Near-Optimal differentially private low-rank trace regression with guaranteed private initialization

Mengyue, Zha ¹¹1Department of Mathematics, Hong Kong University of Science and Technology, [email protected]. Mengyue, Zha’s research was supported by Hong Kong PhD Fellowship Scheme.

(())

Abstract

We study differentially private (DP) estimation of a rank- $r$ matrix $M\in\mathbb{R}^{d_{1}\times d_{2}}$ under the trace regression model with Gaussian measurement matrices. Theoretically, the sensitivity of non-private spectral initialization is precisely characterized, and the differential-privacy-constrained minimax lower bound for estimating $M$ under the Schatten- $q$ norm is established. Methodologically, the paper introduces a computationally efficient algorithm for DP-initialization with a sample size of $n\geq\widetilde{O}(r^{2}(d_{1}\vee d_{2}))$ . Under certain regularity conditions, the DP-initialization falls within a local ball surrounding $M$ . We also propose a differentially private algorithm for estimating $M$ based on Riemannian optimization (DP-RGrad), which achieves a near-optimal convergence rate with the DP-initialization and sample size of $n\geq\widetilde{O}(r(d_{1}+d_{2}))$ . Finally, the paper discusses the non-trivial gap between the minimax lower bound and the upper bound of low-rank matrix estimation under the trace regression model. It is shown that the estimator given by DP-RGrad attains the optimal convergence rate in a weaker notion of differential privacy. Our powerful technique for analyzing the sensitivity of initialization requires no eigengap condition between $r$ non-zero singular values.

1 Introduction

The trace regression model (Rohde and Tsybakov, 2011; Koltchinskii et al., 2011), as an extension of the standard regression model, has been widely applied in various fields such as matrix completion, compressed sensing, and multi-task learning (Negahban and Wainwright, 2011; Koltchinskii et al., 2011; Hamidi and Bayati, 2022). Previous studies have proposed both convex and non-convex approaches for optimal estimation procedures for the model. However, the increasing demand for privacy protection has added new complexities to this extensively studied problem. Differential privacy (DP) (Dwork et al., 2006), a framework for protecting individual privacy, has been widely adopted in industrial and governmental applications (Erlingsson et al., 2014; Apple Differential Privacy Team, 2017; Abowd et al., 2020). This paper aims to develop a near-optimal differentially private method for low-rank matrix estimation under the trace regression model.

Trace regression model

Let $M\in\mathbb{R}^{d_{1}\times d_{2}}$ be an unknown rank- $r$ matrix and $X_{i}\in\mathbb{R}^{d_{1}\times d_{2}}$ be the measurement matrix for $i=1,\cdots,n$ . Suppose the noisy observation $y_{i}$ satisfies

y_{i}=\left<X_{i},M\right>+\xi_{i}\quad{\rm for}\quad i=1,\cdots,n,

(1)

where the model noise $\xi_{i}\overset{i.i.d.}{\sim}\mathcal{N}(0,\sigma_{\xi}^{2})$ and the inner product between $X_{i}$ and $M$ in Euclidean space is given by $\left<X_{i},M\right>:=\operatorname{Tr}(X_{i}^{\top}M)$ . The goal of the present paper is to estimate the unknown rank- $r$ matrix $M\in\mathbb{R}^{d_{1}\times d_{2}}$ under trace regression model defined by (1), subject to differential privacy, based on $n$ independent observations $Z:=\{(X_{i},y_{i})\}_{i=1}^{n}$ .

Our approaches are built upon the Gaussian mechanism Dwork et al. (2006). The main difficulty in applying the Gaussian mechanism is sharply characterizing sensitivities of statistics whose privacy is under protection. Listed below are definitions of sensitivity, differential privacy (DP), and Gaussian mechanism. Interested readers may refer to Dwork et al. (2006, 2014); Vadhan (2017) for proofs and other details. Let $\|\cdot\|$ denotes the spectral norm and $\|\cdot\|_{F}$ denotes the Frobenius norm.

Sensitivity

The sensitivity of a function $f$ that maps a dataset $Z$ into $\mathbb{R}^{d_{1}\times d_{2}}$ is defined by $\Delta_{f}:=\sup_{\textrm{neighbouring}(Z,Z^{\prime})}\|f(Z)-f(Z^{\prime})\|_{\rm F},$ where and the supremum is taken over all neighbouring datasets $Z$ and $Z^{\prime}$ that differ by at most one observation.

Differential privacy

Let $\varepsilon>0$ and $0<\delta<1$ , then we say the randomized algorithm $A$ is $(\varepsilon,\delta)$ -differentially private if $\mathbb{P}\big{(}A(Z)\in\mathcal{Q}\big{)}\leq e^{\varepsilon}\mathbb{P}\big{(}A(Z^{\prime})\in\mathcal{Q}\big{)}+\delta$ for all neighbouring data sets $Z,Z^{\prime}$ and all subset $\mathcal{Q}\subset\mathbb{R}^{d_{1}\times d_{2}}$ .

Gaussian mechanism

The randomized algorithm defined by $A(Z)=f(Z)+E$ is $(\varepsilon,\delta)$ -DP where $E\in\mathbb{R}^{d_{1}\times d_{2}}$ has i.i.d. $N\big{(}0,2\Delta_{f}^{2}\varepsilon^{-2}\log(1.25/\delta)\big{)}$ entries.

RIP of Gaussian measurement matrices

The sensitivity of any statistic involving $\{X_{i}\}_{i\in[n]}$ depends on the properties of the measurement matrices. Besides, it has been previously established since Candes and Tao (2005) that the restricted isometry property (RIP) on measurement matrices is crucial to the recovery of the unknown matrix $M$ . Hence, assumptions on $\{X_{i}\}_{i\in[n]}$ are necessary and the present paper considers $\{X_{i}\}_{i\in[n]}$ with Gaussian design.

Assumption 1 (Gaussian design).

The vectorization of measurement matrices $X_{1},\ldots,X_{n}$ are independent Gaussian $\operatorname{vec}(X_{i})\sim\mathcal{N}\left(\mathbf{0},\Lambda_{i}\right)$ where $\Lambda_{i}$ ’s are known, symmetric and positive definite. There exist absolute constants $C_{l},C_{u}>0$ such that $C_{l}\leq\lambda_{\min}\left(\Lambda_{i}\right)\leq\lambda_{\max}\left(\Lambda_{i}\right)\leq C_{u}.$

The following Lemma 1 shows that under Assumption 1, the measurement matrices $\{X_{i}\}_{i=1}^{n}$ satisfy the restricted isometry property (RIP) with high probability, see the proof in E.1.

Lemma 1.

Under the Assumption 1, for any $B\in\mathbb{R}^{d_{1}\times d_{2}}$ of rank $r$ , there exist constants $c_{1},c_{2},c_{3}>0$ and $c_{5}>c_{4}>0$ such that if $n\geq c_{1}r(d_{1}+d_{2})$ , with probability at least $1-c_{2}\exp\left(-c_{3}r(d_{1}+d_{2})\right)$ , we have $c_{4}\sqrt{C_{u}C_{l}}\|B\|_{\mathrm{F}}^{2}\leq\frac{1}{n}\sum_{i=1}^{n}\left\langle X_{i},B\right\rangle^{2}\leq c_{5}\sqrt{C_{u}C_{l}}\|B\|_{\mathrm{F}}^{2}.$

Notations

Suppose $M$ is of rank- $r$ and its singular value decomposition is of the form $M=U\Sigma V^{\top}\in\mathbb{R}^{d_{1}\times d_{2}}$ where $U\in\mathbb{O}_{d_{1},r}$ , $V\in\mathbb{O}_{d_{2},r}$ and $\Sigma=\operatorname{diag}\{\sigma_{1}\cdots\sigma_{r}\}$ with $\sigma_{1}\geq\cdots\geq\sigma_{r}$ . Here, $\mathbb{O}_{d,r}$ denotes the set of $d\times r$ matrices satisfying $H^{\top}H=I_{r}$ . Let $\kappa:=\sigma_{1}/\sigma_{r}$ be the condition number and $\kappa_{\xi}:=\sigma_{\xi}/\sigma_{r}$ be the signal-to-noise ratio. Let $\widetilde{O}$ stand for the typical big-O notation up to logarithmic factors and $\widetilde{O}_{p}(\cdot)$ stand for $\widetilde{O}$ holds with high probability.

1.1 Main results

The paper presents several key results related to differentially private low-rank matrix estimation. Firstly, we propose a private initialization $\widetilde{M}_{0}$ (as detailed in Algorithm 1). Secondly, we establish the privacy-constrained minimax lower bound under the general Shatten- $q$ norm (as detailed in Theorem 2). Finally, we introduce a private estimator $\widetilde{M}_{l^{*}}$ (as detailed in Algorithm 2) that achieves the near-optimal convergence rate under the Frobenius norm. The sensitivity analysis of $\widetilde{M}_{0}$ heavily relies on a spectral representation formula for asymmetric matrices (See Lemma 2).

We prove in Corollary 1 that the private initialization $\widetilde{M}_{0}$ satisfies $\|\widetilde{M}_{0}-M\|_{F}\leq\sqrt{2r}\|\widetilde{M}_{0}-M\|\leq c_{0}\sigma_{r},$ with high probability (w.h.p.), for a small constant $0<c_{0}<1$ , provided that $n\geq\widetilde{O}\left((\kappa^{4}r^{2}+\kappa^{2}\kappa_{\xi}^{2}r)(d_{1}\vee d_{2})\right).$

Theorem 2 establishes the DP-constrained minimax risk of estimating the rank- $r$ matrix $M\in\mathbb{R}^{d_{1}\times d_{2}}$ under model (1) and general Schatten- $q$ norm. Specifically, the minimax risk under Frobenius norm is in the order of $\sigma_{\xi}\sqrt{\frac{r(d_{1}\vee d_{2})}{n}}+\sigma_{\xi}\,\frac{r(d_{1}\vee d_{2})}{n\varepsilon}$ .

Finally, we show in Theorem 3 that with a sample size of $n\geq\widetilde{O}\left(\left(\kappa_{\xi}^{2}\vee\kappa_{\xi}\right)r(d_{1}\vee d_{2})\right)$ and any initialization satisfying (2), Algorithm 2 achieves geometric convergence rate. The private estimator $\widetilde{M}_{l^{*}}$ attains the near-optimal convergence rate

\left\|\widetilde{M}_{l^{*}}-M\right\|_{F}\leq\widetilde{O}_{p}\left(\sigma_{\xi}\sqrt{\frac{r(d_{1}+d_{2})}{n}}+(\sigma_{\xi}+\sigma_{r})\frac{r(d_{1}+d_{2})}{n\varepsilon}\right).

1.2 Motivations and related works

The trace regression model has been extensively researched, resulting in well-known optimal procedures and theoretical properties. Both convex (Rohde and Tsybakov, 2011; Koltchinskii et al., 2011; Candes and Plan, 2011; Negahban and Wainwright, 2011) and non-convex methods (Burer and Monteiro, 2003; Chen and Wainwright, 2015; Zheng and Lafferty, 2016; Wei et al., 2016) have achieved the optimal convergence rate of the order $\sigma_{\xi}\sqrt{\frac{r\left(d_{1}\vee d_{2}\right)}{n}}$ without the constraint from differential privacy. However, the DP-constrained minimax rate of low-rank matrix estimation under the trace regression model is still unknown. (Near) Optimal DP-algorithms have been developed for statistical problems such as learning Gaussians Kamath et al. (2019); Kuditipudi et al. (2023); Brown et al. (2023) or heavy-tailed distributions Kamath et al. (2020), (sparse or generalized) linear regression Wang (2018); Cai et al. (2021, 2023), and PCA Blum et al. (2005); Dwork et al. (2014); Chaudhuri et al. (2012); Liu et al. (2022). Previous works on DP-regression Cai et al. (2021, 2023) assume that all measurements have bounded $\ell_{2}$ norm. This assumption presents a significant limitation to studying the role of measurements play in the estimation error. Additionally, by treating measurements as a fixed vector or matrix, the statistical properties of measurements are disregarded. As a result, the opportunity for optimal statistical analysis subject to privacy concerns is inevitably lost. Recently, (McSherry and Mironov, 2009; Liu et al., 2015; Jain et al., 2018; Chien et al., 2021; Wang et al., 2023) propose gradient-descent-based algorithms for DP low-rank matrix completion. These algorithms have attained near-optimal sample complexity. However, the problem of sample-efficient, differentially private initialization remains under-explored. Additionally, it is unknown how to establish the minimax risk of low-rank matrix estimation with the constraints of differential privacy, especially when the matrix is asymmetric.

1.3 Organization

Section 2 proposes a DP-initialization algorithm and presents its privacy and utility guarantees. In Section 3, we establish a DP-constrained minimax lower bound (5) for estimating the rank- $r$ matrix $M$ under the trace regression model. Section 4 presents the DP-estimator based on non-convex optimization and derives the upper bound of the DP-estimator’s error, as stated in (7). We discuss the score attack argument and the non-trivial gap between the upper bound of (7) and the DP-constrained minimax lower bound (5) in Section 5. Proofs are given in Appendix A to F.

2 DP-initialization

Section 2.1 presents an $(\varepsilon,\delta)$ -DP initialization $\widetilde{M}_{0}$ , as stated in Algorithm 1. In Section 2.2, we introduce a spectral representation formula (See Lemma 2) that is crucial to sensitivity analysis on the initialization. With the help of the spectral representation formula, the privacy and utility guarantees of the DP-initialization $\widetilde{M}_{0}$ are given in Section 2.3.

2.1 Algorithm for DP-initialization

We begin with $\widehat{L}=n^{-1}\sum_{i=1}^{n}\operatorname{mat}\left(\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\right)y_{i},$ which is unbiased for $M$ . Suppose that the leading- $r$ left and right singular vectors of $\widehat{L}$ is given by the columns of $\widehat{U}\in\mathbb{O}_{d_{1},r}$ and $\widehat{V}\in\mathbb{O}_{d_{2},r}$ , respectively. Then, $\widehat{M}_{0}:=\operatorname{SVD}_{r}(\widehat{L})$ is a non-private estimator for $M$ . Let $\widehat{\Sigma}:=\widehat{U}^{\top}\widehat{L}\widehat{V}$ , then we have

\widehat{M}_{0}=\operatorname{SVD}_{r}(\widehat{L})=\widehat{U}\widehat{U}^{\top}\widehat{L}\widehat{V}\widehat{V}^{\top}=\widehat{U}\widehat{\Sigma}\widehat{V}^{\top}.

It is reasonable to think about privatizing $\widehat{U}$ , $\widehat{V}$ , and $\widehat{\Sigma}$ , separately. We first privatize the empirical spectral projector $\widehat{U}\widehat{U}^{\top}$ and $\widehat{V}\widehat{V}^{\top}$ by Gaussian mechanism. Thanks to post-processing property Dwork et al. (2006), we obtain $\widetilde{U}\in\mathbb{O}^{d_{1},r}$ and $\widetilde{V}\in\mathbb{O}^{d_{2},r}$ whose columns are differentially private and orthogonal. Secondly, we privatize the $r\times r$ matrix $\widetilde{U}^{\top}\widehat{L}\widetilde{V}$ by Gaussian mechanism and obtain $\widetilde{\Sigma}\in\mathbb{R}^{r\times r}$ which is a private surrogate for $\widehat{\Sigma}=\widehat{U}^{\top}\widehat{L}\widehat{V}$ . Finally, we take $\widetilde{M}_{0}=\widetilde{U}\widetilde{\Sigma}\widetilde{V}^{\top}$ as the DP-initialization. We display the pseudo-code of the proposed DP-initialization in Algorithm 1. The privacy of $\widetilde{M}_{0}$ is guaranteed by the composition property Dwork et al. (2006).

Algorithm 1 Differentially private initialization for trace regression

Input: the data set

\{(X_{i},y_{i})\}_{i=1}^{n}

; the covariance matrices

\{\Lambda_{i}\}_{i=1}^{n}

; sensitivity

\Delta^{(1)}

\Delta^{(2)}>0

; rank

r

; nuisance variance

\sigma_{\xi}^{2}

; privacy budget

\varepsilon>0

and

0<\delta<1

Output:

(\varepsilon,\delta)

-differentially private initialization

\widetilde{M}_{0}

Compute the unbiased sample estimator

\widehat{L}

and its top-

r

left and right singular vectors:

\widehat{L}\leftarrow n^{-1}\sum_{i=1}^{n}\operatorname{mat}\left(\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\right)y_{i}\,\quad{\rm and}\,\quad\widehat{M}_{0}=\widehat{U}\widehat{\Sigma}\widehat{V}\leftarrow{\rm SVD}_{r}(\widehat{L})

Compute

(\varepsilon/3,\delta/3)

-differentially private singular subspaces by adding artificial Gaussian noise:

\widetilde{U}\leftarrow{\rm SVD}_{r}\Big{(}\widehat{U}\widehat{U}^{\top}+E_{U}\Big{)}\,{\rm with}\,(E_{U})_{ij}=(E_{U})_{ji}\stackrel{{\scriptstyle{\rm i.i.d.}}}{{\sim}}N\Big{(}0,\frac{18\Delta^{(1)^{2}}}{\varepsilon^{2}}\log(3/\delta)\Big{)},\,\forall 1\leq i\leq j\leq d_{1}

\widetilde{V}\leftarrow{\rm SVD}_{r}\Big{(}\widehat{V}\widehat{V}^{\top}+E_{V}\Big{)}\,{\rm with}\,(E_{V})_{ij}=(E_{U})_{ji}\stackrel{{\scriptstyle{\rm i.i.d.}}}{{\sim}}N\Big{(}0,\frac{18\Delta^{(1)^{2}}}{\varepsilon^{2}}\log(3/\delta)\Big{)},\,\forall 1\leq i\leq j\leq d_{2}

Compute

(\varepsilon/3,\delta/3)

-differentially private estimates of singular values up to rotations:

\displaystyle\widetilde{\Sigma}

\displaystyle\,\leftarrow\widetilde{U}^{\top}\widehat{L}\widetilde{V}+E_{\Sigma}\,{\rm with}\,(E_{\Sigma})_{ij}=(E_{\Sigma})_{ji}\stackrel{{\scriptstyle i.i.d.}}{{\sim}}N\Big{(}0,\frac{18\Delta^{(2)^{2}}}{\varepsilon^{2}}\log(3/\delta)\Big{)},\,\forall 1\leq i\leq j\leq r

Compute

(\varepsilon,\delta)

-differentially private initialization:

\widetilde{M}_{0}\leftarrow\widetilde{U}\widetilde{\Sigma}\widetilde{V}^{\top}

Return:

\widetilde{M}_{0}

To this end, we define the sensitivities of $\Delta^{(1)}$ and $\Delta^{(2)}$ appear in Algorithm 1. Let

\widehat{L}^{(i)}:=n^{-1}\sum_{j\neq i}^{n}\operatorname{mat}\left(\Lambda_{j}^{-1}\operatorname{vec}\left(X_{j}\right)\right)Y_{j}+n^{-1}\operatorname{mat}\left(\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}^{\prime}\right)\right)y_{i}^{\prime},

where $(X_{i}^{\prime},y_{i}^{\prime})$ is an i.i.d. copy of $(X_{i},y_{i})$ . Then, the estimator $\widehat{L}^{(i)}$ differs with $\widehat{L}$ only by the $i$ -th pair of observations. Suppose the top- $r$ left and right singular vectors of $\widehat{L}^{(i)}$ are given by $U^{(i)}$ and $V^{(i)\top}$ , respectively. The sensitivity of $\widehat{U}\widehat{U}^{\top}$ is defined by

\displaystyle\Delta_{\widehat{U}\widehat{U}^{\top}}

\displaystyle=\sup_{{\rm neighbouring}(Z,Z^{\prime})}\left\|\widehat{U}(Z)\widehat{U}(Z)^{\top}-\widehat{U}(Z^{\prime})\widehat{U}(Z^{\prime})^{\top}\right\|_{F}=\max_{i\in[n]}\left\|\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}\right\|_{F},

and the sensitivity $\Delta_{\widehat{V}\widehat{V}^{\top}}$ of $\widehat{V}\widehat{V}^{\top}$ is defined similarly. We refer to $\Delta^{(1)}\triangleq\Delta_{\widehat{U}\widehat{U}^{\top}}\vee\Delta_{\widehat{V}\widehat{V}^{\top}}$ as the sensitivity of singular subspaces and define the sensitivity

\Delta^{(2)}\triangleq\Delta_{\widetilde{U}^{\top}\widehat{L}\widetilde{V}}=\sup_{{\rm neighbouring}(Z,Z^{\prime})}\left\|\widetilde{U}\widehat{L}(Z)\widetilde{V}^{\top}-\widetilde{U}\widehat{L}(Z^{\prime})\widetilde{V}^{\top}\right\|_{F}=\max_{i\in[n]}\left\|\widetilde{U}^{\top}\left(\widehat{L}-\widehat{L}^{(i)}\right)\widetilde{V}\right\|_{F}.

As privatizing $\widehat{\Sigma}=\widehat{U}^{\top}\widehat{L}\widehat{V}$ by Gaussian mechanism, the scale of artificial noise avoids growing with an unnecessary $\sqrt{d_{1}}\vee\sqrt{d_{2}}$ but rather growing with a smaller quantity $\sqrt{r}$ . This benefit motivates us to privatize $\widehat{U}$ , $\widehat{V}$ and $\widehat{\Sigma}$ , separately. However, it is technically challenging to characterize $\Delta^{(1)}=\Delta_{\widehat{U}\widehat{U}^{\top}}\vee\Delta_{\widehat{V}\widehat{V}^{\top}}$ due to the non-linear dependence of $\widehat{U}\widehat{U}^{\top}$ and $\widehat{V}\widehat{V}^{\top}$ on the dataset $Z=\{(X_{i},y_{i})\}_{i=1}^{n}$ . To address this challenge, we introduce an explicit spectral representation formula (See Lemma 2) to obtain a sharp upper bound on the sensitivity of the singular subspaces.

2.2 Spetral representation formula

This section introduces a spectral representation formula for asymmetric matrices (See Lemma 2). To begin with, we quickly explain the standard symmetric dilation trick (See e.g., Section 2.1.17 in Tropp et al. (2015)) and define auxiliary operators used in Lemma 2.

Symmetric dilation and auxiliary operators

For any $M\in\mathbb{R}^{d_{1}\times d_{2}}$ , the symmetric dialation $M_{*}$ of $M$ is a $(d_{1}+d_{2})\times(d_{1}+d_{2})$ matrix defined by $M_{*}:=\left(\begin{array}[]{cc}0&M\\ M^{\top}&0\end{array}\right)$ . It is easy to check that $M_{*}=M_{*}^{\top}$ and $\|M_{*}\|=\|M\|$ . Further, if we assume that $M$ is of rank $r$ and has the form of SVD $M=U\Sigma V^{\top}\in\mathbb{R}^{d_{1}\times d_{2}}$ , then $M_{*}$ is of rank- $2r$ and has eigendecomposition of the form

\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)\cdot\left(\begin{array}[]{cc}\Sigma&0\\ 0&-\Sigma\end{array}\right)\cdot\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)^{\top}:=U_{M^{*}}\Sigma_{M^{*}}U_{M^{*}}^{\top}.

