A Shannon-Theoretic Approach to the Storage–Retrieval Trade-Off in PIR Systems

Abstract

We consider the storage–retrieval rate trade-off in private information retrieval (PIR) systems using a Shannon-theoretic approach. Our focus is mostly on the canonical two-message two-database case, for which a coding scheme based on random codebook generation and the binning technique is proposed. This coding scheme reveals a hidden connection between PIR and the classic multiple description source coding problem. We first show that when the retrieval rate is kept optimal, the proposed non-linear scheme can achieve better performance over any linear scheme. Moreover, a non-trivial storage-retrieval rate trade-off can be achieved beyond space-sharing between this extreme point and the other optimal extreme point, achieved by the retrieve-everything strategy. We further show that with a method akin to the expurgation technique, one can extract a zero-error PIR code from the random code. Outer bounds are also studied and compared to establish the superiority of the non-linear codes over linear codes.

1. Introduction

Private information retrieval (PIR) addresses the situation of storing K messages of L-bits each in N databases, with the requirement that the identity of any requested message must be kept private from any one (or any small subset) of the databases. The early works were largely computer science theoretic [1], where $L=1$, and the main question is the scaling law of the retrieval rate in terms of $(K,N)$.

The storage overhead in PIR systems has been studied in the coding and information theory community from several perspectives using mainly two problem formulations. Shah et al. [2] considered the problem when N is allowed to vary with L and K, and obtained some conclusive results. In a similar vein, for $L=1$, Fazeli et al. [3] proposed a technique to convert any linear PIR code to a new one with low storage overhead by increasing N. Other notable results along this line can be found in [4,5,6,7,8,9].

An information theoretic formulation of the PIR problem was considered in [10], where L is allowed to increase, while $(N,K)$ are kept fixed. Important properties on the trade-off between the storage rate and retrieval rate were identified in [10], and a linear code construction was proposed. In this formulation, even without any storage overhead constraint, characterizing the minimum retrieval rate in the PIR systems is nontrivial, and this capacity problem was settled in [11]. Tajeddine et al. [12] considered the capacity problem when the message is coded across the databases with a maximum-distance separable (MDS) code, which was later solved by Banawan and Ulukus [13]. Capacity-achieving code designs with optimal message sizes were given in [14,15]. Systems where servers can collude were considered in [16]. There have been various extensions and generalizations, and the recent survey article [17] provides a comprehensive overview on efforts following this information theoretic formulation.

In many existing works, the storage component and the PIR component are largely designed separately, usually by placing certain structural constraints on one of them, e.g., the MDS coding requirement for the storage component [13], or the storage is uncoded [18]; moreover, the code constructions are almost all linear. The few exceptions we are aware of are [19,20,21]. In this work, we consider the information theoretic formulation of the PIR problem, without placing any additional structural constraints on the two components, and explicitly investigate the storage–retrieval trade-off region. We mostly focus on the case $N=K=2$ here since it provides the most important intuition; we refer to this as the $(2,2)$ PIR system. Our approach naturally allows the joint design of the two components using either linear or non-linear schemes.

The work in [19] is of significant relevance to our work, where the storage overhead was considered in both single-round and multi-round PIR systems, when the retrieval rate must be optimal. Although multi-round PIR has the same capacity as single-round PIR, it was shown that at the minimum retrieval rate, a multi-round, $ϵ$-error, non-linear code can indeed break the storage performance barrier of an optimal single-round, zero error, linear code. The question of whether all the three differences are essential to overcome this barrier was left as an open question.

In this work, we show that a non-linear code is able to achieve better performance than the optimal linear code in the single-round zero-error $(2,2)$ PIR system, over a range of the storage rates. This is accomplished by providing a Shannon-theoretic coding scheme based on random codebook generation and the binning technique. The proposed scheme at the minimum retrieval rate is conceptually simpler, and we present it as an explicit example. The general inner bound is then provided, and we show an improved trade-off can be achieved beyond space-sharing between the minimum retrieval rate code and the other optimal extreme point. By leveraging a method akin to the expurgation technique, we further show that one can extract a zero-error deterministic PIR code from the random $ϵ$-error PIR code. Outer bounds are also studied for both general codes and linear codes, which allow us to establish conclusively the superiority of non-linear codes over linear codes. Our work essentially answers the open question in [19], and shows that, in fact, only non-linearity is essential in breaking the aforementioned barrier.

A preliminary version of this work was presented first in part in [22]. In this updated article, we provide a more general random coding scheme, which reveals a hidden connection to the multiple description source coding problem [23]. Intuitively, we can view the retrieved message as certain partial reconstruction of the full set of messages, instead of a complete reconstruction of a single message. Therefore, the answers from the servers can be viewed as descriptions of the full set of messages, which are either stored directly at the servers or formed at the time of request, and the techniques seen in multiple description coding become natural in the PIR setting. Since the publication of the preliminary version [22], several subsequent efforts have been made in studying the storage–retrieval trade-off in the PIR setting, which provided stronger and more general information theoretic outer bounds and several new linear code constructions [20,21,24]. However, the Shannon-theoretic random coding scheme given in [22] remains the best-performing for the $(2,2)$ case, which motivates us to provide the general coding scheme in this work and to make the connection to multiple description source coding more explicit. It is our hope that this connection may bring existing coding techniques for the multiple description problem to the study of the PIR problem.

2. Preliminaries

The problem we consider is essentially the same as that in [11], with the additional consideration on the storage overhead constraint at the databases. We provide a formal problem definition in the more traditional Shannon-theoretic language to facilitate subsequent treatment. Some relevant results on this problem are also reviewed briefly in this section.

2.1. Problem Definition

There are two independent messages, denoted as $W_1$ and $W_2$, in this system, each of which is generated uniformly at random in the finite field ${\mathbb{F}}_2^L$, i.e., each message is an L-bit sequence. There are two databases to store the messages, which are produced by two encoding functions operating on $(W_1,W_2)$:

$$\begin{array}{c}{\varphi }_n:{\mathbb{F}}_2^L\times {\mathbb{F}}_2^L\to {\mathbb{F}}_2^{{\alpha }_n},n=1,2,\end{array}$$

where ${\alpha }_n$ is the number of storage symbols at database-n, $n=1,2$, which is a deterministic function of L, i.e., we are using fixed length codes for storage. We write $S_1={\varphi }_1(W_1,W_2)$ and $S_2={\varphi }_2(W_1,W_2)$. When a user requests message-k, it generates two queries $(Q_1^{\left[k\right]},Q_2^{\left[k\right]})$ to be sent to the two databases, randomly in the alphabet $\mathcal{Q}\times \mathcal{Q}$. Note that the joint distribution satisfies the condition

$$\begin{array}{c}\hfill P_{W_1,W_2,Q_1^{\left[k\right]},Q_2^{\left[k\right]}}=P_{W_1,W_2}{P}_{Q_1^{\left[k\right]},Q_2^{\left[k\right]}},k=1,2,\end{array}$$

(1)

i.e., the messages and the queries are independent. The marginal distributions $P_{W_1,W_2}$ and $P_{Q_1^{\left[k\right]},Q_2^{\left[k\right]}}$, $k=1,2$, thus fully specify the randomness in the system.

