Two Party Distribution Testing: Communication and Security
Negev Nosatzki2018, arXiv (Cornell University)
Sign up for access to the world's latest research
checkGet notified about relevant papers
checkSave papers to use in your research
checkJoin the discussion with peers
checkTrack your impact
Abstract
We study the problem of discrete distribution testing in the two-party setting. For example, in the standard closeness testing problem, Alice and Bob each have t samples from, respectively, distributions a and b over [n], and they need to test whether a = b or a, b are-far (in the 1 distance) for some fixed > 0. This is in contrast to the well-studied one-party case, where the tester has unrestricted access to samples of both distributions, for which optimal bounds are known for a number of variations. Despite being a natural constraint in applications, the two-party setting has evaded attention so far. We address two fundamental aspects of the two-party setting: 1) what is the communication complexity, and 2) can it be accomplished securely, without Alice and Bob learning extra information about each other's input. Besides closeness testing, we also study the independence testing problem, where Alice and Bob have t samples from distributions a and b respectively, which may be correlated; the question is whether a, b are independent of-far from being independent. Our contribution is threefold: • Communication: we show how to gain communication efficiency as we have more samples, beyond the information-theoretic bound on t. Furthermore, the gain is polynomially better than what one may obtain by adapting one-party algorithms. For the closeness testing, our protocol has communication s =Θ n 2 /t 2 as long as t is at least the information-theoretic minimum number of samples. For the independence testing over domain [n] × [m], where n ≥ m, we obtain s =Õ (n 2 m/t 2 + nm/t + √ m). • Lower bounds: we prove tightness of our trade-off for the closeness testing, as well as that the independence testing requires tight Ω(√ m) communication for unbounded number of samples. These lower bounds are of independent interest as, to the best of our knowledge, these are the first 2-party communication lower bounds for testing problems, where the inputs represent a set of i.i.d. samples. • Security: we define the concept of secure distribution testing and argue that it must leak at least some minimal information when the promise is not satisfied. We then provide secure versions of the above protocols with an overhead that is only polynomial in the security parameter.
Related papers
Distributed Hypothesis Testing with Privacy Constraints
Entropy, 2019
We revisit the distributed hypothesis testing (or hypothesis testing with communication constraints) problem from the viewpoint of privacy. Instead of observing the raw data directly, the transmitter observes a sanitized or randomized version of it. We impose an upper bound on the mutual information between the raw and randomized data. Under this scenario, the receiver, which is also provided with side information, is required to make a decision on whether the null or alternative hypothesis is in effect. We first provide a general lower bound on the type-II exponent for an arbitrary pair of hypotheses. Next, we show that if the distribution under the alternative hypothesis is the product of the marginals of the distribution under the null (i.e., testing against independence), then the exponent is known exactly. Moreover, we show that the strong converse property holds. Using ideas from Euclidean information theory, we also provide an approximate expression for the exponent when the ...
A scalable multi-party protocol for privacy-preserving equality test
2013
Multi-party computation (MPC) is attractive for data owners who are interested in collaborating to execute queries without sharing their data. Since data owners in MPC do not trust each other, finding a secure protocol for privacy-preserving query processing is a major requirement for real world applications. This paper deals with equality test query among data of multiple data owners without revealing anyone's private data to others. In order to nicely scale with large size data, we show how communication and computation costs can be reduced via a bucketization technique. Our bucketization requires the use of a trusted third party (TTP) only at the beginning of the protocol execution. Experimental tests on horizontally distributed data show the effectiveness of our approach.
Statistical Security Conditions for Two-Party Secure Function Evaluation
Lecture Notes in Computer Science, 2008
To simplify proofs in information-theoretic security, the standard security definition of two-party secure function evaluation based on the real/ideal model paradigm is often replaced by an informationtheoretic security definition. At EUROCRYPT 2006, we showed that most of these definitions had some weaknesses, and presented new information-theoretic conditions that were equivalent to a simulation-based definition in the real/ideal model. However, there we only considered the perfect case, where the protocol is not allowed to make any error, which has only limited applications. We generalize these results to the statistical case, where the protocol is allowed to make errors with a small probability. Our results are based on a new measure of information that we call the statistical information, which may be of independent interest.