The $2r$ eigenvectors of $M_{*}$ is given by the columns of $U_{M^{*}}\in\mathbb{O}_{(d_{1}+d_{2}),2r}$ . For integer $t\geq 1$ , we define operators

Q^{-t}:=U_{M^{*}}\Sigma_{M^{*}}^{-t}U_{M^{*}}^{\top}\quad{\rm and}\quad Q^{-0}:=Q^{\perp}\triangleq(U_{M^{*}})_{\perp}(U_{M^{*}})_{\perp}^{\top}=I_{d_{1}+d_{2}}-U_{M^{*}}U_{M^{*}}^{\top}.

Lemma 2 (Spectral representation formula).

Let $M\in\mathbb{R}^{d_{1}\times d_{2}}$ be any rank- $r$ matrix with singular values $\sigma_{1}\geq\cdots\geq\sigma_{r}>0$ and $\widehat{L}=M+\Delta\in\mathbb{R}^{d_{1}\times d_{2}}$ be a perturbation of $M$ where $\Delta\in\mathbb{R}^{d_{1}\times d_{2}}$ is the deviation matrix. Suppose the top- $r$ left and right singular vectors of $\widehat{L}$ and $M$ , are given by the columns of $\widehat{U}$ , $\widehat{V}$ and $U$ , $V$ , respectively. Suppose that $2\|\Delta\|\leq\sigma_{r}$ , then

\left(\begin{array}[]{cc}\widehat{U}\widehat{U}^{\top}-UU^{\top}&0\\ 0&\widehat{V}\widehat{V}^{\top}-VV^{\top}\end{array}\right)=\sum_{k\geq 1}\mathcal{S}_{M_{*},k}(\Delta_{*}).

Here, $\Delta_{*}$ is the symmetric dilation of $\Delta:=\widehat{L}-M$ and the $k$ -th order term $\mathcal{S}_{M_{*},k}(\Delta_{*})$ is a summation of $\binom{2k}{k}$ terms defined by $\mathcal{S}_{M_{*},k}(\Delta_{*})=\sum_{\mathbf{s}:s_{1}+\ldots+s_{k+1}=k}(-1)^{1+\tau(\mathbf{s})}\cdot Q^{-s_{1}}\Delta_{*}Q^{-s_{2}}\ldots\Delta_{*}Q^{-s_{k+1}},$ where $\mathbf{s}=\left(s_{1},\ldots,s_{k+1}\right)$ contains non-negative indices and $\tau(\mathbf{s})=\sum_{j=1}^{k+1}\mathbb{I}\left(s_{j}>0\right).$

In Lemma 2, the spectral projectors $\widehat{U}\widehat{U}^{\top}$ and $\widehat{V}\widehat{V}^{\top}$ of the matrix $\widehat{L}=M+\Delta$ , is explicitly represented in terms of the symmetric dilation of $\Delta$ , with the help of auxiliary operators $Q^{-0}$ and $Q^{-t}$ for integer $t\geq 1$ . The proof of Lemma 2 is deferred to Appendix E.2. Note that Lemma 2 accommodates a diverging condition number and requires no eigengap condition between $r$ non-zero singular values. In the proof of Theorem 1, we shall see that $\widehat{V}\widehat{V}^{\top}-\widehat{V}^{(i)}\widehat{V}^{(i)\top}$ and $\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}$ are mainly contributed by the 1-st order approximation $\mathcal{S}_{M_{*},1}(\Delta_{*})-\mathcal{S}_{M_{*},1}(\Delta_{*}^{(i)})$ where $\Delta_{*}^{(i)}$ is the symmetric dilation of $\Delta^{(i)}:=\widehat{L}^{(i)}-M$ .

2.3 Privacy and utility guarantees of the initialization

In this section, we study the privacy and utility guarantees of the initialization $\widetilde{M}_{0}$ . Theorem 1 characterizes the sensitivities $\Delta^{(1)}$ and $\Delta^{(2)}$ needed to guarantee an $(\varepsilon,\delta)$ -DP $\widetilde{M}_{0}$ , and present the upper bounds of $\|\widetilde{M}_{0}-M\|$ and $\|\widetilde{M}_{0}-M\|_{F}$ . The proof of Theorem 1 is provided in Appendix A.

Theorem 1 (Privacy and utility guarantees of the initialization $\widetilde{M}_{0}$ ).

Consider i.i.d. observations $Z=\{z_{1},\cdots,z_{n}\}$ drawn from the trace regression model stated in $(\ref{equ: trace_regression_model})$ where $z_{i}:=(X_{i},y_{i})$ for $i=1,\cdots,n$ . Let the true rank- $r$ regression coefficients matrix be $M\in\mathbb{R}^{d_{1}\times d_{2}}$ . Suppose that $\{X_{i}\}_{i\in[n]}$ satisfy the Assumption 1. Under the mild condition $n\geq\frac{\log^{2}n}{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}$ , there exists absolute constants $C_{1},C_{2},C_{3}>0$ such that

n\geq n_{0}\triangleq C_{1}C_{l}^{-1}r\left(\frac{\sigma_{\xi}+\sqrt{C_{u}r}\sigma_{1}}{\sigma_{r}}\right)^{2}(d_{1}\vee d_{2})\log(d_{1}+d_{2});

if Algorithm 1 takes in sensitivities at least $\Delta^{(1)}=C_{2}\left(\frac{\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)}{\sigma_{r}}\right)\frac{\sqrt{r}}{n}\log n$ and $\Delta^{(2)}=C_{2}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\frac{\sqrt{r}}{n}\log n,$ then Algorithm 1 is guaranteed to be $(\varepsilon,\delta)$ -DP. Moreover, the output $\widetilde{M}_{0}$ of Algorithm 1 satisfies

	$\displaystyle\\|\widetilde{M}_{0}-M\\|\bigvee\left(\\|\widetilde{M}_{0}-M\\|_{F}/\sqrt{2r}\right)$
	$\displaystyle\leq\underbrace{C_{3}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\,\frac{\sigma_{1}}{\sigma_{r}}\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}}_{e_{1}}$
	$\displaystyle\quad+\underbrace{C_{3}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\left(\frac{\sigma_{1}}{\sigma_{r}}\frac{\sqrt{r(d_{1}\vee d_{2})}}{n\varepsilon}+\frac{r}{n\varepsilon}\right)\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta})}_{e_{2}},$

with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}-\exp(-d_{1})-\exp(-d_{2})-10^{-20r}$ .

In Theorem 1, the sample size condition $n\geq n_{0}$ ensures that the spectral norm of perturbations is small enough, i.e., $\|\Delta\|+\max_{i\in[n]}\|\Delta^{(i)}\|\leq\sigma_{r}/2,$ to apply Lemma 2 and obtain a sharp characterization on $\Delta^{(1)}\triangleq\Delta_{\widehat{U}\widehat{U}^{\top}}\vee\Delta_{\widehat{V}\widehat{V}^{\top}}$ . Theorem 1 also provides an upper bound on the sensitivity of pseudo singular values, which is of the order $\Delta^{(2)}\triangleq\Delta_{\widetilde{U}^{\top}\widehat{L}\widetilde{V}}\asymp\sigma_{1}\Delta^{(1)}$ . Based on these results, Algorithm 1 outputs an $(\varepsilon,\delta)$ -DP initialization $\widetilde{M}_{0}$ under the sample size condition

n\geq\widetilde{O}\left((\kappa^{2}r^{2}+\kappa_{\xi}r)(d_{1}\vee d_{2})\right),

with an upper bound on the error $\|\widetilde{M}_{0}-M\|$ consisting of two terms. The first term $e_{1}$ accounts for the statistical error of $\widehat{M}_{0}$ and is greater than the the optimal rate $\sigma_{\xi}\sqrt{\frac{d_{1}\vee d_{2}}{n}}$ (Koltchinskii, 2011). The second term $e_{2}$ can be further decomposed into the cost of privacy on the singular subspaces which is of the order $\widetilde{O}_{p}\left(\frac{\sigma_{1}}{\sigma_{r}}\left(\sigma_{1}\sqrt{r}+\sigma_{\xi}\right)\frac{\sqrt{(d_{1}\vee d_{2})}}{n\varepsilon}\right)$ , and the cost of privacy arises from privatizing the singular values by Gaussian mechanism which is of the order $\widetilde{O}_{p}\left((\sigma_{1}\sqrt{r}+\sigma_{\xi})r/(n\varepsilon)\right)$ .

Next, Corollary 1 gives the sample size required by a DP-initialization $\widetilde{M}_{0}$ that falls within a local ball of $M$ . The proof of Corollary 1 is deferred to Appendix A.5.

Corollary 1.

Under the conditions stated in Theorem 1, as the sample size is sufficiently large

	$\displaystyle n\geq C_{1}\max\Bigg{\{}$	$\displaystyle\underbrace{C_{l}^{-1}\left(\frac{\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)^{2}\kappa^{2}r(d_{1}\vee d_{2})\log(d_{1}+d_{2})}_{n_{1}},$
		$\displaystyle\underbrace{\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\left(\kappa r\sqrt{d_{1}\vee d_{2}}+r^{\frac{3}{2}}\right)\log n\frac{\log^{\frac{1}{2}}(\frac{3.75}{\delta})}{\varepsilon}}_{n_{2}}\Bigg{\}},$

for some absolute constant $c_{2}>0$ , then we have, for some small constant $0<c_{0}<1$ ,

\|\widetilde{M}_{0}-M\|_{F}\leq\sqrt{2r}\|\widetilde{M}_{0}-M\|\leq c_{0}\sigma_{r}.

(2)

In Corollary 1, the error due to $\|M\|\cdot\left(\left\|\widehat{V}\widehat{V}^{\top}-VV^{\top}\right\|+\left\|\widehat{U}\widehat{U}^{\top}-UU^{\top}\right\|\right)$ dominates the statistical error $\|\widehat{L}-M\|$ and the sample size $n_{1}$ is required to control these two terms; the sample size $n_{2}$ controls the error due to privatizing the singular subspaces and singular values. According to Corollary 1, as the sample size $n\geq\widetilde{O}\left((\kappa^{4}r^{2}+\kappa^{2}\kappa_{\xi}^{2}r)(d_{1}\vee d_{2})\right),$ the $(\varepsilon,\delta)$ -DP $\widetilde{M}_{0}$ is guaranteed to fall into a local ball surrounding $M$ , as stated in (2). The condition (2) is a pre-requisite for Algorithm 2 to converge geometrically, as discussed in Theorem 3.

3 Minimax lower bounds

This section applies DP-Fano’s lemma (See Lemma 3) to establish the DP-constrained minimax lower bound of estimating the matrix $M\in\mathbb{M}_{r}:=\{M\in\mathbb{R}^{d_{1}\times d_{2}}:\operatorname{rank}(M)=r\}$ under trace regression model

f_{M}(y_{i}|X_{i})=\frac{1}{\sqrt{2\pi}\sigma_{\xi}}\exp\left(\frac{-\left(y_{i}-\left<X_{i},M\right>\right)^{2}}{2\sigma^{2}}\right);X_{i}\sim\mathcal{N}\left(\mathbf{0},\Lambda_{i}\right).

(3)

Suppose we observe an i.i.d. sample $\{(X_{i},y_{i}),(X_{i}^{\prime},y_{i}^{\prime})\}_{i\in[n]}$ of size $2n$ drawn from (3). Then, we have

\bar{y}_{i}:=y_{i}+y_{i}^{\prime}=\left<\left(\begin{array}[]{cc}0&M\\ M^{\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>+\xi_{i}+\xi_{i}^{\prime},

where the underlying matrix $M_{*}$ . Let $f(X_{i},X_{i}^{\prime})$ be the joint distribution of $X_{i}$ and $X_{i}^{\prime}$ ; $f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})$ be the conditional distribution of $\bar{y}_{i}$ given $X_{i},X_{i}^{\prime}$ ; and denote the joint distribution of $\bar{y}_{i}$ and $X_{i},X_{i}^{\prime}$ as $f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime})$ . It is clear that $f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})$ is given by the distribution of

\mathcal{N}(\left<\left(\begin{array}[]{cc}0&M\\ M^{\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>,2\sigma_{\xi}^{2}).

Let $\otimes$ represent the tensor product of marginal laws. For a given matrix $\Sigma=\operatorname{diag}\{\sigma_{1},\cdots,\sigma_{r}\}$ where $C\sigma\geq\sigma_{1}\cdots\geq\sigma_{r}\geq c\sigma$ for some constants $\sigma>0$ and $C>c>0$ , we consider the family of normal distribution under trace regression model:

\mathcal{P}_{\Sigma}:=\Big{\{}\bigotimes_{i=1}^{n}f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime}):M_{*}=(U\Sigma V^{\top})_{*},U\in\mathbb{O}_{d_{1},r},V\in\mathbb{O}_{d_{2},r}\Big{\}}.

By definition, each distribution $P_{M_{*}}\in\mathcal{P}_{\Sigma}$ is indexed by $U_{M_{*}}=\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)\in\mathbb{O}_{d_{1}+d_{2},2r}$ whose columns are the $r$ eigenvectors of $M_{*}$ . Next, we employ DP-Fano’s lemma to derive the minimax lower bound of estimating $M_{*}$ by a sample drawn from $\mathcal{P}_{\Sigma}$ . Let ${\rm KL}(\cdot\|\cdot)$ and ${\rm TV}(\cdot,\cdot)$ denote the Kullback-Leibler divergence and total variation distance between two distributions.

Lemma 3 (DP-Fano’s lemma, Acharya et al. (2021)).

Let $\mathcal{P}:=\{P:P=\mu^{(1)}\times\cdots\times\mu^{(n)}\}$ be a family of product measures indexed by a parameter from a pseudo-metric space $(\Theta,\rho)$ . Denote $\theta(P)\in\Theta$ the parameter associated with the distribution $P$ . Let $\mathcal{Q}=\{P_{1},\cdots,P_{N}\}\subset\mathcal{P}$ contain $N$ probability measures and there exist constants $\rho_{0},l_{0},t_{0}>0$ such that for all $i\neq i^{\prime}\in[N]$ , $\rho\left(\theta(P_{i}),\theta(P_{i^{\prime}})\right)\geqslant\rho_{0},\quad\operatorname{KL}\left(P_{i}\|P_{i^{\prime}}\right)\leq l_{0},\quad\sum_{k\in[n]}\operatorname{TV}\left(\mu_{i}^{(k)},\mu_{i^{\prime}}^{(k)}\right)\leq t_{0},$ where $P_{i}=\mu_{i}^{(1)}\times\cdots\times\mu_{i}^{(n)}$ and $P_{i^{\prime}}=\mu_{i^{\prime}}^{(1)}\times\cdots\times\mu_{i^{\prime}}^{(n)}$ . Suppose $\delta\lesssim e^{-n}$ , then

\displaystyle\inf_{A\in\mathcal{A}_{\varepsilon,\delta}(\mathcal{P})}

\displaystyle\sup_{P\in\mathcal{P}}\mathbb{E}_{A}\;\rho(A,\theta(P))\geqslant\max\left\{\frac{\rho_{0}}{2}\left(1-\frac{l_{0}+\log 2}{\log N}\right),\frac{\rho_{0}}{4}\left(1\bigwedge\frac{N-1}{\exp\left(4\varepsilon t_{0}\right)}\right)\right\},

(4)

where the infimum is taken over all the $(\varepsilon,\delta)$ -DP randomized algorithm defined by $\mathcal{A}_{\varepsilon,\delta}(\mathcal{P}):=\{A:Z\mapsto\Theta\ {\rm and}\ A\text{ is }\;(\varepsilon,\delta)\text{-differentially private}\;\text{for all}\;Z\sim P\in\mathcal{P}\ \}$ .

To apply Fano’s lemma, we need to construct a large subset with well-separated elements for $\mathbb{O}_{d_{1}+d_{2},2r}$ . By Lemma 6, there exists a subset $\mathcal{S}_{q}^{(d_{1}+d_{2})}\subset\mathbb{O}_{d_{1}+d_{2},2r}$ with cardinality $\left|\mathcal{S}_{q}^{(d_{1}+d_{2})}\right|\geq 2^{2r(d_{1}+d_{2}-2r)}$ such that for any $H\neq H^{\prime}\in\mathcal{S}_{q}^{(d_{1}+d_{2})}$ ,

\|HH^{\top}-H^{\prime}H^{\prime\top}\|_{q}\gtrsim\tau\varepsilon_{0}(2r)^{1/q}\quad{\rm and}\quad\|HH^{\top}-H^{\prime}H^{\prime\top}\|_{\rm F}\lesssim 2\sqrt{r}\varepsilon_{0},

for some small constants $\tau,\varepsilon_{0}>0$ , where $\|\cdot\|_{q}$ denotes the Schatten-q norm. We then consider the family of distributions

\displaystyle\mathcal{P}_{\sigma}=\left\{\bigotimes_{i=1}^{n}f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime}):M_{*}=\sigma HH^{\top},H\in\mathcal{S}_{q}^{(d_{1}+d_{2})}\right\}\subset\mathcal{P}_{\Sigma},

whose cardinality $N:=\left|\mathcal{P}_{\sigma}\right|\geq 2^{2r(d_{1}+d_{2}-2r)}$ . Let $M_{*}=\sigma HH^{\top}$ and $M_{*}^{\prime}=\sigma H^{\prime}H^{\prime\top}$ . As shown in Appendix B, for any $H\neq H^{\prime}\in\mathcal{S}_{q}^{(d_{1}+d_{2})}$ , we have

\operatorname{KL}\left(\bigotimes_{i=1}^{n}f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\|\bigotimes_{i=1}^{n}f_{M_{*}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)\lesssim\frac{n}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2},

and $\sum_{k\in[n]}\operatorname{\operatorname{TV}}\left(f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime}),f_{M^{\prime}_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)\lesssim n\frac{\sqrt{C_{u}}\sigma}{\sigma_{\xi}}\sqrt{r}\varepsilon_{0}.$ To this end, we obtain Theorem 2 by applying Lemma 3 with the bounded KL divergence and TV distance, together with the facts that $\mathcal{P}_{\sigma}\subset\mathcal{P}_{\Sigma}$ . The proof of Theorem 2 is deferred to Appendix B.

Theorem 2.

Consider a sample of size $n$ drawn from the distribution $P_{M^{*}}\in\mathcal{P}_{\Sigma}$ , then for any $\delta\lesssim e^{-n}$ and any $q\in[1,\infty]$ , there exists a constant $c>0$

\inf_{\widetilde{M}}\sup_{P\in\mathcal{P}_{\Sigma}}\mathbb{E}\Big{\|}\widetilde{M}-M\Big{\|}_{q}\geq c\frac{\sigma_{\xi}}{\sqrt{C_{u}}}\left(r^{1/q}\sqrt{\frac{d_{1}\vee d_{2}}{n}}+r^{\frac{1}{2}+\frac{1}{q}}\frac{d_{1}\vee d_{2}}{n\varepsilon}\right)\bigwedge r^{1/q}\sigma,

where the infimum is taken over all possible $(\varepsilon,\delta)$ -DP algorithms. It suffices to choose $q=1,2,\infty$ to obtain the bounds in the nuclear norm, Frobenius norm, and spectral norm, respectively. For example, when $q=2$ , there exists a constant $c>0$

\inf_{\widetilde{M}}\sup_{P\in\mathcal{P}_{\Sigma}}\mathbb{E}\Big{\|}\widetilde{M}-M\Big{\|}_{F}\geq c\Big{(}\underbrace{\frac{\sigma_{\xi}}{\sqrt{C_{u}}}\sqrt{\frac{r(d_{1}\vee d_{2})}{n}}}_{l_{1}}+\underbrace{\frac{\sigma_{\xi}}{\sqrt{C_{u}}}\frac{r(d_{1}\vee d_{2})}{n\varepsilon}}_{l2}\Big{)}\bigwedge r^{1/2}\sigma.

(5)

In Theorem 2, the lower bound (5) consists of two terms, the statistical error $l_{1}$ and the cost of privacy $l_{2}$ . The next section proposes a DP-estimator that attains the minimax lower bound (5), up to an additional factor $\sigma_{r}$ and some logarithmic factors. As a supplement to DP-Fano’s Lemma which works for $\delta\lesssim e^{-n}$ , we also try the score attack argument, which is valid for a wider range of $\delta\lesssim n^{1+\gamma}$ where $\gamma>0$ is a constant. Theorem 5 presents the DP-constrained lower bound established by the score attack argument. The content and proof of Theorem 5 are deferred to Appendix D. We also point out that it is trivial to derive the minimax lower bound of the case $d_{1}=d_{2}=d$ based on DP-Fano’s Lemma since there is no need to apply the trick of symmetrization.

4 Upper bounds with differential privacy

In this section, we present Algorithm 2, DP-RGrad, and show that DP-RGrad attains the near-optimal convergence rate for differentially privately estimating low-rank matrices under the trace regression model. Our approach is based on privatizing the Riemannian gradient descent (RGrad) by the Gaussian mechanism. Interested readers may refer to Vandereycken (2013); Edelman et al. (1998); Adler et al. (2002); Absil et al. (2008) for the basics of RGrad. Let the estimate we obtain after $l$ iterations be the rank- $r$ matrix $M_{l}\in\mathbb{R}^{d_{1}\times d_{2}}$ whose SVD has the form $M_{l}=U_{l}\Sigma_{l}V_{l}^{\top}$ . It is well-known in Absil et al. (2008); Vandereycken (2013) that the tangent space of $\mathbb{M}_{r}$ at $M_{l}$ is given by $\mathbb{T}_{l}:=\left\{Z\in\mathbb{R}^{d_{1}\times d_{2}}:Z=U_{l}R^{\top}+LV_{l}^{\top},R\in\mathbb{R}^{d_{2}\times r},L\in\mathbb{R}^{d_{1}\times r}\right\}$ . The projection of the gradient $G_{l}$ onto $\mathbb{T}_{l}$ is $\mathcal{P}_{\mathbb{T}_{l}}\left(G_{l}\right)=U_{l}U_{l}^{\top}G_{l}+G_{l}V_{l}V_{l}^{\top}-U_{l}U_{l}^{\top}G_{l}V_{l}V_{l}^{\top},$ which is of rank at most $2r$ . Let the noisy gradient descent on the tangent space be $M_{l}-\eta_{l}\mathcal{P}_{\mathbb{T}_{l}}\left(G_{l}\right)+\mathcal{P}_{\mathbb{T}_{l}}N_{l}$ where $N_{l}\in\mathbb{R}^{d_{1}\times d_{2}}$ is the Gaussian noise matrix. Then, we retract it back to $\mathbb{M}_{r}$ and obtain

M_{l+1}=\operatorname{SVD}_{r}\left(M_{l}-\eta_{l}\mathcal{P}_{\mathbb{T}_{l}}\left(G_{l}\right)+\mathcal{P}_{\mathbb{T}_{l}}N_{l}\right).

