each user has only a single point in the transcript where they output a sample from $\mathsf{Ber}\left(\tfrac{e^{\varepsilon^{\prime}}}{e^{\varepsilon^{\prime}}+1}\right)$, and the remainder of their outputs are all samples from $\mathsf{Ber}\left(\tfrac{1}{e^{\varepsilon^{\prime}}+1}\right)$. Thus, if we compare the transcript distributions (restricted to a single user with the specified data) of $\pi(a,f)$ and $\pi(b,g)$, there are at most two points in the transcript where their output distributions are not identical. Therefore for any single-user transcript output $z$,

[TABLE]

HLSolver is thus $(\varepsilon,0)$-locally private.

To reason about accuracy, we use the following simple result for randomized response.

Claim 4.3**.**

Let $x_{1},\ldots,x_{n}\in\{0,1\}$ and for each $x_{i}$ draw $y_{i}\sim\mathsf{Ber}\left(e^{x_{i}\varepsilon}/(e^{\varepsilon}+1)\right)$. Let $y=\tfrac{1}{n}\cdot\sum_{i=1}^{n}x_{i}$ and $\bar{y}=\tfrac{1}{n}\cdot\tfrac{e^{\varepsilon}+1}{e^{\varepsilon}-1}\cdot\left(\sum_{i=1}^{n}y_{i}-\tfrac{n}{e^{\varepsilon}+1}\right)$. Then with probability $\geq 1-\beta$,

[TABLE]

Proof.

$\mathbb{E}\left[\sum_{i}y_{i}\right]=\tfrac{ye^{\varepsilon}+(n-y)}{e^{\varepsilon}+1}=\tfrac{y(e^{\varepsilon}-1)+n}{e^{\varepsilon}+1}$, so two Hoeffding bounds implies that with probability $\geq 1-\beta$,

[TABLE]

Thus

[TABLE]

∎

By Claim 4.3, with probability $\geq 1-\beta/2$, whenever $\ell\in\{a,b\}$ but $(v,v_{j})\not\in f\cup g$, i.e. whenever the current layer is hidden but $v_{j}$ is the wrong child node,

[TABLE]

where the last inequality uses $n>100\left(\tfrac{\varepsilon^{\prime}+2}{\varepsilon^{\prime}\sqrt{2}}\right)^{2}(4k+2+\ln(1/\beta))$.

Now consider the situation where $\ell=a$ ($\ell=b$ is symmetric) and $(v,v_{j})\in f$, i.e. the current layer is hidden and $v_{j}$ is the correct child node. Let $A=\{i\mid x_{i}=(a,f)\}$. First, by a Hoeffding bound with probability $\geq 1-\beta/4$, $|A|\geq\tfrac{n}{2}-\sqrt{n\ln(4/\beta)/2}$. Thus by Claim 4.3

[TABLE]

where the last inequality uses the above lower bound on $n$ and $n>25\ln(4/\beta)$. By a union bound, with probability $\geq 1-\beta$ when $(v,v_{j})\in f$ then $\bar{y}>0.2$ and $v_{j}$ is correctly chosen as the next child. ∎

Combining Corollary 4.1.1 and Theorem 4.2 yields an exponential in $k$ separation between sequentially and fully interactive protocols achieving constant success probability on $\mathcal{HL}$.

5 Second Reduction: Round-Specific Separation

The equivalence given in Theorem 3.8 has one drawback: it does not preserve round complexity222In particular, the conversion between noiseless and noisy communication blows up round complexity in both directions.. As a result, we cannot use it to prove a separation between $(k-1)$ and $k$-round sequentially interactive protocols. To do this, we instead prove a slightly different one-way reduction with a looser dependence on $\varepsilon$.

5.1 Second Reduction

Theorem 5.1**.**

Let $\mathcal{A}$ be a sequentially interactive $\varepsilon$-locally private protocol computing relation $\mathcal{R}$ with error probability $\gamma=\Omega(1)$, and let $0<\eta=\Omega(1)$ such that $\gamma+\eta<1$. Then there exists a two-party protocol $\mathcal{A}^{\prime}$ computing $\mathcal{R}$ with error probability $\leq\gamma+\eta$ such that $\mathrm{CC}(\mathcal{A}^{\prime})=\tilde{O}\left(e^{\varepsilon}\cdot\mathrm{SC}(\mathcal{A})\right)$. Moreover, $\mathcal{A}$ and $\mathcal{A}^{\prime}$ have identical round complexity.

Proof.

