General Gaussian Noise Mechanisms and Their Optimality for Unbiased Mean Estimation

TL;DR

This paper characterizes the optimal Gaussian noise mechanisms for unbiased high-dimensional mean estimation under differential privacy and demonstrates their near-optimality compared to all private unbiased estimators.

Contribution

It introduces algorithms to compute optimal Gaussian noise covariance for arbitrary bounded domains and proves Gaussian mechanisms are nearly optimal among all private unbiased mean estimators.

Findings

Optimal Gaussian noise covariance algorithms for arbitrary domains

Geometric properties of the optimal error in high dimensions

Gaussian mechanisms nearly match the best possible private unbiased mean estimation error

Abstract

We investigate unbiased high-dimensional mean estimators in differential privacy. We consider differentially private mechanisms whose expected output equals the mean of the input dataset, for every dataset drawn from a fixed bounded $d$-dimensional domain $K$. A classical approach to private mean estimation is to compute the true mean and add unbiased, but possibly correlated, Gaussian noise to it. In the first part of this paper, we study the optimal error achievable by a Gaussian noise mechanism for a given domain $K$ when the error is measured in the $\ell_p$ norm for some $p \ge 2$. We give algorithms that compute the optimal covariance for the Gaussian noise for a given $K$ under suitable assumptions, and prove a number of nice geometric properties of the optimal error. These results generalize the theory of factorization mechanisms from domains $K$ that are symmetric and finite (or, equivalently, symmetric polytopes) to arbitrary bounded domains. In the second part of the paper we show that Gaussian noise mechanisms achieve nearly optimal error among all private unbiased mean estimation mechanisms in a very strong sense. In particular, for every input dataset, an unbiased mean estimator satisfying concentrated differential privacy introduces approximately at least as much error as the best Gaussian noise mechanism. We extend this result to local differential privacy, and to approximate differential privacy, but for the latter the error lower bound holds either for a dataset or for a neighboring dataset, and this relaxation is necessary.