(6)

We update the estimate as defined in (6) for $1=0,\cdots,l^{*}-1$ where $l^{*}$ is the total number of iterations. Thanks to the composition property and Gaussian mechanism, we only need to ensure that each iteration is $(\varepsilon/l^{*},\delta/l^{*})$ -DP. For trace regression model defined in (1), empirical mean squared loss is defined as $\mathcal{L}_{n}(M_{l};Z):=\frac{1}{2n}\sum_{i=1}^{n}\left(\left\langle X_{i},M_{l}\right\rangle-y_{i}\right)^{2}$ and the empirical Euclidean gradient is $G_{l}:=\nabla\mathcal{L}_{n}(M_{l};Z)=\frac{1}{n}\sum_{i=1}^{n}\left(\left\langle X_{i},M_{l}\right\rangle-y_{i}\right)X_{i}.$ The sensitivity of the $l$ -th iteration is $\Delta_{l}:=\max_{{\rm neighbouring}(Z,Z^{\prime})}\left\|M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l}(Z))-\left[M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l}(Z^{\prime}))\right]\right\|_{F}.$

Algorithm 2 DP-RGrad for trace regression

Input: the loss function

\mathcal{L}

; the data set

\{(X_{i},y_{i})\}_{i=1}^{n}

; sensitivities

\{\Delta_{l}\}_{l\in[l^{*}]}

; DP-initialization

\widetilde{M}_{0}

; rank

r

; nuisance variance

\sigma_{\xi}^{2}

; privacy budget

\varepsilon>0,\delta\in(0,1)

Output:

(\varepsilon,\delta)

-differentially private estimate

M_{l^{*}}

for trace regression.

Initialization:

M_{0}\longleftarrow\widetilde{M}_{0}.

for

l+1\in[l^{*}]

M_{l+1}\longleftarrow\operatorname{SVD}_{r}\left(M_{l}-\eta_{l}\mathcal{P}_{\mathbb{T}_{l}}\left(G_{l}\right)+\mathcal{P}_{\mathbb{T}_{l}}N_{l}\right),

where

G_{l}

is the empirical Euclidean gradient

G_{l}:=\nabla\mathcal{L}_{n}(M_{l};Z)=\frac{1}{n}\sum_{i=1}^{n}\left(\left\langle X_{i},M_{l}\right\rangle-y_{i}\right)X_{i},

and

N_{l}\in\mathbb{R}^{d_{1}\times d_{2}}

has entries i.i.d. to

\mathcal{N}\left(0,\frac{2\Delta_{l}^{2}l^{*2}}{\varepsilon^{2}}\log\left(\frac{1.25l^{*}}{\delta}\right)\right).

Return:

\widetilde{M}_{l^{*}}\longleftarrow M_{l^{*}}

Theorem 3 establishes the error bound of the estimator $\widetilde{M}_{l^{*}}$ given by Algorithm 2. The proof of Theorem 3 is deferred to Appendix C.

Theorem 3.

Consider i.i.d. observations $Z=\{z_{1},\cdots,z_{n}\}$ drawn from the trace regression model stated in $(\ref{equ: trace_regression_model})$ where the true low-rank regression coefficients matrix being $M\in\mathbb{M}_{r}$ . Here, $z_{i}:=(X_{i},y_{i})$ for $i=1,\cdots,n$ and we assume that $\{X_{i}\}_{i\in[n]}$ satisfy the Assumption 1. Under the Assumption 1 and the condition that $(d_{1}+d_{2})>\log n$ , suppose that Algorithm 2 takes in an $(\varepsilon,\delta)$ -DP initialization such that for some small constant $0<c_{0}<1$ , $\|\widetilde{M}_{0}-M\|_{F}\leq\sqrt{2r}\|\widetilde{M}_{0}-M\|\leq c_{0}\sigma_{r},$ and the sensitivities $\Delta_{l}$ take the value

\displaystyle\Delta_{l}

\displaystyle=C_{3}\frac{\eta}{n}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\sqrt{C_{u}r(d_{1}+d_{2})\log n},\quad{\rm for\;all}\quad l=1,\cdots,l^{*},

for some absolute constant $C_{3}>0$ , then we have, Algorithm 2 is $(2\varepsilon,2\delta)$ -differentially private. Moreover, as the sample size

	$\displaystyle n\geq c_{4}\max\Bigg{\{}$	$\displaystyle\underbrace{c_{1}r(d_{1}+d_{2})}_{n_{3}},\quad\underbrace{\eta^{2}\kappa_{\xi}^{2}C_{u}r(d_{1}+d_{2})\log(d_{1}+d_{2})}_{n_{4}},$
		$\displaystyle\underbrace{\eta\sqrt{C_{u}}\left(\kappa_{\xi}+\sqrt{C_{u}}\right)r(d_{1}+d_{2})\log^{3/2}(n)\frac{\log^{1/2}\left(\frac{1.25\log(n)}{\delta}\right)}{\varepsilon}}_{n_{5}}\Bigg{\}},$

for some small constant $0<c_{4}<1$ , number of iteration $l^{*}=O(\log n)$ , and the step size $0<\eta<1$ , we have the output $\widetilde{M}_{l^{*}}$ of Algorithm 2 satisfies

	$\displaystyle\left\\|\widetilde{M}_{l^{*}}-M\right\\|_{F}$	$\displaystyle\leq\underbrace{C_{4}\sigma_{\xi}\sqrt{C_{u}}\sqrt{\frac{r(d_{1}+d_{2})}{n}}\log^{1/2}(d_{1}+d_{2})}_{u_{1}}$
		$\displaystyle+\underbrace{C_{4}\sqrt{C_{u}}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\frac{r(d_{1}+d_{2})}{n\varepsilon}\log^{3/2}n\log^{1/2}\left(\frac{1.25\log(n)}{\delta}\right)}_{u_{2}}.$

with probability at least

	$\displaystyle 1$	$\displaystyle-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)-(d_{1}+d_{2})^{-10}-n^{-9}-e^{-d_{1}}-e^{-d_{2}}-10^{-20r}$
		$\displaystyle-\left((d_{1}+d_{2})^{-10}+\exp(-(d_{1}+d_{2}))+n^{-9}+\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}\right)\log n.$

According to Theorem 3, the upper bound of $\left\|\widetilde{M}_{l^{*}}-M\right\|_{F}$ can be decomposed into the the statistical error $u_{1}$ and the cost of privacy $u_{2}$ . The term $u_{1}$ matches the the optimal rate $l_{1}\sim\sigma_{\xi}\sqrt{\frac{r(d_{1}\vee d_{2})}{n}}$ , only up to logarithmic factors. However, the term $u_{2}$ differs from the theoretical lower bound of the cost of privacy $l_{2}\sim\sigma_{\xi}\frac{r(d_{1}+d_{2})}{n\varepsilon}$ , by a non-trivial factor $\sigma_{r}$ , apart from logarithmic factors. In conclusion, Theorem 3 shows that as the sample size $n\gtrsim\widetilde{O}\left(\left(\kappa_{\xi}^{2}\vee\kappa_{\xi}\right)r(d_{1}\vee d_{2})\right),$ the estimator $\widetilde{M}_{l^{*}}$ given by Algorithm 2 attains the near-optimal convergence rate

\widetilde{O}_{p}\left(\sigma_{\xi}\sqrt{\frac{r(d_{1}+d_{2})}{n}}+(\sigma_{\xi}+\sigma_{r})\frac{r(d_{1}+d_{2})}{n\varepsilon}\right).

(7)

The sample size requirement of Theorem 3 has the following explanations. The sample size $n_{3}$ is required to guarantee that the RIP condition stated in Lemma 1 occurs with high probability. The sample size $n_{4}$ is necessary to control the statistical error contributed by $\sum_{i\in[n]}\xi_{i}X_{i}$ in each iteration where $\xi_{i}$ is the model noise. The sample size $n_{5}$ arises from controlling the cost of privacy due to $\mathcal{P}_{\mathbb{T}_{l}}N_{l}$ in each iteration.

5 Discussion

In this section, we discuss the non-trivial gap $\sigma_{r}$ between $u_{2}\sim(\sigma_{\xi}+\sigma_{r})\frac{r(d_{1}+d_{2})}{n\varepsilon}$ and $l_{2}\sim\sigma_{\xi}\,\frac{r(d_{1}\vee d_{2})}{n\varepsilon}$ . Note that $l_{2}$ is free of $\sigma_{r}$ while $u_{2}$ contains the factor $\sigma_{r}$ arising from sensitivities

\displaystyle\Delta_{l}\asymp\frac{\eta}{n}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\sqrt{C_{u}r(d_{1}+d_{2})\log n}\quad{\rm for}\quad l=1,\cdots,l^{*}.

The quantity $\sigma_{r}\sqrt{C_{u}}$ of $\Delta_{l}$ arises from $\left\|\left<M_{l}-M,X_{i}\right>\right\|_{\psi_{2}}\leq\sqrt{C_{u}}\left\|M_{l}-M\right\|_{F}$ , as elaborated in (S.12). Here, $\|\cdot\|_{\psi_{2}}$ denotes the sub-Gaussian norm. Therefore, we cannot get rid of the factor $\sigma_{r}$ once the measurement matrices $\{X_{i}\}_{i\in[n]}$ are subject to differential privacy. In many real applications, however, the measurement matrices $\{X_{i}\}_{i\in[n]}$ are fixed with deterministic designs. People publish $\{X_{i}\}_{i\in[n]}$ to the public with little concern on the privacy of $\{X_{i}\}_{i\in[n]}$ . Although the exposure of $\{X_{i}\}_{i\in[n]}$ alone will not reveal any information on $M$ , the privacy of $M$ suffers from leakage when the public has access to the joint observations $\{(X_{i},y_{i})\}_{i\in[n]}$ . We, therefore, introduce the following notion of privacy for neighboring datasets sharing the same measurement matrix.

Definition 1 (weak $(\varepsilon,\delta)$ -differential privacy).

The algorithm $A$ that maps $Z$ into $\mathbb{R}^{d_{1}\times d_{2}}$ is weak $(\varepsilon,\delta)$ -differentially private over the dataset $Z$ if $\mathbb{P}\big{(}A(Z)\in\mathcal{Q}\big{)}\leq e^{\varepsilon}\mathbb{P}\big{(}A(Z^{\prime})\in\mathcal{Q}\big{)}+\delta,$ for all neighbouring data set $Z,Z^{\prime}$ sharing the same measurement $X$ and all subset $\mathcal{Q}\subset\mathbb{R}^{d_{1}\times d_{2}}$ .

In Theorem 7, Appendix F, we show that as $n\gtrsim\widetilde{O}\left(\left(\kappa_{\xi}^{2}\vee\kappa_{\xi}\right)r(d_{1}\vee d_{2})\right),$ the estimator $\widetilde{M}_{l^{*}}$ given by Algorithm 2 attains the optimal convergence rate $\widetilde{O}_{p}\left(\sigma_{\xi}\sqrt{\frac{r(d_{1}+d_{2})}{n}}+\sigma_{\xi}\frac{r(d_{1}+d_{2})}{n\varepsilon}\right)$ in the sense of weak differential privacy. The analogs of Theorem 1, Corollary 1 and Theorem 3 in the sense of weak differential privacy can be found as Theorem 6, Corollary 2 and Theorem 7 in Appendix F. It is interesting to explore in future work whether the score attack argument or DP-Fano’s Lemma can be generalized to include the non-trivial factor $\sigma_{r}$ .

Acknowledgement

The author would like to express sincere gratitude to Hong Kong PhD Fellowship Scheme and Hong Kong RGC GRF Grant 16301622 for providing financial support for this research. The author also wishes to acknowledge the invaluable guidance provided by Prof. Dong, Xia throughout the research process. Additionally, the author would like to extend heartfelt thanks to Mr. Zetao, Fei for his constructive criticism during the paper revision. Their contributions have been instrumental in the successful completion of this research.

Appendix A Proof of Theorem 1

The proof of Theorem 1 consists of four parts. In Part A.1, we list several existing results that are useful in the proofs later. In Part A.2, Lemma 2 works as the main technique to derive the sensitivity $\Delta^{(1)}$ . Part A.3 derives the sensitivity $\Delta^{(2)}$ . Part A.4 establishes the upper bounds of $\|\widetilde{M}_{0}-M\|$ and $\|\widetilde{M}_{0}-M\|_{F}$ based on the $\Delta^{(1)}$ and $\Delta^{(2)}$ .

A.1 Part 1

The following Theorem 4 proposed by Proposition $2$ , Koltchinskii (2011) will be frequently used to establish the upper bound of the spectral norm of a summation of independent random matrices.

Theorem 4 (Bernstein’s inequality, Koltchinskii (2011)).

Let $B_{1},\cdots,B_{n}$ be independent $d_{1}\times d_{2}$ matrices such that for some $\alpha\geq 1$ and all $i\in[n]$

\mathbb{E}B_{i}=0,\quad\left\|\Lambda_{\max}\left(B_{i}\right)\right\|_{\Psi_{\alpha}}=:K<+\infty.

Let

S^{2}:=\max\left\{\Lambda_{\max}\left(\sum_{i=1}^{n}\mathbb{E}B_{i}B_{i}^{\top}\right)/n,\Lambda_{\max}\left(\sum_{i=1}^{n}\mathbb{E}B_{i}^{\top}B_{i}\right)/n\right\}.

Then, for some constant $C>0$ and for all $t>0$ ,

\mathbb{P}\left(\left\|\frac{1}{n}\sum_{i=1}^{n}B_{i}\right\|\geq CS\sqrt{\frac{t+\log(d_{1}+d_{2})}{n}}+CK\log^{1/\alpha}\left(\frac{K}{S}\right)\frac{t+\log(d_{1}+d_{2})}{n}\right)\leq\exp(-t).

Theorem 4 applies to bound the spectral norm of $\Delta:=\widehat{L}-M$ . The existing result for the case of heavy-tailed noise can be found in Theorem 6, Shen et al. (2023). Adapting the existing result to the case of Gaussian noise, we have that for some absolute constant $C_{0}>0$ ,

\|\Delta\|=\|\widehat{L}-M\|\leq C_{0}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}},

(S.1)

with probability at least $1-(d_{1}+d_{2})^{-10}$ . The following Lemma originated from Lemma 18, Shen et al. (2023), is useful to analyze the matrix permutation due to singular value decomposition.

Lemma 4 (Matrix Permutation, Shen et al. (2023)).

Let $M\in\mathbb{R}^{d_{1}\times d_{2}}$ be a rank- $r$ matrix with singular value decomposition of the form $M=U\Sigma V^{\top}$ where $\Sigma=\operatorname{diag}\left\{\sigma_{1},\sigma_{2},\cdots,\sigma_{r}\right\}$ with $\sigma_{1}\geq\sigma_{2}\geq\cdots\geq\sigma_{r}>0$ . For any $\widehat{M}\in\mathbb{R}^{d\times d}$ satisfying $\|\widehat{M}-M\|_{\mathrm{F}}<\sigma_{r}/8$ , then

	$\displaystyle\left\\|\operatorname{SVD}_{r}(\widehat{M})-M\right\\|$	$\displaystyle\leq\\|\widehat{M}-M\\|+40\frac{\\|\widehat{M}-M\\|^{2}}{\sigma_{r}},$
	$\displaystyle\left\\|\operatorname{SVD}_{r}(\widehat{M})-M\right\\|_{\mathrm{F}}$	$\displaystyle\leq\\|\widehat{M}-M\\|_{\mathrm{F}}+40\frac{\\|\widehat{M}-M\\|\\|\widehat{M}-M\\|_{\mathrm{F}}}{\sigma_{r}},$

and

\left\|\widehat{U}\widehat{U}^{\top}-UU^{\top}\right\|\leq\frac{8}{\sigma_{r}}\|\widehat{M}-M\|,\quad\left\|\widehat{V}\widehat{V}^{\top}-VV^{\top}\right\|\leq\frac{8}{\sigma_{r}}\|\widehat{M}-M\|,

where the leading $r$ left singular vectors of $\widehat{M}$ are given by the columns of $\widehat{U}\in\mathbb{R}^{d_{1}\times r}$ and the leading $r$ right singular vectors of $\widehat{M}$ are given by the columns of $\widehat{V}\in\mathbb{R}^{d_{2}\times r}$ .

A.2 Part 2

The second part aims to derive the sensivitity

\Delta^{(1)}:=\max_{i\in[n]}\left(\|\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}\|_{F}\vee\|\widehat{V}\widehat{V}^{\top}-\widehat{V}^{(i)}\widehat{V}^{(i)\top}\|_{F}\right).

Before moving on, we present Lemma 5, which provides conclusions on $\Delta$ and $\Delta^{(i)}$ , frequently used in the proof later. The proof of Lemma 5 can be found in Appendix E.4.

Lemma 5.

Under model (1), Assumption 1, and the condition $n\geq\frac{\log^{2}n}{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}$ , there exists some absolute constant $C_{0},C_{1}>0$ such that the event

	$\displaystyle\mathcal{E}_{*}:=$	$\displaystyle\Bigg{\{}\max_{i\in[n]}\big{\\|}\Delta-\Delta^{(i)}\big{\\|}\leq C_{0}\cdot n^{-1}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\log n\Bigg{\}}$
		$\displaystyle\bigcap\Bigg{\{}\\|\Delta\\|+\max_{i\in[n]}\\|\Delta^{(i)}\\|\leq C_{0}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}\Bigg{\}},$

holds with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}$ . Conditioned on the event $\mathcal{E}_{*}$ , as the sample size satisfies

n\geq C_{1}C_{l}^{-1}r\left(\frac{\sigma_{\xi}+\sqrt{C_{u}r}\sigma_{1}}{\sigma_{r}}\right)^{2}(d_{1}\vee d_{2})\log(d_{1}+d_{2}),

(S.2)

we have

\|\Delta_{*}\|\vee\max_{i\in[n]}\|\Delta_{*}^{(i)}\|=\|\Delta\|\vee\max_{i\in[n]}\|\Delta^{(i)}\|\leq\frac{\sigma_{r}}{8\sqrt{2r}}<\frac{\sigma_{r}}{5+\delta}<\frac{\sigma_{r}}{2},

(S.3)

and

\|\Delta_{*}\|_{F}\vee\max_{i\in[n]}\|\Delta_{*}^{(i)}\|_{F}=\max_{i\in[n]}\|\Delta\|_{F}\vee\|\Delta^{(i)}\|_{F}\leq\frac{\sigma_{r}}{8},

for some constant $\delta>0$ , where $\Delta_{*}^{(i)}$ is the symmetric dilation of $\Delta^{(i)}:=L^{(i)}-M$ .

The following analysis is proceeded under the sample size condition (S.2) and is mainly conditioned on the event $\mathcal{E}_{*}$ which happens with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}$ .

Step 1: expansion. Conditioned on $\mathcal{E}_{*}$ , we are able to apply Lemma 2 to $\Delta_{*}$ and $\Delta_{*}^{(i)}$ and get

\left(\begin{array}[]{cc}\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}&0\\ 0&\widehat{V}\widehat{V}^{\top}-\widehat{V}^{(i)}\widehat{V}^{(i)\top}\end{array}\right)=\sum_{k\geq 1}\mathcal{S}_{M_{*},k}(\Delta_{*})-\sum_{k\geq 1}\mathcal{S}_{M_{*},k}(\Delta^{(i)}_{*}).

Our goal is to bound $\Delta^{(1)}$ which satisfies

	$\displaystyle\Delta^{(1)}$	$\displaystyle\leq\max_{i\in[n]}\left(\\|\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}\\|_{F}+\\|\widehat{V}\widehat{V}^{\top}-\widehat{V}^{(i)}\widehat{V}^{(i)\top}\\|_{F}\right)$
		$\displaystyle\leq\max_{i\in[n]}\left(\left\\|\mathcal{S}_{M_{},1}(\Delta_{})-\mathcal{S}_{M_{},1}(\Delta^{(i)}_{})\right\\|_{F}+\left\\|\sum_{k\geq 2}\mathcal{S}_{M_{},k}(\Delta_{})-\sum_{k\geq 2}\mathcal{S}_{M_{},k}(\Delta^{(i)}_{})\right\\|_{F}\right).$

Step 2: bounding the first order term. By the definition of $\mathcal{S}_{M_{*},1}(\Delta_{*})$ and $\mathcal{S}_{M_{*},1}(\Delta^{(i)}_{*})$ ,

		$\displaystyle\max_{i\in[n]}\\|\mathcal{S}_{M_{},1}(\Delta_{})-\mathcal{S}_{M_{},1}(\Delta^{(i)}_{})\\|=\max_{i\in[n]}\\|Q^{-1}(\Delta-\Delta^{(i)})^{\top}Q_{\perp}+Q_{\perp}(\Delta-\Delta^{(i)})^{\top}Q^{-1}\\|$		(S.4)
		$\displaystyle\leq\frac{2\sqrt{r}}{\sigma_{r}}\max_{i\in[n]}\\|\Delta-\Delta^{(i)}\\|\leq C_{4}\frac{\sqrt{r}}{n\sigma_{r}}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\log n,$		(S.4)

conditioned on the event $\mathcal{E}_{*}$ , for some absolute constant $C_{4}>0$ .

Step 3: bounding the higher order terms. Let $I_{k}$ be the index set for terms in $\mathcal{S}_{M_{*},k}$

I_{k}=\left\{\mathbf{s}:\mathbf{s}=\left(s_{1},\ldots,s_{k+1}\right),\sum_{m=1}^{k+1}s_{m}=k,s_{m}\geq 0\quad\forall m\in[k+1]\right\},

with the cardinality $\left|I_{k}\right|=\binom{2k}{k}$ . We define

\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta_{*}-\Delta_{*}^{(i)}\right):=Q^{-s_{1}}\Delta_{*}^{(i)}Q^{-s_{2}}\cdots Q^{-s_{l}}\left(\Delta_{*}-\Delta_{*}^{(i)}\right)Q^{s_{l+1}}\cdots Q^{-s_{k}}\Delta_{*}Q^{s_{k+1}},

for $k\geq 2,\mathbf{s}=\left(s_{1},\cdots,s_{k+1}\right)\in I_{k}$ and $l\in[k]$ . Since $\left|I_{k}\right|=\binom{2k}{k}$ , the higher order terms $\max_{i\in[n]}\left\|\sum_{k\geq 2}\mathcal{S}_{M_{*},k}(\Delta_{*})-\sum_{k\geq 2}\mathcal{S}_{M_{*},k}\left(\Delta_{*}^{(i)}\right)\right\|_{\mathrm{F}}$

\displaystyle=\max_{i\in[n]}\left\|\sum_{k\geq 2}\sum_{\mathbf{s}\in I_{k}}\sum_{l\in[k]}\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta_{*}-\Delta_{*}^{(i)}\right)\right\|_{\mathrm{F}}\leq\max_{i\in[n]}\sum_{k\geq 2}\binom{2k}{k}\sum_{l\in[k]}\left\|\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta_{*}-\Delta_{*}^{(i)}\right)\right\|_{\mathrm{F}}.

(S.5)

It is sufficient to find a upper bound of $\left\|\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta_{*}-\Delta_{*}^{(i)}\right)\right\|_{\mathrm{F}}$ . Denote

D_{\max}:=C_{1}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}},

which appeared in the event $\mathcal{E}_{*}$ as an upper bound of $\|\Delta\|+\max_{i\in[n]}\left\|\Delta^{(i)}\right\|$ .