We start by using Lemma 3.3 to transform $\mathcal{A}$ into a different protocol $\mathcal{A}_{1}$ where each user sends a single bit. $\mathcal{A}_{1}$ has the same round complexity as $\mathcal{A}$ but incurs an $O(e^{\varepsilon})$ blowup in expected sample complexity. As before, we transform this into a bound that holds with probability $1-\eta$ at the cost of an increase in the failure probability by $\eta$ and a constant $1/\eta$ blowup in sample complexity.

Next, we transform $\mathcal{A}_{1}$ into a two-party protocol $\mathcal{A}^{\prime}$ for $\mathcal{R}$. To do so, we run $\mathcal{A}_{1}$ and, for each round of randomizer calls, uniformly at random assign (i.e. using public randomness generated ahead of time) each randomizer call $R$ to one of Alice and Bob for execution on their own data. Alice and Bob then release the corresponding outputs simultaneously, and we proceed to the next round of $\mathcal{A}_{1}$. Since $\mathcal{A}_{1}$ is sequentially interactive, each randomizer call is made using an unknown new sample $s$. Furthermore, since each new sample is drawn from a uniform distribution as $s\sim_{U}\{x,y\}$, $R(s)$ is distributed identically to $R$ executed on a uniformly random choice of Alice and Bob. At the conclusion of $\mathcal{A}^{\prime}$, Alice and Bob mimic the output of the analyst. Since this choice depends entirely on the communications thus far, which are distributed identically in $\mathcal{A}_{1}$ and $\mathcal{A}^{\prime}$, the distribution over final answers is identical as well. Since $\mathcal{A}_{1}$ used $O(e^{\varepsilon}\cdot|\mathrm{SC}(\mathcal{A})|)$ bits of communication, $\mathcal{A}^{\prime}$ does as well. Finally, since each round of $\mathcal{A}_{1}$ leads to exactly one round of $\mathcal{A}^{\prime}$, $\mathcal{A}$ and $\mathcal{A}^{\prime}$ have identical round complexity. ∎

6 Round-specific Separation for Sequential Interactivity

In this section, we introduce the pointer chasing problem and combine it with Theorem 5.1 to prove a round-specific exponential sample complexity separation for sequentially interactive local privacy.

6.1 The Pointer Chasing Problem

In the pointer chasing problem $\mathcal{PC}(k,\ell)$, Alice and Bob respectively receive vectors $a$ and $b$ in $[\ell]^{\ell}$ representing a sequence of pointers to locations in the other vector. The goal is to follow the chain of pointers starting from $a[1]$ and determine the value of the $k$’th pointer in this chain, where we focus on problem instances with $k\ll\ell$. The difficulty is that while Alice knows $a[1]$, to compute the third pointer location she needs to know $b[a[1]]$. Pointer-chasing is therefore a natural candidate for forcing interaction for nontrivial — i.e., communication $o(k\log(\ell))$ — solutions. An illustration appears in Figure 3.

Nisan and Wigderson [24] proved the following communication lower bound for $\mathcal{PC}(k,\ell)$.

Lemma 6.1** (Theorem 2.6 in Nisan and Wigderson [24]).**

Let $k<\tfrac{\ell}{\log(\ell)}$. For any $k$-round protocol $\mathcal{A}$ with success probability $\geq 2/3$ on $\mathcal{PC}(k,\ell)$ where Bob speaks first, $\mathrm{CC}(\mathcal{A})=\Omega\left(\tfrac{\ell}{k^{2}}\right)$.

One obstacle remains before combining Theorem 5.1 with Lemma 6.1. The transformation given in Theorem 5.1 assumes that each round of communication features Alice and Bob releasing outputs simultaneously. In contrast, the model used for Lemma 6.1 supposes that Alice and Bob speak in alternating rounds. We address this gap in Lemma 6.2.

Lemma 6.2**.**

In the two-party communication model, any $(k-1)$-round simultaneous communication protocol can be simulated by a $k$-round alternating communication protocol with Bob speaking first.

Proof.

In the simultaneous protocol, let $(A_{1},B_{1}),(A_{2},B_{2}),\ldots$ denote the outputs produced in each round. Since the outputs are simultaneous, each $A_{t}$ depends only on $(A_{1},B_{1}),\ldots,(A_{t-1},B_{t-1})$ and Alice’s data, and a similar dependence holds for $B_{t}$ and Bob’s data. Alice and Bob can therefore simulate a simultaneous communication protocol with alternating communication protocol as follows: Bob begins by outputting $B_{1}$, then Alice outputs $A_{1}$ and $A_{2}$, then Bob outputs $B_{2}$ and $B_{3}$, and so on. This induces an identical distribution over final outputs $A_{k-1}$ and $B_{k-1}$ at the expense of an additional round. ∎

Combining Lemma 6.1 with Theorem 5.1 yields Corollary 6.2.1.

