With the growth in data volume over recent years, the tasks of data storage and processing are often offloaded from in-house trusted systems to some external entities. Such distributed environments raise challenges, not experienced before. One of the most important ones is privacy concern, which can have different interpretations. Based on the applications use-case, the private asset might be the training data, test data, and even the model parameters (the learning algorithm). While the first two have been the subject of extensive research, from both computational cryptography and information-theoretic perspectives, the last one has been less understood.
In the privacy of the machine learning algorithms, the goal is to ensure the privacy of the parameters. Many different scenarios can be considered in which the parameters are in danger of breaching, and need to be addressed. Here, we focus on the case, where the learner must download some data samples from the servers to train the model. In this case, the learner wants to keep the identity of this subset hidden from the servers. The reason is that in many cases, revealing the identity of the selected training samples would reveal considerable information about the intention of the learner, and can be used to guess the learning algorithm and calculate parameters of the model. For example, assume that learner downloads some training samples from a server to train a classification algorithm, say support vector machines (SVM). The server can easily guess that, and run the same algorithm, and gain full knowledge about the intention and the model.
In this paper, we investigate the above privacy concern in a distributed setting, while our goal is to achieve privacy in a fundamental and information-theoretic level where no information is revealed about the algorithms to data owners. We argue that some of the most basic machine learning algorithms in different areas, including but not limited to SVM for classification, regression for relationship estimation, and principal component analysis (PCA) for dimensionality reduction, share an important feature in using sample data in their algorithm. To run these methods, the learner needs the inner products of the data files instead of the raw data. This can be particularly important when the length of input vectors is large compared to the number of data used for learning.
On a separate line of research, the privacy in distributed settings, referred to as private information retrieval (PIR), is investigated. In , the basic setup of PIR is studied, where the goal is to retrieve a file from a dataset, replicated in some non-colluding servers, without revealing its index. In particular, the capacity, as the infimum of the normalized download rate, is characterized. This is followed by [2, 3, 4, 5, 6] for different cases such as symmetric privacy, possibility of collusion among the servers, and coded storage instead of uncoded replication of data files in servers. In particular, in , the multi-message PIR (MPIR) problem is studied, where the objective is to privately download a subset of files, instead of just one, and the capacity is approximately, and in some cases tightly, characterized. The problem of retrieving a linear function of files from the servers, referred to as private computation (PC) or private function retrieval (PFR), is investigated in  and . In  the capacity for private linear computation in MDS coded databases is studied. Recently the new problem of retrieving a polynomial function of files from some servers has been introduced and discussed in  and  by using Lagrange encoding in coded databases.
In this paper, we study a system, including a dataset of files, replicated across non-colluding servers. A user (learner) wishes to retrieve a subset of inner products out of all possible inner products of data files, without revealing the identity of the subset to each server. We prove that as the length of files, , goes to infinity, the set of inner products of all data files (listed in the vector ) converges, in distribution, to a set of mutually independent uniform random variables. To show that, we introduce some dependencies in the sequence of , , while keeping the marginal distribution of the same. Thanks to this dependency, we show that forms a time-homogeneous irreducible Markov chain, with uniform distribution as its unique stationary distribution. Moreover, the rate of convergence is governed by the second largest eigenvalue of the transition probability matrix, where . This property motivates us to suggest MPIR as an achievable scheme. In addition, we rely on the above property to develop a converse which becomes tight in some case, as the length of files goes to infinity. While this converse is based on , a few changes are needed to be made to reach our goal. This is because of the difference in retrieving inner products instead of data files in . For example, the number of possible inner products cannot be any arbitrary integer which forces us to introduce an equivalent problem with arbitrary number of inner products in the process of reaching converse results.
Ii Background and Motivation
In what follows, we review some of the most basic machine learning algorithms, in three areas of classification, regression, and dimension reduction, and show that all three are based on the inner products of the samples, rather than the samples.
1. Support vector machines (SVM)
: The SVM is one of the basic classification algorithms, where the goal is to correctly label the data files. This algorithm has many use cases such as face detection, bioinformatics (gene classifications), text categorization and etc. Here, we describe a simple case of SVM from[13, Page 63] and we discuss that knowing the inner products is enough to run the algorithm (instead of knowing the entire database).
Consider an input alphabet consisting of length
vectors, a target output alphabetand a distribution on . The learner has training samples from , denoted by , drawn from . The goal here is to find function from hypothesis set , such that the following generalization error is minimized over :
Although many different hypotheses sets exist, can be chosen as described in 
as a linear classifier defined as follows,
The solution to this problem boils down to solving the following convex optimization problem:
where for any integer , denotes . This notation is used throughout this paper. The above problem can be solved by introducing Lagrange variables for each constraint. Thus, the dual form of the constrained optimization problem is derived as following.
