The Capacity of Private Computation

We introduce the problem of private computation, comprised of N distributed and non-colluding servers, K datasets, and a user who wants to compute a function of the datasets privately, i.e., without revealing which function he wants to compute to any individual server. This private computation problem is a strict generalization of the private information retrieval (PIR) problem, by expanding the PIR message set (which consists of only independent messages) to also include functions of those messages. The capacity of private computation, C, is defined as the maximum number of bits of the desired function that can be retrieved per bit of total download from all servers. We characterize the capacity of an elemental private computation setting, with N = 2 servers and K = 2 datasets that are replicated at each server, for linear computations. Surprisingly, the capacity, C = 2/3, matches the capacity of PIR with N = 2 servers and K = 2 messages. Thus, allowing arbitrary linear computations does not reduce the communication rate compared to pure dataset retrieval. The same insight is shown to hold at the opposite extreme where the number of datasets K → ∞, the number of servers N can be arbitrary, and arbitrary (including non-linear) computations are allowed.