The $\epsilon$-error Capacity of Symmetric PIR
with Byzantine Adversaries

We are interested in the problem of symmetric private information retrieval (PIR) with Byzantine adversaries. In symmetric PIR (SPIR), there are $K$ messages, stored over $N$ replicated servers, and a user that wishes to retrieve 1 out of the $K$ messages without revealing the desired message index to any $T$ servers. The user fulfills this PIR task by first sending queries to the servers and then receiving 1 answer from each server. From the $N$ answers, the user decodes the desired message either with exactly zero probability of error or with vanishing probability of error (when the message size approaches infinity). The servers do not allow the user to learn any information beyond the desired message (so that the privacy of the dataset is symmetrically protected). The efficiency of an SPIR protocol is measured by the capacity, $C$, defined as the maximum amount of information retrieved over the total download from the servers (the answer sizes). We consider the presence of Byzantine adversaries in this work. Byzantine adversaries might observe a certain number of communication links (answers) between the servers and the user and modify any $B$ answers. We focus on the interplay between the capability of the adversary (omniscient or limited knowledge) and the error criterion (zero-error or $\epsilon$-error). Among all possible models, the strongest (most restricted) requirement is that the adversary is omniscient (i.e., the adversary has full knowledge and observes all communication between the servers and the user) and the decoding at the user’s side must have exactly zero error¹¹ 1 Note that if we insist on zero error, then it does not matter whether the adversary has full or limited knowledge. The reason is that the adversary may assume an arbitrary realization of the knowledge that he is missing and the probability of guessing the missing knowledge correctly is non-zero. The zero-error decoding constraint requires that decoding error can never occur (including the case when the adversary guesses the full knowledge correctly so that full knowledge case is covered).. We call this problem $\mbox{0-B}_{f}$TSPIR, where the letter $f$ represents full knowledge. The weakest requirement is that the adversary has limited knowledge and the decoding at the user’s side is allowed to have vanishingly small probability of error. We call this problem $\mbox{$\epsilon$-B}_{l}$TSPIR, where the letter $l$ represents limited knowledge. This work is motivated by the following question - when we relax the problem from $\mbox{0-B}_{f}$TSPIR to $\mbox{$\epsilon$-B}_{l}$TSPIR, is it possible to increase the capacity of PIR, because of the presence of a less omnipotent adversary and the requirement of a less stringent decoding criterion?

Before stating our result, we first briefly summarize prior works on capacity results of SPIR and its related variants. The capacity of SPIR with no colluding servers ($T=1$) is characterized in [2],

The intuition is that out of the $N$ answers, 1 answer is useless because it provides no useful information of the desired message. Then we only have $N-1$ effective answers and the ratio (rate) is thus $(N-1)/N$. To see why 1 answer is independent of the desired message, note that the user can not learn anything about undesired messages (data-privacy constraint) so that any 1 answer can not contain any information about undesired messages. Further, because any 1 server does not learn anything about the desired message index (user-privacy constraint), any server can not distinguish desired and undesired messages so that the server’s answer can not contain any information about any message (including the desired one). The generalization of user-privacy from any individual server to any $T$ colluding servers is considered in [3] and the capacity is characterized as

This result could be interpreted intuitively in a similar manner, where any $T$ answers are of no use due to the combination of the $T$-private user-privacy constraint and the data-privacy constraint. The above two capacity results hold under both zero-error and $\epsilon$-error criteria. The presence of a full knowledge Byzantine adversary with zero-error decoding constraint (the $\mbox{0-B}_{f}$TSPIR problem) is considered in [1], and its capacity is characterized as

Compared with the capacity of TSPIR, the capacity expression has an additional term of $2B$ (another $2B$ wasted answers), which could be interpreted as follows. As the Byzantine adversary may modify any $B$ answers, the corrupted answers might have zero information of the desired message so that these $B$ answers can not contribute anything to the decoding (akin to $B$ erasures). It turns out that we have to pay a price of another $B$ answers to identify and correct the $B$ erroneous answers (in total, $2B$ answers). The focus of this work is on the $\mbox{$\epsilon$-B}_{l}$TSPIR problem where the adversary is partially blind and the decoding is allowed to be erroneous occasionally, and we ask if any saving on the $2B$ wasted answers for the Byzantine adversary is possible.