After receiving the queries, the databases produce the answers to the query via a set of deterministic functions:

$$\begin{array}{c}\hfill {\phi }_n^{\left(q\right)}:{\mathbb{F}}_2^{{\alpha }_n}\to {\mathbb{F}}_2^{{\beta }_n^{\left(q\right)}},q\in \mathcal{Q},n=1,2.\end{array}$$

(2)

We also write the answers $A_n^{\left[k\right]}={\phi }_n^{\left(Q_n^{\left[k\right]}\right)}\left(S_n\right)$, $n=1,2$. The user, with the retrieved information, wishes to reproduce the desired message through a set of decoding functions

$$\begin{array}{c}\hfill {\psi }^{(k,q_1,q_2)}:{\mathbb{F}}_2^{{\beta }_1^{\left(q_1\right)}}\times {\mathbb{F}}_2^{{\beta }_2^{\left(q_2\right)}}\to {\mathbb{F}}_2^L.\end{array}$$

(3)

The outputs of the functions ${\widehat{W}}_k={\psi }^{(k,Q_1^{\left[k\right]},Q_2^{\left[k\right]})}(A_1^{\left[k\right]},A_2^{\left[k\right]})$ are essentially the retrieved messages. We require the system to retrieve the message correctly (zero error), i.e., ${\widehat{W}}_k=W_k$ for $k=1,2$.

Alternatively, we can require the system to have a small error probability. Denote the average probability of coding error of a PIR code as

$$\begin{array}{cc}\hfill & P_e=0.5\sum _{k=1,2}{P}_{W_1,W_2,Q_1^{\left[k\right]},Q_2^{\left[k\right]}}(W_k\ne {\widehat{W}}_k).\hfill \end{array}$$

(4)

An $(L,{\alpha }_1,{\alpha }_2,{\beta }_1,{\beta }_2)$ $ϵ$-error PIR code is defined similar as a (zero-error) PIR code, except that the correctness condition is replaced by the condition that the probability of error $P_e\le ϵ$.

Finally, the privacy constraint stipulates that the identical distribution condition must be satisfied:

$$\begin{array}{c}\hfill P_{Q_n^{\left[1\right]},A_n^{\left[1\right]},S_n}=P_{Q_n^{\left[2\right]},A_n^{\left[2\right]},S_n},n=1,2.\end{array}$$

(5)

Note that one obvious consequence is that $P_{Q_n^{\left[1\right]}}=P_{Q_n^{\left[2\right]}}\triangleq P_{Q_n}$, for $n=1,2$.

We refer to the code, which is specified by two probability distributions $P_{Q_1^{\left[k\right]},Q_2^{\left[k\right]}}$, $k=1,2$, and a valid set of coding functions $\{{\varphi }_n,{\phi }_n^{\left(q\right)},{\psi }^{k,q_1,q_2}\}$ that satisfy both the correctness and privacy constraints, as an $(L,{\alpha }_1,{\alpha }_2,{\beta }_1,{\beta }_2)$ PIR code, where ${\beta }_n={\mathbb{E}}_{Q_n}\left[{\beta }_n^{\left(Q_n\right)}\right]$, for $n=1,2$.

Definition 1.

A normalized storage–retrieval rate pair $(\overline{\alpha },\overline{\beta })$ is achievable, if for any $ϵ>0$ and sufficiently large L, there exists an $(L,{\alpha }_1,{\alpha }_2,{\beta }_1,{\beta }_2)$ PIR code, such that

$$\begin{array}{c}L(\overline{\alpha }+ϵ)\ge \frac{1}{2}({\alpha }_1+{\alpha }_2),L(\overline{\beta }+ϵ)\ge \frac{1}{2}\left({\beta }_1+{\beta }_2\right).\end{array}$$

(6)

The collection of the achievable normalized storage–retrieval rate pair $(\overline{\alpha },\overline{\beta })$ is the achievable storage–retrieval rate region, denoted as $\mathcal{R}$.

Unless explicitly stated, the rate region $\mathcal{R}$ is used for the zero-error PIR setting. In the definition above, we used the average rates $(\overline{\alpha },\overline{\beta })$ across the databases instead of the individual rate vectors $\frac{1}{n}({\alpha }_1,{\alpha }_2,{\mathbb{E}}_{Q_1}\left[{\beta }_1^{\left(Q_1\right)}\right],{\mathbb{E}}_{Q_2}\left[{\beta }_2^{\left(Q_2\right)}\right])$. This can be justified using the following lemma.

Lemma 1.

If an $(L,{\alpha }_1,{\alpha }_2,{\beta }_1,{\beta }_2)$ PIR code exists, then a $(2L,\alpha ,\alpha ,\beta ,\beta )$ PIR code exists, where

$$\begin{array}{c}\hfill \alpha ={\alpha }_1+{\alpha }_2,\beta ={\beta }_1+{\beta }_2.\end{array}$$

(7)

This lemma can essentially be proved by a space-sharing argument, the details of which can be found in [19]. The following lemma is also immediate using a conventional space-sharing argument.

Lemma 2.

The region $\mathcal{R}$ is convex.

2.2. Some Relevant Known Results

The capacity of a general PIR system with K messages and N databases is identified in [11] as

$$\begin{array}{c}\hfill C=\frac{1-1/N}{1-1/N^K},\end{array}$$

(8)

which in our definition corresponds to the case when $\overline{\beta }$ is minimized, and the proposed linear code achieves $(\overline{\alpha },\overline{\beta })=(K,(1-1/N^K)/(N-1))$. The capacity of MDS-code PIR systems was established in [13]. In the context of the storage–retrieval trade-off, this result can be viewed as providing the achievable trade-off pairs

$$\begin{array}{c}\hfill (\overline{\alpha },\overline{\beta })=\left(t,\frac{1-t^K/N^K}{N-t}\right),t=1,2,\dots ,N.\end{array}$$

(9)

However, when specialized to the $(2,2)$ PIR problem, this does not provide any improvement over the space-sharing strategy between the trivial code of retrieval-everything and the code in [11]. By specializing the code in [11], it was shown in [19] that for the $(2,2)$ PIR problem, at the minimal retrieval value $\overline{\beta }=0.75$, the storage rate ${\overline{\alpha }}_l=1.5$ is achievable using a single-round, zero-error linear code, and in fact, it is the optimal storage rate that any single-round, zero-error linear code can achieve.