Conditioned on $\mathcal{E}_{*}$ , for all $i\in[n]$ , $k\geq 2,\mathbf{s}\in I_{k}$ and $l\in[k]$ ,

\displaystyle\left\|\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta-\Delta^{(i)}\right)\right\|_{\mathrm{F}}\leq\sqrt{2r}\left\|\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta-\Delta^{(i)}\right)\right\|\leq\frac{\sqrt{2r}}{\sigma_{r}}\left\|\Delta_{*}-\Delta_{*}^{(i)}\right\|\left(\frac{D_{\max}}{\sigma_{r}}\right)^{k-1},

where the first inequality is because $\mathcal{T}_{M_{*},k,\mathbf{s},l}\left(\Delta_{*}-\Delta_{*}^{(i)}\right)$ is of rank at most $2r$ . Let $a$ be a function defined by $a(k)=\binom{2k}{k}k$ , then $a(2)=12$ and $\frac{a(k+1)}{a(k)}\leq 5$ for all integer $k\geq 2$ ,

		$\displaystyle\max_{i\in[n]}\sum_{k\geq 2}\binom{2k}{k}\sum_{l\in[k]}\left\\|\mathcal{T}_{M_{},k,\mathbf{s},l}\left(\Delta_{}-\Delta_{*}^{(i)}\right)\right\\|_{\mathrm{F}}$		(S.6)
		$\displaystyle\leq\max_{i\in[n]}\binom{4}{2}\sum_{k\geq 0}5^{k}\left(\frac{\\|D_{\max}\\|}{\sigma_{r}}\right)^{k}\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|\left(\frac{D_{\max}}{\sigma_{r}}\right)$
		$\displaystyle\leq\max_{i\in[n]}a(2)\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|\sum_{k\geq 0}\left(\frac{5}{5+\delta}\right)^{k}\left(\frac{D_{\max}}{\sigma_{r}}\right)$
		$\displaystyle\leq\max_{i\in[n]}a(2)\left(\frac{5+\delta}{\delta}\right)\left(\frac{D_{\max}}{\sigma_{r}}\right)\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|,$

where the last step is due to (S.3), which is guaranteed by the sample size condition (S.2) together with the event $\mathcal{E}_{*}$ . Combining (S.5) and (S.6), since $\left\|\Delta_{*}-\Delta_{*}^{(i)}\right\|=\left\|\Delta-\Delta^{(i)}\right\|$ , conditioned on the event $\mathcal{E}_{*}$ , we have

\displaystyle\max_{i\in[n]}\left\|\sum_{k\geq 2}\mathcal{S}_{M_{*},k}(\Delta_{*})-\sum_{k\geq 2}\mathcal{S}_{M_{*},k}\left(\Delta_{*}^{(i)}\right)\right\|_{\mathrm{F}}\leq C_{4}\left(\frac{12}{\delta}\right)\frac{\sqrt{2r}}{n}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\log n,

for some absolute constant $C_{3}>0$ . In conclusion, conditioned on $\mathcal{E}_{*}$ , as the sample size $n\geq C_{1}C_{l}^{-1}r\left(\frac{\sigma_{\xi}+\sqrt{C_{u}r}\sigma_{1}}{\sigma_{r}}\right)^{2}(d_{1}\vee d_{2})\log(d_{1}+d_{2}),$ for some absolute constant $C_{1}>0$ , we have $\Delta^{(1)}\leq C_{4}\frac{\sqrt{r}}{n}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\log n,$ for some absolute constant $C_{4}$ .

Let $E_{U}\in\mathbb{R}^{d_{1}\times d_{1}}$ be a symmetric matrix where the entries $(E_{U})_{ij}$ i.i.d. to $\mathcal{N}(0,\frac{18\Delta^{(1)^{2}}}{\varepsilon^{2}}\log(\frac{3.75}{\delta}))$ for $1\leq i\leq j\leq d_{1}$ . Then, conditioned on the event $\mathcal{E}_{*}$ and (S.2), for some absolute constant $\widetilde{C}_{4}>0$ , $\|E_{U}\|\leq\widetilde{C}_{4}\frac{\sqrt{rd_{1}}}{n\varepsilon}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta}),$ with probability at least $1-e^{-d_{1}}$ . Moreover, by Gaussian mechanism, $\widehat{U}\widehat{U}^{\top}+E_{U}$ is $(\varepsilon/3,\delta/3)$ -DP and thus $\widetilde{U}$ is also $(\varepsilon/3,\delta/3)$ -DP thanks to the post-processing property of differential privacy. Furthermore, by Davis-Kahan’s Theorem, for some absolute constant $\tilde{c_{0}}>0$

$\displaystyle\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|$	$\displaystyle\leq 1\wedge\left(\left\\|\widehat{U}\widehat{U}^{\top}-UU^{\top}\right\\|+\\|E_{U}\\|\right)\stackrel{{\scriptstyle(a)}}{{\leq}}1\wedge\left(\left(\frac{8}{\sigma_{r}}\\|\widehat{L}-M\\|\wedge 1\right)+\\|E_{U}\\|\right)$	(S.7)
	$\displaystyle\leq 1\wedge\tilde{c_{0}}\Bigg{(}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}$
	$\displaystyle\quad\quad\quad\quad+\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\frac{\sqrt{rd_{1}}}{n\varepsilon}\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta})\Bigg{)},$

where we apply Lemma 4 in step $(a)$ .

Let $E_{V}\in\mathbb{R}^{d_{2}\times d_{2}}$ be a symmetric matrix with $(E_{V})_{ij}$ i.i.d. to $\mathcal{N}(0,\frac{18\Delta^{(1)^{2}}}{\varepsilon^{2}}\log(\frac{3.75}{\delta}))$ for $1\leq i\leq j\leq d_{2}$ , then for some absolute constant $\widetilde{C}_{4}>0$ , conditioned on the event $\mathcal{E}_{*}$ and (S.2), we have $\|E_{V}\|\leq\widetilde{C}_{4}\frac{\sqrt{rd_{2}}}{n\varepsilon}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta}),$ with probability at least $1-e^{-d_{2}}$ . Moreover, by Gaussian mechanism, $\widehat{V}\widehat{V}^{\top}+E_{U}$ is $(\varepsilon/3,\delta/3)$ -DP and $\widetilde{V}$ is also $(\varepsilon/3,\delta/3)$ -DP thanks to the post-processing property of differential privacy. Furthermore, by Davis-Kahan’s Theorem, for some absolute constant $\tilde{c_{0}}>0$

	$\displaystyle\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|$	$\displaystyle\leq 1\wedge\tilde{c_{0}}\Bigg{(}\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}$		(S.8)
		$\displaystyle\quad\quad\quad\quad+\sqrt{C_{l}^{-1}}\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)\frac{\sqrt{rd_{2}}}{n\varepsilon}\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta})\Bigg{)}.$		(S.8)

A.3 Part 3

Given the $(\varepsilon/3,\delta/3)$ -DP singular vectors $\widetilde{U}\in\mathbb{O}^{d_{1}\times r}$ and $\widetilde{V}\in\mathbb{O}^{d_{2}\times r}$ obtained in Part A.2, we derive the sensitivity $\Delta^{(2)}:=\max_{i\in[n]}\left\|\widetilde{U}^{\top}\left(\widehat{L}-\widehat{L}^{(i)}\right)\widetilde{V}\right\|_{F}.$ Conditioned on the event $\mathcal{E}_{*}$ ,

	$\displaystyle\Delta^{(2)}$	$\displaystyle:=\max_{i\in[n]}\left\\|\widetilde{U}^{\top}\left(\widehat{L}-\widehat{L}^{(i)}\right)\widetilde{V}\right\\|_{F}\leq\max_{i\in[n]}\sqrt{r}\left\\|\widehat{L}-\widehat{L}^{(i)}\right\\|$
		$\displaystyle=\max_{i\in[n]}\sqrt{r}\left\\|\widehat{L}-M+M-\widehat{L}^{(i)}\right\\|=\max_{i\in[n]}\sqrt{r}\left\\|\Delta-\Delta^{(i)}\right\\|$
		$\displaystyle\leq C_{3}\cdot n^{-1}\sqrt{C_{l}^{-1}}\sqrt{r}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\log n.$

Let $E_{\Sigma}$ be a $r\times r$ matrix with entries i.i.d. to $\mathcal{N}(0,18\Delta^{(2)^{2}}\log(\frac{3.75}{\delta})/\varepsilon^{2})$ , then

\|E_{\Sigma}\|\leq\widetilde{C}_{4}\cdot\frac{r}{n\varepsilon}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\log n\log^{\frac{1}{2}}\left(\frac{3.75}{\delta}\right),

(S.9)

for some absolute constant $\widetilde{C}_{4}>0$ with probability at least $10^{-20r}$ . Moreover, by Gaussian mechanism, $\widetilde{\Sigma}=\widetilde{U}^{\top}\widehat{L}\widetilde{V}+E_{\Sigma}$ is $(\varepsilon/3,\delta/3)$ -differentially private. Thanks to the composition property of differential privacy, the output of Algorithm 1 $\widetilde{M}_{0}=\widetilde{U}\widetilde{\Sigma}\widetilde{V}^{\top},$ is $(\varepsilon,\delta)$ -differentially private.

A.4 Part 4

In this part, we derive the upper bound of $\|\widetilde{M}_{0}-M\|$ . Note that

\displaystyle\|\widetilde{M}_{0}-M\|=\left\|\widetilde{U}\widetilde{\Sigma}\widetilde{V}^{\top}-U\Sigma V^{\top}\right\|=\left\|\widetilde{U}(\widetilde{U}^{\top}\widehat{L}\widetilde{V}+E_{\Sigma})\widetilde{V}^{\top}-UU^{\top}MVV^{\top}\right\|,

is a $d_{1}\times d_{2}$ matrix of rank at most $2r$ . Since

		$\displaystyle\left\\|\widetilde{U}(\widetilde{U}^{\top}\widehat{L}\widetilde{V}+E_{\Sigma})\widetilde{V}^{\top}-UU^{\top}MVV^{\top}\right\\|\leq\left\\|\widetilde{U}\widetilde{U}^{\top}\widehat{L}\widetilde{V}\widetilde{V}^{\top}-UU^{\top}MVV^{\top}\right\\|+\left\\|\widetilde{U}E_{\Sigma}\widetilde{V}^{\top}\right\\|$		(S.10)
		$\displaystyle\leq\left\\|\left(\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right)\widehat{L}\widetilde{V}\widetilde{V}^{\top}\right\\|+\left\\|UU^{\top}\left(\widehat{L}-M\right)\widetilde{V}\widetilde{V}^{\top}\right\\|+\left\\|UU^{\top}M\left(\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right)\right\\|+\left\\|\widetilde{U}E_{\Sigma}\widetilde{V}^{\top}\right\\|$
		$\displaystyle\leq\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|\widehat{L}\right\\|+\left\\|\widehat{L}-M\right\\|+\\|M\\|\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|E_{\Sigma}\right\\|$
		$\displaystyle\leq\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|\widehat{L}-M\right\\|+\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|M\right\\|+\left\\|\widehat{L}-M\right\\|+\\|M\\|\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|E_{\Sigma}\right\\|$
		$\displaystyle\leq 2\left\\|\widehat{L}-M\right\\|+\\|M\\|\left(\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\right)+\left\\|E_{\Sigma}\right\\|,$

it is sufficient to plug in the upper bound (S.1) of $\left\|\widehat{L}-M\right\|$ , $\|M\|=\sigma_{1}$ , as well as the upper bounds (S.7) of $\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\|$ , (S.8) of $\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\|$ and (S.9) of $\|E_{\Sigma}\|$ . In conclusion, conditioned on the event $\mathcal{E}_{*}$ , as the sample size

n\geq C_{1}C_{l}^{-1}r\left(\frac{\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}}{\sigma_{r}}\right)^{2}(d_{1}\vee d_{2})\log(d_{1}+d_{2}),

for some absolute constant $C_{1}>0$ , we have

	$\displaystyle\\|\widetilde{M}_{0}-M\\|$	$\displaystyle\leq C_{5}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\frac{\sigma_{1}}{\sigma_{r}}\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}$
		$\displaystyle\quad+C_{5}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\,\sigma_{1}+\sigma_{\xi}\right)\frac{\sigma_{1}}{\sigma_{r}}\frac{\sqrt{r(d_{1}\vee d_{2})}}{n\varepsilon}\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta})$
		$\displaystyle\quad+C_{5}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\frac{r}{n\varepsilon}\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta}),$

for some absolute constant $C_{5}>0$ with probability at least $1-\exp(-d_{1})-\exp(-d_{2})-10^{-20r}$ .

A.5 Proof of Corollary 1

The proof of Corollary 1 is obtained by setting the upper bound of $\|\widetilde{M}_{0}-M\|_{F}\leq\sqrt{2r}\|\widetilde{M}_{0}-M\|$ given by Theorem 1 smaller than the order of $\sigma_{r}$ .

Appendix B Proof of Theorem 2

We first present some preliminary results on the KL-divergence and total variation distance between Gaussian distributions. Let $\mathcal{N}(\mu_{1},\Sigma_{1})$ and $\mathcal{N}(\mu_{2},\Sigma_{2})$ be two $p$ -dimensional multivariate Gaussians, then

	$\displaystyle\operatorname{KL}\left(\mathcal{N}\left(\mu_{1},\Sigma_{1}\right)\\|\mathcal{N}\left(\mu_{2},\Sigma_{2}\right)\right)$
	$\displaystyle=\frac{1}{2}\left(\operatorname{Tr}\left(\Sigma_{2}^{-1}\Sigma_{1}-I_{p}\right)+\left(\mu_{2}-\mu_{1}\right)^{\top}\Sigma_{2}^{-1}\left(\mu_{2}-\mu_{1}\right)+\log\left(\frac{\operatorname{det}\Sigma_{2}}{\operatorname{det}\Sigma_{1}}\right)\right).$

Let $M_{*}=\sigma HH^{\top}$ and $M_{*}^{\prime}=\sigma H^{\prime}H^{\prime\top}$ where $H\neq H^{\prime}\in\mathcal{S}_{q}^{(d_{1}+d_{2})}$ , then

	$\displaystyle\operatorname{KL}\left(f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\\|f_{M_{}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)$
	$\displaystyle=\mathbb{E}_{f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}\left[\log\frac{f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}{f_{M_{*}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}\right]$
	$\displaystyle=\mathbb{E}_{X_{i},X_{i}^{\prime}}\mathbb{E}_{f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})}\left[-\frac{\left(\bar{y}_{i}-\left<\left(\begin{array}[]{cc}0&M\\ M^{\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\right)^{2}}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle\quad+\mathbb{E}_{X_{i},X_{i}^{\prime}}\mathbb{E}_{f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})}\left[-\frac{\left(\bar{y}_{i}-\left<\left(\begin{array}[]{cc}0&M^{\prime}\\ M^{\prime\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\right)^{2}}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle=\mathbb{E}_{X_{i},X_{i}^{\prime}}\left[\frac{\left<M_{}-M_{}^{\prime},\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\cdot\left<M_{}-M_{}^{\prime},\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle\lesssim\frac{1}{\sigma_{\xi}^{2}}C_{u}\\|M_{}-M_{}^{\prime}\\|_{F}^{2}\lesssim\frac{1}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2},$

and further by Pinsker’s inequality, we have

\operatorname{TV}\left(f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime}),f_{M_{*}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)\lesssim\frac{\sqrt{C_{u}}\sigma}{\sigma_{\xi}}\sqrt{r}\varepsilon_{0}.

For any probability measures $P_{M_{*}}\neq P_{M_{*}^{\prime}}\in\mathcal{P}_{\sigma}$ , we have

\operatorname{KL}\left(\bigotimes_{i=1}^{n}f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\|\bigotimes_{i=1}^{n}f_{M_{*}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)\lesssim\frac{n}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2}.

and

\sum_{k\in[n]}\operatorname{\operatorname{TV}}\left(f_{M_{*}}(\bar{y}_{i},X_{i},X_{i}^{\prime}),f_{M^{\prime}_{*}}(\bar{y}_{i},(X_{i}^{\perp\!\!\!\perp})_{*})\right)\lesssim n\frac{\sqrt{C_{u}}\sigma}{\sigma_{\xi}}\sqrt{r}\varepsilon_{0},

The next Lemma 6 states that there exists a sufficiently large subsect of $\mathbb{O}_{d_{1}+d_{2},2r}$ such that the elements in the subsets are well separated.

Lemma 6.

For any $r\leq d$ , there exists a subset $\mathcal{S}_{q}^{(d)}\subset\mathbb{O}_{d,r}$ with cardinality $\left|\mathcal{S}_{q}^{(d)}\right|\geq 2^{r(d-r)}$ such that for any $U_{i}\neq U_{j}\in\mathcal{S}_{q}^{(d)}$ ,

\displaystyle\|U_{i}U_{i}^{\top}-U_{j}U_{j}^{\top}\|_{q}\geq\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}\|V_{i}-V_{j}\|_{q}\gtrsim\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}\|V_{i}V_{i}^{\top}-V_{j}V_{j}^{\top}\|_{q}\gtrsim\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}r^{1/q}

where $\|\cdot\|_{q}$ denotes the Schatten-q norm and, meanwhile,

\|U_{i}U_{i}^{\top}-U_{j}U_{j}^{\top}\|_{\rm F}\lesssim\|U_{i}-U_{j}\|_{\rm F}\leq\varepsilon_{0}\|V_{i}-V_{j}\|_{\rm F}\leq\sqrt{2r}\varepsilon_{0}.

By Lemma 6, there exists a subset $\mathcal{S}_{q}^{(d_{1}+d_{2})}\subset\mathbb{O}_{d_{1}+d_{2},2r}$ with cardinality $\left|\mathcal{S}_{q}^{(d_{1}+d_{2})}\right|\geq 2^{2r(d_{1}+d_{2}-2r)}$ such that for any $H\neq H^{\prime}\in\mathcal{S}_{q}^{(d_{1}+d_{2})}$ ,

\|HH^{\top}-H^{\prime}H^{\prime\top}\|_{q}\gtrsim\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}(2r)^{1/q},

and meanwhile,

\|HH^{\top}-H^{\prime}H^{\prime\top}\|_{\rm F}\lesssim 2\sqrt{r}\varepsilon_{0}.

To invoke Lemma 3, we define the metric $\rho:\mathbb{O}_{d_{1}+d_{2},2r}\times\mathbb{O}_{d_{1}+d_{2},2r}\mapsto\mathbb{R}^{+}$ as $\rho(H,H^{\prime}):=\|HH^{\top}-H^{\prime}H^{\prime\top}\|_{q}$ for any $q\in[1,\infty]$ and take $\rho_{0}\asymp\tau\varepsilon_{0}r^{1/q}$ ,

l_{0}=c_{0}\frac{n}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2}\quad{\rm and}\quad t_{0}=c_{0}n\frac{\sqrt{C_{u}}\sigma}{\sigma_{\xi}}\sqrt{r}\varepsilon_{0},

for some small absolute constant $c_{0},\tau>0$ . Then, by Lemma 3, for any $(\varepsilon,\delta)$ -DP estimator $\widetilde{H}$ ,

	$\displaystyle\sup_{P\in\mathcal{P}_{\sigma}}\mathbb{E}\big{\\|}\widetilde{H}\widetilde{H}^{\top}-HH^{\top}\big{\\|}_{q}$
	$\displaystyle\geqslant\max\left\{\frac{\tau\varepsilon_{0}r^{1/q}}{2}\left(1-\frac{c_{0}\frac{n}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2}+\log 2}{\log N}\right),\frac{\tau\varepsilon_{0}r^{1/q}}{4}\left(1\wedge\frac{N-1}{\exp\left(4\varepsilon c_{0}n\frac{\sqrt{C_{u}}\sigma}{\sigma_{\xi}}\sqrt{r}\varepsilon_{0}\right)}\right)\right\}.$

Recall that $N\geq 2^{2r(d_{1}+d_{2})/2}$ if $d_{1}+d_{2}\geq 4r$ . We can take

\varepsilon_{0}\asymp\frac{\sigma_{\xi}}{\sqrt{C_{u}}\sigma}\left(\sqrt{\frac{d_{1}+d_{2}}{n}}+r^{\frac{1}{2}}\frac{d_{1}+d_{2}}{n\varepsilon}\right),

to get

\displaystyle\sup_{P\in\mathcal{P}_{\sigma}}\mathbb{E}\Big{\|}\widetilde{H}\widetilde{H}^{\top}-HH^{\top}\Big{\|}_{q}\gtrsim\frac{\sigma_{\xi}}{\sqrt{C_{u}}\sigma}\left(r^{1/q}\sqrt{\frac{d_{1}+d_{2}}{n}}+r^{\frac{1}{2}+\frac{1}{q}}\frac{d_{1}+d_{2}}{n\varepsilon}\right)\bigwedge r^{1/q},

where the last term is due to a trivial upper of $\|\widetilde{H}\widetilde{H}^{\top}-HH^{\top}\|_{q}\leq(4r)^{1/q}$ . Since $\sigma$ is already known, it suffices to estimate $HH^{\top}$ differentially privately by the estimator $\widetilde{H}\widetilde{H}^{\top}$ , and an estimator $(\widetilde{M})_{*}$ for the matrix $M_{*}$ is given by $\sigma\widetilde{H}\widetilde{H}^{\top}$ . Therefore,

\displaystyle\underset{P\in\mathcal{P}_{\sigma}}{\sup}\mathbb{E}\big{\|}\widetilde{M}_{*}-

\displaystyle M_{*}\big{\|}_{q}\geq\sigma\cdot\underset{P\in\mathcal{P}_{\sigma}}{\sup}\mathbb{E}\big{\|}\widetilde{H}\widetilde{H}^{\top}-HH^{\top}\big{\|}_{q}.

Due to $\mathcal{P}_{\sigma}\subset\mathcal{P}_{\Sigma}$ , we have

\displaystyle\underset{P\in\mathcal{P}_{\Sigma}}{\sup}\mathbb{E}\big{\|}\widetilde{M}_{*}-M_{*}\big{\|}_{q}\geq\underset{P\in\mathcal{P}_{\sigma}}{\sup}\mathbb{E}\big{\|}\widetilde{M}_{*}-M_{*}\big{\|}_{q}\gtrsim\frac{\sigma_{\xi}}{\sqrt{C_{u}}}\left(r^{1/q}\sqrt{\frac{d_{1}+d_{2}}{n}}+r^{\frac{1}{2}+\frac{1}{q}}\frac{d_{1}+d_{2}}{n\varepsilon}\right)\bigwedge r^{1/q}\sigma.

There is a one-to-one mapping between $\widetilde{M}$ and $(\widetilde{M})_{*}$ . Let $\widetilde{M}-M=U_{\Delta}\Sigma_{\Delta}V_{\Delta}^{\top}$ , then $\|\widetilde{M}-M\|_{q}^{q}=\left\|\Sigma_{\Delta}\right\|_{q}^{q}$ . Note that

(\widetilde{M})_{*}-M_{*}=\left(\begin{array}[]{cc}0&\widetilde{M}-M\\ \widetilde{M}^{\top}-M^{\top}&0\end{array}\right)=\frac{1}{\sqrt{2}}\left(\begin{array}[]{ll}U_{\Delta}&U_{\Delta}\\ V_{\Delta}&-V_{\Delta}\end{array}\right)\left(\begin{array}[]{cc}\Sigma_{\Delta}&0\\ 0&\Sigma_{\Delta}\end{array}\right)\frac{1}{\sqrt{2}}\left(\begin{array}[]{ll}U_{\Delta}&U_{\Delta}\\ V_{\Delta}&-V_{\Delta}\end{array}\right)^{\top},

and

\left\|(\widetilde{M})_{*}-M_{*}\right\|_{q}^{q}=\left\|\left(\begin{array}[]{cc}\Sigma_{A}&0\\ 0&\Sigma_{a}\end{array}\right)\right\|_{q}^{q}=2\left\|\Sigma_{\Delta}\right\|_{q}^{q}=2\|\widetilde{M}-M\|_{q}^{q}.

