Private Approximation of Search Problems Amos Beimel Paz Carmi Kobbi Nissim Enav Weinreb (Technion)

x y Let’s compute f(x, y)!

x y No! You will learn too much information on my input!

x y Haven’t you heard of secure function evaluation?

x y Sure I’v heard of it...But for f it will be inefficient

x y That’s not a problem! We can approximate f by f* and do SFE on f*!

x y Hmmmm.... I don’t know...

What can go wrong? Example: f*(x, y) reveals Bob ’ s input. f(134, 285) = 64 f*(134, 285) = f(847, 121) = 26 f*(847, 121) = y Hmmm...

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Private Approximation [FIMNSW] f* is a private approximation for f:  f* is an approximation of f.  f*(x) gives no more information about x then f(x). Privacy definitions:  f*(x) can be simulated given f(x).  If f(x)=f(x’) then f*(x) and f*(x’) should be indistinguishable.

Positive results [FIMNSW]  Hamming distance: Private approximation in communication O(√n). Improved to polylog(n) by [IW]  Permanent: Private approximation in polynomial time.

PA of NP-Hard Functions [HKKN] Vertex Cover Input: undirected graph G=. A set is a vertex cover of G if for every, or. Functional: Return minimum vertex cover size. * We’ll discuss search version later.

G “ Would you tell me the vertex cover size of your graph? ” “ I would, but it is hard to compute. ” “ So, tell me an approximation! ” “ Hmmm …” SERVER CLIENT Client-Server Model

Maximal Matching Approximation  Find maximal matching.  Its vertices form a cover.  2-approximation: solution size is at most 2 times the optimal solution

G “ So, tell me an approximation! ” “ Hmmm …” VC Matching 22 24

Impossibility results [HKKN]  If NP BPP there is no polynomial private n 1-ε -approximation algorithm for vertex cover size.  Impossibility results for other NP- complete functions: MAX-SAT Vertex cover in planer graphs.

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Search problems  Function - one output for every input.  Search - many solutions for one input. Example: vertex cover Return a vertex cover of the graph (a set of vertices).  What is the right definition of privacy?  What pairs of inputs should not be distinguished by the output?

Step 1: Privacy w.r.t. a Relation R – Equivalence relation over the inputs A – Probabilistic algorithm A is private with respect to R if: x y A( ) ≈ c x y

Step 2: Defining the Relation Let P be a search problem. Let S(x) be the set of solutions to the input x. We say that x ≈ P y if x and y have the same set of solutions, that is, S(x)=S(y).

Example – Vertex Cover (Search)  G 1 ≈ VC G 2 if they have the same set of minimum vertex covers.  A is a private approximation algorithm for vertex cover if: A is an approximation algorithm for vertex cover. G 1 ≈ VC G 2  A(G 1 ) A(G 2 )  Can this be done efficiently? ≈ c ≈ VC vertex cover sets: {2,3} and {3,5}

Search versus Functional  In non-private computation: A lower bound for functional implies a lower bound for search.  Private computation: Functional – equivalent (VC size = 2). Search – not equivalent ({2,4} is a VC only of the right graph)

Search versus Functional Can we use the lower bounds techniques of [HKKN] for functional vertex cover? No.  [HKKN] relies on having few equivalence classes.  In search - Huge number of equivalence classes.

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Vertex Cover - Impossibility Result Theorem 1 If P ≠NP there is no deterministic polynomial time n 1-ε -approximation algorithm for vertex cover. Proof idea: Given a private-approximation algorithm A, we construct a greedy algorithm that solves vertex cover exactly.

Definitions for the Proof Let be a graph.  A vertex is critical for if every minimum vertex cover of contains.  A vertex is relevant for if there exists a minimum vertex cover of that contains.  Every vertex is non-critical or relevant (or both).

A Taste of the Proof Claim: Let be a graph and. If then both and are non critical for. A vertex is critical for if every minimum vertex cover of contains. The approximation’s answer teaches us about the optimal solution!

Proof of the Claim Let be a graph and. If then both and are non critical for. is non critical for. Privacy

Relevant / Non-Critical Problem  Input Graph G Vertex v.  Output - one of the following: v is Relevant for G. v is Non-Critical for G.  Enables a greedy algorithm for Vertex Cover.

Claim 2 (Without proof) Polynomial private approximation algorithm for vertex cover (search) implies a polynomial algorithm for the Relevant/Non-Critical problem.

Vertex Cover - Impossibility Result Theorem 1 If P ≠NP there is no deterministic polynomial time n 1-ε -approximation algorithm for vertex cover. randomizedRP NP

 Given a 3CNF formula find an assignment that satisfies a maximum fraction of its clauses.  Best approximation ratio: 7/8.  if and have the same set of maximum satisfying assignments.  Again, no private approximation! MAX-3SAT

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Almost-Private Algorithms [HKKN]  Let f be a function.  f* is a private approximation for f that leaks k bits: f*(x) can be simulated from f(x) and another k bits of advice. Example: There is an efficient 4-approximation of vertex cover size that leaks 1 bit.