One of the key observations in [19] is that a special coding structure appears to be the main difficulty in the $(2,2)$ PIR setting, which is illustrated in Figure 1. Here, message $W_1$ can be recovered from either $(X_1,Y_1)$ or $(X_2,Y_2)$, and message $W_2$ can be recovered from either $(X_1,Y_2)$ or $(X_2,Y_1)$; $(X_1,X_2)$ is essentially $S_1$ and is stored at database-1, and $(Y_1,Y_2)$ is essentially $S_2$ and is stored at database-2. It is clear that we can use the following strategy to satisfy the privacy constraint: when message $W_1$ is requested, with probability $1/2$, the user queries for either $(X_1,Y_1)$ or $(X_2,Y_2)$; for message 2, with probability $1/2$, the user queries for either $(X_1,Y_2)$ or $(X_2,Y_1)$. More precisely, the following probability distribution $P_{Q_1^{\left[1\right]},Q_2^{\left[1\right]}}$ and $P_{Q_1^{\left[2\right]},Q_2^{\left[2\right]}}$ can be used:

$$\begin{array}{c}\hfill P_{Q_1^{\left[1\right]},Q_2^{\left[1\right]}}=\left\{\begin{array}{cc}0.5\hfill & (Q_1^{\left[1\right]},Q_2^{\left[1\right]})=\left(11\right)\hfill \\ 0.5\hfill & (Q_1^{\left[1\right]},Q_2^{\left[1\right]})=\left(22\right)\hfill \end{array}\right.,\end{array}$$

(10)

and

$$\begin{array}{c}\hfill P_{Q_1^{\left[2\right]},Q_2^{\left[2\right]}}=\left\{\begin{array}{cc}0.5\hfill & (Q_1^{\left[2\right]},Q_2^{\left[2\right]})=\left(12\right)\hfill \\ 0.5\hfill & (Q_1^{\left[2\right]},Q_2^{\left[2\right]})=\left(21\right)\hfill \end{array}\right..\end{array}$$

(11)

2.3. Multiple Description Source Coding

The multiple description source coding problem [23] considers compressing a memoryless source S into a total of M descriptions, i.e., M compressed bit sequences such that the combinations of any subset of these descriptions can be used to reconstruct the source S to guarantee certain quality requirements. The motivation of this problem is mainly to address the case when packets can be dropped randomly on a communication network.

Denote the coding rate for each description as $R_i$, $i=1,2,\dots ,M$. A coding scheme was proposed in [25], which leads to the following rate region. Let $U_1,U_2,\dots ,U_M$ be M random variables jointly distributed with S, then the following rates $(R_1,R_2,\dots ,R_M)$ and distortions $(D_{\mathcal{A}},\mathcal{A}\subseteq \{1,2,\dots ,M\})$ are achievable:

$$\begin{array}{cc}\hfill \sum _{i\in \mathcal{A}}{R}_i& \ge \sum _{i\in \mathcal{A}}H\left(U_i\right)-H\left(\{U_i,i\in \mathcal{A}\}\right|S),\mathcal{A}\subseteq \{1,2,\dots ,M\},\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill D_{\mathcal{A}}& \ge \mathbb{E}\left[d(S,f_{\mathcal{A}}(U_i,i\in \mathcal{A}))\right],\mathcal{A}\subseteq \{1,2,\dots ,M\}.\hfill \end{array}$$

(13)

Here, $f_{\mathcal{A}}$ is a reconstruction mapping from the random variables $\{U_i,i\in \mathcal{A}\}$ to the reconstruction domain, $d(·,·)$ is a distortion metric that is used to measure the distortion, and $D_{\mathcal{A}}$ is the distortion achievable using the descriptions in the set $\mathcal{A}$. Roughly speaking, the coding scheme requires generating approximately $2^{n{R}_i}$ length-n codewords in an i.i.d. manner using the marginal distribution $U_i$ for each $i=1,2,\dots ,M$, and the rate constraints ensure that when n is sufficiently large, with overwhelming probability there is a tuple of M codewords $(u_1^n,u_2^n,\dots ,u_M^n)$, one in each codebook constructed earlier, that are jointly typical with the source vector $S^n$. In this coding scheme, the descriptions are simply the codeword indices of these codewords in these codebooks. For a given joint distribution $(S,U_1,U_2,\dots ,U_M)$, we refer to the rate region in (12) as the MD rate region ${\mathcal{R}}_{MD}(S,U_1,U_2,\dots ,U_M)$, and the corresponding random code construction the MD codebooks associated with $(S,U_1,U_2,\dots ,U_M)$.

The binning technique [26] can be applied in the multiple description problem to provide further performance improvements, particularly when not all the combinations of the descriptions are required to satisfy certain performance constraints, but only a subset of them are; this technique was previously used in [27,28] for this purpose. Assume that only the subsets of descriptions ${\mathcal{A}}_1,{\mathcal{A}}_2,\dots ,{\mathcal{A}}_T\subseteq \{1,2,\dots ,M\}$ have distortion requirements associated with the reconstructions using these descriptions, which are denoted as $D_{{\mathcal{A}}_i}$, $i=1,2,\dots ,T$. Consider the MD codebooks associated with $(S,U_1,U_2,\dots ,U_M)$ at rates $(R_1^{\prime },R_2^{\prime },\dots ,R_M^{\prime })\in {\mathcal{R}}_{MD}(S,U_1,U_2,\dots ,U_M)$, then assign the codewords in the i-th codebook uniformly at random into $2^{n{R}_i}$ bins with $0\le R_i\le R_i^{\prime }$. The coding rates and distortions that satisfy the following constraints simultaneously for all ${\mathcal{A}}_i,i=1,2,\dots ,T$ are achievable:

$$\begin{array}{cc}\hfill \sum _{j\in \mathcal{J}}(R_j^{\prime }-R_j)& \le \sum _{j\in \mathcal{J}}H\left(U_j\right)-H\left(\left\{U_j,j\in \mathcal{J}\right\}|\left\{U_{j^{\prime }},j^{\prime }\in {\mathcal{A}}_i\backslash \mathcal{J}\right\}\right),\forall \mathcal{J}\subseteq {\mathcal{A}}_i,\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill D_{{\mathcal{A}}_i}& \ge \mathbb{E}\left[d(S,f_{{\mathcal{A}}_i}(U_j,j\in {\mathcal{A}}_i))\right].\hfill \end{array}$$

(15)

We denote the collection of such rate vectors $(R_1,R_2,\dots ,R_M,R_1^{\prime },R_2^{\prime },\dots ,R_M^{\prime })$ as ${\mathcal{R}}_{MD}^{\ast }((S,U_1,U_2,\dots ,U_M),(\{U_j,j\in {\mathcal{A}}_i\},i=1,2,\dots ,T))$, and refer to the corresponding codebooks as the MD* codebooks associated with the random variables $(S,U_1,U_2,\dots ,U_M)$ and the reconstruction sets $({\mathcal{A}}_1,{\mathcal{A}}_2,\dots ,{\mathcal{A}}_T)$.

3. A Special Case: Slepian–Wolf Coding for Minimum Retrieval Rate

In this section, we consider the minimum-retrieval-rate case, and show that non-linear and Shannon-theoretic codes are beneficial. We will be rather cavalier here and ignore some details, in the hope of better conveyance of the intuition. In particular, we ignore the asymptotic-zero probability of error that is usually associated with a random coding argument, but this will be addressed more carefully in Section 4.

Let us rewrite the L-bit messages as

$$\begin{array}{c}\hfill W_k=(V_k\left[1\right],\dots ,V_k\left[L\right])\triangleq V_k^L,k=1,2.\end{array}$$

(16)

The messages can be viewed as being produced from a discrete memoryless source $P_{V_1,V_2}=P_{V_1}·P_{V_2}$, where $V_1$ and $V_2$ are independent uniform-distributed Bernoulli random variables.