Therefore, $\left\|(\widetilde{M})_{*}-M*\right\|_{q}=2^{1/q}\|\widetilde{M}-M\|_{q}$ and

\displaystyle\inf_{\widetilde{M}}\underset{P\in\mathcal{P}_{\Sigma}}{\sup}\mathbb{E}\big{\|}\widetilde{M}-

\displaystyle M\big{\|}_{q}\gtrsim\frac{\sigma_{\xi}}{\sqrt{C_{u}}}\left(r^{1/q}\sqrt{\frac{d_{1}+d_{2}}{n}}+r^{\frac{1}{2}+\frac{1}{q}}\frac{d_{1}+d_{2}}{n\varepsilon}\right)\bigwedge r^{1/q}\sigma,

(S.11)

where we use the fact $d_{1}+d_{2}\lesssim d_{1}\vee d_{2}$ and infimum is taken over all possible $(\varepsilon,\delta)$ -DP algorithms.

Appendix C Proof of Theorem 3

In Appendix C, we aim to prove Theorem 3. The proof is composed of three Parts. In Part C.1, we characterize the sensitivity $\Delta_{l}$ for iterations $l=1,\cdots,l^{*}$ and bound $\|\mathcal{P}_{\mathbb{T}_{l}}N_{l}\|_{F}$ . In Part C.2, take mathematical induction to prove that if the RIP-condition holds and both $\Delta_{l}$ and $\|M_{l}-M\|_{F}$ are bounded with high probability, then we also have $\Delta_{l+1}$ and $\|M_{l+1}-M\|_{F}$ are bounded with high probability. In Part C.3, we choose an appropriate $l^{*}$ as the total number of iterations and give the convergence rate of $\|\widetilde{M}_{l^{*}}-M\|_{F}$ .

C.1 Part 1

In Part C.1, we focus on upper bounding $\|\mathcal{P}_{\mathbb{T}_{l}}N_{l}\|_{F}$ . The first step is to characterize the sensitivity of the $l$ -th iteration for $l\in[l^{*}]$ . Let

G_{l}^{(i)}:=\frac{1}{n}\sum_{j\neq i}\left(\left<X_{j},M_{l}\right>-y_{j}\right)X_{j}+\frac{1}{n}\left[\left<X_{i}^{\prime},M_{l}\right>-y_{i}^{\prime}\right]X_{i}^{\prime},

which is the gradient of $l$ -th iteration obtained by the dataset differes with the original one only by the $i$ -th pair of observation. The sensitivity of the gradient descent on the tagent space $\mathbb{T}_{l}$ is

	$\displaystyle\Delta_{l}$	$\displaystyle:=\max_{{\rm neighbouring}(Z,Z^{\prime})}\left\\|M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l}(Z))-\left[M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l}(Z^{\prime}))\right]\right\\|_{F}$
		$\displaystyle=\max_{i\in[n]}\left\\|M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})-\left[M_{l}-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l}^{(i)})\right]\right\\|_{F}.$

By the definition of $G_{l}$ and $G_{l}^{(i)}$ ,

\displaystyle\Delta_{l}\leq\frac{\eta}{n}\max_{i\in[n]}\left[\left\|\mathcal{P}_{\mathbb{T}_{l}}\left(\left<X_{i},M_{l}\right>-y_{i}\right)X_{i}\right\|_{F}+\left\|\mathcal{P}_{\mathbb{T}_{l}}\left(\left<X_{i}^{\prime},M_{l}\right>-y_{i}^{\prime}\right)X_{i}^{\prime}\right\|_{F}\right],

where for all $i\in[n]$ and $l+1\in[l^{*}]$

	$\displaystyle\left\\|\mathcal{P}_{\mathbb{T}_{l}}\left(\left<X_{i},M_{l}\right>-y_{i}\right)X_{i}\right\\|_{F}$	$\displaystyle\leq\left\|\left<X_{i},M_{l}-M\right>-\xi_{i}\right\|\left\\|\mathcal{P}_{\mathbb{T}_{l}}X_{i}\right\\|_{F}$		(S.12)
		$\displaystyle\leq\left(\|\xi_{i}\|+\left\|\left<X_{i},M_{l}-M\right>\right\|\right)\sqrt{2r}\left\\|X_{i}\right\\|.$		(S.12)

Here, the last inequality uses the fact that for any $B\in\mathbb{R}^{d_{1}\times d_{2}}$ , the matrix $\mathcal{P}_{\mathbb{T}_{l}}B$ is of rank at most $2r$ . Since both $\xi_{i}$ and $\left<M_{l}-M,X_{i}\right>$ are sub-Gaussians with $\|\xi_{i}\|_{\psi_{2}}=\sigma_{\xi}$ and $\left\|\left<M_{l}-M,X_{i}\right>\right\|_{\psi_{2}}\leq\left\|M_{l}-M\right\|_{F}\sqrt{C_{u}}$ , we turn to Lemma 7 to upper bound $|\xi_{i}|+\left|\left<X_{i},M_{l}-M\right>\right|$ .

Lemma 7 (Vershynin (2018)).

For any sub-Gaussian random variable $B\in\mathbb{R}$ ,

\mathbb{P}(|B|\geq t)\leq 2\exp\left(-ct^{2}/\|B\|_{\psi_{2}}\right),\quad\forall t\geq 0.

According to the tail probability of sub-Gaussian random variable stated in Lemma 7, we have with probability at least $1-n^{-10}$ ,

\displaystyle|\xi_{i}|+\left|\left<X_{i},M_{l}-M\right>\right|\leq C_{1}(\sigma_{\xi}+\left\|M_{l}-M\right\|_{F}\sqrt{C_{u}})\log^{1/2}n,

(S.13)

for some absolute constant $C_{1}>0$ . Shen et al. (2023) offeres the folowing result on $\|X_{i}\|$ .

Lemma 8 (Shen et al. (2023)).

Suppose the vectorization of $X\in\mathbb{R}^{d_{1}\times d_{2}}$ follows mean zero multivariate Gaussian distribution $N(\mathbf{0},\Lambda)$ where $\Lambda\in\mathbb{R}^{d_{1}d_{2}\times d_{1}d_{2}}$ satisfies $\lambda_{\max}(\Lambda)\leq C_{u}$ . Then, for some constant $c>0$

\mathbb{P}\left(\|X\|\geq t+c\sqrt{C_{u}\left(d_{1}+d_{2}\right)}\right)\leq\exp\left(-t^{2}\right).

It implies $\left\|\|X\|\right\|_{\psi_{2}}\leq c_{1}\sqrt{C_{u}(d_{1}+d_{2})}$ and $\left\|\|X\|\right\|_{\psi_{1}}\leq c_{2}\sqrt{C_{u}(d_{1}+d_{2})}$ for some constants $c_{1},c_{2}>0$ .

Thus, for some absolute constant $C_{2}>0$ , with probability at least $1-\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-10}$

\displaystyle\|X_{i}\|

\displaystyle\leq C_{2}\sqrt{C_{u}(d_{1}+d_{2})+\log n}.

(S.14)

Combining (S.12), (S.13) and (S.14) and taking maximum over $n$ , for some constant $C_{3}>0$ , we have the event

\mathcal{E}_{\Delta_{l}}^{\prime}:=\left\{\Delta_{l}\leq C_{3}\frac{\eta}{n}(\sigma_{\xi}+\|M_{l}-M\|_{F}\sqrt{C_{u}})\sqrt{C_{u}r(d_{1}+d_{2}+\log n)\log n}\right\},

(S.15)

happens with probability at least $1-n^{-9}-\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}$ . In the event $\mathcal{E}_{\Delta_{l}}^{\prime}$ stated in (S.15), the sensitivity $\Delta_{l}$ still relies on $\|M_{l}-M\|_{F}$ . To get an upper bound irrelevant with $l$ , we take condition on the event

\mathcal{E}_{l}=\left\{\left\|M_{l}-M\right\|_{F}\leq c_{0}\sigma_{r}\right\},

and obtain that for some absolute constant $\widetilde{C}_{3}>0$ , the event

\mathcal{E}_{\Delta_{l}}:=\left\{\Delta_{l}\leq\widetilde{C}_{3}\frac{\eta}{n}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\sqrt{C_{u}r(d_{1}+d_{2}+\log n)\log n}\right\},

(S.16)

happens with the probability $\mathbb{P}(\mathcal{E}_{\Delta_{l}})\geq 1-n^{-9}-\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}.$

In the $l+1$ -th iteration of Algorithm 2, the matrix $M_{l}$ and operator $\mathcal{P}_{\mathbb{T}_{l}}$ are known. Moreover, the rank $r$ approximation $\operatorname{SVD}_{r}$ is irrelevant with the data set $Z=\{(X_{i},y_{i})\}_{i=1}^{n}$ . Thanks to the post-processing property and composition property of differential privacy, we only need to guarantee that $M_{l}-\eta_{l}\mathcal{P}_{\mathbb{T}_{l}}(G_{l})$ is $(\varepsilon/l^{*},\delta/l^{*})$ -DP where the gradient

G_{l}=\frac{1}{n}\sum_{i=1}^{n}\left(\left<X_{i},M_{l}\right>-y_{i}\right)X_{i},

is the only component depends on the data set $Z$ . Let $N_{l}$ be a $d_{1}\times d_{2}$ matrix with entries i.i.d. to normal distribution with varicance $\frac{l^{*2}\Delta_{l}^{2}}{\varepsilon^{2}}\log\left(\frac{1.25l^{*}}{\delta}\right).$ Under the condition that $d_{1}+d_{2}\gtrsim\log n$ and conditioned on the event $\mathcal{E}_{\Delta_{l}}\cap\mathcal{E}_{l}$ , we have for some constant $C_{4}>0$

\displaystyle\|\mathcal{P}_{\mathbb{T}_{l}}N_{l}\|_{F}\leq C_{4}\eta l^{*}\frac{r(d_{1}+d_{2})}{n\varepsilon}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\sqrt{C_{u}\log n}\log^{1/2}\left(\frac{1.25l^{*}}{\delta}\right),

with probability at least $1-\exp(-(d_{1}+d_{2}))$ .

C.2 Part 2

In Part C.2, we take mathematical induction to prove that when the events

\mathcal{E}_{l}^{*}:=\mathcal{E}_{{\rm RIP}}\cap\mathcal{E}_{l}\cap\mathcal{E}_{\Delta_{l}},

occurs with high probability, the event $\mathcal{E}_{l+1}^{*}$ occurs with high probability as well. Here, $\mathcal{E}_{{\rm RIP}}$ is defined as the event where the RIP condition of $\{X_{i}\}_{i\in[n]}$ holds, See (S.17).

Step 1: $\mathcal{E}_{0}^{*}$ is true with high probability.

We first consider the RIP condition. According to Lemma 1, for any $B\in\mathbb{R}^{d_{1}\times d_{2}}$ of rank $r$ , there exist constants $c_{1},c_{2},c_{3}>0$ and $0<c_{4}<c_{5}$ such that when $n\geq c_{1}r(d_{1}+d_{2})$ , with probability at least $1-c_{2}\exp\left(-c_{3}r(d_{1}+d_{2})\right)$ ,

(1-R_{r})\|B\|_{\mathrm{F}}^{2}\leq\frac{1}{n}\sum_{i=1}^{n}\left\langle X_{i},B\right\rangle^{2}\leq(1+R_{r})\|B\|_{\mathrm{F}}^{2},

where $R_{r}:=\left(1-c_{4}\sqrt{C_{u}C_{l}}\right)\vee\left(c_{5}\sqrt{C_{u}C_{l}}-1\right)$ . The values of $R_{2r},R_{3r}$ and $R_{4r}$ are defined similarly. Therefore, under the condition that $n\geq\widetilde{c}_{1}r(d_{1}+d_{2})$ , for some constants $\widetilde{c}_{1},\widetilde{c}_{2},\widetilde{c}_{3},\widetilde{c}_{4},\widetilde{c}_{5}>0$ ,

\mathcal{E}_{{\rm RIP}}:=\left\{R_{r}\vee R_{2r}\vee R_{3r}\vee R_{4r}\leq\left(1-\widetilde{c}_{4}\sqrt{C_{u}C_{l}}\right)\vee\left(\widetilde{c}_{5}\sqrt{C_{u}C_{l}}-1\right)\right\},

(S.17)

happens with probability at least $1-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)$ .

As for $\mathcal{E}_{0}$ , we refer to Corollary 1, which shows that as the sample size

n\geq\widetilde{O}\left((\kappa^{4}r^{2}+\kappa^{2}\kappa_{\xi}^{2}r)(d_{1}\vee d_{2})\right),

the event $\mathcal{E}_{0}$ happens with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}-\exp(-d_{1})-\exp(-d_{2})-10^{-20r}$ . Conditioned on $\mathcal{E}_{0}$ , plugging $l=0$ to the event $\mathcal{E}_{\Delta_{l}}^{\prime}$ defined in (S.15), we have the event $\mathcal{E}_{\Delta_{l}}$ defined in (S.16) happens with probability at least $1-n^{-9}-\exp\left(-10C_{u}\left(d_{1}+d_{2}\right)\right)n^{-9}$ . To this end, we have

	$\displaystyle\mathbb{P}\left(\mathcal{E}_{0}^{*}\right)$	$\displaystyle=\mathbb{P}\left(\mathcal{E}_{{\rm RIP}}\cap\mathcal{E}_{0}\cap\mathcal{E}_{\Delta_{0}}\right)\geq 1-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)$
		$\displaystyle\quad\quad-(d_{1}+d_{2})^{-10}-n^{-9}-e^{-d_{1}}-e^{-d_{2}}-10^{-20r}$
		$\displaystyle\quad\quad-n^{-9}-\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}.$

Step 2: induction. The following analysis is conditioned on the event $\mathcal{E}_{l}^{*}$ . Let $\mathcal{X}:\mathbb{R}^{d_{1}\times d_{2}}\rightarrow\mathbb{R}^{n}$ be an operator defined by $\mathcal{X}(B)=\left(\left<X_{1},B\right>,\cdots,\left<X_{n},B\right>\right)^{\top}\in\mathbb{R}^{n},$ for all $B\in\mathbb{R}^{d_{1}\times d_{2}}$ . It is easy to check that the adjoint operator of $\mathcal{X}$ is $\mathcal{X}^{*}:\mathbb{R}^{n}\rightarrow\mathbb{R}^{d_{1}\times d_{2}}$ which is defined by $\mathcal{X}^{*}(b):=\sum_{i=1}^{n}b_{i}X_{i},$ for all $b\in\mathbb{R}^{n}$ . Therefore, $\mathcal{X}^{*}\mathcal{X}(M_{l})=\sum_{i=1}^{n}\left<X_{i},M_{l}\right>X_{i}\quad{\rm and}\quad\mathcal{X}^{*}(\xi)=\sum_{i=1}^{n}\xi_{i}X_{i},$ where $\xi:=(\xi_{1},\cdots,\xi_{n})\in\mathbb{R}^{n}$ and accordingly,

P_{\mathbb{T}_{l}}G_{l}=\frac{1}{n}\left[\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\left(M_{l}-M\right)-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}(\xi)\right].

Our first goal is to upper bound

		$\displaystyle\\|M_{l}-M-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})\\|_{F}=\\|M_{l}-M-\frac{\eta}{n}\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\left(M_{l}-M\right)-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}(\xi)\\|_{F}$		(S.18)
		$\displaystyle\leq\left(1-\frac{\eta}{n}\right)\\|M_{l}-M\\|_{F}+\underbrace{\frac{\eta}{n}\left\\|\left(\mathcal{I}-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}\right)\left(M_{l}-M\right)\right\\|_{F}}_{D_{1}}$
		$\displaystyle\quad+\underbrace{\frac{\eta}{n}\left\\|\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}^{\perp}}\left(M_{l}-M\right)\right\\|_{F}}_{D_{2}}+\underbrace{\frac{\eta}{n}\left\\|\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{}\left(\xi\right)\right\\|_{F}}_{D_{3}}.$

Lemma 9 characterizes the operators $\mathcal{P}_{\mathbb{T}_{l}}-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}$ and $\mathcal{P}_{T_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}^{\perp}}$ , which are critical to upper bound $D_{1}$ and $D_{2}$ in (S.18).

Lemma 9 (Wei et al. (2016), Luo and Zhang (2022)).

Suppose the event $\mathcal{E}_{{\rm RIP}}$ happens, then the following conclusions hold

1.

$\left\|\mathcal{P}_{\mathbb{T}_{l}}-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}\right\|\leq R_{2r}$ .
2.

$\|\mathcal{P}_{T_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}^{\perp}}\left(M_{l}-M\right)\|_{F}=R_{4r}\left\|\mathcal{P}_{\mathbb{T}_{l}^{\perp}}(M_{l}-M)\right\|_{F}$ ,

where $\|\mathcal{P}_{\mathbb{T}_{l}^{\perp}}\left(M_{l}-M\right)\|_{F}\leq\frac{1}{\sigma_{r}}\|M_{l}-M\|\|M_{l}-M\|_{F}$ according to Wei et al. (2016).

According to Lemma 9, conditioned on the event $\mathcal{E}_{l}^{*}$

	$\displaystyle D_{1}=\frac{\eta}{n}\left\\|\mathcal{I}-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}\left(M_{l}-M\right)\right\\|_{F}$
	$\displaystyle\leq\frac{\eta}{n}\left[\left\\|\mathcal{P}_{\mathbb{T}_{l}}-\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}\left(M_{l}-M\right)\right\\|_{F}+\\|\mathcal{P}_{\mathbb{T}_{l}^{\perp}}\left(M_{l}-M\right)\\|_{F}\right]\leq\frac{\eta}{n}\left(R_{2r}+c_{0}\right)\left\\|M_{l}-M\right\\|_{F},$

and $D_{2}=\frac{\eta}{n}\|\mathcal{P}_{T_{l}}\mathcal{X}^{*}\mathcal{X}\mathcal{P}_{\mathbb{T}_{l}}\left(M_{l}-M\right)\|_{F}\leq\frac{\eta}{n}R_{4r}c_{0}\left\|M_{l}-M\right\|_{F}.$ To this end, the only term unknown in (S.18) is

D_{3}=\left\|\mathcal{P}_{\mathbb{T}_{l}}\mathcal{X}^{*}\left(\xi\right)\right\|_{F}=\left\|\mathcal{P}_{\mathbb{T}_{l}}\sum_{i=1}^{n}\xi_{i}X_{i}\right\|_{F}\leq\sqrt{2r}\left\|\sum_{i=1}^{n}\xi_{i}X_{i}\right\|,

where $\left\|\sum_{i=1}^{n}\xi_{i}X_{i}\right\|$ is the spectral norm of a summation of $n$ i.i.d. mean zero sub-exponential random matrices. We upper bound $\left\|\sum_{i=1}^{n}\xi_{i}X_{i}\right\|$ by Theorem 4. Let $B_{i}:=\xi_{i}X_{i}$ for all $i=1,\cdots,n$ , then

\displaystyle K:=\max_{i\in[n]}\left\|\|B_{i}\|\right\|_{\psi_{1}}=\max_{i\in[n]}\left\|\|\xi_{i}X_{i}\|\right\|_{\psi_{1}}\leq\max_{i\in[n]}\|\xi_{i}\|_{\psi_{2}}\left\|\|X_{i}\|\right\|_{\psi_{2}}\leq\sqrt{C_{u}(d_{1}+d_{2})\sigma_{\xi}^{2}}.

Since $\mathbb{E}\xi_{i}^{4}\leq 3\sigma_{\xi}^{4}$ and $\mathbb{E}\|X_{i}\|^{4}\leq 3C_{u}(d_{1}+d_{2})^{2}$ ,

\|\mathbb{E}B_{i}B_{i}^{\top}\|=\mathbb{E}\xi_{i}^{2}\mathbb{E}\|X_{i}\|^{2}\leq\frac{C_{u}(d_{1}+d_{2})}{2\sigma_{\xi}^{2}}\mathbb{E}\xi_{i}^{4}+\frac{\sigma_{\xi}^{2}}{2C_{u}(d_{1}+d_{2})}\mathbb{E}\|X_{i}\|^{4}\leq 3\sigma_{\xi}^{2}C_{u}(d_{1}+d_{2}),

where the first inequality uses the fact $ab\leq\frac{a^{2}}{2c}+\frac{cb^{2}}{2}$ . Similarly, $\|\mathbb{E}B_{i}B_{i}^{\top}\|\leq 3\sigma_{\xi}^{2}C_{u}(d_{1}+d_{2})$ .

Therefore,

S^{2}:=\|\mathbb{E}B_{i}B_{i}^{\top}\|\vee\|\mathbb{E}B_{i}^{\top}B_{i}\|\leq 3\sigma_{\xi}^{2}C_{u}(d_{1}+d_{2}).

Applying Thorem 4 with $\alpha=1$ , $K=c_{1}\sqrt{C_{u}(d_{1}+d_{2})\sigma_{\xi}^{2}}$ and $S=\sqrt{3\sigma_{\xi}^{2}C_{u}(d_{1}+d_{2})}$ , we have

\displaystyle\mathbb{P}\left(\frac{1}{n}\left\|\sum_{i=1}^{n}\xi_{i}X_{i}\right\|\geq C_{5}\sqrt{C_{u}(d_{1}+d_{2})\sigma_{\xi}^{2}}\sqrt{\frac{\log(d_{1}+d_{2})}{n}}\right)\leq(d_{1}+d_{2})^{-10}.

In conclusion, with probability at least $1-(d_{1}+d_{2})^{-10}$

\displaystyle D_{3}\leq C_{1}\sqrt{r}\left\|\sum_{i=1}^{n}\xi_{i}X_{i}\right\|_{F}\leq C_{1}\sqrt{C_{u}\sigma_{\xi}^{2}nr(d_{1}+d_{2})\log(d_{1}+d_{2})},

for some constant $C_{1}>0$ .

Conditioned on $\mathcal{E}_{l}^{*}$ , we plug $D_{1}$ , $D_{2}$ and $D_{3}$ into (S.18) and obtain that for some small constant $0<c_{0}<1$ and absolute constant $C_{2}>0$

	$\displaystyle\\|M_{l}-M-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})+\mathcal{P}_{\mathbb{T}_{l}}N_{l}\\|_{F}\leq\\|M_{l}-M-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})\\|_{F}+\\|\mathcal{P}_{\mathbb{T}_{l}}N_{l}\\|_{F}$
	$\displaystyle\leq\left(1-\rho_{0}\right)\\|M_{l}-M\\|_{F}+C_{2}\eta\sigma_{\xi}\sqrt{C_{u}}\sqrt{\frac{r(d_{1}+d_{2})}{n}}\log^{1/2}(d_{1}+d_{2})$
	$\displaystyle\quad+C_{2}\eta l^{}\sqrt{C_{u}}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\frac{r(d_{1}+d_{2})}{n\varepsilon}\log^{1/2}n\log^{1/2}\left(\frac{1.25l^{}}{\delta}\right),$

with probability at least $1-(d_{1}+d_{2})^{-10}-\exp(-(d_{1}+d_{2}))$ where we define

\rho_{0}:=\frac{\eta}{n}\left(1-R_{2r}-c_{0}-R_{4r}c_{0}\right).

