SearcharxivSearch

arXiv subjects

Lynn Chua

Publications and source records attributed to Lynn Chua.

18 recordsLinked to original sources

Convex Optimization with Local Label Differential Privacy: Tight Bounds in All Privacy Regimes

We study the problem of Stochastic Convex Optimization (SCO) under the constraint of local Label Differential Privacy (L-LDP). In this setting, the features are considered public, but the corresponding labels are sensitive and must be randomized by each user locally before being sent to an untrusted analyzer. Prior work for SCO under L-LDP (Ghazi et al., 2021) established an excess population risk bound with a \emph{linear} dependence on the size of the label space, $K$: $O\left({\frac{K}{\epsilon\sqrt{n}}}\right)$ in the high-privacy regime ($\epsilon \leq 1$) and $O\left({\frac{K}{e^{\epsilon} \sqrt{n}}}\right)$ in the medium-privacy regime ($1 \leq \epsilon \leq \ln K$). This left open whether this linear cost is fundamental to the L-LDP model. In this note, we resolve this question. First, we present a novel and efficient non-interactive L-LDP algorithm that achieves an excess risk of $O\left({\sqrt{\frac{K}{\epsilon n}}}\right)$ in the high-privacy regime ($\epsilon \leq 1$) and $O\left({\sqrt{\frac{K}{e^{\epsilon} n}}}\right)$ in the medium-privacy regime ($1 \leq \epsilon \leq \ln K$). This quadratically improves the dependency on the label space size from $O(K)$ to $O(\sqrt{K})$. Second, we prove a matching information-theoretic lower bound across all privacy regimes for any sufficiently large $n$.

cs.DS

VaultGemma: A Differentially Private Gemma Model

We introduce VaultGemma 1B, a 1 billion parameter model within the Gemma family, fully trained with differential privacy. Pretrained on the identical data mixture used for the Gemma 2 series, VaultGemma 1B represents a significant step forward in privacy-preserving large language models. We openly release this model to the community

cs.CR

Balls-and-Bins Sampling for DP-SGD

We introduce the Balls-and-Bins sampling for differentially private (DP) optimization methods such as DP-SGD. While it has been common practice to use some form of shuffling in DP-SGD implementations, privacy accounting algorithms have typically assumed that Poisson subsampling is used instead. Recent work by Chua et al. (ICML 2024), however, pointed out that shuffling based DP-SGD can have a much larger privacy cost in practical regimes of parameters. In this work we show that the Balls-and-Bins sampling achieves the "best-of-both" samplers, namely, the implementation of Balls-and-Bins sampling is similar to that of Shuffling and models trained using DP-SGD with Balls-and-Bins sampling achieve utility comparable to those trained using DP-SGD with Shuffling at the same noise multiplier, and yet, Balls-and-Bins sampling enjoys similar-or-better privacy amplification as compared to Poisson subsampling in practical regimes.

cs.LG

Scalable DP-SGD: Shuffling vs. Poisson Subsampling

We provide new lower bounds on the privacy guarantee of the multi-epoch Adaptive Batch Linear Queries (ABLQ) mechanism with shuffled batch sampling, demonstrating substantial gaps when compared to Poisson subsampling; prior analysis was limited to a single epoch. Since the privacy analysis of Differentially Private Stochastic Gradient Descent (DP-SGD) is obtained by analyzing the ABLQ mechanism, this brings into serious question the common practice of implementing shuffling-based DP-SGD, but reporting privacy parameters as if Poisson subsampling was used. To understand the impact of this gap on the utility of trained machine learning models, we introduce a practical approach to implement Poisson subsampling at scale using massively parallel computation, and efficiently train models with the same. We compare the utility of models trained with Poisson-subsampling-based DP-SGD, and the optimistic estimates of utility when using shuffling, via our new lower bounds on the privacy guarantee of ABLQ with shuffling.

cs.LG

Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy

Machine unlearning algorithms, designed for selective removal of training data from models, have emerged as a promising approach to growing privacy concerns. In this work, we expose a critical yet underexplored vulnerability in the deployment of unlearning systems: the assumption that the data requested for removal is always part of the original training set. We present a threat model where an attacker can degrade model accuracy by submitting adversarial unlearning requests for data not present in the training set. We propose white-box and black-box attack algorithms and evaluate them through a case study on image classification tasks using the CIFAR-10 and ImageNet datasets, targeting a family of widely used unlearning methods. Our results show extremely poor test accuracy following the attack: 3.6% on CIFAR-10 and 0.4% on ImageNet for white-box attacks, and 8.5% on CIFAR-10 and 1.3% on ImageNet for black-box attacks. Additionally, we evaluate various verification mechanisms to detect the legitimacy of unlearning requests and reveal the challenges in verification, as most of the mechanisms fail to detect stealthy attacks without severely impairing their ability to process valid requests. These findings underscore the urgent need for research on more robust request verification methods and unlearning protocols, should the deployment of machine unlearning systems become more prevalent in the future.