Consider the following auxiliary random variables:

$$\begin{array}{c}{X}_1\triangleq V_1\wedge V_2,X_2\triangleq (\neg V_1)\wedge (\neg V_2),\\ Y_1\triangleq V_1\wedge (\neg V_2),Y_2\triangleq (\neg V_1)\wedge V_2,\end{array}$$

(17)

where ¬ is the binary negation, and ∧ is the binary “and” operation. This particular distribution satisfies the coding structure depicted in Figure 1, with $(V_1,V_2)$ taking the role of $(W_1,W_2)$, and the relation is non-linear. The same distribution was used in [19] to construct a multiround PIR code. This non-linear mapping appears to allow the resultant code to be more efficient than linear codes.

We wish to store $(X_1^L,X_2^L)$ at the first database in a lossless manner, however, store only certain necessary information regarding $Y_1^L$ and $Y_2^L$ to facilitate the recovery of $W_1$ or $W_2$. For this purpose, we will encode the message as follows:

• At database-1, compress and store $(X_1^L,X_2^L)$ losslessly;
• At database-2, encode $Y_1^L$ using a Slepian–Wolf code (or more precisely Sgarro’s code with uncertainty side information [29]), with either $X_1^L$ or $X_2^L$ at the decoder, whose resulting code index is denoted as $C_{Y_1}$; encode $Y_2^L$ in the same manner, independent of $Y_1^L$, whose code index is denoted as $C_{Y_2}$.

It is clear that for database-1, we need roughly ${\overline{\alpha }}_1=H(X_1,X_2)$. At database-2, in order to guarantee successful decoding of the Slepian-Wolf code, we can chose roughly

$$\begin{array}{cc}\hfill \overline{{\alpha }_2}& =max(H\left(Y_1\right|X_1),H\left(Y_1\right|X_2))+max(H\left(Y_2\right|X_1),H\left(Y_2\right|X_2))\hfill \\ \hfill & =2H\left(Y_1\right|X_1),\hfill \end{array}$$

(18)

where the second equality is due to the symmetry in the probability distribution. Thus we find that this code achieves

$$\begin{array}{cc}\hfill {\overline{\alpha }}_{nl}& =0.5[H(X_1,X_2)+2H\left(Y_1\right|X_1)]\hfill \\ \hfill & =0.75+0.75H(1/3,2/3)\hfill \\ \hfill & =0.25+0.75{log}_{2}3\approx 1.4387.\hfill \end{array}$$

(19)

The retrieval strategy is immediate from the coding structure in Figure 1, with $(V_1^L,V_2^L,X_1^L,X_2^L,C_{Y_1},C_{Y_2})$ serving the roles of $(W_1,W_2,X_1,X_2,Y_1,Y_2)$, and thus indeed the privacy constraint is satisfied. The retrieval rates are roughly as follows:

$$\begin{array}{c}{\overline{\beta }}_1^{\left(1\right)}={\overline{\beta }}_1^{\left(2\right)}=H\left(X_1\right)=H\left(X_2\right),\end{array}$$

(20)

$$\begin{array}{c}{\overline{\beta }}_2^{\left(1\right)}={\overline{\beta }}_2^{\left(2\right)}=H\left(Y_1\right|X_1),\end{array}$$

(21)

implying

$$\begin{array}{c}\overline{\beta }=0.5[H\left(X_1\right)+H\left(Y_1\right|X_1)]=0.5H(Y_1,X_1)=0.75.\end{array}$$

Thus, at the optimal retrieval rate $\overline{\beta }=0.75$, we have

$$\begin{array}{c}\hfill {\overline{\alpha }}_l=1.5\mathrm{vs}.{\overline{\alpha }}_{nl}\approx 1.4387,\end{array}$$

(22)

and clearly the proposed non-linear Shannon-theoretic code is able to perform better than the optimal linear code. We note that it was shown in [19] by using a multround approach, the storage rate $\overline{\alpha }$ can be further reduced; however, this issue is beyond the scope of this work. In the rest of the paper, we build on the intuition in this special case to generalize and strengthen the coding scheme.

4. Main Result

4.1. A General Inner Bound

We first present a general inner bound to the storage–retrieval trade-off region. Let $(V_1,V_2)$ be independent random variables uniformly distributed on ${\mathbb{F}}_2^t\times {\mathbb{F}}_2^t$. Define the region ${\mathcal{R}}_{in}^{\left(t\right)}$ to be the collection of $(\overline{\alpha },\overline{\beta })$ pairs for which there exist random variables $(X_0,X_1,X_2,Y_1,Y_2)$ jointly distributed with $(V_1,V_2)$ such that the following hold:

• There exist deterministic functions $f_{1,1}$, $f_{1,2}$, $f_{2,1}$, and $f_{2,2}$ such that

  $$\begin{array}{c}{V}_1=f_{1,1}(X_0,X_1,Y_1)=f_{2,2}(X_0,X_2,Y_2),V_2=f_{1,2}(X_0,X_1,Y_2)=f_{2,1}(X_0,X_2,Y_1);\end{array}$$

  (23)
• There exist non-negative coding rates

  $$\begin{array}{c}({\beta }_1^{\left(0\right)},{\beta }_1^{\left(1\right)},{\beta }_1^{\left(2\right)},{\beta }_2^{\left(1\right)},{\beta }_2^{\left(2\right)},{\gamma }_1^{\left(0\right)},{\gamma }_1^{\left(1\right)},{\gamma }_1^{\left(2\right)},{\gamma }_2^{\left(1\right)},{\gamma }_2^{\left(2\right)})\hfill \\ \in {\mathcal{R}}_{MD}^{\ast }\left(((V_1,V_2),X_0,X_1,X_2,Y_1,Y_2),\right.\hfill \\ \left.\left(\{X_0,X_1,Y_1\},\{X_0,X_1,Y_2\},\{X_0,X_2,Y_1\},\{X_0,X_2,Y_2\}\right)\right);\hfill \end{array}$$

  (24)
• There exist non-negative storage rates $({\alpha }_1^{\left(0\right)},{\alpha }_1^{\left(1\right)},{\alpha }_1^{\left(2\right)},{\alpha }_2^{\left(1\right)},{\alpha }_2^{\left(2\right)})$ such that

  $$\begin{array}{c}{\alpha }_1^{\left(0\right)}\le {\beta }_1^{\left(0\right)},{\alpha }_1^{\left(1\right)}\le {\beta }_1^{\left(1\right)},{\alpha }_1^{\left(2\right)}\le {\beta }_1^{\left(2\right)},{\alpha }_2^{\left(1\right)}\le {\beta }_2^{\left(1\right)},{\alpha }_2^{\left(2\right)}\le {\beta }_2^{\left(2\right)},\end{array}$$

  (25)

  and if

  $$\begin{array}{c}\hfill {\gamma }_1^{\left(0\right)}-{\beta }_1^{\left(0\right)}+{\gamma }_1^{\left(1\right)}-{\beta }_1^{\left(1\right)}+{\gamma }_1^{\left(2\right)}-{\beta }_1^{\left(2\right)}<H\left(X_1\right)+H\left(X_2\right)+H\left(X_3\right)-H(X_0,X_1,X_2),\end{array}$$

  (26)

  choose

  $$\begin{array}{c}\hfill ({\alpha }_1^{\left(0\right)},{\alpha }_1^{\left(1\right)},{\alpha }_1^{\left(2\right)},{\gamma }_1^{\left(0\right)},{\gamma }_1^{\left(1\right)},{\gamma }_1^{\left(2\right)})\in {\mathcal{R}}_{MD}^{\ast }\left(((V_1,V_2),X_0,X_1,X_2),\left(\{X_0,X_1,X_2\}\right)\right);\end{array}$$

