REVIEW 45 cited by
Opacus: User-Friendly Differential Privacy Library in PyTorch
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
We introduce Opacus, a free, open-source PyTorch library for training deep learning models with differential privacy (hosted at opacus.ai). Opacus is designed for simplicity, flexibility, and speed. It provides a simple and user-friendly API, and enables machine learning practitioners to make a training pipeline private by adding as little as two lines to their code. It supports a wide variety of layers, including multi-head attention, convolution, LSTM, GRU (and generic RNN), and embedding, right out of the box and provides the means for supporting other user-defined layers. Opacus computes batched per-sample gradients, providing higher efficiency compared to the traditional "micro batch" approach. In this paper we present Opacus, detail the principles that drove its implementation and unique features, and benchmark it against other frameworks for training models with differential privacy as well as standard PyTorch.
Forward citations
Cited by 45 Pith papers
-
Dithered Gaussian Mechanism for Randomness-Efficient Differential Privacy
The dithered Gaussian mechanism discretizes the output of the Gaussian mechanism via a randomly shifted grid, inheriting Gaussian privacy guarantees while reducing private randomness to a constant per coordinate.
-
Reducing Per-Sample Interference in Stochastic Optimization
A batch-space trust-region step that reweights samples by last-layer gradient structure yields small but consistent accuracy gains for SGD and AdamW on image classification.
-
Composition for Pufferfish Privacy
Pufferfish mechanisms compose linearly only under DP-style inequalities; any per-entry DP mechanism can be translated to a composable Pufferfish mechanism using the a(b)-influence curve.
-
Correlating Cross-Iteration Noise for DP-SGD using Model Curvature
Using Hessian eigenvalues from public data to design correlated noise for DP-SGD improves accuracy by 1–4% over current DP-MF methods.
-
Private Hyperparameter Tuning with Ex-Post Guarantee
A random-dropping mechanism tunes hyperparameters under ex-post DP with about a 2x privacy blowup for the winning candidate, and extends to Rényi DP.
-
Towards Trustworthy Federated Learning with Untrusted Participants
CAFCOR combines pairwise shared-randomness correlated noise with a covariance-agnostic robust filter to achieve central-DP-like utility under the SecLDP trust model with Byzantine workers and an untrusted server.
-
General-Purpose $f$-DP Estimation and Auditing in a Black-Box Setting
A black-box estimator and auditor recover an algorithm's entire f-differential privacy trade-off curve with formal convergence and confidence guarantees.
-
End-to-End Differential Privacy in Training Deep Neural Network Classifiers
Perturbing softmax outputs with the Dirichlet mechanism during training yields input-private, label-public classifiers that beat prior differentially private training accuracy on five image benchmarks.
-
Term2Note: Synthesising Differentially Private Clinical Notes from Medical Terms
Term2Note synthesizes differentially private clinical notes by generating section-wise text conditioned on privately perturbed medical terms, achieving fidelity and downstream utility close to real notes.
-
On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy
Malicious clients can craft LDP-compliant updates that collapse the global model in federated learning, even when the server uses Multi-Krum or trimmed mean aggregation.
-
An Interactive Framework for Finding the Optimal Trade-off in Differential Privacy
Modeling the privacy-accuracy Pareto front with sigmoid curves and letting users pick points on hypothetical fronts finds the optimal DP privacy budget with fewer queries and evaluations than pairwise baselines.
-
On the MIA Vulnerability Gap Between Private GANs and Diffusion Models
Under identical differential privacy budgets, GANs show less membership inference leakage than diffusion models in the paper's MNIST experiments, a gap the authors attribute to training stability.
-
Improving Noise Efficiency in Privacy-preserving Dataset Distillation
Dosser improves differentially private dataset distillation by decoupling sampling from optimization and projecting signals into a learned subspace.
-
What is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?
DP-SGD causes large utility loss in deep trajectory generation, a new DP mechanism for conditional inputs helps stabilize GANs, and GANs overtake diffusion models when formal privacy is required.