cs.CR

Crosslingual Capabilities and Knowledge Barriers in Multilingual Large Language Models

Large language models (LLMs) are typically multilingual due to pretraining on diverse multilingual corpora. But can these models relate corresponding concepts across languages, i.e., be crosslingual? This study evaluates state-of-the-art LLMs on inherently crosslingual tasks. We observe that while these models show promising surface-level crosslingual abilities on machine translation and embedding space analyses, they struggle with deeper crosslingual knowledge transfer, revealing a crosslingual knowledge barrier in both general (MMLU benchmark) and domain-specific (Harry Potter quiz and TOFU benchmark) contexts. Since simple inference-time mitigation methods offer only limited improvement, we propose fine-tuning of LLMs on mixed-language data, which effectively reduces these gaps, even when using out-of-domain datasets like WikiText. Our findings suggest the need for explicit optimization to unlock the full crosslingual potential of LLMs. Our code is publicly available at https://github.com/google-research/crosslingual-knowledge-barriers.

cs.CL

Mind the Privacy Unit! User-Level Differential Privacy for Language Model Fine-Tuning

Large language models (LLMs) have emerged as powerful tools for tackling complex tasks across diverse domains, but they also raise privacy concerns when fine-tuned on sensitive data due to potential memorization. While differential privacy (DP) offers a promising solution by ensuring models are 'almost indistinguishable' with or without any particular privacy unit, current evaluations on LLMs mostly treat each example (text record) as the privacy unit. This leads to uneven user privacy guarantees when contributions per user vary. We therefore study user-level DP motivated by applications where it necessary to ensure uniform privacy protection across users. We present a systematic evaluation of user-level DP for LLM fine-tuning on natural language generation tasks. Focusing on two mechanisms for achieving user-level DP guarantees, Group Privacy and User-wise DP-SGD, we investigate design choices like data selection strategies and parameter tuning for the best privacy-utility tradeoff.

cs.CL

How Private are DP-SGD Implementations?

We demonstrate a substantial gap between the privacy guarantees of the Adaptive Batch Linear Queries (ABLQ) mechanism under different types of batch sampling: (i) Shuffling, and (ii) Poisson subsampling; the typical analysis of Differentially Private Stochastic Gradient Descent (DP-SGD) follows by interpreting it as a post-processing of ABLQ. While shuffling-based DP-SGD is more commonly used in practical implementations, it has not been amenable to easy privacy analysis, either analytically or even numerically. On the other hand, Poisson subsampling-based DP-SGD is challenging to scalably implement, but has a well-understood privacy analysis, with multiple open-source numerically tight privacy accountants available. This has led to a common practice of using shuffling-based DP-SGD in practice, but using the privacy analysis for the corresponding Poisson subsampling version. Our result shows that there can be a substantial gap between the privacy analysis when using the two types of batch sampling, and thus advises caution in reporting privacy parameters for DP-SGD.

cs.LG

Training Differentially Private Ad Prediction Models with Semi-Sensitive Features

Motivated by problems arising in digital advertising, we introduce the task of training differentially private (DP) machine learning models with semi-sensitive features. In this setting, a subset of the features is known to the attacker (and thus need not be protected) while the remaining features as well as the label are unknown to the attacker and should be protected by the DP guarantee. This task interpolates between training the model with full DP (where the label and all features should be protected) or with label DP (where all the features are considered known, and only the label should be protected). We present a new algorithm for training DP models with semi-sensitive features. Through an empirical evaluation on real ads datasets, we demonstrate that our algorithm surpasses in utility the baselines of (i) DP stochastic gradient descent (DP-SGD) run on all features (known and unknown), and (ii) a label DP algorithm run only on the known features (while discarding the unknown ones).

cs.LG

Computing Theta Functions with Julia

We present a new package Theta.jl for computing with the Riemann theta function. It is implemented in Julia and offers accurate numerical evaluation of theta functions with characteristics and their derivatives of arbitrary order. Our package is optimized for multiple evaluations of theta functions for the same Riemann matrix, in small dimensions. As an application, we report on experimental approaches to the Schottky problem in genus five.

cs.MS

On the Schottky problem for genus five Jacobians with a vanishing theta null

We give a solution to the weak Schottky problem for genus five Jacobians with a vanishing theta null, answering a question of Grushevsky and Salvati Manni. More precisely, we show that if a principally polarized abelian variety of dimension five has a vanishing theta null with a quadric tangent cone of rank at most three, then it is in the Jacobian locus, up to extra irreducible components. We employ a degeneration argument, together with a study of the ramification loci for the Gauss map of a theta divisor.