The Price of Low Communication in Secure Multi-party Computation
2017
Traditional protocols for secure multi-party computation among n parties communicate at least a linear (in n) number of bits, even when computing very simple functions. In this work we investigate the feasibility of protocols with sublinear communication complexity. Concretely, we consider two clients, one of which may be corrupted, who wish to perform some “small” joint computation using n servers but without any trusted setup. We show that enforcing sublinear communication complexity drastically affects the feasibility bounds on the number of corrupted parties that can be tolerated in the setting of information-theoretic security.
Distributed Hypothesis Testing With a Privacy Constraint
2018
A distributed binary hypothesis testing problem involving two parties, a remote observer and a detector, is studied. The remote observer has access to a discrete memoryless source, and communicates its observations to the detector via a rate-limited noiseless channel. The detector observes another discrete memoryless source, and performs a binary hypothesis test on the joint distribution of its own observations with those of the observer. While the goal of the observer is to maximize the type 2 error exponent of the test for a given type 1 error probability constraint, it also wants to keep a private part of its observations as oblivious to the detector as possible. Considering both equivocation and average distortion as possible measures of privacy, the trade-off between the communication rate from the observer to the detector, the type 2 error exponent and privacy is studied. For the general hypothesis testing problem, we establish single-letter inner bounds on both the rate-error...
Uniformity Testing in the Shuffle Model: Simpler, Better, Faster
Symposium on Simplicity in Algorithms (SOSA), 2022
Uniformity testing, or testing whether independent observations are uniformly distributed, is the prototypical question in distribution testing. Over the past years, a line of work has been focusing on uniformity testing under privacy constraints on the data, and obtained private and data-efficient algorithms under various privacy models such as central differential privacy (DP), local privacy (LDP), pan-privacy, and, very recently, the shuffle model of differential privacy. In this work, we considerably simplify the analysis of the known uniformity testing algorithm in the shuffle model, and, using a recent result on "privacy amplification via shuffling," provide an alternative algorithm attaining the same guarantees with an elementary and streamlined argument.
Nearly Quadratic Broadcast Without Trusted Setup Under Dishonest Majority
IACR Cryptol. ePrint Arch., 2020
Broadcast (BC) is a crucial ingredient for many protocols in distributed computing and cryptography. In this paper we study its communication complexity against an adversary that controls a majority of the parties. In this setting, all known protocols either exhibit a communication complexity of more than O(n) bits (where n is the number of parties) or crucially rely on a trusted party to generate cryptographic keys before the execution of the protocol. We give the first protocol for BC that achieves Õ(n · κ) bits of communication (where κ is the security parameter) under a dishonest majority and minimal cryptographic setup assumptions, i.e., where no trusted setup is required and parties just need to generate their own cryptographic keys. Our protocol is randomized and combines the classic Dolev-Strong protocol with network gossiping techniques to minimize communication. Our analysis of the main random process employs Chernoff bounds for negatively-associated variables and might be...
On communication protocols that compute almost privately
Theoretical Computer Science, 2012
We further investigate and generalize the approximate privacy model recently introduced by Feigenbaum et al. . We explore the privacy properties of a natural class of communication protocols that we refer to as "dissection protocols". Informally, in a dissection protocol the communicating parties are restricted to answering questions of the form "Is your input between the values α and β (under a pre-defined order over the possible inputs)?". We prove that for a large class of functions, called tiling functions, there always exists a dissection protocol that provides a constant average-case privacy approximation ratio for uniform or "almost uniform" probability distributions over inputs. To establish this result we present an interesting connection between the approximate privacy framework and basic concepts in computational geometry. We show that such a good privacy approximation ratio for tiling functions does not, in general, exist in the worst case. We also discuss extensions of the basic setup to more than two parties and to non-tiling functions, and provide calculations of privacy approximation ratios for two functions of interest.