Solving the dual problem on , we have:
As is clear from (5)-(7), in order to solve the main problem for , we only need the inner products of samples and their labels to solve the dual problem for and a linear combination of data samples to get 111To having a linear combination of the samples privately, we can use a scheme called private function retrieval. So, when the length of vectors , , is large, retrieving inner products instead of raw samples is more efficient in a distributed learning setting.
2. Regression: The regression algorithm predicts the real-valued label of a point by using a data set. Regression is a very common task in machine learning for approximately and closely deriving the relationship between variables. The regression is similar to continuous-label version of the classification, as opposed to the classification’s discrete labels. Many use cases can be considered for the regression algorithm, such as optimizing the price of products by learning the relation of price and the sale volume in different markets and analyzing the product sale drivers such as distribution methods in markets. Here, we first describe a simple regression problem from [13, Page 245] and show in order to solve this problem we only need the inner products as opposed to retrieve all data files.
Similar to SVM, consider an input alphabet consisting of vectors of length and a distribution on . The learner has training samples from , denoted by , drawn from . The difference is that the target output alphabet
can be a continuous space. Since the labels are real numbers, the learner is not able to predict them precisely. So, a loss function is considered to show the distance between the label and the predicted value.
Now, we discuss a simple linear regression problem. Similar to SVM, the hypothesis set is as follows.
The loss here is empirical mean squared error. So, the optimization problem is as follows,
which can be written in a simpler form as:
where , and . It is clear that the objective functions is convex and reaches its optimum value in . So, we have:
Now, if is invertible, we can calculate . Otherwise, we replace the inverse with pseudo-inverse.
It can be easily shown that the above result can be rewritten as below.
As seen, the solution only needs inner products () and a linear combination of data files ( ) and not all data files. If the length of data vectors, , is large, downloading all data files needs much more resource.
3. Principal component analysis (PCA): The purpose of this algorithm is to reduce the dimensionality of data with large vector length, so that its most important features can be better analyzed. The reason is that sometimes the generalization ability of method decreases with the increase in dimension of data. The following example is from [14, Page 324].
Consider the vectors of length ,
, as data files. The goal here is to reduce the dimensionality of these vectors using linear transformation. To do this, we define a matrixwhere . We also have a mapping , whose output is the lower dimensionality representation of data. Then a second matrix is defined to recover . This means that if is the reduced representation, then the is the recovered data. Minimizing the magnitude of empirical distance between the original data and the recovered data is the goal of PCA.
It is shown in  that and this problem can be rewritten as follows.
is the identity matrix. According to Theorem 23.2 in[14, Page 325] the solution for above problem is to calculate
which are eigenvectors of matrix() corresponding to largest eigenvalues of the matrix. The solution is .
If the dimension of the original vectors is too large (), then we can rewrite the answer. We define . Let be an eigenvector of matrix (so ). This means that we have and thus,
Therefore, if is an eigenvector of , corresponding to eigenvalue , then is an eigenvector of matrix , corresponding to the same eigenvalue. So in PCA, when vector length is large, it is simpler to calculate the matrix that is matrix of inner products of original data. Then, the eigenvectors of this matrix corresponding to its largest eigenvalues are enough.
These three algorithms make clear that methods using inner products of data files are important and common tasks of machine learning. Thus, retrieving the inner products privately from the servers is an important step in machine learning privacy.
Iii Problem Statement
Consider a set of data files, , for some integer , where files are selected independently and uniformly at random from a finite field , for some integer . Thus,
Files can be represented in the vector form as
We assume that files are replicated in non-colluding servers, for some integer . We define , as the set of the inner product of all pairs of data files,
Also, we define as index of inner products as follows,
Note that each member of corresponds to an inner product in set , i.e., .
A user wishes to retrieve a subset of size of inner products. More precisely, the user chooses a set , where , and , and entreats to know , defined as
The cardinality of is known to all servers. The user wishes to retrieve while ensuring privacy of from each server.