Our main contribution is summarized next. The main result of this work is the capacity characterization of the $\mbox{$\epsilon$-B}_{l}$TSPIR problem. We show that

under two models of Byzantine adversaries with limited knowledge.²² 2 The two adversary models have been studied in the network coding literature [4, 5].

1. 1.

   There exist secret channels (with vanishing rate) between the servers and the user that are not observed by the adversary.

2. 2.

   There exists at least 1 answer that the adversary is not able to observe or corrupt (i.e., the total number of answers observed or corrupted is smaller than $N$).

The interpretation of this capacity result is that as long as we may hide some information to the adversary (we have shown two examples, one with secret channels and one with limited observations) and $\epsilon$-error is allowed, then we can avoid the loss of the $B$ answers that are used to correct the $B$ erroneous answers and the problem with $B$ errors reduces to the problem with $B$ erasures. This is made possible through the hidden information and the allowance of small probability of decoding error. To answer the question that motivates our work, it is not only possible to increase the capacity by weakening the adversary and decoding requirement, but also the price to pay is minimal, i.e., reducing a small amount of knowledge to the omniscient adversary and relaxing zero-error to $\epsilon$-error.

Notation: For variables $X,Y$, $[X\;Y]$ and $[X;Y]$ denote a row vector and a column vector respectively. For integers $n_{1}\leq n_{2}$, $[n_{1}:n_{2}]$ denotes the set $\{n_{1},n_{1}+1,\cdots,n_{2}\}$. For a vector $\mathcal{I}=(i_{1},i_{2},\cdots,i_{n})$, $A_{\mathcal{I}}$ represents the column vector $[A_{i_{1}};A_{i_{2}};\cdots;A_{i_{n}}]$. Denote the $N\times M$ Vandermonde matrix generated from $N$ distinct symbols $\lambda_{1},\lambda_{2},\dots,\lambda_{N}$ from a finite field by $\mathbf{V}^{M}(\lambda_{1},\dots,\lambda_{N})$, where the $(i.j)$-th element is $\lambda_{i}^{j-1}$.

A dataset comprised of $K$ messages is stored over $N$ replicated servers. The messages $\{W_{k}\}$ are independent and each message consists of $L$ i.i.d. symbols from $\mathbb{F}_{q}$, i.e., $H(W_{k})=L,\forall k\in[1:K]$ and $H(W_{1},\dots,W_{K})=KL$. Here and throughout the paper we measure entropy to base $q$.

A user wants to retrieve a message $W_{\kappa}$ from the servers, where the desired message index $\kappa$ is drawn from some prior distribution over $[1:K]$. Denote the realization of $\kappa$ by $k$. Based on $k$, the user generates random queries to send to the servers. The query received by Server $n$ is denoted by $Q_{n}^{[k]}$. Let $\mathcal{Q}=[Q_{n}^{[k]}]_{n\in[1:N],k\in[1:K]}$ denote the complete query scheme, i.e., the collection of all queries under all choices of the desired message index. The queries are independent of the messages.

The servers share a common random variable $S$, the realization of which is unavailable to the user. The common randomness is independent of the messages and queries, i.e., $I(S;W_{[1:K]},\mathcal{Q})=0.$ Let $\rho$ denote the ratio of the amount of common randomness relative to the message size, i.e.,

The servers follow the protocol agreed with the user a priori, and generate answers based on the received query $Q_{n}^{[k]}$, the stored messages $W_{[1:K]}$, and the common random variable $S$. The answer sent to the user from Server $n$ is denoted by $A_{n}^{[k]}$. We have $H(A_{n}^{[k]}|Q_{n}^{[k]},W_{[1:K]},S)=0.$

Any $T$ servers may collude. To guarantee user-privacy, from the queries and answers of any $T$ servers, together with the message contents and the common random variable, the servers should not be able to infer any information about the desired message index. Thus, the following user-privacy constraint must be satisfied,

A Byzantine adversary hidden in the system can observe and jam the communications. We assume that the adversary has unlimited computational power, and knows the encoding and decoding scheme of the user and servers. An omniscient adversary can observe all the communications in the system; a limited knowledge adversary only observes part of the communications. In this work, we assume the adversary has limited knowledge, and can overwrite the answers of any set of servers $\mathcal{B}$ of size $B$ to $\widetilde{A}_{\mathcal{B}}^{[k]}$. Assume that the adversary holds some private randomness $\gamma$ (independent of the messages, queries, answers and the common randomness) that he can use for jamming. Two ways of reducing the observation of the adversary are considered in this work:

Note that the user does not know which answers are corrupted ($\widetilde{A}_{\mathcal{B}}^{[k]}$), and we denote all the answers received by $\widetilde{A}_{[1:N]}^{[k]}=\{\widetilde{A}_{\mathcal{B}}^{[k]},{A}_{[1:N]\setminus\mathcal{B}}^{[k]}\}$. From all the answers (and the information through secret channels) downloaded and other information available to the user, the user should be able to decode the desired message with diminishing probability of error as $L$ tends to infinity. By Fano’s inequality, this corresponds to the following correctness constraint,

where for the untouched server model, $H_{[1:N]}^{[k]}=\varnothing$.

The user should learn no information about the other messages besides the desired one, named the database-privacy constraint. Denote $\{W_{1},\dots,W_{k-1},W_{k+1},\dots,W_{K}\}$ by $W_{\bar{k}}$,

The rate, $R$ of a scheme characterizes the number of desired information symbols retrieved per downloaded symbol³³ 3 We use the uncorrupted answers $\{A_{n}^{[k]}\}$ to define the rate $R$, because there is no motivation for the adversary to change the answer sizes (if so, the user can easily identify the corrupted answers and treat them as erasures)., $R=\frac{L}{\sum_{n=1}^{N}H(A_{n}^{[k]})}.$ A rate $R$ is said to be $\epsilon$-error achievable⁴⁴ 4 In this work, we interpret $\epsilon$ as a term that vanishes (a typical assumption in Shannon theory). Note that this is different from the assumption in strong converse where $\epsilon$ is a fixed positive constant. if there exists a sequence of PIR schemes with rate at least $R$, and probability of error $P_{e}\to 0$ as $L\to\infty$. The supremum of all $\epsilon$-error achievable rates is called the $\epsilon$-error capacity $C$. The problem defined in this section is called $\mbox{$\epsilon$-B}_{l}$TSPIR.

The achievability proof (the main contribution of this work) is presented in the next section. The (weak) converse proof is presented in Section V.

Note that the answers corrupted by the adversary $\widetilde{A}_{\mathcal{B}}^{[k]}$ may be useless to the user for decoding $W_{k}$. Denote the set of uncorrupted nodes by $\mathcal{H}=[1:N]\setminus\mathcal{B}$, from (5),

Further, $I(W_{k};H_{[1:N]}^{[k]}|A_{\mathcal{H}}^{[k]},\mathcal{Q})\leq H(H_{[1:N]}^{[k]})=o(L)$. Then

for any $\mathcal{T}\subset\mathcal{H}$ with $|\mathcal{T}|=T$. Note that from (33), the superscript $[k]$ in $A_{\mathcal{T}}$ can be dropped because of user-privacy (2). By Han’s inequality [6],

Averaging (35) over all subsets $\mathcal{T}$ of $\mathcal{H}$ and combining with (36), we have

By symmetry, we assume the answer sizes are the same. Therefore, $H(W_{k})\leq\frac{N-B-T}{N-B}\cdot\frac{N-B}{N}\sum_{n=1}^{N}H(A_{n}^{[k]}|\mathcal{Q})+o(L)$. By letting $L\to\infty$,

By database-privacy (6),

where (42) holds because the uncorrupted answers are deterministic functions of the queries, the dataset $W_{[1:K]}$, and the randomness $S$. (44) holds because the randomness $S$, the messages $W_{[1:K]}$, and the queries $\mathcal{Q}$ are independent. Combining (46) with (37), and by letting $L\to\infty$,

For symmetric PIR with Byzantine adversaries, we show that if the adversary has limited knowledge and a vanishingly small probability of error is allowed, the capacity increases when compared to the setting with omniscient adversaries and zero probability of error. It is interesting to see if similar results hold for the PIR problem with Byzantine adversaries [7, 8].⁷⁷ 7 [8] considers PIR with Byzantine adversaries, where $\epsilon$-error is allowed. List decoding is used therein to achieve communication cost $\mathcal{O}(BN)$ (upload plus download) whenever $N>B+T+1$ (note that we raise the question for information theoretic capacity) and the focus is mainly on computational efficiency and programming implementation.