-
Training Dynamics Underlying Language Model Scaling Laws: Loss Deceleration and Zero-Sum Learning
Loss deceleration, a piecewise-linear break in log-log loss curves, is attributed to zero-sum learning where per-example gradients oppose one another, and scaling helps by mitigating it.
-
The Gaussian Mixing Mechanism: Renyi Differential Privacy via Gaussian Sketches
Gaussian sketching with additive Gaussian noise satisfies a closed-form Rényi differential privacy bound that is tighter than prior analyses and improves private linear and logistic regression.
-
Multi-level Certified Defense Against Poisoning Attacks in Offline Reinforcement Learning
A DP-based certified defense provides lower bounds on expected cumulative reward and per-state action stability for offline RL under transition- and trajectory-level poisoning, with larger certified radii than COPA.
-
NoEsis: Differentially Private Knowledge Transfer in Modular LLM Adaptation
NoEsis couples DP-trained shared prompt tokens with non-private per-domain LoRA experts, achieving private knowledge transfer across Python, Java, and Go code completion.
-
Hyperparameters in Score-Based Membership Inference Attacks
A new shadow-model hyperparameter selection method (KL-LiRA) makes membership inference attacks nearly as effective without knowing target hyperparameters, and training-data-based hyperparameter tuning shows no detect...
-
Comparing privacy notions for protection against reconstruction attacks in machine learning
Bayes' capacity, not the DP epsilon parameter, is shown to track how well Gaussian and von Mises-Fisher noise mechanisms resist gradient-based reconstruction attacks.
-
Privacy Amplification by Structured Subsampling for Deep Differentially Private Time Series Forecasting
Structured subsampling in time series forecasting yields tight, sound event- and user-level DP-SGD guarantees, with leakage probability given by the product of top- and bottom-level sampling rates.
-
Reconciling Privacy and Explainability in High-Stakes: A Systematic Inquiry
Gradient-based explainers yield almost uncorrelated attributions on DP-trained chest X-ray models, so the authors recommend privatizing explanations from a non-private model instead.
-
Balls-and-Bins Sampling for DP-SGD
Balls-and-Bins sampling for DP-SGD has a tight privacy analysis: as private as Poisson at large epsilon, with shuffle-comparable utility, verified by Monte Carlo accounting.
-
Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training
A stage-wise diffusion training method that substitutes synthetic images in coarse and cleaning steps to cut the privacy noise in DP image generation.
-
Protecting Confidentiality, Privacy and Integrity in Collaborative Learning
Citadel++ claims to protect dataset, model, and code confidentiality, user-level differential privacy, and execution integrity in collaborative training using VM-level trusted execution environments and enhanced DP-SGD.
-
Balancing Utility and Privacy: Dynamically Private SGD with Random Projection
D2P2-SGD combines time-decreasing privacy noise with random projection to improve the accuracy of differentially private SGD, with convergence rates matching ordinary SGD.
-
Achieving Hilbert-Schmidt Independence Under R\'enyi Differential Privacy for Fair and Private Data Generation
FLIP combines a VAE, latent diffusion, Rényi DP, and CKA alignment across protected groups to produce tabular data with substantially reduced predictability of the protected attribute.
-
Uncertainty-Driven Reliability: Selective Prediction and Trustworthy Deployment in Modern Machine Learning
A training-dynamics abstention method matches deep ensembles at a fraction of the training cost, and a five-term error budget explains why selective classifiers still fall short of the oracle.
-
Embedding-Based Federated Data Sharing via Differentially Private Conditional VAEs
A federated, differentially private conditional VAE trained on foundation-model embeddings lets hospitals share synthetic data that supports downstream classification better than standard federated classifiers.
-
FlashDP: Private Training Large Language Models with Efficient DP-SGD
FlashDP fuses per-sample gradient computation, norm calculation, clipping, and noise addition into a cache-friendly block-wise all-reduce workflow that avoids explicit per-sample gradient storage and redundant recomputation.