  (27)

  otherwise, choose $({\alpha }_1^{\left(0\right)},{\alpha }_1^{\left(1\right)},{\alpha }_1^{\left(2\right)})=({\beta }_1^{\left(0\right)},{\beta }_1^{\left(1\right)},{\beta }_1^{\left(2\right)})$. Similarly, if

  $$\begin{array}{c}\hfill {\gamma }_2^{\left(1\right)}-{\beta }_2^{\left(1\right)}+{\gamma }_2^{\left(2\right)}-{\beta }_2^{\left(2\right)}<I(Y_1;Y_2),\end{array}$$

  (28)

  choose

  $$\begin{array}{c}\hfill ({\alpha }_2^{\left(1\right)},{\alpha }_2^{\left(2\right)},{\gamma }_2^{\left(1\right)},{\gamma }_2^{\left(2\right)})\in {\mathcal{R}}_{MD}^{\ast }\left(((V_1,V_2),Y_1,Y_2),\left(\{Y_1,Y_2\}\right)\right),\end{array}$$

  (29)

  otherwise $({\alpha }_2^{\left(1\right)},{\alpha }_2^{\left(2\right)})=({\beta }_1^{\left(1\right)},{\beta }_1^{\left(2\right)})$;
• The normalized average retrieval and storage rates

  $$\begin{array}{cc}\hfill & 2t\overline{\alpha }\ge {\alpha }_1^{\left(0\right)}+{\alpha }_1^{\left(1\right)}+{\alpha }_1^{\left(2\right)}+{\alpha }_2^{\left(1\right)}+{\alpha }_2^{\left(2\right)},\hfill \end{array}$$

  (30)

  $$\begin{array}{cc}\hfill & 4t\overline{\beta }\ge 2{\beta }_1^{\left(0\right)}+{\beta }_1^{\left(1\right)}+{\beta }_1^{\left(2\right)}+{\beta }_2^{\left(1\right)}+{\beta }_2^{\left(2\right)}.\hfill \end{array}$$

  (31)

Then, we have the following theorem.

Theorem 1.

${\mathcal{R}}_{in}^{\left(t\right)}\subseteq \mathcal{R}$.

We can, in fact, potentially enlarge the achievable region by taking ${\cup }_{t=1}^{\infty }{\mathcal{R}}_{in}^{\left(t\right)}$. However, unless ${\mathcal{R}}_{in}^{(t+1)}\subseteq {\mathcal{R}}_{in}^{\left(t\right)}$ for all $t\ge 1$, the region ${\cup }_{t=1}^{\infty }{\mathcal{R}}_{in}^{\left(t\right)}$ is even more difficult to characterize. Nevertheless, for each fixed t, we can identify inner bounds by specifying a feasible set of random variables $X_0,X_1,X_2,Y_1,Y_2$.

Instead of directly establishing this theorem, we shall prove the following theorem which establishes the existence of a PIR code with diminishing error probability, and then use an expurgation technique to extract a zero-error PIR code.

Theorem 2.

Consider any $(\overline{\alpha },\overline{\beta })\in {\mathcal{R}}_{in}^{\left(t\right)}$. For any $ϵ>0$ and sufficiently large L, there exists an $(L,L(\overline{\alpha }+ϵ),L(\overline{\alpha }+ϵ),L(\overline{\beta }+ϵ),L(\overline{\beta }+ϵ))$ ϵ-error PIR code with the query distribution given in (10) and (11).

The key observation to establish this theorem is that there are five descriptions in this setting; however, the retrieval and storage place different constraints on different combination of descriptions, and some descriptions can, in fact, be stored, recompressed, and then retrieved. Such compression and recompression may lead to storage savings. The description based on $X_0$ can be viewed as some common information to $X_1$ and $X_2$, which allows us to trade-off the storage and retrieval rates.

Proof of Theorem 2.

Codebook generation: Codebooks are built using the MD codebooks based on the distribution $((V_1,V_2),X_0,X_1,X_2,Y_1,Y_2)$.

Storage codes: The bin indices of the codebooks are stored in the two servers: those of $X_0$, $X_1$, and $X_2$ are stored at server-1 at rates ${\alpha }_1^{\left(0\right)}$, ${\alpha }_1^{\left(1\right)}$, and ${\alpha }_1^{\left(2\right)}$, respectively; those of $Y_1$ and $Y_2$ are stored at server-2 at rates ${\alpha }_2^{\left(1\right)}$ and ${\alpha }_2^{\left(2\right)}$. Note that at such rates, the codewords for $X_0$, $X_1$, and $X_2$ can be recovered jointly with overwhelming probability, while those for $Y_1$ and $Y_2$ can also be recovered jointly with overwhelming probability.

Retrieval codes: A different set of bin indices of the codebooks are retrieved during the retrieval process, again based on the MD* codebooks: those of $X_0$, $X_1$, and $X_2$ are retrieved at server-1 at rates ${\beta }_1^{\left(0\right)}$, ${\beta }_1^{\left(1\right)}$, and ${\beta }_1^{\left(2\right)}$, respectively; those of $Y_1$ and $Y_2$ are retrieved at server-2 at rates ${\beta }_2^{\left(1\right)}$ and ${\beta }_2^{\left(2\right)}$. Note that at such rates, the codewords of $X_0$, $X_1$, and $Y_1$ can be jointly recovered such that using the three corresponding codewords, the required $V_1$ source vector can be recovered with overwhelming probability. Similarly, the three retrieval patterns of $(X_0,X_1,Y_2)\to V_2$, $(X_0,X_2,Y_1)\to V_2$, and $(X_0,X_2,Y_2)\to V_2$ will succeed with overwhelming probabilities.

Storage and retrieval rates: The rates can be computed straightforwardly, after normalization by the parameter t. □

Next we use it to prove Theorem 1.

Proof of Theorem 1.

Given an $ϵ>0$, according to Proposition 2, we can find an $(L,L(\overline{\alpha }+ϵ),L(\overline{\alpha }+ϵ),L(\overline{\beta }+ϵ),L(\overline{\beta }+ϵ))$ $ϵ$-error PIR code for some sufficient large L. The probability of error of this code can be rewritten as

$$\begin{array}{cc}\hfill P_e& =0.5\sum _{k=1,2}\sum _{(w_1,w_2)}{2}^{-2L}{P}_{Q_1^{\left[k\right]},Q_2^{\left[k\right]}|(w_1,w_2)}(w_k\ne {\widehat{W}}_k).\hfill \end{array}$$