Corollary 6.2.1**.**

Let $\mathcal{A}$ be a $(k-1)$-round sequentially interactive $\varepsilon$-locally private protocol solving $\mathcal{PC}(k,\ell)$ with error probability $\gamma\leq 1/3-c$ for $c=\Omega(1)$. Then $\mathrm{SC}(\mathcal{A})=\Omega\left(\tfrac{\ell}{e^{\varepsilon}k^{2}}\right)$.

6.2 $k$-round Upper Bound

We now provide a $k$-round sequentially interactive protocol, PCSolver, achieving much better sample complexity on $\mathcal{PC}$. PCSolver is a straightforward private version of the trivial $O(k\log(\ell))$ communication solution to $\mathcal{PC}$ where Alice and Bob alternate communicating the next pointer in sequence, bit by bit. Local privacy forces this communication to pass through randomized response for each bit, and sequential interaction forces the use of a new group of users for each bit. Pseudocode for PCSolver appears in Appendix 8.2. As both the privacy and accuracy proofs for Theorem 6.3 are nearly identical to those of Theorem 4.2, we defer them to Appendix 8.3.

Theorem 6.3**.**

PCSolver* is $(\varepsilon,0)$-locally private, solves $\mathcal{PC}(k,\ell)$ with error $\leq 1/6$ and has $\mathrm{SC}(\mathcal{A})=\tilde{O}\left(\tfrac{k\log(\ell)}{\varepsilon^{2}}\right)$.*

In conjunction with Corollary 6.2.1, Theorem 6.3 yields an exponential separation in $\ell$ between $(k-1)$- and $k$-round sequentially interactive locally private protocols for $\mathcal{PC}(k,\ell)$.

7 Discussion and Open Problems

Using tools from communication complexity, we have exhibited an exponential sample complexity separation between the sequentially interactive and fully interactive models of local differential privacy. This raises several interesting questions.

It has been known since Kasiviswanathan et al. [21] that the query complexity of locally private protocols is polynomially related to the query complexity of algorithms in the statistical query model from learning theory [22], for which there are a number of lower bounds. Since query complexity and sample complexity are equivalent for sequentially interactive protocols, and since no separation between the two models was known until very recently [20], this was widely viewed as an equivalence that might also hold for sample complexity. Now that we know there is in fact an exponential gap between the sample complexity of fully interactive protocols and sequentially interactive protocols (and hence the query complexity of algorithms in the statistical query model), this again raises the question of the power of locally private learning when protocols are not restricted to be sequentially interactive. In particular, is there an algorithm that can learn parity functions in $d$ dimensions with sample complexity that is sub-exponential in $d$? We conjecture that the answer remains “no” but don’t know how to prove it. 2. 2.

Might there be larger than exponential separations between sequentially and fully interactive locally private protocols? Our results leave this possibility open. To refute it, one would like to demonstrate a reduction that takes as input a fully interactive protocol, and outputs a sequentially interactive protocol inducing the same transcript distribution with “only” an exponential increase in sample complexity. Joseph et al. [20] give a reduction in this style that is tight in terms of what they call the “compositionality” of the fully interactive protocol, but their reduction does not give any guarantees in terms of $n$.

8 Appendix

8.1 Pseudocode for HLSolver

8.2 Pseudocode for PCSolver

8.3 Proof of Theorem 6.3

Proof.

First, we prove privacy. Since PCSolver is sequentially interactive, each user produces a single output. As each output is produced by $\varepsilon$-randomized response, i.e. drawn from either $\mathsf{Ber}\left(\tfrac{e^{\varepsilon}}{e^{\varepsilon}+1}\right)$ or $\mathsf{Ber}\left(\tfrac{1}{e^{\varepsilon}+1}\right)$, PCSolver is $\varepsilon$-locally private.

We now prove accuracy. For each pointer index in $[k]$, the protocol computes the next location in $\ell$ bit by bit, using $\lceil\log(\ell)\rceil$ queries, each to a new group of $m$ users. By a similar invocation of Claim 4.3 as in the proof of Theorem 4.2, given group size

[TABLE]

with probability $1-\beta$ all $k\lceil\log(\ell)\rceil$ queries return the correct bit. PCSolver thus uses $mk\lceil\log(\ell)\rceil=O\left(\tfrac{k\log(\ell)\log(k\log(\ell))}{\varepsilon^{2}}\right)$ samples to solve $\mathcal{PC}(k,\ell)$ with error probability $\leq 1/6$. ∎