Suppose that $c_{0}\lesssim\frac{1}{R_{2r}(1+R_{4r})}\wedge\frac{1}{8}$ , the step size $\eta\leq n$ being a small constant, then we have $0\leq\rho_{0}<1$ . Further, as for some absolute constant $C_{3}>0$ , the sample size satisfies

	$\displaystyle n\geq C_{3}\max\Bigg{\{}$	$\displaystyle\eta^{2}\left(\frac{\sigma_{\xi}}{\sigma_{r}}\right)^{2}C_{u}r(d_{1}+d_{2})\log(d_{1}+d_{2}),$
		$\displaystyle\eta l^{}\sqrt{C_{u}}\left(\frac{\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}}}{\sigma_{r}}\right)\frac{r(d_{1}+d_{2})}{\varepsilon}\log^{1/2}n\log^{1/2}\left(\frac{1.25l^{}}{\delta}\right)\Bigg{\}},$

we have for some small constant $0<\rho_{1}<1$ ,

\|M_{l}-M-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})+\mathcal{P}_{\mathbb{T}_{l}}N_{l}\|_{F}\leq\left(1-\rho_{1}\right)\|M_{l}-M\|_{F}\leq(1-\rho_{1})c_{0}\sigma_{r}.

Applying Lemma 4, we obtain that under the condition $40c_{0}<\frac{\rho_{1}}{2}$ ,

$\displaystyle\left\\|M_{l+1}-M\right\\|_{F}$	$\displaystyle\leq\left(1+40c_{0}\right)\left\\|M_{l}-M-\eta\mathcal{P}_{\mathbb{T}_{l}}(G_{l})+\mathcal{P}_{\mathbb{T}_{l}}N_{l}\right\\|_{F}$	(S.19)
	$\displaystyle\leq\left(1+40c_{0}\right)(1-\rho_{1})\\|M_{l}-M\\|_{F}$
	$\displaystyle\leq\left(1-\frac{\rho_{1}}{2}\right)\\|M_{l}-M\\|_{F}\leq\left(1-\frac{\rho_{1}}{2}\right)c_{0}\sigma_{r}.$

In summary, conditioned on the event $\mathcal{E}_{l}^{*}$ , the event

\mathcal{E}_{l+1}:=\left\{\left\|M_{l+1}-M\right\|_{F}\leq c_{0}\sigma_{r}\right\},

occurs with probability at least $1-(d_{1}+d_{2})^{-10}-\exp(-(d_{1}+d_{2}))$ . Besides, according to $\mathcal{E}_{\Delta_{l}}^{\prime}$ defined in (S.15), the event

\mathcal{E}_{\Delta_{l+1}}:=\left\{\Delta_{l+1}\leq\widetilde{C}_{3}\frac{\eta}{n}\left(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}}\right)\sqrt{C_{u}r\left(d_{1}+d_{2}+\log n\right)\log n}\right\},

occurs with probability $1-n^{-9}-\exp\left(-10C_{u}\left(d_{1}+d_{2}\right)\right)n^{-9}$ . Therefore, conditioned on $\mathcal{E}_{l}^{*}$ , the event $\mathcal{E}_{l+1}^{*}$ happens with probability at least $1-(d_{1}+d_{2})^{-10}-\exp(-(d_{1}+d_{2}))-n^{-9}-\exp\left(-10C_{u}\left(d_{1}+d_{2}\right)\right)n^{-9}.$

To this end, we has finished the induction and conclude Part C.2 by

	$\displaystyle\mathbb{P}\left(\bigcap_{i=0}^{l}\mathcal{E}_{i}^{*}\right)$	$\displaystyle\geq 1-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)-(d_{1}+d_{2})^{-10}-n^{-9}-e^{-d_{1}}-e^{-d_{2}}-10^{-20r}$
		$\displaystyle\quad-l\left((d_{1}+d_{2})^{-10}+\exp(-(d_{1}+d_{2}))\right)-(l+1)\left(n^{-9}+\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}\right).$

C.3 Part 3

In Part C.3, we derive the convergence rate of $\left\|M_{l^{*}}-M\right\|_{F}$ and choose an appropriate value for $l^{*}$ . Conditioned on the event $\bigcap_{i=0}^{l^{*}-1}\mathcal{E}_{i}^{*}$ , according to (S.19), with probability at least $1-(d_{1}+d_{2})^{-10}-\exp(-(d_{1}+d_{2}))$

	$\displaystyle\left\\|\widetilde{M}_{l^{}}-M\right\\|_{F}=\left\\|M_{l^{}}-M\right\\|_{F}$
	$\displaystyle\leq\left(1-\rho_{0}\right)^{l^{}}\\|M_{0}-M\\|_{F}+\left(\sum_{l=0}^{l^{}-1}\left(1-\rho_{0}\right)^{l^{*}-l-1}\right)C_{2}\eta\sigma_{\xi}\sqrt{C_{u}}\sqrt{\frac{r(d_{1}+d_{2})}{n}}\log^{1/2}(d_{1}+d_{2})$
	$\displaystyle\quad+\left(\sum_{l=0}^{l^{}-1}\left(1-\rho_{0}\right)^{l^{}-l-1}\right)C_{2}\eta l^{}\sqrt{C_{u}}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\frac{r(d_{1}+d_{2})}{n\varepsilon}\log^{1/2}n\log^{1/2}\left(\frac{1.25l^{}}{\delta}\right).$

Let $\left\|M_{0}-M^{*}\right\|_{F}=c_{0}^{*}$ and $l^{*}:=\log\left(c_{0}^{*}n\right)/\rho_{0}$ , then we have $\left(1-\rho_{0}\right)^{l^{*}}\|M_{0}-M\|_{F}\asymp\frac{1}{n}$ , indicating that there is little reason to run the algorithm further than $O(\log n)$ iterations.

In conclusion,

	$\displaystyle\left\\|\widetilde{M}_{l^{*}}-M\right\\|_{F}$	$\displaystyle\leq C_{3}\sigma_{\xi}\sqrt{C_{u}}\sqrt{\frac{r(d_{1}+d_{2})}{n}}\log^{1/2}(d_{1}+d_{2})$
		$\displaystyle+C_{3}\sqrt{C_{u}}(\sigma_{\xi}+\sigma_{r}\sqrt{C_{u}})\frac{r(d_{1}+d_{2})}{n\varepsilon}\log^{1/2}n\log^{3/2}\left(\frac{1.25l^{*}}{\delta}\right).$

with probability at least

	$\displaystyle 1$	$\displaystyle-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)-(d_{1}+d_{2})^{-10}-n^{-9}-e^{-d_{1}}-e^{-d_{2}}-10^{-20r}$
		$\displaystyle-\left((d_{1}+d_{2})^{-10}+\exp(-(d_{1}+d_{2}))+n^{-9}+\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}\right)\log n.$

Appendix D The lower bound derived by score attack argument

Let $\mathbb{M}_{r}:=\{M\in\mathbb{R}^{d_{1}\times d_{2}}:\operatorname{rank}(M)=r\}$ . This section establishes the minimax lower bound of differentially privately estimating the matrix $M\in\bigcup_{k=1}^{r}\mathbb{M}_{k},$ within the trace regression model based on an alternative approach, score attack argument Cai et al. (2023).

The score attack argument involves designing a test statistic and establishing the lower bound of the statistic with the help of a prior distribution of the parameters to estimate. It is unclear, however, how to construct a prior distribution for the low-rank matrix $M$ such that the prior complies with the parameter space $\mathbb{M}_{r}$ and the score attack is easy to compute at the same time. Compared to DP-fano’s Lemma (See Lemma 3) which requires $\delta\lesssim e^{-n}$ , the score attack argument is valid for a wider range of $\delta\lesssim n^{1+\gamma}$ where $\gamma>0$ is a constant. We first define some necessary notations for the elaboration of score attack argument. For any matirx $B,C\in\mathbb{R}^{d_{1}\times d_{2}}$ , we denote $\operatorname{supp}(B):=\{(i,j)\in[d_{1}]\times[d_{2}]:B_{ij}\neq 0\}$ as the support of $B$ and the matrix $C$ restricted on $\operatorname{supp}B$ is $\left[C\right]_{\operatorname{supp}(B)}=\sum_{i=1}^{d_{1}}\sum_{j=1}^{d_{2}}C_{ij}e_{i}e_{j}^{\top}\mathbb{I}(B_{ij}\neq 0)$ where $e_{i}$ is the $i$ -th canonical basis in $\mathbb{R}^{d_{1}}$ and $e_{j}$ is the $j$ -th canonical basis in $\mathbb{R}^{d_{2}}$ .

To apply score attack argument, we relax the problem to deriving minimax lower bounds over $\mathbb{M}_{r,d_{1}}:=\{M\in\mathbb{R}^{d_{1}\times d_{2}}:\operatorname{supp}(M)\subset[d_{1}]\times[r]\}\subset\bigcup_{k=1}^{r}\mathbb{M}_{k}$ . The benefit is that there exists a trivial prior of $M\in\mathbb{M}_{r,d_{1}}$ such that $M_{ij}\stackrel{{\scriptstyle i.i.d.}}{{\sim}}\mathcal{N}(0,1)$ for $(i,j)\in[d_{1}]\times[r]$ and $M_{ij}=0$ otherwise. Similarly, we may consider establish minimax lower bound over $\mathbb{M}_{r,d_{2}}:=\{M\in\mathbb{R}^{d_{1}\times d_{2}}:\operatorname{supp}(M)\subset[r]\times[d_{2}]\}\subset\bigcup_{k=1}^{r}\mathbb{M}_{k}.$ For any $M\in\mathbb{M}_{r,d_{2}}$ , there is a trivial prior as well. Let $A$ be a randomized algorithm mapping a dataset $Z$ to a $d_{1}\times d_{2}$ matrix. We define the DP-constrained minimax risk over $\bigcup_{k=1}^{r}\mathbb{M}_{k}$ as

\operatorname{risk}(\bigcup_{k=1}^{r}\mathbb{M}_{k}):=\inf_{A}\sup_{M\in\mathbb{M}_{r}}\mathbb{E}\left\|A(Z)-M\right\|_{F}^{2},

where $A$ is taken over all $(\epsilon,\delta)$ -DP algorithms. Similarly, we define $\operatorname{risk}(\mathbb{M}_{r,d_{1}})$ and $\operatorname{risk}(\mathbb{M}_{r,d_{2}})$ . Since $\mathbb{M}_{r,d_{1}}\subset\bigcup_{k=1}^{r}\mathbb{M}_{k}$ and $\mathbb{M}_{r,d_{2}}\subset\bigcup_{k=1}^{r}\mathbb{M}_{k}$ , we have

\operatorname{risk}(\bigcup_{k=1}^{r}\mathbb{M}_{k})\geq\operatorname{risk}(\mathbb{M}_{r,d_{1}})\bigvee\operatorname{risk}(\mathbb{M}_{r,d_{2}}),

(S.20)

which indicates that the lower bound of $\operatorname{risk}(\bigcup_{k=1}^{r}\mathbb{M}_{k})$ will be an immediate result once we successfully lower bound $\operatorname{risk}(\mathbb{M}_{r,d_{1}})$ and $\operatorname{risk}(\mathbb{M}_{r,d_{2}})$ .

Next, we construct score attacks to derive the lower bounds of $\operatorname{risk}(\mathbb{M}_{r,d_{1}})$ and $\operatorname{risk}(\mathbb{M}_{r,d_{2}})$ . Let $z=(X,y)$ be the pair of a measurement matrix and its corresponding response variable, drawn independently from (3). The score function is defined by

\displaystyle S_{M}(z):=\nabla_{M}\log f_{M}(z)=\nabla_{M}\log f_{M}(y|X),

and the score attack is defined by

\mathcal{A}^{(1)}_{M}(z,A(Z)):=\left<\left[A(Z)-M\right]_{[d_{1}]\times[r]},S_{M}(z)\right>,

where $A$ is an $(\varepsilon,\delta)$ -DP algorithm to estimate $M\in\mathbb{M}_{r}$ ; $z=(X,y)$ is a piece of datum that we want to test whether it belongs to $Z=\{(X_{i},y_{i})\}_{i=1}^{n}$ ; the quantity $\left[A(Z)-M\right]_{[d_{1}]\times[r]}$ is obtained by restricting $A(Z)-M\in\mathbb{R}^{d_{1}\times d_{2}}$ to the index set $[d_{1}]\times[r]$ . Under some regularity conditions, the score attack $\mathcal{A}^{(1)}_{M}(z,A(Z))$ will lead to the lower bound of $\operatorname{risk}(\mathbb{M}_{r},d_{1})$ . Similarly, we derive the lower bound of $\operatorname{risk}(\mathbb{M}_{r},d_{2})$ with the help of the attack

\mathcal{A}^{(2)}_{M}(z,A(Z)):=\left<\left[A(Z)-M\right]_{[r]\times[d_{2}]},S_{M}(z)\right>.

Finally, Theorem 5 establishes the lower bound for estimating the low-rank matrix $M$ . The proof of Theorem 5.

Theorem 5.

Consider i.i.d. observations $Z=\{z_{1},\cdots,z_{n}\}$ drawn from the trace regression model defined in $(\ref{equ: trace_regression_model})$ , where $z_{i}:=(X_{i},y_{i})$ for $i=1,\cdots,n$ . We assume that $\{X_{i}\}_{i\in[n]}$ satisfy the Assumption 1, $r(d_{1}\vee d_{2})\lesssim n\varepsilon$ , $0<\varepsilon<1$ and $\delta\lesssim n^{-(1+\gamma)}$ for some $\gamma>0$ , then

\operatorname{risk}(\bigcup_{k=1}^{r}\mathbb{M}_{k})=\inf_{A}\sup_{M\in\bigcup_{k=1}^{r}\mathbb{M}_{k}}\mathbb{E}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\underbrace{\sigma_{\xi}^{2}\;\frac{r(d_{1}\vee d_{2})}{n}}_{a_{1}}+\underbrace{\sigma_{\xi}^{2}\;\frac{r^{2}(d_{1}\vee d_{2})^{2}}{n^{2}\varepsilon^{2}}}_{a_{2}}.

(S.21)

By Theorem 5, the lower bound of $\operatorname{risk}(\mathbb{M}_{r})$ consists of two terms where the first term $a_{1}$ accounts for the statistical error and the second term $a_{2}$ is the cost of privacy. The proof for $a_{1}$ can be found in Rohde and Tsybakov (2011) and the cost of privacy is deduced in the following proof.

Proof of Theorem 5.

We now start proving Theorem 5 by score attack argument. Throughout the proof, we assume that $Z=\{z_{1},\cdots,z_{n}\}$ is an i.i.d. sample drawn from $f_{M}$ and $Z_{i}^{\prime}$ is a neighbouring data set of $Z$ obtained by replacing $z_{i}$ with an independent copy $z_{i}^{\prime}\sim f_{M}$ . Besides, we mainly focus on the case $M\in\mathbb{M}_{r,d_{1}}$ and states the result for the case $M\in\mathbb{M}_{r,d_{2}}$ in Remark 1. Let

\mathcal{A}^{(1)}_{M}(z,A(Z)):=\left<\left[A(Z)-M\right]_{[d_{1}]\times[r]},S_{M}(z)\right>.

We derive the lower bound of $\operatorname{risk}(\mathbb{M}_{r,d_{1}}):=\inf_{A}\sup_{M\in\mathbb{M}_{r,d_{1}}}\mathbb{E}\left\|A(Z)-M\right\|_{F}^{2},$ in three steps. For ease of notation, we define

\displaystyle A_{i}^{\prime}:=\mathcal{A}_{M}\left(z_{i},A(Z_{i}^{\prime})\right)\quad{\rm and}\quad A_{i}:=\mathcal{A}_{M}\left(z_{i},A(Z)\right).

Step 1: bounding the summation. The following Lemma 10 bounds $\mathbb{E}\left|A_{i}^{\prime}\right|$ ; Lemma 11 develops the upper bound of $\sum_{i\in[n]}\mathbb{E}\,A_{i}$ based on $\mathbb{E}\left|A_{i}^{\prime}\right|$ discussed in Lemma 10 and a tunning parameter $T$ . The proof of Lemma 10 and 11 can be found in Appendix E.7 and E.8.

Lemma 10.

For $i\in[n]$ , we have $\mathbb{E}A_{i}^{\prime}=0\quad{\rm and}\quad\mathbb{E}\left|A_{i}^{\prime}\right|\leq\sqrt{\mathbb{E}\left\|A(Z)-M\right\|^{2}_{F}}\sqrt{\frac{C_{u}}{\sigma_{\xi}^{2}}}.$

Lemma 11.

Let $A$ be an $(\varepsilon,\delta)$ -DP algorithm with $0<\varepsilon<1$ and $\delta\geq 0$ , under model (1), by choosing $T=\sqrt{2/\sigma_{\xi}^{2}}rd_{1}\sqrt{\log(\frac{1}{\delta})}$ , we have

\displaystyle\sum_{i\in[n]}\mathbb{E}A_{i}\leq 2n\varepsilon\sqrt{\mathbb{E}\|A(Z)-M\|_{F}^{2}}\sqrt{C_{u}/\sigma_{\xi}^{2}}+4\sqrt{2}\delta rd_{1}\sqrt{\log(1/\delta)/\sigma_{\xi}^{2}}.

(S.22)

Step 2: lower bounding the summation. Under some regularity conditions, the following Lemma 12 characterize the quantity $\sum_{i\in[n]}A_{i}$ as a summation of functions of $M$ . Lemma 13 lower bounds the summation of functions by assigning an appropriate prior distribution $\pi$ to $M$ . The proof of Lemma 12 and 13 can be found in Appendix E.8.

Lemma 12.

If for every $(i,j)\in[d_{1}]\times[r],\log f_{M}(Z)$ is continuously differentiable with respect to $M_{ij}$ and $\left|\frac{\partial}{\partial M_{ij}}\log f_{M}(Z)\right|<h_{ij}(Z)$ such that $\mathbb{E}\left|h_{ij}(Z)A(M)_{ij}\right|<\infty$ , we have

\sum_{i\in[n]}\mathbb{E}\,\mathcal{A}^{1}_{M}\left(z_{i},A(Z)\right)=\sum_{(i,j)\in[d_{1}]\times[r]}\frac{\partial}{\partial M_{ij}}\mathbb{E}A(Z)_{ij}.

Lemma 12 has its general form stated in Theorem $2.1$ , Cai et al. (2023). Let $g_{ij}$ be a function defined by $g_{ij}(M):=\left(\mathbb{E}_{Z|M}A(Z)\right)_{ij}$ for all $(i,j)\in[d_{1}]\times[r]$ , then

\sum_{(i,j)\in[d_{1}]\times[r]}\frac{\partial}{\partial M_{ij}}\mathbb{E}A(Z)_{ij}=\mathbb{E}_{\pi}\left(\sum_{(i,j)\in[d_{1}]\times[r]}\frac{\partial}{\partial M_{ij}}g_{ij}\right).

Lemma 13 lower bounds this quantity by assigning the prior distribution $\pi$ to $M$ such that $M_{ij}\sim\mathcal{N}(0,1)$ for all $(i,j)\in[d_{1}]\times[r]$ and otherwise, $M_{ij}=0$ .

Lemma 13.

Let $M\in\mathbb{M}_{r,d_{1}}$ be distributed according to a density $\pi$ whose marginal densities are $\{\pi_{ij}\}$ for $i=1,\cdots,d_{1}$ and $j=1,\cdots,d_{2}$ such that $\pi_{ij}\sim\mathcal{N}(0,1)$ for all $(i,j)\in[d_{1}]\times[r]$ , and otherwise, $\pi_{ij}$ be the density function such that $\mathbb{P}(M_{ij}=0)=1$ . Then,

\mathbb{E}_{\pi}\left(\sum_{(i,j)\in[d_{1}]\times[r]}\frac{\partial}{\partial M_{ij}}g_{ij}\right)\geq\sum_{(i,j)\in[d_{1}]\times[r]}\mathbb{E}_{\pi_{ij}}M_{ij}^{2}-\sqrt{C}\sqrt{\mathbb{E}_{\pi_{ij}}M_{ij}^{2}}=rd_{1}-\sqrt{Crd_{1}}\gtrsim rd_{1}.

Combining Lemma 12 and 13, we obtain

\sum_{i\in[n]}\mathbb{E}A_{i}=\sum_{i\in[n]}\mathbb{E}\,\mathcal{A}_{M}\left(z_{i},A(Z)\right)\gtrsim rd_{1}.

(S.23)

Step 3: combining the upper and lower bounds. Combining the lower bound $(\ref{equ: lower_bound_summation_A_i})$ of $\sum_{i\in[n]}\mathbb{E}A_{i}$ and the upper bound (S.22) of $\sum_{i\in[n]}\mathbb{E}A_{i}$ , we have

2n\varepsilon\sqrt{\mathbb{E}_{\pi}\mathbb{E}_{Z\mid M}\|A(Z)-M\|_{F}^{2}}\sqrt{C_{u}/\sigma_{\xi}^{2}}\gtrsim rd_{1}-4\sqrt{2}\delta rd_{1}\sqrt{\log(1/\delta)/\sigma_{\xi}^{2}}.

Under the assumption that $\delta<n^{-(1+\gamma)}$ for some $\gamma>0$ , we have $rd_{1}-4\sqrt{2}\delta rd_{1}\sqrt{\log(1/\delta)/\sigma_{\xi}^{2}}\gtrsim rd_{1}$ , and therefore $\mathbb{E}_{\pi}\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\sigma_{\xi}^{2}\cdot\frac{r^{2}d_{1}^{2}}{n^{2}\varepsilon^{2}}.$ Since the sup-risk is greater than the Bayesian risk,

\sup_{M\in\mathbb{M}_{r,d_{1}}}\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\sigma_{\xi}^{2}\cdot\frac{r^{2}d_{1}^{2}}{n^{2}\varepsilon^{2}}.

Furthermore, due to $\mathbb{M}_{r,d_{1}}\subset\bigcup_{k=1}^{r}\mathbb{M}_{k}$ , we have $\sup_{M\in\bigcup_{k=1}^{r}\mathbb{M}_{k}}\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\sigma_{\xi}^{2}\cdot\frac{r^{2}d_{1}^{2}}{n^{2}\varepsilon^{2}}$ and

\inf_{A}\sup_{M\in\bigcup_{k=1}^{r}\mathbb{M}_{k}}\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\sigma_{\xi}^{2}\cdot\frac{r^{2}d_{1}^{2}}{n^{2}\varepsilon^{2}},

where $A$ is an $(\varepsilon,\delta)$ -DP algorithm that satisfies $\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\lesssim 1$ . This conclusion extends to all differentially private $A$ if we assume that $rd_{1}\lesssim n\varepsilon$ such that $\frac{r^{2}d_{1}^{2}}{n^{2}\varepsilon^{2}}\lesssim 1$ .