For a fixed $(w_1,w_2)$ pair, denote the event that there exists a $(q_1,q_2)\in \{\left(11\right),\left(22\right)\}$, i.e., when $(Q_1^{\left[1\right]},Q_2^{\left[1\right]})=(q_1,q_2)$, such that ${\widehat{w}}_1\ne w_1$ as $E_{w_1,w_2}^{\left(1\right)}$, and there exists a $(q_1,q_2)\in \{\left(12\right),\left(21\right)\}$ such that ${\widehat{w}}_2\ne w_2$ as $E_{w_1,w_2}^{\left(2\right)}$. Since $(Q_1^{\left[k\right]},Q_2^{\left[k\right]})$ is independent of $(W_1,W_2)$, if $P\left(E_{w_1,w_2}^{\left(k\right)}\right)\ne 0$, we must have $P\left(E_{w_1,w_2}^{\left(k\right)}\right)\ge 0.5$. It follows that

$$\begin{array}{cc}\hfill P_e& \ge 0.25\sum _{(w_1,w_2)}{2}^{-2L}\mathbf{1}(E_{w_1,w_2}^{\left[1\right]}\cup E_{w_1,w_2}^{\left[2\right]}),\hfill \end{array}$$

(32)

where $(·)$ is the indicator function. This implies that for any $ϵ\le 0.125$, there are at most $2^{2L-1}$ pairs of $(w_1,w_2)$ that will induce any coding error. We can use any $2^{2L-2}$ of the remaining $2^{2L-1}$ pairs of L-bit sequence pairs to instead store a pair of $(L-1)$-bit messages, through an arbitrary but fixed one-to-one mapping. This new code has a factor of $1+1/(L-1)$ increase in the normalized coding rates, which is negligible when L is large. Thus a zero-error PIR code is found with the same normalized rates as the $ϵ$-error code asymptotically, and this completes the proof. □

4.2. Outer Bounds

We next turn our attention to the outer bounds for $\mathcal{R}$, summarized in the following theorem.

Theorem 3.

Any $(\overline{\alpha },\overline{\beta })\in \mathcal{R}$ must satisfy

$$\begin{array}{c}\hfill \overline{\beta }\ge 0.75,\overline{\alpha }+\overline{\beta }\ge 2,3\overline{\alpha }+8\overline{\beta }\ge 10.\end{array}$$

(33)

Moreover, if $(\overline{\alpha },\overline{\beta })\in \mathcal{R}$ can be achieved by a linear code, it must satisfy

$$\begin{array}{c}\hfill \overline{\alpha }+6\overline{\beta }\ge 6.\end{array}$$

(34)

The inequality $\overline{\beta }\ge 0.75$ follows from [11], while the two other bounds in (33) were proved in [24]. Therefore, we only need to prove (34).

Proof of Theorem 3.

Following [19], we make the following simplifying assumptions that have no loss of generality. Define $\mathbb{Q}=\{Q_1^{\left[1\right]},Q_1^{\left[2\right]},Q_2^{\left[1\right]},Q_2^{\left[2\right]}\}$.

$$\begin{array}{ccc}& & 1.Q_1^{\left[1\right]}=Q_1^{\left[2\right]}\Rightarrow A_1^{\left[1\right]}=A_1^{\left[2\right]},\hfill \end{array}$$

(35)

$$\begin{array}{ccc}& & 2.H\left(A_1^{\left[1\right]}\right|\mathbb{Q})=H\left(A_2^{\left[1\right]}\right|\mathbb{Q})=H\left(A_2^{\left[2\right]}\right|\mathbb{Q}),H\left(S_1\right)=H\left(S_2\right)\hfill \end{array}$$

(36)

$$\begin{array}{ccc}& & \Rightarrow H\left(A_1^{\left[1\right]}\right|\mathbb{Q})\le \beta \le (\overline{\beta }+ϵ)L,H\left(S_2\right)\le \alpha \le (\overline{\alpha }+ϵ)L.\hfill \end{array}$$

(37)

Assumption 1 states that the query to the first database is the same regardless of the desired message index. This is justified by the privacy condition that the query to one database is independent of the desired message index. Assumption 2 states that the scheme is symmetric after the symmetrization operation in Lemma 1 (the proof is referred to Theorem 3 in [19]). Then, (37) follows from the fact that to describe $S_2,A_1^{\left[1\right]}$, the number of bits needed cannot be less than the entropy value, and Definition 1.

In the following, we use $\left(c\right)$ to refer to the correctness condition, $\left(i\right)$ to refer to the constraint that queries are independent of the messages, $\left(a\right)$ to refer to the constraint that answers are deterministic functions of the storage variables and corresponding queries, and $\left(p\right)$ to refer to the privacy condition.

From $A_1^{\left[1\right]},A_2^{\left[1\right]},\mathbb{Q}$, we can decode $W_1$.

$$\begin{array}{ccc}\hfill H(A_1^{\left[1\right]},A_2^{\left[1\right]}|W_1,\mathbb{Q})& =& H(A_1^{\left[1\right]},A_2^{\left[1\right]},W_1|\mathbb{Q})-H\left(W_1\right|\mathbb{Q})\hfill \end{array}$$

(38)

$$\begin{array}{ccc}& \stackrel{\left(c\right)\left(i\right)}{=}& H(A_1^{\left[1\right]},A_2^{\left[1\right]}|\mathbb{Q})-L\hfill \end{array}$$

(39)

$$\begin{array}{ccc}& \stackrel{\left(36\right)}{\le }& 2H\left(A_1^{\left[1\right]}\right|\mathbb{Q})-L.\hfill \end{array}$$

(40)

Next, consider Ingleton’s inequality.

$$\begin{array}{ccc}\hfill I(A_2^{\left[1\right]};A_2^{\left[2\right]}|\mathbb{Q})& \le & I(A_2^{\left[1\right]};A_2^{\left[2\right]}|W_1,\mathbb{Q})+I(A_2^{\left[1\right]};A_2^{\left[2\right]}|W_2,\mathbb{Q})\hfill \end{array}$$

(41)

$$\begin{array}{ccc}& =& 2I(A_2^{\left[1\right]};A_2^{\left[2\right]}|W_1,\mathbb{Q})\hfill \end{array}$$

(42)

$$\begin{array}{ccc}& =& 2\left(H\left(A_2^{\left[1\right]}\right|W_1,\mathbb{Q})+H\left(A_2^{\left[2\right]}\right|W_1,\mathbb{Q})-H(A_2^{\left[1\right]},A_2^{\left[2\right]}|W_1,\mathbb{Q})\right)\hfill \end{array}$$

(43)

$$\begin{array}{ccc}& \stackrel{\left(p\right)}{=}& 2\left(2H\left(A_2^{\left[1\right]}\right|W_1,\mathbb{Q})-H(A_2^{\left[1\right]},A_2^{\left[2\right]}|W_1,\mathbb{Q})\right)\hfill \end{array}$$

(44)

$$\begin{array}{ccc}& \le & 2(2H\left(A_2^{\left[1\right]}\right|W_1,\mathbb{Q})+H(A_1^{\left[1\right]},A_2^{\left[1\right]}|W_1,\mathbb{Q})\hfill \\ & & -H(A_1^{\left[1\right]},A_2^{\left[1\right]},A_2^{\left[2\right]}|W_1,\mathbb{Q})-H\left(A_2^{\left[1\right]}\right|W_1,\mathbb{Q}))\hfill \end{array}$$

(45)

$$\begin{array}{ccc}& \stackrel{\left(c\right)\left(35\right)}{=}& 2(H\left(A_2^{\left[1\right]}\right|W_1,\mathbb{Q})+H(A_1^{\left[1\right]},A_2^{\left[1\right]}|W_1,\mathbb{Q})\hfill \\ & & -H(A_1^{\left[1\right]},A_2^{\left[1\right]},A_2^{\left[2\right]},W_2|W_1,\mathbb{Q}\left)\right)\hfill \end{array}$$

(46)

$$\begin{array}{ccc}& \stackrel{\left(i\right)}{\le }& 2\left(2H(A_1^{\left[1\right]},A_2^{\left[1\right]}|W_1,\mathbb{Q})-H\left(W_2\right)\right)\hfill \end{array}$$

(47)

$$\begin{array}{ccc}& \stackrel{\left(40\right)}{\le }& 2\left(2(2H\left(A_1^{\left[1\right]}\right|\mathbb{Q})-L)-L\right)\hfill \end{array}$$

(48)

where (42) follows from the observation that the second term can be bounded using the same method as that bounds the first term by switching the message index. A more detailed derivation of (44) appears in (79) of [19]; (45) is due to the sub-modularity of entropy.