Almost-Private Algorithms - Search x y A( ) ≈ c w z ? x y z w

Almost-Private Algorithms is k-private with respect to if there exists such that: Every equivalence class of is a union of at most equivalence classes of. 3. is private with respect to.

Search versus Functional Can we use the ideas of [HKKN] for functions to get efficient almost private algorithms for search problems? No. [HKKN] use rounding of the result of a non-private approximation. Not clear how to generalize to search problems.

Every equivalence class of is divided into subclasses. Almost Private Approximation for MAX-E3SAT and have the same set of maximum satisfying assignments. … …

Lemma 1 There is a set of assignments such that for every 3SAT formula on n variables there exists an that satisfies of the clauses in. Proof: Construct almost 3-wise [NN, AGHP] independent variables. Number of assignments:.

Proof of Lemma 1 (cont.) For every 3 random variables and every 3 Boolean values : Conclusion 1: For each clause : over the choice of. Conclusion 2: For every formula there is an assignment that satisfies of its clauses.

Almost Private Approximation for MAX-3SAT Theorem 2 There exists a -private -approximation algorithm for MAX-3SAT. Proof: We use from Lemma 1. Given a formula return the first that satisfies at least of the clauses in.

Solution-List Paradigm  A short list of solutions.  Every input has a good approximation in the list.  2 k solutions  k-private algorithm

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Problems in P - Private Computation Let S be a search problem in P. (Example: shortest-path) Recall that x ≈ S y if x and y have the same set of solutions. For a private algorithm we require: A(x) ≈ c A(y) Is there a private algorithm for every problem in P? No!

Impossibility result for a Problem in P Input: G=, C, k Output: If C is a clique of size k in G then output a clique of size k in G. The problem is in P because C is a legal output. A private algorithm implies a non- uniform algorithm for Clique.

Positive Results for Problems in P Any problem S for which we can find:  The lexicographically first solution x ≈ S y implies x and y have the same lex first solution.  A random solution x ≈ S y implies that a random solution distributes identically for x and y. Examples: perfect matching, shortest path, linear algebra, and more...

Discussion – Strength of Definition We said the definition is minimal – good for impossibility results. Is it strong enough for positive results? Can returning the lex first solution be considered private? What is the right sufficient definition? (work in progress...)

 Background and Previous Work  Definitions for Search Problems  Impossibility Result for Vertex Cover  Algorithms that Leak (Little) Information Positive Result for MAX-3SAT  Problems in P  Conclusions and Open Problems Talk Overview

Further Results  Impossibility result for (any) (log n)-private -approximation algorithm for vertex cover.  Solution-list -approximation algorithm for vertex cover that leaks bits. [BHN07] improved the lower bound to show that the solution-list algorithm is optimal.

Conclusions  Defined private approximation of search problems  Impossibility result for private approximation of vertex cover  Defined k-private approximation algorithms for search problems  Positive result for MAX-3SAT  Private computation of problems in P

Open Problems  More private approximation algorithms. Design algorithms that defeat solution list algorithms.  Private computation of problems in P. What is the right (sufficient) definition? What search problems admit efficient private computation?

Vertex Cover - Impossibility Result Theorem 1 If P ≠NP there is no deterministic polynomial time n 1-ε -approximation algorithm that is private with respect to ≈ VC. Proof Idea: Given a private n 1-ε -approximation algorithm A, we exactly solve vertex cover.

Definitions for the Proof Let be a graph.  A vertex is critical for if every minimum vertex cover of contains.  A vertex is relevant for if there exists a minimum vertex cover of that contains.  Every vertex is non-critical or relevant (or both).

Claim 1 Let be a graph and. If then both and are non critical for. Note: The claim is useless if.

Proof of Claim 1 Let be a graph and. If then both and are non critical for. is non critical for. Privacy

Relevant / Non-Critical Algorithm  Input Graph G Vertex v.  Output - one of the following: v is Relevant for G. v is Non-Critical for G.  Enables a greedy algorithm for Vertex Cover.

Relevant / Non-Critical Algorithm Let Is ? I is a big set of isolated vertices.

Case 1 is non critical for. Privacy (If was critical for, both copies of would be critical for.)

Case 2 By Claim 1 is not critical for.Claim 1 Let be the size of the minimum vertex cover of. Thus, there exists a minimum cover of that does not contain.

Case 2 (cont.) Assume is not relevant for. must contain both copies of as it does not contain. Thus, contains two non-optimal vertex covers of

Case 2 (cont. ii) However, taking two minimal covers of and adding results in a cover for of size. Contradiction to the minimality of Hence, is relevant for.

Relevant / Non-Critical (Summary)  On input ( ): Define the graph. Compute. Choose. Define the graph. If, output: “ is Non-Critical for. ” If, output: “ is Relevant for. ”

Greedy Vertex Cover  Choose an arbitrary vertex.  Execute the Relevant/Non-Critical algorithm on.  If is Relevant, take and delete all edges adjacent to.  If is Non-Critical, take and delete all edges adjacent to.  Continue recursively.

Vertex Cover - Impossibility Result Theorem 1 If P ≠NP there is no deterministic polynomial time n 1-ε -approximation algorithm for vertex cover. randomizedRP NP