Testing and Reconstruction of Lipschitz Functions with Applications to Data Privacy

A function f : D ? R has Lipschitz constant c if dR(f(x),f(y)) = c· dD(x,y) for all x,y in D, where dR and dD denote the distance functions on the range and domain of f, respectively. We say a function is Lipschitz if it has Lipschitz constant 1. (Note that rescaling by a factor of 1/c converts a function with a Lipschitz constant c into a Lipschitz function.) In other words, Lipschitz functions are not very sensitive to small changes in the input. We initiate the study of testing and local reconstruction of the Lipschitz property of functions. A property tester has to distinguish functions with the property (in this case, Lipschitz) from functions that are e -far from having the property, that is, differ from every function with the property on at least an e fraction of the domain. A local filter reconstructs an arbitrary function f to ensure that the reconstructed function g has the desired property (in this case, is Lipschitz), changing f only when necessary. A local filter is given a function f and a query x and, after looking up the value of f on a small number of points, it has to output g(x) for some function g, which has the desired property and does not depend on x. If f has the property, g must be equal to f. We consider functions over domains {0,1}d, {1,..., n} and {1,..., n}d, equipped with l1 distance. We design efficient testers of the Lipschitz property for functions of the form f:{0,1}d? d Z, where d ? (0,1] and d Z is the set of integer multiples of d, and of the form f: {1,..., n} ? R, where R is (discretely) metrically convex. In the first case, the tester runs in time O(d· min{d,r}/d e ), where r is the diameter of the image of f, in the second, in time O((log n)/e ). We give corresponding lower bounds of O (d) and O (log n) on the query complexity (in the second case, only for nonadaptive 1-sided error testers). Our lower bound for functions over {0,1}dis tight for the case of the {0,1,2} range and constant e. The first tester implies an algorithm for functions of the form f:{0,1}d? R that distinguishes Lipschitz functions from functions that are e -far from (1+d )-Lipschitz. We also present a local filter of the Lipschitz property for functions of the form f: {1,..., n}d ? R with lookup complexity O((log n+1)d). For functions of the form {0,1}d, we show that every nonadaptive local filter has lookup complexity exponential in d. The testers that we developed have applications to programs analysis. The reconstructors have applications to data privacy. For the first application, the Lipschitz property of the function computed by a program corresponds to a notion of robustness to noise in the data. The application to privacy is based on the fact that a function f of entries in a database of sensitive information can be released with noise of magnitude proportional to a Lipschitz constant of f, while preserving the privacy of individuals whose data is stored in the database (Dwork, McSherry, Nissim and Smith, TCC 2006). We give a differentially private mechanism, based on local filters, for releasing a function f when a Lipschitz constant of f is provided by a distrusted client. We show that when no reliable Lipschitz constant of f is given, previously known differentially private mechanisms either have a substantially higher running time or have a higher expected error for a large class of symmetric functions f.