Testing the Lipschitz Property over Product Distributions with Applications to Data Privacy
Lecture Notes in Computer Science, 2013
In the past few years, the focus of research in the area of statistical data privacy has been in designing algorithms for various problems which satisfy some rigorous notions of privacy. However, not much effort has gone into designing techniques to computationally verify if a given algorithm satisfies some predefined notion of privacy. In this work, we address the following question: Can we design algorithms which tests if a given algorithm satisfies some specific rigorous notion of privacy (e.g., differential privacy)? We design algorithms to test privacy guarantees of a given algorithm A when run on a dataset x containing potentially sensitive information about the individuals. More formally, we design a computationally efficient algorithm Tpriv that verifies whether A satisfies differential privacy on typical datasets (DPTD) guarantee in time sublinear in the size of the domain of the datasets. DPTD, a similar notion to generalized differential privacy first proposed by [3], is a distributional relaxation of the popular notion of differential privacy [14]. To design algorithm Tpriv, we show a formal connection between the testing of privacy guarantee for an algorithm and the testing of the Lipschitz property of a related function. More specifically, we show that an efficient algorithm for testing of Lipschitz property can be used as a subroutine in Tpriv that tests if an algorithm satisfies differential privacy on typical datasets. Apart from formalizing the connection between the testing of privacy guarantee and testing of the Lipschitz property, we generalize the work of [21] to the setting of property testing under product distribution. More precisely, we design an efficient Lipschitz tester for the case where the domain points are drawn from hypercube according to some fixed but unknown product distribution instead of the uniform distribution.
On the Power of Correlated Randomness in Secure Computation
Lecture Notes in Computer Science, 2013
We investigate the extent to which correlated secret randomness can help in secure computation with no honest majority. It is known that correlated randomness can be used to evaluate any circuit of size s with perfect security against semi-honest parties or statistical security against malicious parties, where the communication complexity grows linearly with s. This leaves open two natural questions: (1) Can the communication complexity be made independent of the circuit size? (2) Is it possible to obtain perfect security against malicious parties? We settle the above questions, obtaining both positive and negative results on unconditionally secure computation with correlated randomness. Concretely, we obtain the following results. Minimizing communication. Any multiparty functionality can be realized, with perfect security against semi-honest parties or statistical security against malicious parties, by a protocol in which the number of bits communicated by each party is linear in its input length. Our protocol uses an exponential number of correlated random bits. We give evidence that super-polynomial randomness complexity may be inherent. Perfect security against malicious parties. Any finite "senderreceiver" functionality, which takes inputs from a sender and a receiver and delivers an output only to the receiver, can be perfectly realized given correlated randomness. In contrast, perfect security is generally impossible for functionalities which deliver outputs to both parties. We also show useful functionalities (such as string equality) for which there are efficient perfectly secure protocols in the correlated randomness model.
Related topics
Related papers
Optimal high-dimensional and nonparametric distributed testing under communication constraints
2022
We derive minimax testing errors in a distributed framework where the data is split over multiple machines and their communication to a central machine is limited to b bits. We investigate both the dand infinite-dimensional signal detection problem under Gaussian white noise. We also derive distributed testing algorithms reaching the theoretical lower bounds. Our results show that distributed testing is subject to fundamentally different phenomena that are not observed in distributed estimation. Among our findings, we show that testing protocols that have access to shared randomness can perform strictly better in some regimes than those that do not. Furthermore, we show that consistent nonparametric distributed testing is always possible, even with as little as 1-bit of communication and the corresponding test outperforms the best local test using only the information available at a single local machine.