In order to retrieve these inner products user creates queries and sends to server , through an error-free secure link. In response, server , responds with . Since user has no knowledge of files,
The answer of server , , is a function of query sent to that server and the set of data files available there, thus
Also, denotes set . The queries and answers must satisfy two conditions:
(i) Correctness Condition: This condition states that by having all queries and answers from servers, the user can calculate inner products indexed by the set . Equivalently,
(ii) Privacy Condition: In order to satisfy privacy, regardless of what set is chosen, query and answer for each server must be identically distributed, i.e., , , we must have,
For an achievable scheme, satisfying (25) and (26), we define the retrieval rate , as the ratio between information of the inner products in and total downloading cost to retrieve the inner products , minimized over all possible requests , , i.e.,
The capacity is the supremum of all achievable .
In order to proceed we need to review the results of MPIR problem in . Consider a system, including data files, replicated in noncoluding servers. Each data file is chosen independently and uniformly at random from the finite field . A user wishes to retrieve a subset indexed by of data files, ensuring the privacy of . Assume , where is known publicly. Rate is defined as information of subset of data files indexed by over download cost, and the capacity is defined as the supremum over all rates in privacy preserving schemes. Then we have ,
where for , we have
and for , we have
and is equal to
where is defined as and . In addition, , is the solution of the set of linear equations and , .
V Main Results
The main result is stated in the following theorem.
For a system with files in and servers, where the user is interested in a subset of size of inner products, we have
where is a constant independent of and .
If , then we have
If , then we have
The proof can be found in the next section. Assuming is large enough, for achievability, we use the scheme of MPIR. For converse, we prove that as goes to infinity, entries of converges to a set of independent random variables with uniform distribution, with the rate of convergence dominated by a constant , . For large , in some cases, the achievable rate and converse match. In other cases, these two are very close.
We sort the elements of set in a vector , such that in comes before if or and . Likewise, we sort the elements of in a vector .
In this section, we provide the proof for Theorem 1.
First we show that as , the distribution of converges to a uniform distribution over :
Indeed, we increase by one, and show that the distribution of over becomes closer to a uniform distribution. In addition, we derive the rate of convergence.
Let us denote the members of set by , i.e.,
We denote the probability mass function of over by , i.e.
Our goal is to investigate how changes, as we increase to . Let
Without loss of generality, we assume that
where is selected uniformly at random from . We note that by this construction and become correlated. However, the distribution of is still the same as it was discussed in the problem formulation but this correlation allows us to derive the converging distribution.
The sequence forms a Markov chain with a time-homogeneous transition probability , i.e.
Defining the data files as above, then we have,
Thus for the vector of inner products , we also can write,
Because of the way we constructed from , for , it is apparent that is independent of data files , , and irrespective of . We have
Thus from (35), we can rewrite the above equation as
where is a constant matrix, with entry be equal to
We note that is constant and independent of . ∎
To show that the limit in (32) exists, in the following lemma, we guarantee that the Markov chain has steady distribution.
Markov chain formed by the sequence is irreducible.
In order to prove lemma we show that there exists some , such that , . This means it is possible to get to any state from any state in this chain or equivalently this chain is irreducible. We note that for any integer
One can see that
denotes entry of matrix .
This lemma is equivalent to claim that there exists some such that every realization of in is possible with some positive probability. Notice that the following relationship holds,
It is obvious that , , are mutually independent. The reason is that is only dependent of .
We first show that for every vector in with only one non-zero element is a probable (has a positive probability) realization of . In other words, we show that, for any , where and , , for some , then . Let us assume
We know that by definition , for some . Here, we consider two cases for values of .
: In this case . In other words, , for some
From [15, Page 66 ], we have
Therefore one possible case that can create such is as follows:
Clearly this case has positive probability and therefore .
In the case . In other words, , for some , .
We have (see [15, Page 66])
Therefore one possible case that can create such is as follows:
In particular, one can verify that
Other entries of are zero trivially.
Since the probability of (55) is not zero, therefore in this case also .
From these two cases above, we can say every vector with one non-zero element is a probable (with positive probability) realization of . We now show that every vector in is a possible realization with positive probability for when . First we write as,
Let be an arbitrary vector. To show that is a possible realization of with non-zero probability, we first define , as follows,
This means is zero in every index except in index where its value is . We can see that,
Markov sequence has a steady state.
As , Markov chain converges to a random vector with uniform distribution over .
It is known that if a Markov chain has steady state, its stationary distribution is equal to its steady state probabilities [16, Page 174]. We use this fact to find that steady state. As obtained, we know . It is easy to see that for any , the set is equal to . Thus,
Let . It is easy to see that due to (63), . Thus uniform distribution is stationary state probability of this Markov chain. ∎
Let denote the PMF of over . Then, , where is the second largest eigenvalue (absolute value of eigenvalue) of and .
We show that,