math.AG

On cycles of pairing-friendly elliptic curves

A cycle of elliptic curves is a list of elliptic curves over finite fields such that the number of points on one curve is equal to the size of the field of definition of the next, in a cyclic way. We study cycles of elliptic curves in which every curve is pairing-friendly. These have recently found notable applications in pairing-based cryptography, for instance in improving the scalability of distributed ledger technologies. We construct a new cycle of length 4 consisting of MNT curves, and characterize all the possibilities for cycles consisting of MNT curves. We rule out cycles of length 2 for particular choices of small embedding degrees. We show that long cycles cannot be constructed from families of curves with the same complex multiplication discriminant, and that cycles of composite order elliptic curves cannot exist. We show that there are no cycles consisting of curves from only the Freeman or Barreto--Naehrig families.

math.NT

Schottky Algorithms: Classical meets Tropical

We present a new perspective on the Schottky problem that links numerical computing with tropical geometry. The task is to decide whether a symmetric matrix defines a Jacobian, and, if so, to compute the curve and its canonical embedding. We offer solutions and their implementations in genus four, both classically and tropically. The locus of cographic matroids arises from tropicalizing the Schottky-Igusa modular form.

math.AG

Gram Spectrahedra

Representations of nonnegative polynomials as sums of squares are central to real algebraic geometry and the subject of active research. The sum-of-squares representations of a given polynomial are parametrized by the convex body of positive semidefinite Gram matrices, called the Gram spectrahedron. This is a fundamental object in polynomial optimization and convex algebraic geometry. We summarize results on sums of squares that fit naturally into the context of Gram spectrahedra, present some new results, and highlight related open questions. We discuss sum-of-squares representations of minimal length and relate them to Hermitian Gram spectrahedra and point evaluations on toric varieties.

math.AG

From Curves to Tropical Jacobians and Back

Given a curve defined over an algebraically closed field which is complete with respect to a nontrivial valuation, we study its tropical Jacobian. This is done by first tropicalizing the curve, and then computing the Jacobian of the resulting weighted metric graph. In general, it is not known how to find the abstract tropicalization of a curve defined by polynomial equations, since an embedded tropicalization may not be faithful, and there is no known algorithm for carrying out semistable reduction in practice. We solve this problem in the case of hyperelliptic curves by studying admissible covers. We also describe how to take a weighted metric graph and compute its period matrix, which gives its tropical Jacobian and tropical theta divisor. Lastly, we describe the present status of reversing this process, namely how to compute a curve which has a given matrix as its period matrix.

math.AG

Proof of a conjecture of Guy on class numbers

It is well known that for any prime $p\equiv 3$ (mod $4$), the class numbers of the quadratic fields $\mathbb{Q}(\sqrt{p})$ and $\mathbb{Q}(\sqrt{-p})$, $h(p)$ and $h(-p)$ respectively, are odd. It is natural to ask whether there is a formula for $h(p)/h(-p)$ modulo powers of $2$. We show the formula $h(p) \equiv h(-p) m(p)$ (mod $16$), where $m(p)$ is an integer defined using the "negative" continued fraction expansion of $\sqrt{p}$. Our result solves a conjecture of Richard Guy.

math.NT

Bounded gaps between primes in special sequences

We use Maynard's methods to show that there are bounded gaps between primes in the sequence $\{\lfloor nα\rfloor\}$, where $α$ is an irrational number of finite type. In addition, given a superlinear function $f$ satisfying some properties described by Leitmann, we show that for all $m$ there are infinitely many bounded intervals containing $m$ primes and at least one integer of the form $\lfloor f(q)\rfloor$ with $q$ a positive integer.

math.NT

Psi-Epistemic Theories: The Role of Symmetry

Formalizing an old desire of Einstein, "psi-epistemic theories" try to reproduce the predictions of quantum mechanics, while viewing quantum states as ordinary probability distributions over underlying objects called "ontic states." Regardless of one's philosophical views about such theories, the question arises of whether one can cleanly rule them out, by proving no-go theorems analogous to the Bell Inequality. In the 1960s, Kochen and Specker (who first studied these theories) constructed an elegant psi-epistemic theory for Hilbert space dimension d=2, but also showed that any deterministic psi-epistemic theory must be "measurement contextual" in dimensions 3 and higher. Last year, the topic attracted renewed attention, when Pusey, Barrett, and Rudolph (PBR) showed that any psi-epistemic theory must "behave badly under tensor product." In this paper, we prove that even without the Kochen-Specker or PBR assumptions, there are no psi-epistemic theories in dimensions d>=3 that satisfy two reasonable conditions: (1) symmetry under unitary transformations, and (2) "maximum nontriviality" (meaning that the probability distributions corresponding to any two non-orthogonal states overlap). This no-go theorem holds if the ontic space is either the set of quantum states or the set of unitaries. The proof of this result, in the general case, uses some measure theory and differential geometry. On the other hand, we also show the surprising result that without the symmetry restriction, one can construct maximally-nontrivial psi-epistemic theories in every finite dimension d.

quant-ph