Randomness in Distribution Protocols
Information and Computation, 1996
Optimal Algorithms for Testing Closeness of Discrete Distributions
Proceedings of the Twenty-Fifth Annual ACM-SIAM Symposium on Discrete Algorithms, 2013
We study the question of closeness testing for two discrete distributions. More precisely, given samples from two distributions p and q over an n-element set, we wish to distinguish whether p = q versus p is at least ε-far from q, in either ℓ 1 or ℓ 2 distance. Batu et al [BFR + 00, BFR + 13] gave the first sub-linear time algorithms for these problems, which matched the lower bounds of [Val11] up to a logarithmic factor in n, and a polynomial factor of ε.
A Full Characterization of Completeness for Two-Party Randomized Function Evaluation
Advances in Cryptology – EUROCRYPT 2014, 2014
We settle a long standing open problem which has pursued a full characterization of completeness of (potentially randomized) finite functions for 2-party computation that is secure against active adversaries. Since the first such complete function was discovered [Kilian, FOCS 1988], the question of which finite 2-party functions are complete has been studied extensively, leading to characterization in many special cases. In this work, we completely settle this problem. We provide a polynomial time algorithm to test whether a 2-party finite secure function evaluation (SFE) functionality (possibly randomized) is complete or not. The main tools in our solution include: -A formal linear algebraic notion of redundancy in a general 2-party randomized function. -A notion of statistically testable games. A kind of interactive proof in the information-theoretic setting where both parties are computationally unbounded but differ in their knowledge of a secret. -An extension of the (weak) converse of Shannon's channel coding theorem, where an adversary can adaptively choose the channel based on its view. We show that any function f , if complete, can implement any (randomized) circuit C using only O(|C| + κ) calls to f , where κ is the statistical security parameter. In particular, for any two-party functionality g, this establishes a universal notion of its quantitative "cryptographic complexity" independent of the setup and has close connections to circuit complexity.
The Round Complexity of Two-Party Random Selection
SIAM Journal on Computing, 2008
We study the round complexity of two-party protocols for generating a random nbit string such that the output is guaranteed to have bounded bias (according to some measure) even if one of the two parties deviates from the protocol (even using unlimited computational resources). Specifically, we require that the output's statistical difference from the uniform distribution on {0, 1} n is bounded by a constant less than 1. We present a protocol for the above problem that has 2 log * n + O(1) rounds, improving a previous 2n-round protocol of Goldreich, Goldwasser, and Linial (FOCS '91). Like the GGL protocol, our protocol actually provides a stronger guarantee, ensuring that the output lands in any set T ⊆ {0, 1} n of density µ with probability at most O(√ µ + δ), where δ is an arbitarily small constant. We then prove a matching lower bound, showing that any protocol guaranteeing bounded statistical difference requires at least log * n − log * log * n − O(1) rounds. As far as we know, this is the first nontrivial lower bound on the round complexity of random selection protocols (of any type) that does not impose additional constraints (e.g. on communication or "simulatability"). We also prove several results for the case when the output's bias is measured by the maximum multiplicative factor by which a party can increase the probability of a set T ⊆ {0, 1} n .
Security with Low Communication Overhead
Lecture Notes in Computer Science, 1991
We consider the communication complexity of secure multiparty computations by networks of processors each with unlimited computing power. Say that an n-party protocol for a function of m bits is efficient if it uses a constant number of rounds of communication and a total number of message bits that is polynomial in max(m, n). We show that any function has an efficient protocol that achieves (rclog n)/m resilience. Ours is the first secure multiparty protocol in which the communication complexity is independent of the computational complexity of the function being computed. We also consider the communication complexity of zero-knowledge proofs of properties of committed bits. We show that every function / of m bits has an efficient notarized envelope scheme; that is, there is a protocol in which a computationally unlimited prover commits a sequence of bits x to a computationally unlimited verifier and then proves in perfect zero-knowledge (without decommitting x) that f(x) = 1, using a constant number of rounds and poly(m) message bits. Ours is the first notarized envelope scheme in which the communication complexity is independent of the computational complexity of /. Finally, we establish a new upper bound on the number of oracles needed in instance-hiding schemes for arbitrary functions. These schemes allow a computationally limited querier to capitalize on the superior power of one or more computationally unlimited oracles in order to obtain f(x) without revealing its private input x to any one of the oracles. We show that every function of m bits has an (m/logm)-oracle instance-hiding scheme. The central technique used in all of these results is locally random reducibility, which was used for the first time in [7] and is formally defined for the first time here. In addition to the applications that we present, locally random reducibility has been applied to interactive proof systems, program checking, and program testing.