Remark 1.

Lemma 11 and 13 are also applicable to the case where the parameter space is $M_{r,d_{2}}$ . For $M\in\mathbb{M}_{r,d_{2}}$ , Lemma 11 implies that

\sum_{i\in[n]}\mathbb{E}A_{i}\leq 2n\varepsilon\sqrt{\mathbb{E}\|A(Z)-M\|_{F}^{2}}\sqrt{C_{u}/\sigma_{\xi}^{2}}+4\sqrt{2}\delta rd_{2}\sqrt{\log(1/\delta)/\sigma_{\xi}^{2}};

and Lemma 13 results in $\mathbb{E}\left(\sum_{(i,j)\in[d_{1}]\times[r]}\frac{\partial}{\partial M_{ij}}g_{ij}\right)\gtrsim rd_{2}.$ Therefore, as $\delta<n^{-(1+\gamma)}$ for some $\gamma>0$ , the minimax lower bound

\inf_{A}\sup_{M\in\bigcup_{k=1}^{r}\mathbb{M}_{k}}\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\gtrsim\sigma_{\xi}^{2}\cdot\frac{r^{2}d_{2}^{2}}{n^{2}\varepsilon^{2}},

where $A$ is an $(\varepsilon,\delta)$ -DP algorithm that satisfies $\mathbb{E}_{Z\mid M}\left\|A(Z)-M\right\|_{F}^{2}\lesssim 1$ . Similarly, this conclusion extends to all differentially private $A$ if we assume that $rd_{2}\lesssim n\varepsilon$ such that $\frac{r^{2}d_{2}^{2}}{n^{2}\varepsilon^{2}}\lesssim 1$ .

∎

Appendix E Proofs of Technical Lemmas

E.1 Proof of Lemma 1

Lemma 1 is a consequence of Proposition $10.4$ , Vershynin (2015) and Lemma $1$ , Chen et al. (2019) by setting $c_{l}^{2}=C_{l}$ and $c_{u}^{2}=C_{u}$ and $\tau^{2}\asymp\frac{\sqrt{C_{u}}}{\sqrt{C_{l}}}$ . See the definiton of $c_{l}^{2}$ and $c_{u}^{2}$ in Lemma $1$ , Chen et al. (2019).

E.2 Proof of Lemma 2

The proof of Lemma 2 involves applying the symmetric dilation trick to Theorem $1$ , Xia (2021).

Lemma 14 (Theorem 1, Xia (2021)).

Let $B\in d\times d$ be a rank- $r$ symmetric matrix with eigen-decomposition of the form $B=\Theta\Lambda\Theta^{\top}$ where $\Theta\in\mathbb{O}_{d,r}$ and the diagonal matrix $\Lambda=\{\lambda_{1},\cdots,\lambda_{r}\}$ has the eigenvalues of $B$ arranging in the non-increasing order. Let $\widehat{B}=B+\Delta_{B}$ be another $d\times d$ symmetric matrix and leading $r$ eigen vector of $\widehat{B}$ is given by $\widehat{\Theta}\in\mathbb{O}_{r,d}$ . Then,

\widehat{\Theta}\widehat{\Theta}^{\top}-\Theta\Theta^{\top}=\sum_{k\geq 1}\mathcal{S}_{B,k}(\Delta_{B}),

where the $k$ -th order term $\mathcal{S}_{M_{*},k}(\Delta)$ is a summation of $\binom{2k}{k}$ terms defined by

\mathcal{S}_{B,k}(\Delta_{B})=\sum_{\mathbf{s}:s_{1}+\ldots+s_{k+1}=k}(-1)^{1+\tau(\mathbf{s})}\cdot Q^{-s_{1}}\Delta_{B}Q^{-s_{2}}\ldots\Delta_{B}Q^{-s_{k+1}},

where $\mathbf{s}=\left(s_{1},\ldots,s_{k+1}\right)$ contains non-negative indices and $\tau(\mathbf{s})=\sum_{j=1}^{k+1}\mathbb{I}\left(s_{j}>0\right).$

Lemma 14 provides an explicit representation formula for the spectral projector $\widehat{\Theta}\widehat{\Theta}^{\top}$ given that $B$ is symmetric and of rank- $r$ . Since we are interested in the asymmetric rank- $r$ matrix $M=U\Sigma V^{\top}\in\mathbb{R}^{d_{1}\times d_{2}}\in\mathbb{R}^{d_{1}\times d_{2}}$ , we apply the symmetric dilation trick to $M$ and obtain the rank- $2r$ symmetric matrix $M_{*}$ has eigendecomposition of the form

M^{*}=U_{M^{*}}\Sigma_{M^{*}}U_{M^{*}}^{\top}=\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)\left(\begin{array}[]{cc}\Sigma&0\\ 0&-\Sigma\end{array}\right)\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)^{\top}.

The proof is finished by applying Lemma 14 with $B=M_{*}$ , $\widehat{B}=M_{*}+\Delta_{*}$ , $d=d_{1}+d_{2}$ , the rank be $2r$ and

\displaystyle\Theta=\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}U&U\\ V&-V\end{array}\right)\quad{\rm and}\quad\widehat{\Theta}=\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}\widehat{U}&\widehat{U}\\ \widehat{V}&-\widehat{V}\end{array}\right).

E.3 Proof of Lemma 3 and 4

See the proof of Lemma 3 in Acharya et al. (2021) and Cai et al. (2024). See the proof of 4 in Shen et al. (2023).

E.4 Proof of Lemma 5

	$\displaystyle\max_{i\in[n]}\big{\\|}\Delta-\Delta^{(i)}\big{\\|}$	$\displaystyle\leq\frac{1}{n}\left\\|\operatorname{mat}(\Lambda_{i}^{-1}\operatorname{vec}(X_{i}))\left(\left<X_{i},M\right>+\xi_{i}\right)\right\\|$
		$\displaystyle\quad+\max_{i\in[n]}\,\frac{1}{n}\left\\|\operatorname{mat}((\Lambda_{i}^{\prime})^{-1}\operatorname{vec}(X_{i}^{\prime}))\left(\left<X_{i}^{\prime},M\right>+\xi_{i}\right)\right\\|,$

where $\|\xi_{i}\|_{\psi_{2}}=\sigma_{\xi}$ and $\left\langle X_{i},M\right\rangle\sim N\left(0,\operatorname{vec}\left(M\right)^{\top}\Lambda_{i}\operatorname{vec}\left(M\right)\right),\quad\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\sim N\left(0,\Lambda_{i}^{-1}\right).$

	$\displaystyle\left\\|\\|\xi_{i}+\left\langle X_{i},M\right\rangle\operatorname{mat}\left(\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\right)-M\\|\right\\|_{\Psi_{1}}$
	$\displaystyle\leq\left\\|\xi_{i}+\left\langle X_{i},M\right\rangle\right\\|_{\Psi_{2}}\left\\|\\|\operatorname{mat}\left(\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\right)\\|\right\\|_{\Psi_{2}}\leq c_{0}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right),$

for some absolute constant $c_{0}>0$ . Therefore, for some absolute constant $C_{3}>0$ , with probability at least $1-n^{-10}$ ,

\left\|\operatorname{mat}(\Lambda_{i}^{-1}\operatorname{vec}(X_{i}))\left(\left<X_{i},M\right>+\xi_{i}\right)\right\|\leq C_{3}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\log n.

Taking maximum over $n$ , with probability at least $1-n^{-9}$

\displaystyle\max_{i\in[n]}\big{\|}\Delta-\Delta^{(i)}\big{\|}\leq C_{3}\cdot n^{-1}\sqrt{C_{l}^{-1}}\left(\sqrt{C_{u}r}\sigma_{1}+\sigma_{\xi}\right)\log n.

In (S.1), we have already shown that that for some absolute constant $C_{1}>0$ ,

\|\Delta\|=\|\widehat{L}-M\|\leq C_{1}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}},

(S.24)

with probability at least $1-(d_{1}+d_{2})^{-10}$ . Note that for all $i\in[n]$ , $\|\Delta^{(i)}\|=\|\Delta-(\Delta-\Delta^{(i)})\|\leq\|\Delta\|+\|\Delta-\Delta^{(i)}\|,$ and thus

\|\Delta\|+\max_{i\in[n]}\|\Delta^{(i)}\|\leq 2\|\Delta\|+\max_{i\in[n]}\|\Delta-\Delta^{(i)}\|.

As long as the sample size $n\geq\frac{\log^{2}n}{(d_{1}\vee d_{2})\log(d_{1}+d_{2})},$ there exists an absolute constant $C_{0}>0$ such that

\|\Delta\|+\max_{i\in[n]}\|\Delta^{(i)}\|\leq C_{0}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}},

with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}$ .

E.5 Proof of Lemma 6

By (Pajor, 1998, Proposition 8) and (Koltchinskii and Xia, 2015, Lemma 5), for any $q\in[1,\infty]$ , there exists an absolute constant $c^{\prime}>0$ and a subset $\mathcal{S}_{q}^{(d-r)}\subset\mathbb{O}_{d-r,r}$ such that for any $V_{i}\neq V_{j}\in\mathcal{S}_{q}^{(d-r)}$ , $\|V_{i}V_{i}^{\top}-V_{j}V_{j}^{\top}\|_{q}\geq c^{\prime}r^{1/q}$ , and the cardinality of $\mathcal{S}_{q}^{(d-r)}$ is at least $2^{r(d-r)}$ . Here, $\|\cdot\|_{q}$ denotes the Schatten- $q$ norm of a matrix. In particular, spectral norm is Schatten- $\infty$ norm, Frobenius norm is Schatten- $2$ norm, and nuclear norm is Schatten- $1$ norm. Let $\varepsilon_{0}>0$ be a small number to be decided later. Now, for each $V\in\mathcal{S}_{q}^{(d-r)}$ , we define

U=\left(\begin{array}[]{c}\sqrt{1-\varepsilon_{0}^{2}}I_{r}\\ \sqrt{\varepsilon_{0}^{2}}V\end{array}\right)

such that $U\in\mathbb{R}^{d\times r}$ and $U^{\top}U=I_{r}$ . This means that, for any $V\in\mathcal{S}_{q}^{(d-r)}$ , we can construct a $U\in\mathbb{O}_{d,r}$ . This defines a subset $\mathcal{S}_{q}^{(d)}\subset\mathbb{O}_{d,r}$ with ${\rm Card}\big{(}\mathcal{S}_{q}^{(d)}\big{)}\geq 2^{r(d-r)}$ such that for any $U_{i}\neq U_{j}\in\mathcal{S}_{q}^{(d)}$ ,

\displaystyle\|U_{i}U_{i}^{\top}-U_{j}U_{j}^{\top}\|_{q}\geq\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}\|V_{i}-V_{j}\|_{q}\gtrsim\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}\|V_{i}V_{i}^{\top}-V_{j}V_{j}^{\top}\|_{q}\gtrsim\sqrt{\varepsilon_{0}^{2}(1-\varepsilon_{0}^{2})}r^{1/q}

and, meanwhile,

\|U_{i}U_{i}^{\top}-U_{j}U_{j}^{\top}\|_{\rm F}\lesssim\|U_{i}-U_{j}\|_{\rm F}\leq\varepsilon_{0}\|V_{i}-V_{j}\|_{\rm F}\leq\sqrt{2r}\varepsilon_{0}.

E.6 Proof of Lemma 7, 8 and 9

See the proof of Lemma 7 in Vershynin (2018), Lemma 8 in Shen et al. (2023) and Lemma 9 in Wei et al. (2016) and Luo and Zhang (2022).

E.7 Proof of Lemma 10

Since $Z_{i}^{\prime}$ is independent of $z_{i}$ and $\mathbb{E}\,\mathcal{S}_{M}(z_{i})=\mathbb{E}\,\nabla_{M}f_{M}(y_{i}|X_{i})=0$ ,

\displaystyle\mathbb{E}\,\mathcal{A}^{1}_{M}(z_{i},A(Z_{i}^{\prime}))=\mathbb{E}\left<\left[A(Z_{i}^{\prime})-M\right]_{[d_{1}]\times[r]},\mathcal{S}_{M}(z_{i})\right>=\left<\mathbb{E}\left[A(Z_{i}^{\prime})-M\right]_{[d_{1}]\times[r]},\mathbb{E}\,\mathcal{S}_{M}(z_{i})\right>=0,

As for $\mathbb{E}A_{i}=\mathbb{E}\,\mathcal{A}^{1}_{M}(z_{i},A(Z))$ , we apply Jensen’s inequality and have

		$\displaystyle\mathbb{E}\left\|\mathcal{A}^{1}_{M}(z_{i},A(Z_{i}^{\prime}))\right\|\leq\sqrt{\mathbb{E}\left\|\mathcal{A}^{1}_{M}(z_{i},A(Z_{i}^{\prime}))\right\|^{2}}$		(S.25)
		$\displaystyle\leq\sqrt{\mathbb{E}\operatorname{vec}\left(\left[A(Z_{i}^{\prime})-M\right]_{[d_{1}]\times[r]}\right)^{\top}\operatorname{vec}(\mathcal{S}_{M}(z_{i}))\operatorname{vec}(\mathcal{S}_{M}(z_{i}))^{\top}\operatorname{vec}\left(\left[A(Z_{i}^{\prime})-M\right]_{[d_{1}]\times[r]}\right)}$
		$\displaystyle\leq\sqrt{\left\\|\mathbb{E}\operatorname{vec}(\mathcal{S}_{M}(z_{i}))\operatorname{vec}(\mathcal{S}_{M}(z_{i}))^{\top}\right\\|}\cdot\sqrt{\mathbb{E}\left\\|\left[A(Z_{i}^{\prime})-M\right]_{[d_{1}]\times[r]}\right\\|_{F}^{2}},$

where the second line is due to $\left<B,C\right>=\operatorname{vec}(B)^{\top}\operatorname{vec}(C)$ and the last inequality is because $Z_{i}^{\prime}$ is independent of $z_{i}$ . By the definition of $\mathcal{S}_{M}(z_{i})=\frac{1}{\sigma_{\xi}^{2}}(y_{i}-\left<X_{i},M\right>)X_{i}$ and the independence between $\xi_{i}$ and $X_{i}$ ,

\displaystyle\left\|\mathbb{E}\operatorname{vec}(\mathcal{S}_{M}(z_{i}))\operatorname{vec}(\mathcal{S}_{M}(z_{i}))^{\top}\right\|=\left\|\mathbb{E}\left(\frac{y_{i}-\left<X_{i},M\right>}{\sigma_{\xi}^{2}}\right)^{2}\mathbb{E}\operatorname{vec}\left(X_{i}\right)\operatorname{vec}\left(X_{i}\right)^{\top}\right\|=\frac{1}{\sigma_{\xi}^{2}}\|\Lambda_{i}\|\leq\frac{C_{u}}{\sigma_{\xi}^{2}}.

Plugging the upper bound of $\left\|\mathbb{E}\operatorname{vec}(\mathcal{S}_{M}(z_{i}))\operatorname{vec}(\mathcal{S}_{M}(z_{i}))^{\top}\right\|$ into (S.25),

\displaystyle\mathbb{E}\left|\mathcal{A}^{1}_{M}(z_{i},A(Z_{i}^{\prime}))\right|\leq\sqrt{\mathbb{E}\left\|A(Z)-M\right\|^{2}_{F}}\sqrt{\frac{C_{u}}{\sigma_{\xi}^{2}}},

E.8 Proof of Lemma 11, Proof of Lemma 12, Lemma 13

Lemma 11 is a trivial consequence by setting $T=\sqrt{2/\sigma_{\xi}^{2}}rd_{1}\sqrt{\log(\frac{1}{\delta})}$ to Proposition $2.1$ , Cai et al. (2023). Lemma 12 is a trivial consequence of Theorem 2.1, Cai et al. (2023) along with the definition of $\mathcal{A}_{M}^{1}\left(z_{i},A(Z)\right)$ . Lemma 13 is a trivial consequence of Proposition $2.2$ , Cai et al. (2023) by taking $M_{ij}\sim\mathcal{N}(0,1)$ for $(i,j)\in[d_{1}]\times[r]$ and $M_{ij}=0$ otherwise.

E.9 Proof of Lemma 14

See the proof of Lemma 14 in Xia (2021).

Appendix F Weak Differential privacy

This section proposes a weaker definition than differential privacy such that the sensitivities are free of $\{X_{i}\}_{i\in[n]}$ .

Definition 2 (weak $(\varepsilon,\delta)$ -differential privacy).

Let $Z$ be a given data set and $Z^{\prime}$ be a weak neighbouring data set of $Z$ , i.e., $Z$ and $Z^{\prime}$ differs by at most one pair of observations $z\in Z$ and $z^{\prime}\in Z^{\prime}$ sharing the same measurement $X$ . The algorithm $A$ that maps $Z$ into $\mathbb{R}^{d_{1}\times d_{2}}$ is weak $(\varepsilon,\delta)$ -differentially private over the dataset $Z$ if

\mathbb{P}\big{(}A(Z)\in\mathcal{Q}\big{)}\leq e^{\varepsilon}\mathbb{P}\big{(}A(Z^{\prime})\in\mathcal{Q}\big{)}+\delta,

(S.26)

for all weak neighbouring data set $Z,Z^{\prime}$ and all subset $\mathcal{Q}\subset\mathbb{R}^{d_{1}\times d_{2}}$ .

Compared to the standard $(\varepsilon,\delta)$ -DP, weak $(\varepsilon,\delta)$ -differential privacy is a less powerful constraint. Definition 2 only requires the algorithm $A$ to preserve the property (S.26) over weak neighbouring datasets, i.e., datasets that differs by at most one pair of observations sharing the same measurement $X$ . As we consider a pair of observations $z=(X,y)$ and $z^{\prime}=(X,y^{\prime})$ under the model (1), where $y=\left<X,M\right>+\xi\quad{\rm and}\quad y^{\prime}=\left<X,M\right>+\xi^{\prime},$ the difference $y-y^{\prime}=\xi-\xi^{\prime}$ is free of the measurement $X$ .

Next, we list the Theorem 6, Corollary 2 and Theorem 7 as the analogues of Theorem 1, Corollary 1 and Theorem 3. All proofs for this section are deferred to the end of this section.

Theorem 6 (Weak DP and utility guarantees of the initialization $\widetilde{M}_{0}$ ).

Consider i.i.d. observations $Z=\{z_{1},\cdots,z_{n}\}$ drawn from the trace regression model stated in $(\ref{equ: trace_regression_model})$ where $z_{i}:=(X_{i},y_{i})$ for $i=1,\cdots,n$ . Let the true low-rank regression coefficients matrix being $M\in\mathbb{M}_{r}$ . Suppose that $\{X_{i}\}_{i\in[n]}$ satisfy the Assumption 1. Under the mild condition $n\geq\frac{\sigma_{\xi}}{\sigma_{\xi}+\sqrt{C_{u}r}\sigma_{1}}$ , there exists absolute constants $C_{1},C_{2},C_{3}>0$ such that as the sample size $n\geq n_{0}$ , the sensitivity for leading $r$ left and right singular vectors takes the value

\displaystyle\Delta_{weak}^{(1)}

\displaystyle:=\max_{i\in[n]}\left(\|\widehat{U}\widehat{U}^{\top}-\widehat{U}^{(i)}\widehat{U}^{(i)\top}\|_{F}\vee\|\widehat{V}\widehat{V}^{\top}-\widehat{V}^{(i)}\widehat{V}^{(i)\top}\|_{F}\right)=C_{2}\sqrt{C_{l}^{-1}}\frac{\sigma_{\xi}}{\sigma_{r}}\frac{\sqrt{r}}{n}\log n;

the sensitivity for the $r$ singular values takes the value

\displaystyle\Delta_{weak}^{(2)}

\displaystyle:=\max_{i\in[n]}\left\|\widetilde{U}^{\top}\left(\widehat{L}-\widehat{L}^{(i)}\right)\widetilde{V}\right\|_{F}=C_{2}\sqrt{C_{l}^{-1}}\sigma_{\xi}\frac{\sqrt{r}}{n}\log n,

and Algorithm 1 is weak $(\varepsilon,\delta)$ -differentially private. Moreover,

\displaystyle\|\widetilde{M}_{0}^{weak}-M\|\bigvee\left(\|\widetilde{M}_{0}^{weak}-M\|_{F}/\sqrt{2r}\right)

\displaystyle\leq e_{1}+\underbrace{C_{3}\sqrt{C_{l}^{-1}}\sigma_{\xi}\left(\frac{\sigma_{1}}{\sigma_{r}}\frac{\sqrt{r(d_{1}\vee d_{2})}}{n\varepsilon}+\frac{r}{n\varepsilon}\right)\log n\log^{\frac{1}{2}}(\frac{3.75}{\delta})}_{e^{weak}_{2}},

with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}-\exp(-d_{1})-\exp(-d_{2})-10^{-20r}$ .

Theorem 6 requires the same sample size condition $n\geq n_{0}$ as Theorem 1, however, the sensitivities $\Delta_{weak}^{(1)}$ and $\Delta_{weak}^{(2)}$ derived under weak DP, differs with their DP counterpart $\Delta^{(1)}$ and $\Delta^{(2)}$ by the factor $\sqrt{C_{u}r}\sigma_{1}$ . This leads to a smaller cost of privacy $e^{weak}_{2}$ than the cost of privacy $e_{2}$ we obtained under stronger standard DP-constraints, as presented in Theorem 1.

Corollary 2.

Under the conditions stated in Theorem 6, as the sample size is sufficiently large such that for some absolute constant $c_{2}>0$ ,

\displaystyle n\geq C_{1}\max\Bigg{\{}n_{1},\underbrace{\sqrt{C_{l}^{-1}}\left(\frac{\sigma_{\xi}}{\sigma_{r}}\right)\left(\kappa r\sqrt{d_{1}\vee d_{2}}+r^{\frac{3}{2}}\right)\log n\frac{\log^{\frac{1}{2}}(\frac{3.75}{\delta})}{\varepsilon}}_{n_{2}^{weak}}\Bigg{\}},

we have for some small constant $0<c_{0}<1$ , $\|\widetilde{M}_{0}-M\|_{F}\leq\sqrt{2r}\|\widetilde{M}_{0}-M\|\leq c_{0}\sigma_{r}.$

Compared with Corollary 1, Corollary 2 requires smaller sample size as $n_{2}^{weak}\leq n_{2}$ .

Theorem 7.

