Label differential privacy via clustering
  We present new mechanisms for \emph{label differential privacy}, a relaxation
of differentially private machine learning that only protects the privacy of
the labels in the training set. Our mechanisms cluster the examples in the
training set using their (non-private) feature vectors, randomly re-sample each
label from examples in the same cluster, and output a training set with noisy
labels as well as a modified version of the true loss function. We prove that
when the clusters are both large and high-quality, the model that minimizes the
modified loss on the noisy training set converges to small excess risk at a
rate that is comparable to the rate for non-private learning. We describe both
a centralized mechanism in which the entire training set is stored by a trusted
curator, and a distributed mechanism where each user stores a single labeled
example and replaces her label with the label of a randomly selected user from
the same cluster. We also describe a learning problem in which large clusters
are necessary to achieve both strong privacy and either good precision or good
recall. Our experiments show that randomizing the labels within each cluster
significantly improves the privacy vs. accuracy trade-off compared to applying
uniform randomized response to the labels, and also compared to learning a
model via DP-SGD.