Note that

$$\begin{array}{ccc}\hfill I(A_2^{\left[1\right]};A_2^{\left[2\right]}|\mathbb{Q})& =& H\left(A_2^{\left[1\right]}\right|\mathbb{Q})+H\left(A_2^{\left[2\right]}\right|\mathbb{Q})-H(A_2^{\left[1\right]},A_2^{\left[2\right]}|\mathbb{Q})\hfill \end{array}$$

(49)

$$\begin{array}{ccc}& \stackrel{\left(36\right)}{\ge }& 2H\left(A_1^{\left[1\right]}\right|\mathbb{Q})-(\overline{\alpha }+ϵ)L\hfill \end{array}$$

(50)

where in (50), and the second term is bounded as follows:

$$\begin{array}{c}\hfill H(A_2^{\left[1\right]},A_2^{\left[2\right]}|\mathbb{Q})\le H(A_2^{\left[1\right]},A_2^{\left[2\right]},S_2|\mathbb{Q})\stackrel{\left(a\right)}{=}H\left(S_2\right|\mathbb{Q})\stackrel{\left(37\right)}{\le }(\overline{\alpha }+ϵ)L.\end{array}$$

(51)

Combining (48) and (50), we have

$$\begin{array}{ccc}& & 2H\left(A_1^{\left[1\right]}\right|\mathbb{Q})/L-(\overline{\alpha }+ϵ)\ge 2(4H\left(A_1^{\left[1\right]}\right|\mathbb{Q})/L-3)\hfill \end{array}$$

$$\begin{array}{ccc}& \Rightarrow & \overline{\alpha }+ϵ+6H\left(A_1^{\left[1\right]}\right|\mathbb{Q})/L\ge 6\hfill \end{array}$$

(52)

$$\begin{array}{ccc}& \stackrel{\left(37\right)}{\Rightarrow }& \overline{\alpha }+6\overline{\beta }\ge 6.\hfill \end{array}$$

(53)

The proof is complete. □

4.3. Specialization of the Inner Bound

The inner bound given in Theorem 1 is general but more involved, and we can specialize it in multiple ways in order to simplify it. One particularly interesting approach is as follows. Define the region ${\tilde{\mathcal{R}}}_{in}^{\left(t\right)}$ to be the collection of $(\overline{\alpha },\overline{\beta })$ pairs such that there exists random variables $(X_0,X_1,X_2,Y_1,Y_2)$ jointly distributed with $(V_1,V_2)$ such that the following hold:

• The distribution factorizes as follows

  $$P_{V_1,V_2,X_0,X_1,X_2,Y_1,Y_2}=P_{V_1,V_2}{P}_{X_0|V_1,V_2}{P}_{X_1|V_1,V_2}{P}_{X_2|V_1,V_2}{P}_{Y_1|V_1,V_2}{P}_{Y_2|V_1,V_2};$$
• There exist deterministic functions $f_{1,1}$, $f_{1,2}$, $f_{2,1}$, and $f_{2,2}$ such that

  $$\begin{array}{c}{V}_1=f_{1,1}(X_0,X_1,Y_1)=f_{2,2}(X_0,X_2,Y_2),\end{array}$$

  (54)

  $$\begin{array}{c}{V}_2=f_{1,2}(X_0,X_1,Y_2)=f_{2,1}(X_0,X_2,Y_1);\end{array}$$

  (55)
• A set of rates

  $$\begin{array}{c}{\gamma }_1^{\left(0\right)}=I(V_1,V_2;X_0),{\gamma }_1^{\left(1\right)}=I(V_1,V_2;X_1),{\gamma }_1^{\left(2\right)}=I(V_1,V_2;X_2),\end{array}$$

  (56)

  $$\begin{array}{c}{\gamma }_2^{\left(1\right)}=I(V_1,V_2;Y_1),{\gamma }_2^{\left(2\right)}=I(V_1,V_2;Y_2),\end{array}$$

  (57)

  $$\begin{array}{c}{\beta }_1^{\left(0\right)}={\gamma }_1^{\left(0\right)},{\beta }_1^{\left(1\right)}=I(V_1,V_2;X_1|X_0),{\beta }_1^{\left(2\right)}=I(V_1,V_2;X_2|X_0),\end{array}$$

  (58)

  $$\begin{array}{c}{\beta }_2^{\left(1\right)}=max(I(V_1,V_2;Y_1|X_0,X_1),I(V_1,V_2;Y_1|X_0,X_2)),\end{array}$$

  (59)

  $$\begin{array}{c}{\beta }_2^{\left(2\right)}=max(I(V_1,V_2;Y_2|X_0,X_1),I(V_1,V_2;Y_2|X_0,X_2)),\end{array}$$

  (60)

  and $({\alpha }_1^{\left(0\right)}={\gamma }_1^{\left(0\right)},{\alpha }_1^{\left(1\right)},{\alpha }_1^{\left(2\right)},{\alpha }_2^{\left(1\right)},{\alpha }_2^{\left(2\right)})$ as defined in item 3 for the general region ${\mathcal{R}}^{\left(t\right)}$;
• The normalized average retrieval and storage rates

  $$\begin{array}{cc}\hfill & 2t\overline{\alpha }\ge {\alpha }_1^{\left(0\right)}+{\alpha }_1^{\left(1\right)}+{\alpha }_1^{\left(2\right)}+{\alpha }_2^{\left(1\right)}+{\alpha }_2^{\left(2\right)},\hfill \end{array}$$

  (61)

  $$\begin{array}{cc}\hfill & 4t\overline{\beta }\ge 2{\beta }_1^{\left(0\right)}+{\beta }_1^{\left(1\right)}+{\beta }_1^{\left(2\right)}+{\beta }_2^{\left(1\right)}+{\beta }_2^{\left(2\right)}.\hfill \end{array}$$

  (62)

Then we have the following corollary.

Corollary 1.

${\tilde{\mathcal{R}}}_{in}^{\left(t\right)}\subseteq \mathcal{R}$.

This inner bound is illustrated together with the outer bounds in Figure 2.

Proof. 