Consider i.i.d. observations $Z=\{z_{1},\cdots,z_{n}\}$ drawn from the trace regression model stated in $(\ref{equ: trace_regression_model})$ where the true low-rank regression coefficients matrix being $M\in\mathbb{M}_{r}$ . Here, $z_{i}:=(X_{i},y_{i})$ for $i=1,\cdots,n$ and we assume that $\{X_{i}\}_{i\in[n]}$ satisfy the Assumption 1 and $(d_{1}+d_{2})>\log n$ . Suppose the weak $(\varepsilon,\delta)$ -DP initialization satisfies 2, then Algorithm 2 is weak $(2\varepsilon,2\delta)$ -differentially private with the sensitivities

\displaystyle\Delta_{l}

\displaystyle=C_{3}\frac{\eta}{n}\sigma_{\xi}\sqrt{C_{u}r(d_{1}+d_{2})\log n},

for some absolute constant $C_{3}>0$ . Moreover, as the sample size

\displaystyle n\geq c_{4}\max\Bigg{\{}n_{3},n_{4},\underbrace{\eta\sqrt{C_{u}}\kappa_{\xi}r(d_{1}+d_{2})\log^{3/2}(n)\frac{\log^{1/2}\left(\frac{1.25\log(n)}{\delta}\right)}{\varepsilon}}_{n_{5}^{weak}}\Bigg{\}},

for some small constant $0<c_{4}<1$ , number of iteration $l^{*}=O(\log n)$ , and the step size $0<\eta<1$ , we have the output of Algorithm 2 satisfies

\displaystyle\left\|\widetilde{M}_{l^{*}}-M\right\|_{F}

\displaystyle\leq u_{1}+\underbrace{C_{4}\sqrt{C_{u}}\sigma_{\xi}\frac{r(d_{1}+d_{2})}{n\varepsilon}\log^{3/2}n\log^{1/2}\left(\frac{1.25\log(n)}{\delta}\right)}_{u_{2}^{weak}}.

with probability at least

	$\displaystyle 1$	$\displaystyle-\widetilde{c}_{2}\exp\left(-\widetilde{c}_{3}r(d_{1}+d_{2})\right)-(d_{1}+d_{2})^{-10}-n^{-9}-e^{-d_{1}}-e^{-d_{2}}-10^{-20r}$
		$\displaystyle-\left((d_{1}+d_{2})^{-10}+\exp(-(d_{1}+d_{2}))+n^{-9}+\exp\left(-10C_{u}(d_{1}+d_{2})\right)n^{-9}\right)\log n.$

Theorem 7 shows that as the sample size $n\gtrsim\widetilde{O}\left(\left(\kappa_{\xi}^{2}\vee\kappa_{\xi}\right)r(d_{1}\vee d_{2})\right),$ the estimator $\widetilde{M}_{l^{*}}$ given by Algorithm 2 attains the optimal convergence rate $\widetilde{O}_{p}\left(\sigma_{\xi}\sqrt{\frac{r(d_{1}+d_{2})}{n}}+\sigma_{\xi}\frac{r(d_{1}+d_{2})}{n\varepsilon}\right),$ in the sense of weak differential privacy.

The proofs of Theorem 6, 7 and Corollary 2 will be a trivial concequence of replacing the first part of Lemma 5 by the following Lemma 15

Lemma 15.

Under model (1), Assumption 1, and the condition $n\geq\frac{\sigma_{\xi}}{\sigma_{\xi}+\sqrt{C_{u}r}\sigma_{1}}$ , there exists some absolute constant $C_{0},C_{1}>0$ such that the event

	$\displaystyle\mathcal{E}_{*}:=$	$\displaystyle\Bigg{\{}\max_{i\in[n]}\big{\\|}\Delta-\Delta^{(i)}\big{\\|}\leq C_{0}\cdot n^{-1}\sqrt{C_{l}^{-1}}\sigma_{\xi}\log n\Bigg{\}}$
		$\displaystyle\bigcap\Bigg{\{}\\|\Delta\\|+\max_{i\in[n]}\\|\Delta^{(i)}\\|\leq C_{0}\sqrt{C_{l}^{-1}}\left(\sigma_{\xi}+\sqrt{C_{u}}\sqrt{r}\sigma_{1}\right)\sqrt{\frac{(d_{1}\vee d_{2})\log(d_{1}+d_{2})}{n}}\Bigg{\}},$

holds with probability at least $1-(d_{1}+d_{2})^{-10}-n^{-9}$ .

Proof of Lemma 15.

We only need to focus on $\max_{i\in[n]}\big{\|}\Delta-\Delta^{(i)}\big{\|}$ since the rest of the proof is the same as Lemma 5.

\displaystyle\max_{i\in[n]}\big{\|}\Delta-\Delta^{(i)}\big{\|}\leq\max_{i\in[n]}\frac{1}{n}\left\|\operatorname{mat}(\Lambda_{i}^{-1}\operatorname{vec}(X_{i}))\left(\xi_{i}-\xi_{i}^{\prime}\right)\right\|,

where $\|\xi_{i}\|_{\psi_{2}}=\|\xi_{i}^{\prime}\|_{\psi_{2}}=\sigma_{\xi}$ and $\Lambda_{i}^{-1}\operatorname{vec}\left(X_{i}\right)\sim N\left(0,\Lambda_{i}^{-1}\right)$ for all $i=1,\cdots,n$ . Therefore, for some absolute constant $c_{0}>0$ ,

\displaystyle\left\|\left\|\operatorname{mat}(\Lambda_{i}^{-1}\operatorname{vec}(X_{i}))\left(\xi_{i}-\xi_{i}^{\prime}\right)\right\|\right\|_{\Psi_{1}}\leq c_{0}\sqrt{C_{l}^{-1}}\sigma_{\xi}.

We complete the proof by appying tail bound for sub-exponential random variable and taking a maximum over $n$ . ∎

References

Abowd et al. (2020) Abowd, J. M., I. M. Rodriguez, W. N. Sexton, P. E. Singer, and L. Vilhuber (2020). The modernization of statistical disclosure limitation at the us census bureau. US Census Bureau.
Absil et al. (2008) Absil, P.-A., R. Mahony, and R. Sepulchre (2008). Optimization Algorithms on Matrix Manifolds. Princeton, NJ: Princeton University Press.
Acharya et al. (2021) Acharya, J., Z. Sun, and H. Zhang (2021). Differentially private assouad, fano, and le cam. In Algorithmic Learning Theory, pp. 48–78. PMLR.
Adler et al. (2002) Adler, R. L., J. Dedieu, J. Y. Margulies, M. Martens, and M. Shub (2002, 07). Newton’s method on Riemannian manifolds and a geometric model for the human spine. IMA Journal of Numerical Analysis 22(3), 359–390.
Apple Differential Privacy Team (2017) Apple Differential Privacy Team (2017). Learning with privacy at scale.
Blum et al. (2005) Blum, A., C. Dwork, F. McSherry, and K. Nissim (2005, 06). Practical privacy: The sulq framework. Proceedings of the ACM SIGACT-SIGMOD-SIGART Symposium on Principles of Database Systems, 128–138.
Brown et al. (2023) Brown, G., S. Hopkins, and A. Smith (2023, 12–15 Jul). Fast, sample-efficient, affine-invariant private mean and covariance estimation for subgaussian distributions. In G. Neu and L. Rosasco (Eds.), Proceedings of Thirty Sixth Conference on Learning Theory, Volume 195 of Proceedings of Machine Learning Research, pp. 5578–5579. PMLR.
Burer and Monteiro (2003) Burer, S. and R. D. Monteiro (2003). A nonlinear programming algorithm for solving semidefinite programs via low-rank factorization. Mathematical Programming 95(2), 329–357.
Cai et al. (2021) Cai, T. T., Y. Wang, and L. Zhang (2021). The cost of privacy: Optimal rates of convergence for parameter estimation with differential privacy. The Annals of Statistics 49, 2825–2850.
Cai et al. (2023) Cai, T. T., Y. Wang, and L. Zhang (2023). Score attack: A lower bound technique for optimal differentially private learning. arXiv preprint arXiv:2303.07152.
Cai et al. (2024) Cai, T. T., D. Xia, and M. Zha (2024). Optimal differentially private pca and estimation for spiked covariance matrices. arXiv preprint arXiv:2401.03820.
Candes and Plan (2011) Candes, E. J. and Y. Plan (2011). Tight oracle inequalities for low-rank matrix recovery from a minimal number of noisy random measurements. IEEE Transactions on Information Theory 57(4), 2342–2359.
Candes and Tao (2005) Candes, E. J. and T. Tao (2005). Decoding by linear programming. IEEE transactions on information theory 51(12), 4203–4215.
Chaudhuri et al. (2012) Chaudhuri, K., A. Sarwate, and K. Sinha (2012). Near-optimal differentially private principal components. Advances in Neural Information Processing Systems 25.
Chen et al. (2019) Chen, H., G. Raskutti, and M. Yuan (2019). Non-convex projected gradient descent for generalized low-rank tensor regression. The Journal of Machine Learning Research 20(1), 172–208.
Chen and Wainwright (2015) Chen, Y. and M. J. Wainwright (2015). Fast low-rank estimation by projected gradient descent: General statistical and algorithmic guarantees.
Chien et al. (2021) Chien, S., P. Jain, W. Krichene, S. Rendle, S. Song, A. Thakurta, and L. Zhang (2021). Private alternating least squares: Practical private matrix completion with tighter rates. pp. 1877–1887.
Dwork et al. (2006) Dwork, C., F. McSherry, K. Nissim, and A. Smith (2006). Calibrating noise to sensitivity in private data analysis. Theory of Cryptography Conference, 265–284.
Dwork et al. (2014) Dwork, C., A. Roth, et al. (2014). The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science 9(3–4), 211–407.
Dwork et al. (2014) Dwork, C., K. Talwar, A. Thakurta, and L. Zhang (2014). Analyze gauss: optimal bounds for privacy-preserving principal component analysis. Proceedings of the forty-sixth annual ACM symposium on Theory of computing, 11–20.
Edelman et al. (1998) Edelman, A., T. A. Arias, and S. T. Smith (1998). The geometry of algorithms with orthogonality constraints. SIAM journal on Matrix Analysis and Applications 20(2), 303–353.
Erlingsson et al. (2014) Erlingsson, U., V. Pihur, and A. Korolova (2014). Rappor: Randomized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS ’14, New York, NY, USA, pp. 1054–1067. Association for Computing Machinery.
Hamidi and Bayati (2022) Hamidi, N. and M. Bayati (2022). On low-rank trace regression under general sampling distribution. Journal of Machine Learning Research 23(321), 1–49.
Jain et al. (2018) Jain, P., O. D. Thakkar, and A. Thakurta (2018). Differentially private matrix completion revisited. pp. 2215–2224.
Kamath et al. (2019) Kamath, G., J. Li, V. Singhal, and J. Ullman (2019). Privately learning high-dimensional distributions. In Conference on Learning Theory, pp. 1853–1902. PMLR.
Kamath et al. (2020) Kamath, G., V. Singhal, and J. Ullman (2020, 09–12 Jul). Private mean estimation of heavy-tailed distributions. In J. Abernethy and S. Agarwal (Eds.), Proceedings of Thirty Third Conference on Learning Theory, Volume 125 of Proceedings of Machine Learning Research, pp. 2204–2235. PMLR.
Koltchinskii (2011) Koltchinskii, V. (2011). Von neumann entropy penalization and low-rank matrix estimation.
Koltchinskii et al. (2011) Koltchinskii, V., K. Lounici, and A. B. Tsybakov (2011). Nuclear-norm penalization and optimal rates for noisy low-rank matrix completion.
Koltchinskii and Xia (2015) Koltchinskii, V. and D. Xia (2015). Optimal estimation of low rank density matrices. J. Mach. Learn. Res. 16(53), 1757–1792.
Kuditipudi et al. (2023) Kuditipudi, R., J. Duchi, and S. Haque (2023, 12–15 Jul). A pretty fast algorithm for adaptive private mean estimation. In G. Neu and L. Rosasco (Eds.), Proceedings of Thirty Sixth Conference on Learning Theory, Volume 195 of Proceedings of Machine Learning Research, pp. 2511–2551. PMLR.
Liu et al. (2022) Liu, X., W. Kong, P. Jain, and S. Oh (2022). Dp-pca: Statistically optimal and differentially private pca. Advances in Neural Information Processing Systems 35, 29929–29943.
Liu et al. (2015) Liu, Z., Y.-X. Wang, and A. Smola (2015). Fast differentially private matrix factorization. In Proceedings of the 9th ACM Conference on Recommender Systems, pp. 171–178.
Luo and Zhang (2022) Luo, Y. and A. R. Zhang (2022). Tensor-on-tensor regression: Riemannian optimization, over-parameterization, statistical-computational gap, and their interplay. arXiv preprint arXiv:2206.08756.
McSherry and Mironov (2009) McSherry, F. and I. Mironov (2009). Differentially private recommender systems: Building privacy into the netflix prize contenders. In Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 627–636.
Negahban and Wainwright (2011) Negahban, S. and M. J. Wainwright (2011). Estimation of (near) low-rank matrices with noise and high-dimensional scaling.
Pajor (1998) Pajor, A. (1998). Metric entropy of the grassmann manifold. Convex Geometric Analysis 34(181-188), 0942–46013.
Rohde and Tsybakov (2011) Rohde, A. and A. B. Tsybakov (2011). Estimation of high-dimensional low-rank matrices.
Shen et al. (2023) Shen, Y., J. Li, J.-F. Cai, and D. Xia (2023). Computationally efficient and statistically optimal robust high-dimensional linear regression. arXiv preprint arXiv:2305.06199.
Tropp et al. (2015) Tropp, J. A. et al. (2015). An introduction to matrix concentration inequalities. Foundations and Trends® in Machine Learning 8(1-2), 1–230.
Vadhan (2017) Vadhan, S. (2017). The complexity of differential privacy. Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich, 347–450.
Vandereycken (2013) Vandereycken, B. (2013). Low-rank matrix completion by riemannian optimization. SIAM Journal on Optimization 23(2), 1214–1236.
Vershynin (2015) Vershynin, R. (2015). Estimation in high dimensions: a geometric perspective. In Sampling Theory, a Renaissance: Compressive Sensing and Other Developments, pp. 3–66. Springer.
Vershynin (2018) Vershynin, R. (2018). High-dimensional probability: An introduction with applications in data science, Volume 47. Cambridge university press.
Wang et al. (2023) Wang, L., B. Zhao, and M. Kolar (2023, 25–27 Apr). Differentially private matrix completion through low-rank matrix factorization. 206, 5731–5748.
Wang (2018) Wang, Y.-X. (2018). Revisiting differentially private linear regression: optimal and adaptive prediction and estimation in unbounded domain. In UAI 2018.
Wei et al. (2016) Wei, K., J.-F. Cai, T. F. Chan, and S. Leung (2016). Guarantees of riemannian optimization for low rank matrix recovery. SIAM Journal on Matrix Analysis and Applications 37(3), 1198–1222.
Xia (2021) Xia, D. (2021). Normal approximation and confidence region of singular subspaces. Electronic Journal of Statistics 15(2), 3798–3851.
Zheng and Lafferty (2016) Zheng, Q. and J. Lafferty (2016). A convergent gradient descent algorithm for rank minimization and semidefinite programming from random linear measurements.

	$\displaystyle\left\\|\operatorname{SVD}_{r}(\widehat{M})-M\right\\|$	$\displaystyle\leq\\|\widehat{M}-M\\|+40\frac{\\|\widehat{M}-M\\|^{2}}{\sigma_{r}},$
	$\displaystyle\left\\|\operatorname{SVD}_{r}(\widehat{M})-M\right\\|_{\mathrm{F}}$	$\displaystyle\leq\\|\widehat{M}-M\\|_{\mathrm{F}}+40\frac{\\|\widehat{M}-M\\|\\|\widehat{M}-M\\|_{\mathrm{F}}}{\sigma_{r}},$

		$\displaystyle\max_{i\in[n]}\sum_{k\geq 2}\binom{2k}{k}\sum_{l\in[k]}\left\\|\mathcal{T}_{M_{},k,\mathbf{s},l}\left(\Delta_{}-\Delta_{*}^{(i)}\right)\right\\|_{\mathrm{F}}$		(S.6)
		$\displaystyle\leq\max_{i\in[n]}\binom{4}{2}\sum_{k\geq 0}5^{k}\left(\frac{\\|D_{\max}\\|}{\sigma_{r}}\right)^{k}\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|\left(\frac{D_{\max}}{\sigma_{r}}\right)$
		$\displaystyle\leq\max_{i\in[n]}a(2)\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|\sum_{k\geq 0}\left(\frac{5}{5+\delta}\right)^{k}\left(\frac{D_{\max}}{\sigma_{r}}\right)$
		$\displaystyle\leq\max_{i\in[n]}a(2)\left(\frac{5+\delta}{\delta}\right)\left(\frac{D_{\max}}{\sigma_{r}}\right)\frac{\sqrt{2r}}{\sigma_{r}}\left\\|\Delta_{}-\Delta_{}^{(i)}\right\\|,$

		$\displaystyle\left\\|\widetilde{U}(\widetilde{U}^{\top}\widehat{L}\widetilde{V}+E_{\Sigma})\widetilde{V}^{\top}-UU^{\top}MVV^{\top}\right\\|\leq\left\\|\widetilde{U}\widetilde{U}^{\top}\widehat{L}\widetilde{V}\widetilde{V}^{\top}-UU^{\top}MVV^{\top}\right\\|+\left\\|\widetilde{U}E_{\Sigma}\widetilde{V}^{\top}\right\\|$		(S.10)
		$\displaystyle\leq\left\\|\left(\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right)\widehat{L}\widetilde{V}\widetilde{V}^{\top}\right\\|+\left\\|UU^{\top}\left(\widehat{L}-M\right)\widetilde{V}\widetilde{V}^{\top}\right\\|+\left\\|UU^{\top}M\left(\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right)\right\\|+\left\\|\widetilde{U}E_{\Sigma}\widetilde{V}^{\top}\right\\|$
		$\displaystyle\leq\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|\widehat{L}\right\\|+\left\\|\widehat{L}-M\right\\|+\\|M\\|\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|E_{\Sigma}\right\\|$
		$\displaystyle\leq\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|\widehat{L}-M\right\\|+\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\left\\|M\right\\|+\left\\|\widehat{L}-M\right\\|+\\|M\\|\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|E_{\Sigma}\right\\|$
		$\displaystyle\leq 2\left\\|\widehat{L}-M\right\\|+\\|M\\|\left(\left\\|\widetilde{V}\widetilde{V}^{\top}-VV^{\top}\right\\|+\left\\|\widetilde{U}\widetilde{U}^{\top}-UU^{\top}\right\\|\right)+\left\\|E_{\Sigma}\right\\|,$

	$\displaystyle\operatorname{KL}\left(f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\\|f_{M_{}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})\right)$
	$\displaystyle=\mathbb{E}_{f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}\left[\log\frac{f_{M_{}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}{f_{M_{*}^{\prime}}(\bar{y}_{i},X_{i},X_{i}^{\prime})}\right]$
	$\displaystyle=\mathbb{E}_{X_{i},X_{i}^{\prime}}\mathbb{E}_{f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})}\left[-\frac{\left(\bar{y}_{i}-\left<\left(\begin{array}[]{cc}0&M\\ M^{\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\right)^{2}}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle\quad+\mathbb{E}_{X_{i},X_{i}^{\prime}}\mathbb{E}_{f_{M_{*}}(\bar{y}_{i}\mid X_{i},X_{i}^{\prime})}\left[-\frac{\left(\bar{y}_{i}-\left<\left(\begin{array}[]{cc}0&M^{\prime}\\ M^{\prime\top}&0\end{array}\right),\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\right)^{2}}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle=\mathbb{E}_{X_{i},X_{i}^{\prime}}\left[\frac{\left<M_{}-M_{}^{\prime},\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>\cdot\left<M_{}-M_{}^{\prime},\left(\begin{array}[]{cc}0&X_{i}\\ X_{i}^{\prime\top}&0\end{array}\right)\right>}{4\sigma_{\xi}^{2}}\right]$
	$\displaystyle\lesssim\frac{1}{\sigma_{\xi}^{2}}C_{u}\\|M_{}-M_{}^{\prime}\\|_{F}^{2}\lesssim\frac{1}{\sigma_{\xi}^{2}}C_{u}\sigma^{2}r\varepsilon_{0}^{2},$

	$\displaystyle\left\\|\mathcal{P}_{\mathbb{T}_{l}}\left(\left<X_{i},M_{l}\right>-y_{i}\right)X_{i}\right\\|_{F}$	$\displaystyle\leq\left\|\left<X_{i},M_{l}-M\right>-\xi_{i}\right\|\left\\|\mathcal{P}_{\mathbb{T}_{l}}X_{i}\right\\|_{F}$		(S.12)
		$\displaystyle\leq\left(\|\xi_{i}\|+\left\|\left<X_{i},M_{l}-M\right>\right\|\right)\sqrt{2r}\left\\|X_{i}\right\\|.$		(S.12)

Near-Optimal differentially private low-rank trace regression with guaranteed private initialization

Abstract

1 Introduction

Trace regression model

Sensitivity

Differential privacy

Gaussian mechanism

RIP of Gaussian measurement matrices

Assumption 1 (Gaussian design).

Lemma 1.

Notations

1.1 Main results

1.2 Motivations and related works

1.3 Organization

2 DP-initialization

2.1 Algorithm for DP-initialization

2.2 Spetral representation formula

Symmetric dilation and auxiliary operators

Lemma 2 (Spectral representation formula).

2.3 Privacy and utility guarantees of the initialization

Theorem 1 (Privacy and utility guarantees of the initialization M~0\widetilde{M}_{0}).

Corollary 1.

3 Minimax lower bounds

Lemma 3 (DP-Fano’s lemma, Acharya et al. (2021)).

Theorem 2.

4 Upper bounds with differential privacy

Theorem 3.

5 Discussion

Definition 1 (weak (ε,δ)(\varepsilon,\delta)-differential privacy).

Acknowledgement

Appendix A Proof of Theorem 1

A.1 Part 1

Theorem 4 (Bernstein’s inequality, Koltchinskii (2011)).

Lemma 4 (Matrix Permutation, Shen et al. (2023)).

A.2 Part 2

Lemma 5.

A.3 Part 3

A.4 Part 4

A.5 Proof of Corollary 1

Appendix B Proof of Theorem 2

Lemma 6.

Appendix C Proof of Theorem 3

C.1 Part 1

Lemma 7 (Vershynin (2018)).

Lemma 8 (Shen et al. (2023)).

C.2 Part 2

Lemma 9 (Wei et al. (2016), Luo and Zhang (2022)).

C.3 Part 3

Appendix D The lower bound derived by score attack argument

Theorem 5.

Proof of Theorem 5.

Lemma 10.

Lemma 11.

Lemma 12.

Lemma 13.

Remark 1.

Appendix E Proofs of Technical Lemmas

E.1 Proof of Lemma 1

E.2 Proof of Lemma 2

Lemma 14 (Theorem 1, Xia (2021)).

E.3 Proof of Lemma 3 and 4

E.4 Proof of Lemma 5

E.5 Proof of Lemma 6

E.6 Proof of Lemma 7, 8 and 9

E.7 Proof of Lemma 10

E.8 Proof of Lemma 11, Proof of Lemma 12, Lemma 13

E.9 Proof of Lemma 14

Appendix F Weak Differential privacy

Definition 2 (weak (ε,δ)(\varepsilon,\delta)-differential privacy).

Theorem 6 (Weak DP and utility guarantees of the initialization M~0\widetilde{M}_{0}).

Corollary 2.

Theorem 7.

Lemma 15.

Proof of Lemma 15.

References

Theorem 1 (Privacy and utility guarantees of the initialization $\widetilde{M}_{0}$ ).

Definition 1 (weak $(\varepsilon,\delta)$ -differential privacy).

Definition 2 (weak $(\varepsilon,\delta)$ -differential privacy).

Theorem 6 (Weak DP and utility guarantees of the initialization $\widetilde{M}_{0}$ ).