Label Differential Privacy via Aggregation

Abstract

This paper explores the use of linear aggregation to protect the privacy of sensitive training labels through the concept of \emph{label differential privacy} (label-DP) while maintaining regression task utility. Our key finding is that weighted linear aggregation of training instances with i.i.d. $N(0, 1)$ weights can achieve $(\varepsilon, \delta)$-label-DP with $m = O\left(n/(\log(1/\delta))\right)$. Unlike prior methods, our approach relies on the minimum linear regression loss rather than the minimum singular value of the data matrix, resulting in better practical bounds on real datasets. We also examine real-world mechanisms involving disjoint sets or \textit{bags} of instances. We demonstrate that aggregating labels from sub-sampled disjoint $k$-sized bags using i.i.d. $N(0,1)$ weights achieves $(\varepsilon,\delta)$-label-DP with $k \geq \Omega\left(\left((1/\varepsilon)\log\left(1/\delta\right)\right)^2\right)$. In both scenarios, the optimal linear mse-regressor on the aggregated data approximates the original dataset's optimum with high probability, without needing additive label noise. Furthermore, we show that adding $N(0,1)$ noise to any constant fraction of labels allows for similar label-DP guarantees when aggregating labels over random disjoint bags, while preserving the utility of Lipschitz-bounded neural mse-regression tasks.