The main difference from Theorem 1 is in the special dependence structure of $(X_0,X_1,X_2,Y_1,Y_2)$ jointly distributed with $(V_1,V_2)$, i.e., the Markov structure. We verify that the rate assignments satisfy all the constraints in Theorem 1. Due to the special dependence structure of $(X_0,X_1,X_2,Y_1,Y_2)$ jointly distributed with $(V_1,V_2)$, it is straightforward to verify that

$$({\gamma }_1^{\left(0\right)},{\gamma }_1^{\left(1\right)},{\gamma }_1^{\left(2\right)},{\gamma }_2^{\left(1\right)},{\gamma }_2^{\left(2\right)})\in {\mathcal{R}}_{MD}((V_1,V_2),X_0,X_1,X_2,Y_1,Y_2).$$

We next verify that (24) holds with the choice given above. Due to the symmetry in the structure, we only need to confirm one subset of random variables, i.e., $\{X_0,X_1,Y_1\}$, and the three other subsets $\{X_0,X_1,Y_2\}$, $\{X_0,X_2,Y_1\}$, and $\{X_0,X_2,Y_2\}$ follow similarly. There are a total of 7 conditions in the form of (14) associated with this subset $\{X_0,X_1,Y_1\}$. Notice that

$$\begin{array}{c}\hfill {\gamma }_1^{\left(0\right)}-{\beta }_1^{\left(0\right)}=0,{\gamma }_1^{\left(1\right)}-{\beta }_1^{\left(1\right)}=I(X_1;X_0),{\gamma }_2^{\left(2\right)}-{\beta }_2^{\left(2\right)}\le I(Y_1;X_0,X_1),\end{array}$$

which in fact confirm three of the seven conditions when $\mathcal{J}$ is a singleton. Next, when $\mathcal{J}$ has two elements, we verify that

$$\begin{array}{cc}\hfill {\gamma }_1^{\left(0\right)}-{\beta }_1^{\left(0\right)}+{\gamma }_1^{\left(1\right)}-{\beta }_1^{\left(1\right)}& =I(X_1;X_0)=H\left(X_0\right)+H\left(X_1\right)-H(X_0,X_1)\hfill \\ \hfill & \le H\left(X_0\right)+H\left(X_1\right)-H(X_0,X_1|Y_1),\hfill \end{array}$$

(63)

$$\begin{array}{cc}\hfill {\gamma }_1^{\left(0\right)}-{\beta }_1^{\left(0\right)}+{\gamma }_2^{\left(1\right)}-{\beta }_2^{\left(1\right)}& \le I(Y_1;X_0,X_1)=H\left(Y_1\right)+H(X_0,X_1)-H(X_0,X_1,Y_1)\hfill \\ \hfill & \le H\left(Y_1\right)+H\left(X_0\right)+H\left(X_1\right)-H(X_0,X_1,Y_1)\hfill \\ \hfill & =H\left(X_0\right)+H\left(Y_1\right)-H(X_0,Y_1|X_1),\hfill \end{array}$$

(64)

$$\begin{array}{cc}\hfill {\gamma }_1^{\left(1\right)}-{\beta }_1^{\left(1\right)}+{\gamma }_2^{\left(1\right)}-{\beta }_2^{\left(1\right)}& \le I(X_1;X_0)+I(Y_1;X_0,X_1)=H\left(X_1\right)+H\left(Y_1\right)-H(X_1,Y_1|X_0).\hfill \end{array}$$

(65)

Finally when $\mathcal{J}$ has all the three elements, we have

$$\begin{array}{cc}\hfill & {\gamma }_1^{\left(0\right)}-{\beta }_1^{\left(0\right)}+{\gamma }_1^{\left(1\right)}-{\beta }_1^{\left(1\right)}+{\gamma }_2^{\left(1\right)}-{\beta }_2^{\left(1\right)}\hfill \end{array}$$

$$\begin{array}{cc}\hfill & =I(X_0;X_1)+I(V_1,V_2;X_1)-max(I(V_1,V_2;Y_1|X_0,X_1),I(V_1,V_2;Y_1|X_0,X_2))\hfill \end{array}$$

(66)

$$\begin{array}{cc}\hfill & \le I(X_0;X_1)+I(V_1,V_2;X_1)-I(V_1,V_2;Y_1|X_0,X_1)\hfill \end{array}$$

(67)

$$\begin{array}{cc}\hfill & =H\left(X_0\right)+H\left(X_1\right)+H\left(Y_1\right)-H(X_0,X_1,Y_1).\hfill \end{array}$$

(68)

Thus, (24) is indeed true with the assignments (56)–(60). This, in fact, completes the proof. □

We can use any explicit distribution $(X_0,X_1,X_2,Y_1,Y_2)$ to obtain an explicit inner bound to ${\tilde{\mathcal{R}}}_{in}^{\left(t\right)}$, and the next corollary provides one such non-trivial bound. For convenience, we write the entropy function of a probability mass $(p_1,\dots ,p_t)$ as $H(p_1,\dots ,p_t)$.

Corollary 2.

The following $(\overline{\alpha },\overline{\beta })\in \mathcal{R}$ for any $p\in [0,1]$:

$$\begin{array}{cc}\hfill \overline{\alpha }=& \frac{9}{4}-H(\frac{1}{4},\frac{3}{4})+\frac{1}{4}H(\frac{1-p}{2},\frac{1-p}{2},\frac{p}{2},\frac{p}{2})\hfill \\ \hfill & +\frac{1}{2}H(\frac{2-p}{4},\frac{2-p}{4},\frac{p}{2})-\frac{3}{4}H(\frac{3-2p}{6},\frac{3-2p}{6},\frac{p}{3},\frac{p}{3}),\hfill \\ \hfill \overline{\beta }=& \frac{5}{8}+\frac{1}{4}H(\frac{2-p}{4},\frac{2-p}{4},\frac{p}{2})-\frac{1}{8}H(\frac{1-p}{2},\frac{1-p}{2},p).\hfill \end{array}$$

Proof. 

These trade-off pairs are obtained by applying Corollary 1, and choosing $t=1$ and setting $(X_1,X_2,Y_1,Y_2)$ as given in (17), and letting $X_0$ be defined as in

Table 1. Conditional distribution $P_{X_0|W_1,W_2}$ used in Corollary 2.

$({\mathit{w}}_1,{\mathit{w}}_2)$	${\mathit{x}}_0=\left(00\right)$	${\mathit{x}}_0=\left(01\right)$	${\mathit{x}}_0=\left(10\right)$	${\mathit{x}}_0=\left(11\right)$
(00)	$1/2$			1/2
(10)	$(1-p)/2$	p		$(1-p)/2$
(01)	$(1-p)/2$		p	$(1-p)/2$
(11)	1/2			1/2

. Note that the joint distribution indeed satisfies the required Markov structure, and in this case ${\alpha }_2^{\left(1\right)}={\beta }_2^{\left(1\right)}$ and ${\alpha }_2^{\left(2\right)}={\beta }_2^{\left(2\right)}$. □

5. Conclusions

We consider the problem of private information retrieval using a Shannon-theoretic approach. A new coding scheme based on random coding and binning is proposed, which reveals a hidden connection to the multiple description problem. It is shown that for the $(2,2)$ PIR setting, this non-linear coding scheme is able to provide the best known tradeoff between retrieval rate and storage rate, which is strictly better than that achievable using linear codes. We further investigate the relation between zero-error PIR codes and $ϵ$-error PIR codes in this setting and show that they do not cause any essential difference in this problem setting. We hope that the hidden connection to multiple description coding can provide a new avenue to design more efficient PIR codes.