-
Can One Safety Loop Guard Them All? Agentic Guard Rails for Federated Computing
A unified two-layer safety loop for federated computing that decouples guardrails from FHE, MPC, and DP back-ends via a backend-neutral DSL and interchangeable execution providers.
-
Mitigating Disparate Impact of Differentially Private Learning through Bounded Adaptive Clipping
Bounded adaptive clipping puts a floor under the adaptive clipping threshold in DP-SGD and improves worst-class accuracy on skewed and Fashion MNIST.
-
Beyond Anonymization: Object Scrubbing for Privacy-Preserving 2D and 3D Vision Tasks
Scrubbing sensitive objects with inpainting preserves more downstream detection and 3D reconstruction utility than deleting images, but the paper's privacy guarantee rests on the same oracle detector that defines and ...
-
TabularARGN: A Flexible and Efficient Auto-Regressive Framework for Generating High-Fidelity Synthetic Data
TabularARGN is a lightweight any-order auto-regressive model that matches or beats state-of-the-art tabular synthetic data quality while training up to orders of magnitude faster, including for sequential two-table datasets.
-
DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization
Adding a loss-variance penalty to adversarial training reduces membership inference leakage on CIFAR-10/100 while keeping accuracy mostly intact.
-
Combining Machine Learning Defenses without Conflicts
A stage-and-risk-based decision rule predicts whether pairs of ML defenses conflict, with reported balanced accuracy of 90% on eight prior combinations and 81-86% on 30 new ones.
-
A Robust Framework for Secure Cardiovascular Risk Prediction: An Architectural Case Study of Differentially Private Federated Learning
On synthetic cardiac data, FedCVR — a re-implementation of FedAdam with server-side momentum — is reported to reach F1 0.78 / AUC 0.96 under DP (ε≈13.4), beating stateless and other adaptive baselines, though the pape...
-
PrivacyBench: Privacy Isn't Free in Hybrid Privacy-Preserving Vision Systems
Combining federated learning with differential privacy causes catastrophic accuracy loss and large resource overhead in vision models, whereas federated learning with secure multi-party computation retains near-baseli...
-
Network-Aware Differential Privacy
Network-Aware Differential Privacy initiates a research agenda connecting networking and differential privacy, with preliminary evidence that packet-level adversaries can manipulate local DP protocols.
-
PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction
A federated, privacy-preserving RDSN framework for encrypted image reconstruction whose local differential privacy mechanism is not actually differentially private because it releases low-frequency DCT coefficients wi...
-
Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI
Compliance-weighted noise allocation in federated healthcare learning claims no accuracy loss versus uniform noise, but its differential privacy guarantee applies only to the aggregator dataset, not client data.
-
Empirical Analysis of Asynchronous Federated Learning on Heterogeneous Devices: Efficiency, Fairness, and Privacy Trade-offs
On five physical edge devices, asynchronous federated learning reached 75% accuracy about ten times faster than synchronous learning, but high-end devices supplied far more updates and accumulated up to roughly five t...
-
Privacy-Preserving Transformers: SwiftKey's Differential Privacy Implementation
Microsoft's small DP-finetuned transformer for keyboard prediction beats an older GRU in offline tests but shows no aggregate live gain, and its privacy guarantee for the modified sampling is unproven.
-
Federated Diffusion Modeling with Differential Privacy for Tabular Data Synthesis
DP-FedTabDiff wraps an existing federated tabular diffusion model with per-client DP-SGD and reports how the privacy budget, number of clients, and local update count affect synthetic data quality and empirical privacy risk.
-
How to DP-fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy
A practical, extremely thorough survey of differentially private synthetic data generation: methods, privacy units, evaluation metrics, and end-to-end system components across four data modalities.
Discussion (0). Continue with ORCID to comment.