One-round multi-party communication complexity of distinguishing sums
Theoretical Computer Science, 2013
We consider an instance of the following problem: Parties P 1 , . . . , P k each receive an input x i , and a coordinator (distinct from each of these parties) wishes to compute f (x 1 , . . . , x k ) for some predicate f . We are interested in one-round protocols where each party sends a single message to the coordinator; there is no communication between the parties themselves. What is the minimum communication complexity needed to compute f , possibly with bounded error? We prove tight bounds on the one-round communication complexity when f corresponds to the promise problem of distinguishing sums (namely, determining which of two possible values the {x i } sum to) or the problem of determining whether the {x i } sum to a particular value. Similar problems were studied previously by Nisan and in concurrent work by Viola. Our proofs rely on basic theorems from additive combinatorics, but are otherwise elementary.
The communication complexity of non-signaling distributions
34th International Symposium on Mathematical Foundations of Computer Science (MFCS'09), 2009
We study a model of communication complexity that encompasses many well-studied problems, including classical and quantum communication complexity, the complexity of simulating distributions arising from bipartite measurements of shared quantum states, and XOR games. In this model, Alice gets an input x, Bob gets an input y, and their goal is to each produce an output a, b distributed according to some pre-specified joint distribution p(a, b|x, y). Our results apply to any non-signaling distribution, that is, those where Alice's marginal distribution does not depend on Bob's input, and vice versa.
On the communication complexity of distributions
Consider the following general communication problem: Alice and Bob have to simulate a probabilistic function p, that with every (x, y) ∈ X ×Y associates a probability distribution on A × B. The two parties, upon receiving inputs x and y, need to output a ∈ A, b ∈ B in such a manner that the (a, b) pair is distributed according to p(x, y). They share randomness (this is their only source of randomness), and have access to a channel that allows two-ways communication. Our main focus is an instance of the above problem coming from the well known EPR experiment in quantum physics, but we also present some more general facts about this rather young and promising complexity measure. The results contained herein are entirely classical and no knowledge of the quantum phenomenon is assumed. Different notions of complexity may be defined for this problem. Due to an upper bound by Toner and Bacon [TB03], and a matching lower bound by Barrett, Kent and Pironio [BKP06], the average and worst-ca...
Secure Non-interactive Simulation: Hardness & Feasibility
IACR Cryptol. ePrint Arch., 2020
Network latency is a significant source of inefficiency in interactive protocols. This work contributes towards the possibility of reducing the round complexity and communication complexity of secure computation protocols to a minimum. We introduce the concept of secure noninteractive simulation of joint distributions. Two parties begin with multiple independent samples from a correlated randomness source. Next, our objective is to investigate what forms of joint distributions can Alice and Bob securely simulate without any further communication. This offline preprocessing step fits perfectly within the offline-online paradigm of secure computation, which enables general secure computation even against parties with unbounded computational power. One may interpret this concept as imbuing the notion of non-interactive simulation of joint distributions, which initiated from the seminal works of Gács and Körner (1972), and Wyner (1975), in information theory with cryptographic security....
Loading Preview
Sorry, preview is currently unavailable. You can download the paper by clicking the button above.